From the ground up podcast: Reshaping the landscape of DevOps through innovative authorization solutions

In a recent enlightening episode of the "From the Ground Up" podcast, Emre Baran, the CEO and Co-founder of Cerbos, shared his entrepreneurial journey and the inception of Cerbos.

Cerbos empowers developers to implement, manage, and delegate fine-grained access control in software applications, in a fraction of the time spent building and maintaining it in-house.

Read on for the summary of the discussion, as well as to find out the key insights and takeaways from Emre's experience.

Summary of the conversation

Starting his career by co-founding Turkey's largest social network and later contributing to Google's billion-dollar products, Emre Baran has always been at the forefront of technological advancement. His journey from an undecided major to a technology aficionado showcases the transformative power of passion and curiosity in the tech world.

Cerbos, born out of a need identified through years of experience, focuses on making authorization simple and scalable for developers, allowing them to concentrate on their core products. This solution addresses a significant gap in the Identity and Access Management (IAM) market, poised for substantial growth. Emre's approach to founding Cerbos was methodical and driven by an extensive validation process, including conversations with potential customers and leveraging feedback to refine the product.

One of the most compelling takeaways from the podcast is the importance of understanding your market and the unmet needs of potential customers. Cerbos's journey from concept to a fully realized product, attracting attention from VCs and securing funding, is a masterclass in how to successfully navigate the startup ecosystem. Emre's experience underscores the value of resilience, a well-defined problem space, and the importance of building a solution that addresses real-world needs.

Conclusion

Emre Baran's episode is a deep dive into the mind of an entrepreneur who understands the intricacies of scaling businesses, the dynamics of the venture capital world, and the critical role of technology in solving complex problems. The biggest takeaway for aspiring entrepreneurs and developers is the significance of passion, diligence, and the continuous pursuit of knowledge.

Emre's narrative is not just inspiring but also instructional, providing a blueprint for navigating the challenges of startup life and the tech industry at large. His emphasis on the critical nature of roles and permissions in modern software development, coupled with a strategic approach to business growth and investor relations, makes this episode a must-listen for anyone in the tech space.

You can learn more about Cerbos Hub here.

Transcript

Jake: Welcome to our podcast from the ground up where we interview startup founders, exploring their journeys or success challenges and lessons learned. We hope you'll be inspired and discovering what it takes to build a thriving startup. I'm your host, Jake Aaron Villareal and excited to have with us today.

Emre Baran, founder of Cerbos, who's raised 11 million in funding. Emre, welcome to the show. Thank you for having me. So a little bit about Emre he launched Cerbos in 2021 with a mission to make roles and permissions simpler to implement and manage so developers can focus on building their core products.

Before Cerbos, he co founded Turkey's largest social network at the time, worked for Google where he built products that generated over a billion dollars in revenue and is a serial entrepreneur. Emory, there's a lot here in your background and you're maybe more unique than other guests we have on the show because you've got a background of companies that you've launched, have had a lot of success.

Work for Google, which a lot of people haven't. And so there's a lot just curiosity about what those experiences were like. But before we really dive in here, walk us through a little bit about you, where you're from, where you're at, and how did you get into technology?

Emre: Sure. I grew up in Turkey and then went to school went to university in the States and like every other, you know not every other, but most undergrads, I was an undecided major.

And by the time I had to declare a major, I had enough economics, less economics classes under my belt. And I did two internships at investment banks. And then eventually I decided that banking wasn't for me. And I even found myself doing more coding and building macros while I was doing my banking job that I decided to go back to school and also major in computer science.

Since then I've worked in all those companies and ultimately I fell in love with technology because it's all about, you know, using machines to do repetitive or even things that humans can't do. So that's how my journey started. That's how I got sucked into technology.

Jake: That's great. You know, when you talk about social networks to us today, it's a very normal conversation to think you're part of a social network.

You've been on one. Your friends are there. But in the early days when they didn't exist, what inspired you to even think about trying to create a social network? And how did it come about? So,

Emre: Let's be honest. I mean, we didn't invent social networks. Back then there was this was around circa 2002, 2003 when you know, digital cameras were coming up, people were putting their photos on, everybody was getting an email address, et cetera.

And back then there was like a couple of, you know, social networks slowly emerging in the U S namely Friendster and Myspace and my brother and I looked at this and my brother. I mean, all credit to him. He, he, he can spot a lot of things that will have exponential growth from a mile away. And he said, this is going to be huge.

And these are all very us centric. A lot of us people. Let's go build the social network for Europe. You know, we grew up in Turkey. We had a lot of friends there. We grew up traveling all around Europe as well. It was like, let's go build one. And so ultimately we built a social network and we launched it with three of our, 300 of our high school friends.

And that was a Christmas I remember. So Justing, a Christmas 2003 and 2002 to 2003, and we launched it with 300, all of our friends. And suddenly. By the end of February, we had 20, 000 users by the end of the year. We had half a million in about 2, 3 years. We had 7, users. It was 1 of those things that, you know, being at the right time at the right place at the right time.

