How does a new player like Hack The Box, how do you build credibility? Why would people trust a new solution? And if possible, tell us about the community as you explain this.

Yeah, yeah. So I mean, just a little bit of throwback history, right? Our CEO and founder, Harris, he literally just put up a box, a module, a challenge, you know, for cybersecurity enthusiasts, hackers, etc., up on Facebook and was just like, who can solve this, right? And then that kind of went viral. Somebody, you know, solved the challenge. That person became a community member, right, or co-founder. And then they kept creating more and more. And then it just caught on because this was back in, you know, 2017. There wasn't a lot of that happening. And then it just caught on because this was back in, you know, 2017. There wasn't a lot of that happening.

And he was just a big believer in, hey, cybersecurity should be for everybody. I'm a hands-on individual. I want this to be fun. I want this to be interactive. I want to learn from other hackers in the industry, right? See what's working. What are their tactics? What are they interested in solving for, right?And then it kind of spiraled. And I think it was a little bit of, you know, timing — nobody else in the market was doing that. It was a little bit of, you know, you can prepare for anything, but it's all about taking action, right? He just took the action. And maybe that would have failed.

And there were probably other — I'm sure there were other — challenges and modules that did fail, right? That people were like, hey, this one sucks, or I created something better. But that's the dynamic that you want, those conversations to start to form. And I think in this day and age, we kind of shy away from some of the negativity or the feedback. And the reality is that's the sweet spot to really grow your community and learn from them, right? What's working, what's not working, where are the pain points, where are the challenges?

And so I think therein lies the trust that starts to get built over time, right? And for Hack The Box, right, it was just a matter of, okay, well, when he started to release all this stuff independently, right, then he had community members, and then it got so big. You and I know coming from Cisco, servers cost money. Technology costs money. You can't just keep creating, you know, boxes and servers and making them available so people can hack into them, right? So at some point, you guys are charging a fee for the reality of how the structure of this comes together.

So therein lies — right — like, putting it out there: hey, if we want more challenges, we're going to have to start, you know, investing in building this community, right? And luckily, that was kind of a no-brainer. So it was one of those where the money would just show up because you're solving a problem that's so meaningful for people that naturally that next step takes place.

I'm going to segue right off of that, right — where the money shows up — because oftentimes that money shows up from people like you and me, marketers, right? So let's talk about this before we talk about how a marketer or a brand performs in a community, which is what everyone's here to learn about and hear about.

Let's be fair — there are folks here from much larger brands, but they probably don't have a community like Hack The Box. For you guys, it's your business. It's your purpose. It's what you do. The size and quality of the community is why you exist, right?

But for a lot of large tech brands, that's not why they exist. At Cisco, we exist to, you know, give networking to the world — a very important function. Everybody needs to be connected, right?

So let's just talk about community for one second, and then we'll come back to how to market into a community. You've seen this firsthand at Hack The Box — like you said, the story and the founding and the purpose and how it's grown.

But for technical buyers — from engineers up — because it's a fallacy that CISOs buy anything, right? CISOs are looking at decisions their teams are making and aligning them to business strategy. That's a CISO's job. If they're evaluating the tools themselves, something's way off, right?

So for technical buyers, what is the purpose of online communities? What do they want out of it — the actual technical engineers?

Yeah, they want to learn, right? They want to know, like, hey, have you troubleshooted this? And I think, yes, that’s technical engineers, but you could argue marketing has technical facets and technical buyers as well, right?

And the reality is, I mean, for marketers — folks are in HubSpot, Salesforce — you're working through challenges, you're trying to learn the product, you're trying to get the best outcome. You're trying to work at speed and at levels that maximize your time. Technical engineers are doing the same thing, right? They're like, how can I make this easier for my customer? What problems is that customer trying to solve? And then how do I break that, fix it, learn from it, make it better?

So I think having those forums where folks can have that open dialogue — and not feel like they're getting pitched to, or that somebody's just looking to sell them another solution — is important. It’s like, no, I want to know how this works. What’s your best practice? How do you start your day? What are the five things you do to maximize your time? Or, you know, my manager's a pain in my butt — what do you do to put your business case forward?

Even those managerial things that we’re stuck with in the work world, especially when you're in a highly complex, multi-threaded company — or even a smaller company — you still need to state your business case. And, you know, ChatGPT can’t solve it all.

