Get my ultimate guide to boosting conversions and customer engagement delivered straight to your inbox.
Get my ultimate guide to boosting conversions and customer engagement delivered straight to your inbox.
“Security has to operate at the same speed as AI-generated code – or it becomes the biggest risk in modern software development.”
– Eran Kinsbruner
AI is rewriting the rules of software development – and security teams are racing to keep up.
In this episode of The Chat, Terry sits down with Eran Kinsbruner, VP of Product Marketing at Checkmarx, best-selling author, and one of the Product Marketing Alliance’s Top 100 Product Marketers, to unpack what the rise of AI-generated code and agentic AI means for application security, DevOps, and modern go-to-market strategy.
Eran shares a powerful shift happening inside enterprise software teams: developers are now the front line of application security. As AI coding tools accelerate developer productivity and generate thousands of lines of code in hours, organizations must rethink how they secure software – not after deployment, but directly inside the development workflow.
You’ll learn how leading companies are adapting their AppSec strategy, product marketing messaging, and developer workflows to keep pace with AI-driven development.
The same AI model can generate completely different code for the same prompt – making blind trust in AI-generated code a growing risk.
If you want to understand how AI, security, and developer productivity are colliding, this conversation is a must-listen.
01:46 – Why developers are the real drivers of the AI coding revolution and how AI is accelerating software development speed across organizations.
02:20 – Eran explains the powerful concept “Security for AI and AI for Security” and why both sides must evolve together.
05:00 – The major shift in buyer personas: AppSec vendors must now serve developers, engineering leaders, and security teams simultaneously.
08:30 – Why developers are becoming the front line of application security and why fixing vulnerabilities early saves enormous cost and time.
16:15 – Inside the strategy behind launching Checkmarx One Assist, an agentic AI AppSec platform designed to reduce security noise and improve developer productivity.
22:35 – A surprising insight: the same LLM prompt can generate completely different code outputs each time, raising major trust and security questions.
27:30 – Why security tools must live inside developer workflows-and what happens when they slow developers down.
36:10 – AI coding tools can generate 10,000+ lines of code in hours, dramatically changing the economics of software development.
40:00 – Eran’s simple but powerful product marketing framework: keep asking “So what?” until you uncover the real customer value.
55:20 – A leadership mindset shift: everyone in the company is part of the sales team, from developers to HR to marketing.
Podcast Title – The Rise of Agentic AI: What It Means for AppSec, Developers, and Product Marketing
Host: Terry Wilson, Founder and CEO of Chatmetrics and Zotly
Guest: Eran Kinsbruner, VP of Product Marketing at Checkmarx, Best-Selling Author, and Product Marketing Alliance Top 100 Leader
Episode Summary
In this episode, Terry Wilson sits down with Eran Kinsbruner to explore how AI-generated code and agentic AI are transforming software development, application security, and go-to-market strategy.
They unpack the massive shift happening inside enterprise engineering teams as AI coding tools dramatically accelerate developer productivity while introducing new security risks. Eran explains why developers are becoming the front line of application security and why security tools must now operate at the same speed as AI-driven development.
The conversation also dives into how product marketers and revenue leaders must adapt their messaging, buyer personas, and launch strategies for a world where developers, security leaders, and engineering executives all influence purchasing decisions.
AI can now generate thousands of lines of code in hours, but if security doesn’t move at the same speed, it becomes the biggest risk to the business.
[00:00] – Introduction: AI, Security, and the Future of Development
[01:40] – Developers Are Driving the AI Coding Revolution
Developers are leading the adoption of AI coding tools because they enable:
However, this creates new risks:
Key Insight:
Security must evolve to operate at the same speed as AI-generated code.
[05:00] – “Security for AI and AI for Security”
Two major challenges shaping modern application security:
Strategic takeaway:
[08:00] – The New Buyer Personas in AppSec
Traditional buyers:
New AI-era buyers include:
Marketing Insight for B2B Leaders
Product marketing must now speak to multiple technical personas with different priorities:
[11:00] – Moving Security Earlier in the Development Lifecycle
Why developers are critical:
Fixing issues early leads to:
Strategic Shift
Security must move “left” into developer workflows and IDE environments.