And not just being lucky, but also identifying an opportunity and embarking and actually building it. From a technology perspective, it was also very challenging. This, these were the times back in 2003, there is very limited open source. I mean, we built a Yonja with MySQL, Tomcat and Apache and a lot of duct tape.

And there were no, you know, AWS or Google. Google cloud cloud providers. We had to actually order servers every week into a data center and hook them up. And even our, you know, it's like, it's a fun story. Our very first server was a server that we bought that was living in my brother's living room under the table.

And as we started running out of data. Bandwidth and everything else, like we need much more bandwidth than this because it's, it's slow. And we took that server desktop server to a data center, literally turned it sideways, put it on a rack and cook it, hooked it up to like a high bandwidth connection, and that was our very beginning of that journey.

But it was about, you know, seeing that potential of how we can connect people, how we can, you know, get people to be more online and be, you know, present themselves online and share more of their experiences with their friends.

Jake: Yeah. It's, you know, so prevalent today, but back then, even to be thinking about how you could putthat together, was your brother also an engineer?

Emre: He studied industrial engineering. He thinks he can code, but God bless him. He can't. I mean, he can build very basic things, but it was my, you know, mostly it was me and a couple of other engineers who actually initially. built it. And then a lot of our challenges was around actually scaling that. And, you know, this thing became the most traffic thing in Turkey and, you know, on the right next to it was like Yahoo mail at the time and a little bit of eBay and like the one major news site.

So there was a lot of lessons learned on how to scale open source, how to scale all these things. And, you know, we were doing my. SQL replication before my SQL replication was a thing we were doing load balancing software based load balancing before that was a thing. And like experimenting with a lot of software.

So, you know, he had a engineering background. My brother had a vision, but a lot of the things was he was much more. Focus on the product management and the CEO job where, you know, we had to also generate revenue for this thing. And back then nobody was paying, still nobody pays for social network, right?

The ads and various other things pay for it. And our audience being mostly in Turkey, we had to actually manage a business in Turkey for all the advertising and et cetera, revenue. From your U. S. And, you know, we had our initial, he was instrumental in building that initial team, the sales team and the customer service team.

And then, you know, I took on a lot of the engineering job, engineering challenges

Jake: when you try and scale a company, you have to go somewhere to learn how to scale. You got to get involved in other people that know how to scale. What was your path to learning how to scale a product or a company?

Emre: So it was, so as you said, there are two different distinct things here scaling a company and scaling a product.

So in terms of scaling a company, You know, at least back then is it wasn't that big of a company or two, three of us started it. And at peak, we were about 20 people. And by the time we got acquired to maybe 25 people, mostly on customer service. And so there wasn't that much of a challenge there. The bigger challenge, actually, Of was around scaling the product.

It's, you know, this, you know, prototype site website built on very simple, you know Apache Tomcat and JSB templates. How do you actually handle 8, 10, 12, 000 people concurrently being online? So there was a lot of Googling, a lot of learning, a lot of talking to other, you know, back then there were a couple of forums that had similar levels of traffic and pretty much Yahoo and email and Yahoo and eBay.

There weren't, you know, there weren't that many frameworks that weren't that many things. So a lot of it was trial and error and trying, you know, building systems that will potentially scale. So then my journey was ultimately a lot of that scaling was learned at Google. So I, you know, I hit the fork in my career where you know, while I was doing your own job, I'd also applied to a business school.

And I got into a business school, but I had to defer that because the company was growing very fast. And then eventually I had to go to business school. And luckily that was like a one year, very intensive business school called INSEAD based out of France and Singapore. And I spent a lot of my days during the day, during the week going you know, going to school and in the evenings actually working.

And at the end of the business school, the goal was for me to go back, right? There was like, we had a fast growing business, but in the meantime, Google came to the campus. And that was like one of the very few jobs that I actually, I was excited. I was like, Oh, that, that can be an interesting company. Like I didn't want to do.

You know, consulting or business investment banking and various other things. So I'd actually applied to Google and, and then I got recruited into Google. So I, I came to, I came to this fork where. You know, I could go back to my own company and keep growing that or go to Google and learn real scaling because Google was, you know, back by then, this is 2005, 2006, a global powerhouse.

And they had. You know, huge traffic, they had sort of, you know, 90, 90 to a hundred percent of search search traffic in a lot of companies and my brother and I, we decided that it would be best for me to go to Google and learn real scaling in terms of a product and, you know, spend a year or two there and then come back and apply a lot of those learnings.

So about a year into my, my journey at Google, Yonja got acquired. So then I actually continued at Google. And where I actually really learned what it takes to a you know, scale a product technology wise, which we, I actually applied a lot of them in my next company, but also learned about how to operate a very large scale organization.

And to this day, credit to Google, I don't know, back then when I left Google, it was about 15, 20, 000 employees, but it was light years ahead of any other company of that size. So a lot of my learnings from Google, we applied to the Qubit where we actual learning of my, how to scale a company happened because, you know, we were three of my colleagues from Google.

