Michael Borohovski is CTO and co-founder of Tinfoil Security, which provides web application level security with a strong focus on simplicity, ease-of-use and automation. It essentially takes the web-app aspect of a penetration test and automates it. Michael is a pure hacker at heart, with a love for algorithms, software security and UI/UX design.
Michael holds a Bachelor of Science degree in Computer Science from the Massachusetts Institute of Technology (MIT). Prior to co-founding Tinfoil Security, he worked for ManTech, a leading provider of innovative technologies and solutions for mission-critical national security programs. While at MIT, he held internships at Morgan Stanley, KBC Financial Products, Mandiant, Apple and a Middle East teaching tour with Middle East Education through Technology (MEET).
A true online security guru, hacker and pyromaniac, Michael took the time to talk with the Rackspace Startup Program about the importance of listening to your customers, differentiating yourself from the competition and focus. What follows are Michael’s thoughts on doing one thing, and doing that one thing incredibly well:
What was involved in the product development of Tinfoil Security?
Listen to your customers. Steve Jobs didn’t have to, but you’re probably not Steve Jobs. Iterate, iterate, iterate. Release before you think it is ready, and see if customers care. If they do, double down on it. If they don’t, kill it fast. Don’t waste time building features for a group of people that doesn’t exist, because they won’t suddenly materialize out of thin air. Make sure you are constantly talking to your customers, listening to them and iterating based on their feedback. Also, we made sure to have a greater vision and plan in our heads and on paper. This vision changed a decent amount, but it gave us a heading of where to go – we knew what we were headed towards at almost all times. If we had to readjust, we assessed how the heading changed too, and where that would land us.
How do you go about establishing a company culture?
Company culture is incredibly important to us. I don’t know that you can “create” a culture out of thin air, but you can certainly cultivate it by allowing your employees to express themselves and have fun outside of just work. We instituted a weekly event we call Tinfoil Fun Times, where once a week we’ll go out and do something as a team: bowling, watch a movie, mini golf, etc. Just something that gets us out of the office, conversing and having fun as a group of friends rather than just colleagues. Over time, we developed a list of friends outside the company (other startups, friends of employees, etc.) and invite that group to these events as well. Perhaps this won’t scale one day, but for now it seems to be working great – it’s been great for keeping up morale, recruitment, etc.
What lessons were learned building Tinfoil Security?
This is definitely the hardest thing we’ve ever done. While your title may be Engineer, CTO, CEO, whatever…you’ll still be doing everything. There will be times when there are 12 things to do in a single hour, and only three people. You learn to multitask very quickly, and you learn to be willing to do whatever it takes. Your title is irrelevant. You are not too good to take out the trash, talk to customers, build that new feature or figure out how to write that contract. At an early stage, there is and can be very little specialization. Hire generalists, and cultivate that within yourself as well.
What business challenges did your startup run into?
Differentiating yourself from your competitors is immensely hard, no matter how much better you actually are. We used to tell our customers all about how much better our features were, how much cheaper we were, etc. None of them cared. It turns out that your customers care about what the benefit is to them, not about all your awesome features. How much time will you save them? Do they need to hire one less engineer? Will you acquire those 20 percent more customers in the first three months? Those are actual, tangible benefits and are directly correlated to their bottom line, which means they care. This took us a while to understand.
What business wins has Tinfoil Security achieved?
Our biggest wins, by far, are our happy customers. The reason we exist is to provide the absolute best security for our customers, with an intense and ardent focus on ease-of-use and actionability. If we are making our customers’ lives easier, allowing them to spend more time on their business, and constantly reading (or hearing) about how our service has saved them money, time or stress, we win. Hearing about our customers’ successes as a result of our service, direct or indirect, is the reason we get up in the morning.
What were the ”What to Do” and ”What Not to Do” while building your startup?
Focus. Many companies make the mistake of trying to do too much from the outset. Do one thing, and do that one thing incredibly well. Make sure your customers care about it, need it, want it and can’t imagine using anything else. Then, and only then, expand into other products, verticals, etc. Note that this has nothing to do with features, necessarily. You may already have built all the features your customers need to fall in love with you and it may be a matter of making it easier for them to use, act upon, establishing an emotional connection through your service, injecting some amount of serotonin into their day, however small that amount may be. You have to start somewhere.
Don’t over-engineer and don’t scale before you need to. As an engineer, playing with auto scaling tools, automating deployments, worrying about massive traffic spikes, etc. are fun, but they’re a complete waste of time in your initial stages because you can probably support your few dozen visitors per day on a single tiny Rackspace Cloud Server. Only when that is no longer true, worry about adding a second server and maybe a load balancer (or just increase the size of the box). When dealing with scaling seems to be taking up 50 percent of your time, then automate it. I promise you’ll get to that point faster if you can focus on other things before you scale, like getting customers.
What were the good, the bad and the ugly of establishing Tinfoil Security?
Good: We found a team of people we loved working with. Our team is easily among the smartest folks I can think of having ever known, and we mesh really well together. It’s not all roses and sunshine all the time, but we care a lot about each other, the problem and moving the business forward. Building a team is incredibly hard, so having high standards is even harder. But if you compromise on whom you hire for the sake of speed, you end up with a team of B or C players trying to build a Class A product – everyone gets frustrated and leaves or has to be let go. A single B-player will drag down a team of A-players ten-fold, so be uncompromising on your standards for hiring.
Bad: Find a great lawyer before you start. We can make recommendations, but definitely don’t use a family friend. My co-founder has written a great blog post about this, but you’d be surprised how much can be screwed up in the early days of building a company with bad legal counsel. Good legal counsel is expensive, but most firms will defer until your company has some modicum of success.
Ugly: You have to do it all – literally. There is nobody else to pick up the slack. It’s easy to get distracted by the latest shiniest thing, but if it isn’t acquiring you customers or keeping your existing ones happy, it can wait. Sure, there are the standard legal things you have to do, and payroll has to get paid, but do you really need the best and most optimal printer? Surely one from Craigslist will be fine. Focus on the right things, and make quick decisions on everything else that likely doesn’t matter. Your gut feeling is probably right.
What risks were involved while establishing your business?
It can be scary to take risks, especially in the early days. It’s really easy to worry about what people will think and how the media will react. As long as you are acting ethically, and not acting illegally, being willing to take bigger risks is something worth considering. As a startup, you have very little clout and very little time in which to make a splash. Making a splash for big companies is hard, making it infinitely harder to make a splash as a startup. A great example of this is WePay’s “Unfreeze Your Money” ice block outside the PayPal dev conference. It got me to take them more seriously, but was a huge risk that certainly could have backfired quite poorly. It took us a long time to be comfortable taking bigger risks, and I think we could still get better at it, but there were definitely times in the past that it could have served us well.
What straight up business advice would give to a startup?
Trust your gut. This took us a while to learn, and we’re fairly confident at this point that your gut reaction is usually the right one. There have been dozens of times when we wished we hadn’t wasted time investigating options for something our gut told us not to do, only to find that the best option was to not do it after all. I can count only one or two times when our gut was wrong. Frankly, those one or two times I would rather have gotten it wrong and saved all the other time we wasted on investigating our gut feelings in all the other situations.
The Rackspace Startup Program thanks our favorite geek from MIT, Michael Borohovski, for taking the time out of his busy schedule to enlighten us on being willing to take bigger risks, trusting your gut and providing the absolute security for his customers. For more insight on hosting your startup on the Rackspace Cloud platform backed by Fanatical Support™, contact the Startup Team today.