[16:00] – Launching an AI-Driven AppSec Platform
Checkmarx’s go-to-market strategy focused on four key enterprise needs:
Why this matters:
[19:00] – Aligning Teams for a Major Product Launch
Successful enterprise launches require coordination across:
Key tactic:
Lesson:
[22:00] – The Biggest Blind Spot in AI Development
A major misconception among developers:
Reality:
Implication:
[27:00] – Security Guardrails Without Slowing Developers
For security tools to succeed:
If security slows development:
Best practice:
[30:00] – The Future of Developer Observability
Traditional incident response:
Future model:
[36:00] – AI Coding Is Changing Software Economics
AI tools can now generate:
Previously:
Impact:
[38:00] – Building Authority as a Product Marketing Leader
Eran’s core principle:
Deliver real value with every piece of content.
Practical advice for marketers:
[40:00] – The “So What?” Framework for Product Marketing
Eran recommends a simple framework:
Keep asking “So what?” until the real value is uncovered.
Example progression:
Key Insight:
Customers buy business value, not product features.
[43:00] – Pre-Launch Marketing Strategy
Successful launches rely on multiple channels, including:
Key takeaway:
[47:00] – AI SDRs and Website Engagement
AI SDR tools can enhance website engagement.
Best practices include:
Example:
[52:00] – The Biggest Myth in AppSec
Common belief:
Reality:
[55:00] – The Most Important Lesson in Product Marketing
Eran’s leadership lesson:
Everyone in the company contributes to revenue.
This includes:
Mindset shift:
[59:00] – AI Tools Used at Checkmarx
Two tools mentioned in the episode:
1. ai
2. Qualified
Stats & Insights
Useful For
This episode is especially valuable for:
Technology leaders navigating AI-powered development and security
Links & Resources – Connect with Eran Kinsbruner on LinkedIn
Learn more at – checkmarx.com
00:00- Intro:
Welcome to the chat. Come behind the inbound scenes of some of the world’s fastest growing companies. For the past 10 years as chat metrics, we’ve had an exclusive inside view of how these industry leaders are revolutionizing inbound marketing and sales across diverse sectors. Each week we bring you conversations with top minds in marketing and sales who share insider secrets and strategies.
For driving inbound success, join us on the chat, your front row seat to the future of inbound.
00:49- Terry:
Today we’re joined by Eran Kinsbruner VP of Product Marketing at Checkmarx
00:53- Terry:
best-selling author and one of the product. Marketing alliance’s, Top 100 Product Marketers. Eran is a recognized thought leader in AppSec DevOps and AI driven software development. He’s lead go to market strategies at companies like Lightrun, Perforce and Checkmarx, and is a driving force behind the industry shift towards secure AI powered application development.
01:16- Terry:
He’s also the author of four books and a frequent keynote speaker on the future of developer productivity and software security. Eran, welcome to the chat.
01:25- Eran:
Thank you so much Terry for the intro and, happy to be here with you.
01:28- Terry:
Look, I wanted to, start with a couple of questions about the intersection, of security, AI and developer tools you’ve built and led product marketing for some of the most innovative AppSec platforms on the planet.
01:41- Terry:
What originally drew you to that intersection between of, security, AI and developer tools?
01:46- Eran:
that’s a great question. And, basically, what’s the driving force behind? Everything that we are seeing right now are actually the software developers themselves. So, they’re leading, I would say the market transformation around AI coding, vibe coding, ai, software development.
02:02- Eran:
But with the adoption, and what’s driving the adoption is obviously the velocity, the speed of software development that, all of the organizations are trying to, accomplish. but with all of this velocity and adoption of AI coding comes also the risks, to software development, security, and, you know, within Checkmarx we call it security for AI and AI for security.
02:28- Eran:
Yeah. And what we mean by that is that when you are using, AI coding tools within your software development environment. You are obviously relying on LLM, right? Large language models that are built within these IDEs, these development environments. And we know that these are not secure by definition, okay?
02:49- Eran:
They’re not, caring with them so much, experience and expertise and backlog of all the security vulnerabilities and open source, risks, et cetera. So securing the AI of the world, these LLMs and what’s actually building the software, that’s one thing, but there is the other side of the story and that’s, AI force security.