And I actually moved to London at that stage started Qubit. I was the only technical co founder. I built a product and engineering team. And at the, at the, you know, that company grew from four people to its peak about 320. And that learning journey was full of mistakes. And that's, I think, how you learn how to scale a company.

You have to, you know, fully fall into a lot of those traps and make a lot of mistakes and learn by that. And luckily towards the end. You know, mid to late in my, my journey, a lot of podcasts started becoming also very popular. And nowadays, a lot of my learning is, you know, listening to a lot of other people's journeys and thanks to a podcast like you and other ones, we get, we get exposed to those things because back in the day, it was all about.

You're lucky if somebody actually wrote a book and published about it.

Jake: Yeah. You know, you mentioned a couple of things I just want to go back to and we'll come back to your Qubit company, but with your social network, you mentioned you got acquired. How did that happen? Cause I think the dream for a lot of startup founders is you build a product, you find the market, you get funded, you scale it, and then you get acquired and then you retire.

Like, In your first company that you started got acquired. I think it's amazing. Whether the numbers were big or not doesn't really matter. Just the fact there was enough value that someone would want it. That's incredible. And maybe the numbers were huge, but walk us through how that happened. So I think

Emre: the key thing there was we were actually the market number one market leader in Turkey.

There were at the time, there were many other social networks that actually started, but we were the ones that actually grew the fastest and we're had the market share. So that helps a lot because at the end of the day, social networks that is a social network is a B2C product. And a lot of people actually a lot of popularity drives a lot of B2C B2C products.

And as long as you have a decent product that people like to use, and you're not, you haven't taken many risks. Wrong steps, you know, people draw other people in and that's the nature of social networks. People want to be where other people are. People want to find their old friends. People want to hang out with new friends.

People want to see a lot of stories shared. So, number one, the product. On its own was a great magnet to actually draw everybody. And the second one is it was a great business because it wasn't only an ads business. And we also actually generated revenue from prior, you know, prime membership. And one of the, the story behind that.

His, you know, at early days, we built Yonja we had very little angel investment from one investor, but that gave us the confidence to go forward. And at some point with all this computing costs and services, servers, et cetera, we had to find some sort of funding. Right. Because it had to pay for itself.

Every day we were spending, we weren't paying ourselves any salary or like minimal salary for insurance and various other things, but there was a lot of server costs every week we ordered like four or five, six, 10 new servers so that we could actually handle the traffic, handle pictures and everything else.

So there were two options. Number one is a good old method of advertising, right? It's talking to publishers at the end of the day. It's a. It's a, you know, huge audience, a lot of eyeballs and a lot of, you know, great eyeballs for, by advertising standards, like a lot of young people, you know, young professionals who are in the beginning, they were, you know, Prime candidates for a lot of CPG companies, et cetera.

So we actually started putting ads and monetizing the traffic through that. The other thing that we did that none of the social networks nowadays do, maybe you know, Elon Musk is trying to do this a little bit with his Twitter checkmarks was we actually took a look at our traffic. We took a look. At what people do when they come to Yonca and what we actually suddenly discovered that a lot of our traffic was about, I think, 48 percent or so was actually people browsing pictures.

And then right after that, people actually messaging and look, and what actually resulted from a lot of these things are people actually dating. Because as social, as a social network, one of the key things that you can actually see whenever you're talking to somebody new. How you're connected, like, how do you know that person?

Are you connected to that person? Are you a first degree connection, second degree, third degree, which it turns out is a great validation. If when people want to actually date somebody, they don't want to date a complete stranger. They want to actually date somebody that's. Somewhat known to them, et cetera.

Anyway, by looking at all those traffic trends, we actually decided to draw a line between what is social networking and what's dating. And back then there are a lot of, you know, there, there were the harmonies and various other companies that were actually. They were making a lot of revenue from that. So by drawing that line, we actually said, okay, here's a fine line.

If you want to send, I believe it was 15 messages or 10 messages. If you want to send more than 10 messages a day to different people, that's, you know, now you're actually going out of social networking per day into you know, dating. If you're browsing more than a hundred pictures a day, again, you're, you're leaving the realm of.

Social netorking into dating, and then I don't remember now it's been 20 years almost, but there were a couple of other you know, boundaries that we found. And we said, if you want to do any of these things. Now you've got to become a, we used to call it the golden member. And the golden membership was about three to 4 a month.

And through that, we also generated a lot of revenue. So, and so at the end of the day, the path to acquisition was, We had a viable business that was generating not only revenue, but profits. We had a business that had a lot of eyeballs and a lot of people spending time on it. On average, I believe per day, there was like 48 minutes or 52 minutes, something like that spent on it.

On our social network and the realization moment for me was one day, you know, when I walked into a florist to get, I think my grandmother, some flowers. And in the background, the guy who's working there was on the computer. He said, hold on a second. He did something and then came. And then I, I immediately recognized our interface.