So having those forums to have those real-world conversations, I think, is imperative. I even do it as a CMO. I'm in CMO Slack channels, getting insights, seeing what people are talking about. And you can be that creeper in the forums too — just reading and gathering information. Maybe you're not ready to share yet, but you're absorbing it.

But I think the big element goes back to trust. Because obviously, if you're in those communities, you need to respect that, be part of it, and understand that sometimes you have to give a little to get a little too, right?

Exactly. And I think one key aspect of any successful community is the pursuit of mastery, right? The reason you attract the smartest people and the most active users is because they are actively pursuing mastery in their craft. And most communities aren’t 80-20 at all — they’re 95-5, right? There’s 5% active, and they’re not always the smartest person in the room, but they’re generally the best connector or the best communicator. And that works.

But the other 95%, to your point, are either just reacting — which is now much more visible because we have reactions and emojis, right? Before, it was just crickets. You’d be out there doing a virtual event like we used to do, and you’re just like, I hope these 2,000 people — yeah, I hope the 2,000 people watching me right now like it. I have no idea.

So we’ve gotten over that, but it’s still 95-5, right? There’s 5% active and 95% what we call passive, which is not a bad thing.So in that scenario, let’s now introduce marketing.How do you show up as a representative of a brand, of a solution, in a scenario that’s being discussed? What are we supposed to do so that we’re not the pariah — not that salesy person nobody really wants to engage with in the community?

Yeah, no, I think it’s important. I think that’s where that two-way dialogue becomes really important, right? It’s to understand what the pain points are and also not get defensive. The reality is, if somebody’s using your product or talking about your product, they’re already somewhat interested in you. Otherwise, even if it’s negative, why would they waste their time and energy on it? And if whatever — that’s on them — but engage in that. Discover more. Get that kind of discovery. I like to call it investigative journalism. Try to understand what the concerns are and what they care about.

And then the other thing I like to think about too is, as somebody who’s grown up in my own professional career, some people — not everybody, but some people — want to be heard, and they want to lift up their own profile, especially in the digital world that we live in. So if there’s a way that you can help them be better, right, and help encourage them, mentor them — maybe that’s kind of off the chat line — but even so, in the chat line, right, help level up those folks in that community. Give them a platform to stand on.

So there are different ways to look at it, I think, on a personal level — like we’re all human — versus going straight to, okay, well, how am I going to sell my product? Or just getting the black-and-white stuff out of what’s going to make my product better or how I’m going to sell more. A lot of this — and I think we learned a lot about this at Cisco — is relationship-driven too. I mean, that’s just… and the art of that in some communities has kind of been lost, right?

And I think that’s why I mentioned the give and take. You have to give a little. Don’t just come in with all your questions expecting somebody to hand over all the keys to the kingdom. That’s not — especially in cyber — that’s definitely not going to happen. People are just going to shut the door and never talk to you again.So you have to build that trust and that relationship, even on social channels, and find ways to help. That’s a big thing. I think education and help are a big piece of it.

I love it. And I’m going to summarize some of that, and I’ll throw in a Ted Lasso quote just for good measure, right? I’ll start with “be curious, not judgmental,” right? So be curious.

The second thing you touched on there is be honest, right? When people are discussing things, they’re discussing what they see as reality. Don’t negate that. Don’t diminish that. That’s their reality. Engage them there.But then the third — and I think this is probably the biggest — good salespeople do this naturally, but I think marketers need to learn this when we show up — is be helpful, right? Don’t just be a champion for your brand. Be a champion for the community, right?

Then people genuinely start to like you. They might even forget what brand you’re with, which is not a bad thing, right? Because they’ll just remember that person’s helpful, and they’re from this company. Maybe this company’s helpful, right?

Right. So I have a problem. How do I solve it? You know, and help them solve it.

Exactly, right? Which is — I mean, if we go back to what marketing was supposed to be — we’re all very focused on promotions nowadays, but there are three other pieces, right? We’re supposed to be helping with place. This is a classic example of that. There are hundreds of places where your product, your solution is being discussed — and if you’re not willing to participate, you’re not even there.

Exactly.