03:10- Eran:
And what we mean by that is securing the application code, but on higher scale, higher speed, higher velocity. So if a developer is using this, AI models to build software much faster. We need at the same speed, at the same scale, at the same pace to secure the code that is being generated. So it’s kind of twofold.
03:33- Eran:
AI for security, security for ai, and this is kind of where we are at today. and, I think that, you know, it’s very exciting to see how it evolves, but today we are seeing way more, risks and threats, actually new ones, that are flooding, you know, the market across all different, development languages.
03:53- Terry:
It’s really, the tool is using the tool to secure the tool
03:58- Eran:
it actually, we, we live within, this development environment. So actually we, from one hand we are securing, to your point, the tool and, we are also using ourselves to secure what comes out of the tool, if you like. Yeah. So yeah, it’s a very weird situation, but that’s the new reality, right now in software engineering.
04:16- Terry:
it is. and I guess on that point, how’s your approach to marketing evolved with the rise of AI and agentic systems? You know, what’s changed? Is there anything that has actually stayed the same?
04:27- Eran:
I will start as follows: the old threats, the old software engineering, processes.
04:33- Eran:
Are still available, are still relevant, because think about it, if you are, a vendor or let’s say, a bank financial, in institution, you have legacy systems, you have your existing code, you have your existing software, your existing applications, which you need to secure, okay? And this software, in most cases was not built by ai, okay?
04:54- Eran:
It was built in legacy systems using open source, traditional source code, IP proprietary code. And that’s the existing code. So for that, all the non practices, methodologies, security testing and coverage and everything around that is still relevant. But then you have. Agents, like you mentioned, you have the agent error, and this is where agents generate the code for the developers.
05:20- Eran:
And with that, you have new ways of, kind of harming or, of fencing, uh, the software. And this is, LLM poisoning, hijacking of models, you know, prompt injections and all these kind of new era threats from a security standpoint that, kind of build on top of, okay. And the worst thing is when you have both, right?
05:43- Eran:
You have a mix of legacy, and traditional code mixed with AI generated code. For that, you need both the old fashioned, software security and software quality and all the practices in software engineering, plus the new agents that are actually securing and protecting, against AI code, security risks.
06:04- Terry:
So how has your approach to product marketing changed in this environment?
06:09- Eran:
Another amazing question. when you look at traditional AppSec application security, up until the agenda era, the main, focus was, or the main budgets, and the main, responsibility came from the AppSec leaders, the CSOs, right?
06:25- Eran:
The chief security officers. When you bring into,this mix, The AI coding, The AI transformation, suddenly you are dealing with the head of engineering, right? The VPs of r and d, the developers, because they’re the ones that are bringing and injecting AI code into the systems. And sometimes they’re the budget, not sometimes they’re the budget owners because they own these software development tools.
06:49- Eran:
So from a product marketing perspective, from a go-to market perspective, you are now serving two different types of personas. which have totally different objectives. Okay. The developers are trying to run to run much faster. They’re not security experts. The security guys are trying to put governance, control, security, best practices.
07:11- Eran:
And this sometimes conflicts or slows down the developers. So you need to kind of meet both personas,in the middle. And that’s where kind of Agentic software, agen AppSec kind of serves both personas because it helps with prioritization, remediation, and reducing the noise. And that kind of satisfies the upsec leaders of the world.
07:33- Eran:
And on the other hand, you prevent and remediate much faster with agents within the software development environments, and that satisfies the developers. So it’s a whole new mind shift or mindset that you need to think of.
07:47- Terry:
Is the audience changing rapidly? I mean, look. I know it’s happened quite rapidly, but I guess is what’s the shift look like?
07:54- Terry:
Is it 50 50 or is it 30? 30. 30? I’ve noticed on your website, on the homepage in particular, you’ve got the, you know, most places will, always tell you, you know, textbooks will always tell you, speak to one person. That’s where your messaging needs to be. But how do you do that in this environment?
08:10- Terry:
You look like you’ve managed that in a way where you’re actually speaking to three very different profiles on the homepage.
08:17- Eran:
So first I appreciate that you visited, our homepage. and yes, you are correct. We are serving the CSOs, the AppSec leaders and the developers. But if you look on our website, in the middle or in the center, the first persona that you’re going to see is going to be the developer.