I'm like, Oh my God, the florist is on it. So all of these things are lined up. And at the end of the day, our acquisition of Yonca was by the largest Turkish ISB and their private equity investors. So they are there ultimately, it was a bit of a consolidation game for them in terms of the total you know, internet monitors traffic in Turkey.

Jake: Well, I love that story and I know that a lot of people don't know behind the scenes how things go down. So to hear it, it sounds like you understood the analytics, you looked at the patterns, you understood there's an opportunity and you had the right people around you to, to want to take it on or acquire it.

Let's switch gears to Qubit, the company that you raised 75 million. You scaled it to 300 and downsized it. This is happening in today's market, prevalently from like big companies that we know about to smaller companies and the lessons that are learned, I'm sure very instrumental in just how it shapes you as a leader, but also what you can take from that to your next company or companies in the future, walk us through.

What were some of the biggest lessons in that downsize that you went through that you recall as being really powerful? incredibly important today. So I, would say, I mean, my, the Qubit story is pretty much the story of my third thirties to early forties. And there's a lot of me in it. My personal development, actually, that was aligned to that company as well.

So we, four of us starting in a room, a company, and then actually growing and discovering a lot of things along the way. And we were lucky enough to, again we identified a trend. So first of all, before we actually started the company, and that was a big data revolution back in 2010, Hadoop became open source and a lot of data that wasn't, you know, That was kind of available, but not proessed or used.

And that's one thing that we identified coming out of Google, you know, the, the, the hotbed of data and data may data driven decisions that we tried to make it available to all these companies. And of course, because of that, Qubit grew very fast, very quickly, right? So there was four of us in 2010 and about 2016, by the time.

We raised our last CRC 40 million, we, after that, we actually reached about 300, 320 people. And the lesson learned there was that we actually grew too quick, too fast, before we actually Realize our product market fits, and it turns out you can have a product market fit in one market, and you may completely not have another product market fit in another market.

So it turns out that, you know, we actually. Operated in the UK, mostly in the UK market. Qubit was a market leader when you walk in main street, which is the high street in the UK, 90 percent of the brands that you see on, on the UK main high street, where our customers, their e commerce businesses, where our customers.

We understood really well how those e commerce businesses operate. And, and it worked because we were able to. In the UK, back then, there was a good mix of what companies looked for, which is a good mix of professional services and technology, right? A lot of companies not only buy technology from you, they want actually your professional services, your advice and various other things.

However, when we actually looked when we tried to expand in the US markets. You know, we slowly started losing our product market fit because a lot of companies were looking for self service and they didn't want professional services and throughout our journey, a lot of the times when we were lacking something in product, we always tried to make it up with professional services and nobody minded that in the UK.

But in the U. S. Suddenly you're starting to lose trust between the company and the customer. And they actually start questioning it, which eventually turns leads into a chart. So, and we thought we had the product market fit in the U. S. And we scaled us up very fast, which in turn ate a lot of our funding and suddenly it, you know, we started spending way more in customer acquisition costs than we would get in a lifetime value from a customer, which, you know, it's a great, it's a great way of learning.

Why, why investors care about that ratio. And eventually that led to us, you know, growing the company, having all the operations, all the sales and everything else ready, and to, you know, to pour a little bit of fuel on the on the fire, our average customer acquisition time was between six months to nie months.

Or sometimes up to a year. So that means you need to actually make that much of an investment before you can see a dime from a customer. And now imagine you're doing all of this with a huge sales team, sales and marketing and operations team on the ground. And suddenly all of those customers that you're spending more than one year of revenue to acquire, they're not renewing their contracts.

And suddenly you find yourself in the hole. And that was the journey, right? So that, and that led a cascaded across. The company. And there, there was a bit of a failure of our product management. There was a little bit of failure of our sales, but in marketing in terms of strategy, trying not understanding, not seeing the signals upright and trying to compensate that with, you know, throwing more money.

You know, bodies at a problem, whereas, you know, we should have actually taken the earlier step to stop all of that, fix the product and get there. And throughout that, you know, downside, once you actually hire all these people and then you realize the writing is on the wall, you know, the goalis to save the company, survive so that we can actually live another day to fight.

And that led to, of course, some hard decisions to, you know, start, start shutting offices down, start downsizing and various, various other things. And from my perspective, when I was actually running the engineering team and running the product team, et cetera, the biggest learning was around. As a company is growing and scaling, we're adding more bodies.

And every time you add a new body, you're It's actually you're hiring, you know, when you start to start up, you hire a lot of generalists because you've got to cover so many different areas. And then as you actually grow now, you don't need as many generals. You need to start getting specialists for every single area.

However, the biggest challenges. As the tide starts turning, so now you're, you're, you have a lot of specialists in the company and you're downsizing, but ultimately you're maintaining some people in the company, but those specialists now need to become generalists again, because they can't just do one job, or they can't just focus on one area.