Same approach — light cleanup, no tone shift, just grammar and structure fixes.So that brings me to my next question. When you’re, as a marketer, right — not as a community owner or community orchestrator, but as a marketer — looking at all these different communities you could participate in, how do you prioritize or judge which ones to tackle first versus others that maybe, you know what, you just don’t have enough resources for?

Yeah. I mean, obviously there's listening tools and things like that, or, you know, your, your, your own customers, right? Find out where they're at. What are they talking? What threads are they in? Right.

I would kind of go there first, you know, and maybe, and, and some of it's going to have to be the whole, you know, experimental, you know, fail fast, right? Do a couple of proof of concepts with your team or yourself, right? Get in there. Maybe also maybe leverage that a few community members in that community that are product owners, right? Again, that helping them level up their career, right?

And, and in that form, right, kind of more mentoring from behind versus like being active in the chat. So there, I think there's different ways to go about it. And again, that all goes back to that establishing trust, right? And building out a relationship. So then maybe at some point, then you do get indoctrinated into that community, which is what you would want versus like just shoving through the front door, you would want a warm handoff from somebody that's already in that community that sees the value, sees the trust being built.

Now, now let's get into the mechanics a little bit, because you and I didn't start at the top. We don't have PhDs in marketing. My God, we did everything right from, from the beginning upwards, right? So yeah. So, so let's get into the mechanics, right? Is our goal as marketers and participants in buyer communities, right, which is not, they're not for buying, but they're full of buyers, right?

Is our goal to carefully and in the right way, pull people from the community to our site or to our resources, or is our goal to bring our resources and, and information and knowledge into the community? What are we supposed to be doing?

Now, now let's get into the mechanics a little bit, because you and I didn't start at the top. We don't have PhDs in marketing. My God, we did everything right from, from the beginning upwards, right? So yeah. So, so let's get into the mechanics, right? Is our goal as marketers and participants in buyer communities, right, which is not, they're not for buying, but they're full of buyers, right?

Is our goal to carefully and in the right way, pull people from the community to our site or to our resources, or is our goal to bring our resources and, and information and knowledge into the community? What are we supposed to be doing?

I think it's almost twofold. You want, I mean, ideally you want both, but I think this is the give and get, right? You're going to have to give away some stuff. You're going to have like, so in the cyber community, right, is there an active threat or an active, you know, thing that, that, that, you know, engineers are solving for. We have a, you know, a module or a capture the flag activation. We'd love for you to try it. Here it is for free. Like just let us know what you think, right? No, no commitment, nothing. If you have elements like that, that I think you can share that are going to provide immediate hands-on value, you know, without, again, some of that might actually link to your website or links to your product.

Some of it may not, maybe it's a PDF, but I think either way, it's that, Hey, here's something that we think solves your problem or could be useful. Or here's a news article like, Hey, I just read this today. This is relevant for our industry. What do you think? Right? So just establishing that two-way conversation. And then ultimately, like, maybe it gets to a point where there's a natural insertion that you could say, you know, Oh, maybe you want to check out this, or actually I just wrote a blog on this, or, you know, my colleague did, who's, you know, a threat researcher and X, Y, Z, like, those are the types of elements I think that again, is more of a, a casual conversation that will ultimately, yes, lead to your website.

I think too, the other thing people forget is folks will look you up on LinkedIn, right? And if folks are interested, they'll see where you work. So naturally they'll get there. So don't think that you need to like, just shove your website in front of their face. Like they'll, if they're smart and they have a problem they're trying to solve, they'll think, you know, they're going to start poking around and figure some things out. But I think where you can be an added value of like, Hey, okay, you're interested in this, you know, capture the flag event, or you're listening, you're interested in AI agents. Okay.

We've got an engineer who's written a piece, or would you like to talk to them? Like happy to like, introduce the two of you, like who knows where that could lead. Right. So I think those types of, you know, conversations in, in those communities will make a difference. And then to your point, like ultimately, yeah, they're probably going to end up on your website or they're going to engage in the conversation, which is ultimately, I think kind of the end goal of what you're looking for.

Right. And I think some of this just has to do with the power of your brand, right? I mean, like, you know, if you're a smaller company, you, you might be unknown. Like Lead2Pipeline is a good example. We've been around four years. We're the fifth largest big database, but most people still don't know us just because we grew so incredibly fast, right? Like it's our own fault, right? Like if we'd been around a little longer, we'd be a little better known.