08:31- Eran:
And your question, they are in my mind, in the 60 70% of, you know, they are the one, only the code. And we believe that security starts with the developers. because Security issues are code related issues. And where you are, and who is writing the code? The developers. So we believe that you want to focus mostly on the developers because when you can prevent issues, early in the cycle, what we call, obviously it’s much cheaper at the end because once you start dealing with the upsec and the CSOs, which obviously are important, and we are serving them and we speak with them day in and day out, right?
09:09- Eran:
If it’s like what we call in the technical language, PostIt, when it’s already in the pipeline, whether it’s an escape secret or a malicious package or an LLM thing that kind of poisoned and impacts your,production environment. it’s too late. which means it takes you a full pipeline, rerun and re execution and it’s very costly.
09:30- Eran:
So we are trying to meet the developers where they are in the ides. We’re trying to prevent as much as we can. Within the software development life cycle, all of the issues, with before they actually ingest them into the pipeline, into the main repo, main code repository. So, you know, we can save a lot of money, to these organizations.
09:50- Eran:
’cause we know what can happen on the other side. So, yes, but to your point, we’re serving the three personas. High highest focus on developers, obviously serving as well, the CSOs and the EC leaders
10:01- Terry:
and developers, really on the basis of trying to keep that gate closed so you’re not having to deal with things after the horse is bolted.
10:08- Eran:
Yeah, and listen, you know, I’ve been working with developers for, over two decades. Developers don’t care about security, okay? They care about delivering, meeting their goals, their deadlines, developer experience, developer productivity as much, you know, tickets that they can solve or, features that they can implement.
10:26- Eran:
That’s what drives them. At the end of the day, this is the. KPIs if you like. Okay. They’re not getting compensated on security fixes. So if you can take this security toil, from their daily, activities, that’s a win for them. Okay? They don’t need to worry, they’re not security experts. by the, fact that you are injecting or embedding yourself into their workflows, you are actually solving a lot of problems for them.
10:52- Eran:
So they can just focus on what they care mostly about. Whether it’s done through AI coding, white coding, what we call today or other traditional, software development. It doesn’t matter as long as they can put the output outer as fast as possible, and most importantly, in high quality and high security.
11:10- Terry:
Talking about high security, then, what does your go-to market playbook look like today for launching enterprise SaaS products in a security first environment?
11:20- Eran:
that’s, a very interesting question and, what we’re looking at because, to your point, we are serving and we are dealing mostly with enterprises.
11:27- Eran:
Okay? So, and we are a cloud full cloud SaaS, solution. and from, an enterprise perspective, they have top of minds. Okay? So we need, when we’re thinking about a go to market for, actually, we just recently launched what we call the adjunct platform. We call it Checkmarx one assist. Okay. We looked when we launched it, to solve.
11:48- Eran:
a specific set of, objectives or challenges that, these enterprises have. One of them was as, as I mentioned earlier, cost of using ai. Okay? We know that all of the enterprises are, in some cases, even though it’s not that secure, they are adopting their, sometimes even mandating, develop. to use AI coding tools.
12:09- Eran:
Right? But if this blows out, on their faces because the, security vulnerabilities, which causes the, business to lose money, et cetera, then it’s their head at the end of the day. Yeah. So they need to protect their decision making about adopting AI coding, which means that can deliver software much faster and be more competitive with the market while still maintaining security.
12:31- Eran:
So one, of the go-to market objective was to ensure that we, from a messaging perspective, positioning perspective, we are protecting the business for the AI era. And that was one thing. Second was about serving the developers and reducing, the noise. Okay. If you ask any software engineer today, and it doesn’t need to be a specific security expert, you know.
12:54- Eran:
The perception in the market, for the past decade or so with security is that it causes a lot of noise. Whether it’s false positives, false negatives, it’s noise. You can get a report, what we call sbo, like a uh, bill of materials. it’s a list of a lot of security vulnerabilities. Developers is overwhelmed by seeing this long list.
13:15- Eran:
He doesn’t know where to start. If you’re able to remediate or prioritize what actually impacts what we call reachability, right, what is actually impacting the bottom line, whether it’s exposing the business to security, vulnerabilities in production, at runtime, across web services, et cetera, then.