We need to be able to go back to that startup mindset where everybody needs to do everything. So that has been a great learning around, you know, and a challenge when it comes to downsizing.

Jake: Yeah, that's I love how you explain that. I went through a similar scenario where we had a company and we took a product and brought it to market and we invested way more in the people than actually the revenue coming in.

And we were upside down for a long time until we had to start making those hard decisions. It's not just a business decision. It's an emotional one too, because they're real people that you've built relationships with and you have to say, you've done a great job. Unfortunately, it's not working out right now.

And so I think you get battle tested emotionally as well, not just educated. You know, there's like, you know, businesses, 80 percent psychological. So if you're In tune with how that works, you can weather the ups and downs, but there's an emotional aspect to it. I think that I'm no founders and everyone goes through and they understand it, but you don't always understand it until you have those hard decisions to make.

Emre: So I'll give you a tip on how I coped with that. So, first of all, you're absolutely right. When you, when you have to go through that, it's a business decision. And for some people whose first job, or the only job they've known, or a job that they've, you know, they've. Grown up with is this, it's very hard to separate that emotional connection from our business connection and actually to be leaving a company.

However so it's, and there, there, there've been people that we had to let go and it's been, it's always hard, right? It's, it's because each one of those people also, each one of those employees also have friends who are staying. So there's still a connection to those people. It's not like you're never going to see them again.

The way that I, one way that I coped with, and I actually mentioned this to someone and it's a bit controversial, but I always thought about it this way, unfortunately, you know, it's when it's a business decision, you have to, you have to make it happen. But when we think about the business decision, you know, when somebody actually, as a manager, you know, I.

I employed probably more than 300 people within my team over the, over the period of, you know, 10 years. And, you know, some people came, some people quit, some people would let go, various other things. But at the end of the day, I was always at the receiving end of somebody, you know, I always knew when somebody on a Monday morning at 8am put a meeting for the red in the afternoon, it's like, you know, what's going to happen.

They're going to come and leave. Right. And in the, in the U S it's employment at will in the UK, usually people have a one month notice. So they actually tell you that they're about to leave. So the way that I coped with it, it's like, Hey, like when we actually let people go now, the, the, the, the entire equation is reversed, right?

I, we didn't let him go right away on that day. We're actually giving them one, their one month notice. So at the end of the day, it's a bit of a. You know, karma in a sense that it's a balance, right? And just like you can leave, I can let you go as well, but it's all on the same terms, right? We each give, we give each other a month of notice.

We that's, that's enough time to get each other ready for it. You know, probably this happened to me way many more times than number of people. Actually, we had to let go. So, you know, once I was able to logically think about that, I came to like better terms. With it, but hopefully that might actually be helpful to all those listeners who actually have to go through a similar, similar journey.

Jake: Yeah, I am sure it's going to have an impact on, on some people for sure. What was the outcome of the company once you downsized and got into survival mode and then re innovated, what was the exit?

Emre: It, it, it eventually got acquired. So. We actually went through these trials and tribulations, I believe twice, but at the end of the day, it was acquired by a, an e commerce personalization, e commerce merchandising company, because it was actually a good compliment for their business.

Jake: I went through a similar scenario like that, and it's always good to know that it. You had enough value built in where it ends up in good hands and, you know, you get something out of it too. Maybe the lessons are the most important part you got out of it, but, you know, you see it through and you kind of grow from it.

Emre: I think the most important lesson there is again, it's the company's survival, right? It's the technology that you built. As long as the technology you built or the product you built has value as a business, there is always somewhere it can actually you know, grow. Plug into the, you know, the, the, the, and again, from a personal perspective as a founder, et cetera, the success story is always different, right?

So there are some, we always hear about the billion dollar exits or, you know, and those make the news, but not many of those. Just regular exits where a company gets acquired by somebody else so that it can survive and actually its technology survives, its teams actually continue building. It doesn't make the headlines that long, that much.

Jake: Yeah, I hear you. Let's dive in now to Cerbos, your current company, and I'm going to just read through. A little bit of content here, and you can correct me if it's off, but we really read about you and tech crunch and we read the article was bringing your product to the cloud. And, and kind of the, the content reads as servos exists in a space broadly known as identity identity and access management.

I am a 13. 4 billion market is expected to double in the next five years, your product at its core. Is about decoupling authorization process from an application's main code base, making it easier to scale their access management system. This is particularly important as companies transition from monolithic software to micro services.

Correct me if that's accurate, or if it's not, and if it's not, Accurate. Let me hear you. And if it is, let's dive into what inspired you to build it.

Emre: It is accurate. And if I may summarize it in one word, in, in one sentence, Cerbos ultimately makes implementation of roles and permissions very easy. It enables so that developers don't have to build all of that logic into their codes, scale, and make it extensible.

And what led us to build this company was that we had to actually go and Authorization layers multiple times in our careers as a co as a founding team. And every time we had to build it, we had to spend, you know, a month here, two months there, three months there with an engineering team of three to four people so that our product can have roles and permissions built in it.