Right. So my assumption is always people don't know I need to give them what they need, not some sort of brand pitch who cares, right? About how I, how I see myself. So I, I bring this up because in communities, when you show up as a marketer and we have some large brands in attendance today, and we will have watching the clips afterwards as well. We work with a lot of large brands. You might have a brand that's ubiquitous. You show up and you mentioned where you're from that, oh, I know that company. And there's always some trust or credibility or some bias built in.

But if you're a smaller company, right? I think what I'm hearing is you've got to lead as a person in the community as a good community member. Is that right?

Yes. No, a thousand percent. Yeah. Yeah. Yeah. I don't know that I have more to add there. It's just show up as a human, somebody that naturally cares, has curiosity top of mind. Right .And you're, you know, if you're in the industry, like for me in cybersecurity, again, just interested to find out more.

What are, you know, what are the, you know, the challenges that you're facing? Is compliance and governance and risk a challenge? Are, you know, are your teams up to speed? How do they practice? How do they hone in their skills? How do they get better? Right. What are some of the challenges that you face today? You know, we all have them. Even in marketing, you do the same thing, right?

Like, I always like to give the analogy of like, you go to RSA, which is the big cybersecurity conference. Most people know about it. By now, 40,000 people attend, and there's always like a view of who all the tech vendors are that attend.

Right. And it's like, it's massive. Like, you need a microscope to like look at it.You can do the same thing, not necessarily from an event perspective for marketers, but if you look at like the marketing tech stack vendor landscape, it's the same. It's like, again, break out the microscope. What area? Automation? No. Email marketing? No. There's elements of AI, marketing attribution. Like, it's like, I joke that the complexity for cybersecurity is similar to what I've always faced as a growing marketeer and leader in building out. Like, how do you show marketing's value? Same thing. Cyber leaders are like, how do I show the value? How do I show the ROI of the products that I'm buying, of the training that I'm doing with my teams?

Right.
So not to, you know, dumb it down, but a lot of those, you know, care abouts and attributes of what leaders need to speak to or when you put it down to brass tacks, they're very similar in nature.

And you can just start at home. Think about how you tackle this problem as a marketer and then understand what your buyer is doing and, you know, be human, be organic in that way. Right. Just don't think of them as some foreign entity. They're just, they're going to work like you are. They're solving a problem.

Right. Okay. You're not going to believe this. And I always get blamed for this, that they're too short, but we are at time. So I'm going to squeeze in one last question. I know it goes fast, right? And this is a hard one. So you think about it, answer it however you like.

Okay.

We talked about all the way into how we, we identify, how we prioritize, how we participate, right? How we build trust and credibility, right? In communities. Now the dirty word, right? How and where in your experience, does it make sense to sponsor activities in or around a community? Is that a bad look or does it make sense? Because that's where your buyers are. So you want that brand visibility. How do we do this?

Yeah, I think, I don't know that it's so bad anymore. I think it's expected. Thank you, Facebook and other social platforms that have made it very clear when something's sponsored in your phase. But I think, yeah, I almost think it's expected. Some of our community members will even let us know like, Hey, you're not at this event. Like what's going on?

Like Hack the Box should be there. You know, and that type of thing. Like there's a blue team con event. Like we're sponsoring that. Like, so I do think that there's almost a level of expectation from your community to be where they are. And so, and I think transactionally folks get that sponsorships are part of the deal, right? And that's, that's the reality. We were just at DEF CON. We, we sponsored an exhibitor booth there, but then we also had a ton of our employee base go just using their training budget to learn and be with our community members.

Right? So again, there's, I think there's elements to think about it. I don't know that it's so negative, like it used to be right. In terms of sponsored content, I think where I get a little, I don't know, wiggly is in the sponsored, like more like journalistic content. Right? Cause it's like, Ooh, you're trying to show up like you're newsworthy. Is that really like, we all have blogs now. Like just use the blog, like use, use your forum, your communication tools.

Right. Maybe there's some elements there, but it's like your, your messaging and what you stand for should be authentic, authentic enough that either the press will come knocking on your door and, you know, establish that credibility. And trust me, it takes time. I'm not saying that that happens overnight, but you're better off getting those organic impressions versus doing some of that, like paid organic. Placement type of stuff. Um, and maybe that's more so in the cyber world than, than in other places.