13:34- Eran:
Obviously we can reduce the time it takes them to remediate. And, by that you are also protecting the business. I said twice the world business because one of them is protecting the business decision of adopting AI and, and actually future proofing the business for ai. Second is protecting the business by focusing on the highest priority, security vulnerabilities, again within the IDE.
13:57- Eran:
And third is about, at the end of the day, it’s all about developer experience and developer productivity because you want the velocity to run much faster. We know today that, you know, small or, even enterprises now compete against so many different, solutions and tools. Mm. So, they’re trying to also consolidate many tools, okay?
14:19- Eran:
They have tons of tools. Think about an enterprise that, has, I dunno, thousands of applications. They would probably use hundreds of tools, in their software development lifecycle. So if you can, introduce, to them a platform, a unified platform that reduces or consolidates every, not every tool, but many tools into a single platform.
14:41- Eran:
That also covers the AI era threats and security risks. Also, the other traditional, security that I mentioned earlier, right? For the legacy and other code, it’s kind of all in one. It allows them to use only one vendor for many, of the, you know, tasks and, objectives or jobs to be done. And reduces also the cost of, operation, if you like, because there are so many other tools that they can let go.
15:07- Eran:
And honestly Terry, I’m hearing it day in and day out for many, like the biggest financial organizations in the world are saying, listen, we have had it now with AI and everything. That’s a good time for us to look at all of our tools and see how we can consolidate, how we can bring down the amount of tools that we have because AI can do a lot of things for us.
15:27- Eran:
And if we have a platform that also covers, I dunno, 10 tools in one, it obviously saves us a lot of money, headaches, and much more. And training on tools also takes some time and, et cetera. So. these are just few things that we are using in the go-to market, business protection, productivity,tool optimization and, consolidation, and the likes.
15:48- Terry:
in the finance sector in particular, there are a lot of legacy systems aren’t there because of the regulatory requirements to for compliance. look, AppSec is, is one of the fastest scaling,verticals that I can see. There seems to be a lot of, players starting to enter that market in talking about those three areas, what messaging or positioning, shifts have helped you differentiate in such a crowded space?
16:15- Eran:
So, we believe that, we have few things, few messages. One. thankfully it’s not just us saying it. we have received in 2025 from the top analyst like Gardner Foster, IDC, the award of being the market leaders. Okay? So obviously if you want to work with, the market leader, you automatically fall on check marks and that’s a very good and easy, entry point, when you are entering competitive situation.
16:41- Eran:
Yeah, but that’s not enough. You need to have the platform that actually merits this, award and we have that platform.many of our competitors are looking at what we call outside of the development environment when they’re trying to prevent and protect software engineering, what we call post commit or pull request, security testing, et cetera.
17:02- Eran:
What check marks is doing, and that’s kind of where we launched our agent solution. We are looking at the pre-commit, okay? We want to make sure that before the code is even merged into any code repository, it’s already underwent a scan. We found all the issues, we remediated them, prevented them, and also took care of, what We have something that’s unique.
17:24- Eran:
Talking about messaging, we call it safe refactor. What is safe Refactor? It means that, okay, we identified, let’s say a malicious package that fell into the code while you were creating your software, application. We fixed it, but. Guess what, when we fix it, we cause six or seven other issues. And that happens when a developer is touching a, a line of code.
17:48- Eran:
There is kind of the blast radius, right? Is impacting some other areas. We auto autonomously with our agent. not only fixing these issues, we are also what we call safe refactor. We’re going through all of the broken code dependencies, unit tests, documentation, and autonomously, fixing everything. So like in one task, if you like, we remediate, we fix, we clear, the pipeline and make sure that the application is built successfully and ready to go to market.
18:20- Eran:
So, being the leader, that’s one good strong message that we are using. The other one is our differentiating, methodology of strategy serving the developers in the early stages of the coding, plus what we call the safe refactor.
18:34- Terry:
Yeah. It’s interesting, the market lead is one thing, but again, it comes back to the message that you’d me, mentioned before about keeping the gate closed before the software actually hits the repository.