And when you think about that, it's a bit of, it is a bit crazy because a lot of times when you're building software, a lot of the infrastructure that you need nowadays is available off the shelf. A lot of people, nobody you know, go, going back to the Yonja days, we had to actually get the service, physically hook them up, put, you know, put operating systems and get it all going.

And nowadays nobody does that nowadays. You actually just go on Amazon one click or go to Google cloud. One click you have service available to you. And we. So similar thing is actually now when you look at the software stack that you're building, there are frameworks that are readily available. So you don't have to actually think about how to handle your HTTP calls, your APIs, or there are authentic providers available.

So you don't have to do your own username, password storage, and lookups and all the security bells and whistles around it. There are services that do all of your, you know, email sending, your. Payment processing, your SMS sending, your various other infrastructure pieces that you give it for, you take it for granted that you build on your software on top of.

However, authorization is still not available off the shelf at the same quality as all these other services are. And, but that, when that happens, you, you know, good engineering teams actually need to build something in there that will actually get the Stand the test of time as their companies grow. And we took bill.

I had to build that at Yonja so that, you know, that you can think of Yonja as a customer as a social network, but it had a whole, another department in the back office, which is around customer service, right? Handling spam, abuse. We had those gold membership that you had to actually handle payments.

And suddenly you have an office. Bunch of people in different roles that you need to control who can do what, who can restore an account, who can refund a payment, who can, you know, change an account status or look into investigate a report. So we had to build roles and permissions there. Similarly at Qubit, very similar story where, you know, when we started our product, we actually just built a very quick and dirty authorization layer where, you know, everybody was either a super user or a read only user, or you had no access.

Suddenly, now we were doing actually professional services on behalf of our customers, so then our customer service team had to actually assume some of these roles. And then suddenly we started getting customers with, you know, thousand users or hundreds of users within their organization that need to be able to do these things, but they don't want everybody to have same rights.

So there's governance that plays into, plays into this. So we had to actually go and build that authorization layer two, three different times based on all of our customer's requirements. So, and every time you build that, it means the engineering team that's building that infrastructure, that layer is not focusing on a real customer requirement in order to make your software better.

You're actually going back and building infrastructure. And we saw that in the market ultimately, you know, authorization and in the IAM space authentication is handled right in the IAM space directories are handled since 1980s. There's LDAP, which was decoupled. It started with now there's Microsoft Azure directory, Cognito and various other directory services and the security space and IAM.

There's logs, log management, and all the action logs, et cetera is handled, but there's still not a single solution that's actually reliably handling authorization. And we ultimately set our course on solving that challenge.

Jake: So if you're a software company or an engineer, that's building a platform and you want to embed your solution into their product, how long does it take to do that?

Emre: Software development is like, how long is a piece of string, but that being said, it's ultimately, you know, for a very bad, no, you know, people normal are back, which is role based access control or a back. It takes. you know, five to 10 minutes to be able to implement this. And then you get in return, you get an API that you can actually connect to from anywhere on your stack, where you can actually check the permissions of whether a user is able to do an action on a resource or not.

So, I would say, you know, 5 to 10 minutes to get started, you get to have your very basic implementation. And depending on how complex it gets down the road, you can actually You know, it may take a bit longer.

Jake: Sounds like the real benefit is not just having that as part of their platform without having to build that in their infrastructure, but also time.

Like it saves them a ton of time of having to build this, which is money. And also maybe you lose out on market share if you're trying to get to market with your own product. So that to me sounds like an incredible solution for anybody that's building technology or software. When you went to get funding for your company.

What was that like? And we asked this question because for founders that haven't raised capital yet, it's a double edged sword. You go out and raise the money, give up part of your company to do it. And the pressure is on to build, get to market and hopefully have a success before the money runs out. So there's pressure.

From the found from the investors to actually do something, execute and grow. But when you went out and got funding for this, what was the process like? How many times did you have to pitch before you got the funding and then how much pressure is on you now from your investors to actually make this work?

So we were. Slightly lucky because we actually went to market around March, 2021, which was COVID times, which was a lot of VCs were taking a lot of calls, but I also capitalize on that. So when, so before let's, let's go, let's go get the story straight before we actually went onto funding. We built the product, we built a prototype.

We had, you know, we had. Probably about 100, 120, 120 interviews with potential customers in different companies. You know, here's the idea we have. We're thinking about this, like, what are your needs? How do you, how would you implement this and various other things? So the product, that prototype that we've built was built on top of our experience with having to deal with this and potential customers and what they're looking for.

At that point, we had a prototype that you know, put customers and investors can actually take a look at. And we had a, you know, a demo that we can actually show. And after the demo, it wasn't a smoke and mirrors. We could actually leave the product behind because it was kind of open source that they can actually play with.

So on the back of that prior to going out and doing a proper funding round, I actually. Did a couple of calls with friends who now happen to be VCs. And I was only soliciting feedback around, Hey, what do you think about this product? What are the, you know, do you think this has a shot? So where, where do you think this fits best?

And suddenly. I started getting interest from those friends, right? Friends who are VCs are saying, Hey, this is interesting. This place in this space, this place in the security space, which is a true horizontal when it comes in software. And suddenly as I started seeing the interest there, I started getting interested.

So suddenly realize, Hey, this is actually a very big opportunity, which, you know, initially in my mind, I'm like, okay, it's a good business. It's a good layer of software that a lot of people think. But, you know, going back to, as you quantified this IAM space, I wasn't fully aware of the market size there.

Once you know, I became aware of that, then I grasped the whole. You know the, the, the potential there. And then me and my co founder decided to actually, number one, form a company because now this is going to get real. Is this something we want to do long term? And yes, the answer was yes. And the second thing was now.

This is where COVID kind of helped us and accelerated. I was willing to talk to any VC who wanted to talk to me. And I ended up talking to 89 different VCs. And I still have that sheet here. And again, this was our lock at a COVID times. A lot of VCs were doing a lot of calls and a lot of these calls We're actually on video conference.

And so they, and my, you know, I opened up my calendar from 7 AM to 11 PM. So that covered pretty much all of Europe, Eastern Asia and all of the US. And yeah, I spoke to 89 different VCs. Some were interested, some were not, some were not, but as you know, I tried to narrow down the process and started putting time pressure, et cetera.

And so there were both VCs and angels or like large check angels. I had 19 terms at the end of the day. So, which became a problem, it's a great problem to have. Don't get me wrong, but it's a problem because now 19 people are saying yes to you and you need to choose the right ones. Like, how do we actually, you know, there's no way you can have 19 investors.

On, on your cap table, because also when it comes to VCs, they want to put a significant amount of cash because they need to justify the returns and the process. So, you know, just to, you know, answer your question going back is like the pressure was on me to number one to pick the right set that would actually understand this business so that later on you know, I can have a healthy relationship with them where, you know, when they put a pressure on me, we're actually all on the same page.

So that's when a lot of, you know, Again, analytics kicked in looking at all these investors, like, what are they good at? Which ones of, which one of them actually understands a SaaS business? Which one understands an open source business? Which one understands a developer tool? Because every single one of these have different dimensions that impact your business model.

And you know, what you don't want is the wrong VC trying to push you for growth or for different, you know, pressure you for different Angles that are not right for our business style. So at the end of the day, we, you know, chose, you know, what's some classified as a party round. But the way that I looked at this is it takes a village to start a company.

And I want to have the best. Best support village around me in order to get this company going. So, you know, chose a VC who understands developer tools as our lead investor. Chose a VC who's very good at SAS businesses. Chose a VC that has a lot of, two VCs actually that have, A very large portfolios of startups, which are potential customers for us, potential initial customers, a VC that understands open source software and open source licensing, a VC that, you know, that's geographically great that, you know, it's connected to a lot of our next stage investors somebody that what else?

I'm sorry, like, there's so many VCs, but at the end of the day, those were the dimensions. And when I looked at all the terms, I'm like, okay, here are the ones that we're going to go with. And suddenly, you know, when you look at it, there are a couple of very well knowns that are actually sitting in 1 category.

And unfortunately, you have to say no to some of them. And, you know, I had, you know, I broke some hearts and I was actually feeling really bad about it as well, because I'm like, it would have been amazing to work with him, but I can't have 2 of them to talk to VCs with the same value, same value proposition sitting on the cap table.

Jake: I never knew that you actually can, you should turn away investors that you know, that could potentially help you grow a business. I guess if you have enough investors to choose from, then you have a good problem to have. I mean, it was a great

Emre: COVID problem. I mean, just to reflect back to by Yonja fundraising and Cupid fundraising rounds that we've done.

I mean, we just, you know, in my career, we just finished last. Well, how, when was it last March? We just closed I just did my 10th round with investors. Right. And it is uh, you know, up till that round, it was only one term sheets. And maybe when we had two terms, she's like, Ooh, we have a competitive situation here, where, whereas with Cerbos, when we did our first seed, it was like, You know, suddenly it's, it's very weird to say this, but suddenly money became, money wasn't an object anymore.

It was like money was commoditized because everybody was, you know, giving terms, very favorable terms. And we didn't actually go and take the, in the highest terms either, because at the end of today, you need to think about this as like, what's, what happens in the next round, how much do you need to grow to cover that?

And there's a, you know, fallout if you.

Jake: Yeah, the patterns that we're seeing are very similar to what you go through, which is when you get investors to, to give you money for whatever startup you have, what's the trade off? What do they give you as well? You know, do they have a big network that can introduce your product to, do they have connections to a strategic industry that you don't?

So I think it's important to also look at what do they bring aside from the money because the money is there. But what can they do to help you build or scale the company? I want to go back to 1 thing you talked about before you even brought the product to the table to get funding, which was you had roughly 100 or 120 meetings or conversations with companies.