18:44- Terry:
So not, yeah, not allowing the issue to arise in the first place. So when you were going through this process of developing and launching,the agentic side, how did you keep sales, marketing, product, technical stakeholders? How do you keep them all aligned as you’re going through building this product and then building that whole go to market or launch, campaigns.
19:04- Eran:
So it all starts with, I think you mentioned this word, the keyword here is communication, because we will align from our product management,side of the house on what’s coming when it’s coming. So we were able to, kind of roll back from that due date, which was August, this year, back until when we started working on, you know, we did an adjunct AI summit when we launched our, product initially in June.
19:29- Eran:
we invited, something like 2000 people to attend. so just to think about orchestrating an event for 2000 people, when you’re just relaunching a product, took a lot of, sync and, communication between. The sales reps that invited customers,right? The sales engineering that needed to be ready to answer most of the, you know, tough questions.
19:50- Eran:
The product management that needed to make sure that the product is ready to show, at that event, the website, the content, for this, announcement, the messaging that you mentioned earlier. So it took a village, as we say.
20:02- Terry:
Mm.
20:02- Eran:
but if you communicate properly, and we had twice a week at least, sync meetings.
20:07- Eran:
Not long ones, by the way. I don’t like long meetings, but, they were very focused. They included all the key stakeholders from support sales, AEs, ses, regional marketers, product marketers. the leadership as well. VPs of communication. We did a press release, of course, work with analysts, right.
20:25- Eran:
Brief them because we are the leaders. We all also gave them, the early announcement of what’s coming.
20:31- Terry:
Yes.
20:32- Eran:
Talking with the media, right? setting interviews with the media folks, the information and all the other outlets that, are out there. So, it was a fully orchestrated go to market plan that touched almost each and every pillar of, you know, this, product launch if you like.
20:48- Eran:
And I think, and I’ve been almost 25 years in this, business. I think what we launched, with this Agentic AppSec platform was in my mind one of, my best experiences in launching and going to market with a new product, with a new platform because of all these, elements that fell into the right place.
21:07- Terry:
and, yes, I think we’re all proud of what we accomplished. and it’s all the foundation, or it’s all underpinned by proper communications across the entire organization.
21:15- Eran:
Of course, shared communication, shared resources, multiple reviews by all these, contact, persons. also getting the bylines, the binds.
21:24- Eran:
So from leadership, who set this as, you know, the top priority for, dc right? Making sure that we are launching it properly. This year, this was one of the top missions from, the executives, at check marks. So it was very clear okay, that we are very. For laser focused on what we need to do. And, I think, I’ve been in many companies when, yeah, we want to do that.
21:45- Eran:
That’s very high priority, but there is also a high priority item, and this is the other one. And then, okay, what takes priority? ’cause at the end of the day, you only have x amount of resources and budget to do, x amount of things. So for us, it was very clear what we need to put most of our focus, on.
22:02- Eran:
And it helps of course.
22:03- Terry:
Yeah, absolutely. and the fact that comes from the top is a, the decision. It keeps it absolute. gunsight, accurate deci line of sight vision on what’s moving, what’s important.
22:13- Terry:
By all means, You’ve written and spoken extensively about the risks of vibe coding and LLM poisoning.
22:21- Terry:
and in fact, as far as LLM poisoning is concerned.I really only gained a good understanding of that over the last couple of weeks. Not through experience, but through education. what’s the most urgent blind spot for engineering teams right now?
22:35- Eran:
two, there actually a few things. one, one perception.
22:39- Eran:
Okay. They think that what they get from, AI by definition is solid. Is secure. Okay. And honestly, why wouldn’t they? Okay. They have no other, they don’t have a benchmark, on their end. You know, they use,not going into too much technicalities, but if they. If they use cloud code, they get a specific LLM, okay?
22:59- Eran:
They can use a different one. But when you use, let’s say, VS code with copilot, okay? What you get from copilot, that’s what you get. And by the way, if the developers have watched one of our previous, researchers and webinars we showed live, when five developers are asking, an LLM to create, let’s say a specific, batch of code five times for the exact same request from the exact same LLM, you’re going to get five different code outputs.
23:28- Eran:
Okay? You are never gonna the same
23:30- Terry:
lm,
23:30- Eran:
the same LLM, you’re never going to get the same code. And so think about it, how can you rely on that from a security quality context perspective? And the basic code we’re dealing with, a relatively. Decent amount of code.