The people that might be interested in your product, you left it behind. They tried it, you know, as a company that's just starting out, you know, I'm sure a lot of founders wish they had a network that they could have 120 meetings with or presentations or demos or sales pitches. How do you even start to get that volume of companies are going to present a new idea or product to. I mean, it always starts with people, you know, right? Because those are the warmest introductions. Those are the people who are willing to take a minute from their job and listen to your page and evaluate, but of course, not all of them were people. Actually, we knew, but, you know, when, when you start thinking about that tape, this is.

It's almost going back to my social networking background, right? There's a first round of circle around you and then the people that people know, and then the people that people know. So the classic thing was after talking to my contacts and like, who else do you know who might be interested in this?

Who else have you worked with? So start tapping into their network. And similarly, which I think worked on our favor really well, as I was talking to investors, one of the things that I was always the VC, one of the things that I was, I I was always testing as like, Hey, who in your portfolio can we talk to?

Which served us in two ways. Number one, we got an introduction to a brand new company that we can get actually feedback from. Number two, we always knew that feedback would make it back to the VC, which kind of, you know, strengthened our case. So it was a lot of networking in that sense, but always, you know, keeping connect, keeping to warm connection or warm connections, connections.

I love that. And, and, and at some point, actually, I also remember we've done a round on, I believe we use user interviews or something where, you know, I wanted also like a non biased, like, Great feedback from the out called, and we actually spoke to about 10 different companies or 10 different people from different companies that we recruited and got their feedback as well.

Jake: Really important. So, Cerbos we've talked a lot about the company where you're at today. How, how big are you now as a company and where, where is the company located? It's distributed remote. Correct.

Emre: Correct. We are legally in the UK, a UK company, but we are distributed across, I don't know how many time zones anywhere we are, anywhere between, you know, New Zealand, Philippines, Turkey, Serbia, Bosnia, UK, Portugal.

Maryland, I'm sure I'm leaving a country out somewhere in there.

Jake: Very international. How big is the employee?

Emre: So we are about 12 full time employees, and then we also have additional team members that are working with us part time. And this is actually one of those other decisions that we made, like not everybody has to be full time.

Right. Not every function has to be full time. So we actually leverage a lot of professionals in different, you know, in a contractor basis, but we also treat them as just full members of our, of our company. We have, you know, everybody's engaged with them on Slack conversations, but you know, if you ask where the company is running, the company is running on, on Slack asynchronously and fully remote.

Jake: You know, it's funny you mentioned that about part time or we call it fractional workers today, where there's just a huge demand for I need the work done. I need it done at a high level, but I also don't need to spend a full time salary for somebody, at least in part time. At some point in your company, eventually you grow it to a point where maybe you do, but you know, our business, we pivoted a little bit too.

And a large amount of our work today is companies that are bringing on fractional or part time workers in a contract basis, you know, globally, and it's been

Emre: one more dimension to add one more dimension to add there. As job done right by senior and experienced people. So we actually pay a lot of attention to that, which is when, you know, when we get somebody fractional, we, I mean, it's great.

I've done this for years at Qubit. We had a very great triangle where we actually brought up, you know, people who didn't have much experience and brought them up, but when we were operating in an environment, when there is no office and there's no learning by osmosis, We actually don't have that time or capacity to be able to train people as much as you could do in physical, in a physical office.

So that's why it's very important to have senior and experienced people who know what they're doing.

Jake: Yeah, a hundred percent agree. If somebody wants to learn about Cerbos, where do they find you? And if they want to connect with you directly, where would they connect with you?

Emre: So Cerbos is Cerbos. dev our website, or you can just Google Cerbos.

I believe by now we've won the SEO games everywhere in the world. It just comes up as the first, first result. I am on both Twitter and LinkedIn on Twitter, I'm Emre, E M R E, and on LinkedIn, I'm Emre Baran.

Jake: Great. Emre, if there, is there anything before we wrap up that I haven't asked you that you want to share?

Emre: I mean, in many dimensions, if you let me talk, I'll talk till tomorrow morning, but I guess the, the, the key thing is for entrepreneurs who are listening to us for people who want to build software. I would have 1 piece of advice, which is. Build something that you're passionate about because it's a rollercoaster ride.

There'll be good days, there'll be bad days. And on those bad days, one thing you need is, you know, encouragement to keep you going. And a lot of that comes from passion to solve a problem, passion to serve customers, passion, to deliver a technology, to improve life, to improve the world. And if you are. Only doing it for commercial success, but nothing else.

Sometimes that runs out. So focus on what you're passionate about bringing to the world.

Jake: I love that. Well, on that note, I want to thank you and give a big shout out to Emory for taking his time today and sharing all these valuable lessons to our listeners. And to our listeners, thanks for joining us. It means the world to me as we continue to go through these episodes and learn. I'm your host, Jake Aaron Villareal, signing off, but can't wait to connect with you again on the next episode. Until then, sayonara.