23:45- Eran:
We didn’t took it to the most complicated scenario with like microservices, multi architectures, containerized applications, and you know, the likes we looked at very simple to medium, scale applications, but still received different outputs for the same prompt against, the exact same LLM. So the perception is a huge risk.
24:08- Eran:
That’s, definitely one thing.and we have evidence that shows, you know, so that’s, one thing. The other thing is, go ahead.
24:16- Terry:
My mind is still processing that and I was shocked to hear it to start with because in my mind, code is maths and maths is logical, however. my thought process is going even from, say a content perspective.
24:30- Terry:
If you give the LLMA prompt and ask it to produce some content, yeah. If you go back and give it the same prompt, exactly the same prompt, you do get different content, it’ll write it a different way. You can say the same thing to a couple of times, then it will do it differently. So, I dunno why I’m so shocked with that, but it’s actually shocking when you start to think about the ram on the, bigger ramifications.
24:50- Eran:
So, it’s a fact, you know, and by the way, if there are any developers that are listening, you know, that I’m challenging them to do the exact same test, and hopefully they won’t be surprised, as you are. but, yes, the reality is that you are never going to get, or in most cases, you’re not going to get the exact same, response or output, which means how can you trust what you’re getting?
25:15- Eran:
The other thing with regards to LLM is that, it’s not just LLMs, it’s what we call this entire agentic era that we are living in. And what, not Checkmarx , but Checkmarx as well. we actually wrote a research, based on use of,experience called, lies in the Loop. Okay? LITL lies in the loop.
25:37- Eran:
And what it means is that within this LLM there can be bad afterall that can be, a human interference that can actually hijack if you like, and LLM and divert it against the developer. So you think that you’re working with, the LLM, but in the middle there can be something. And that’s kind of the lie if you like, that kind of comes and takes over if you like your prompt, your model and can use it against you.
26:04- Eran:
that’s when you are in involving a human being. But we also know about, offensive agents. You never had this term six months ago. Okay? So today we have agentic AI agents, but not all of them are nice, or playing nice. They’re also offensive agents. And you can think about the offensive agents as the modern human hackers, but guess what?
26:27- Eran:
These AI hackers are much more intelligent, much more sophisticated than humans because they’re lying or they’re relying so on a massive amount of data that gives them the power to actually attack you much faster at higher scale and with higher sophistication. So, I’m trying to scare everyone and I hope I’m succeeding because that’s the reality right now.
26:51- Eran:
And we have already, evidence out there that shows, you know, the results.
26:55- Terry:
You’re scaring me.
26:56- Terry:
I should be marketing, I guess. No, just kidding.
26:58- Terry:
It’s really interesting, isn’t it? That, that, you know, for ev it’s almost the yin and yang for every good. There’s a bad for, you know, when you’ve got a tool and it brings such benefits, then there’s always gonna be bad actors that will leverage that tool you know, towards their ends and everybody ends aren’t to the, same, same level, that’s for sure.
27:16- Terry:
Well, that’s really interesting. So what does, you talked about it’s the trust being, it’s not a valid trust. We shouldn’t trust it. What does trust look like in an agentic driven environment? how can security and developer teams build guardrails without killing velocity?
27:33- Eran:
So as you are, integrated more into the workflows, you know, that’s when you come become a seamless.
27:40- Eran:
and not afterthought, right? When you are becoming a seamless ingredient in the workflow, when you fit into the workflow, that’s when trust is being built. You know, when you’re just kind of using the, right side of the, equation, which is, let’s say the ai IDs, the windsurf of the world, et cetera, and you think that’s the perception that I mentioned earlier, that what you’re getting is good enough, then you are, putting yourself in a very,tough situation when you are, bundling or in integrating into these workflows.
28:11- Eran:
The guard rails that you mentioned earlier, you know, but in a way that they don’t interfere with the process. If they slow you down, you failed, right? Because, as I mentioned earlier, it’s all about the speed. When you’re adopting ai, you’re adopting a AI for main two main reasons. One is speed, the other one is.
28:29- Eran:
Scale because AI can do things much faster and at higher scale than just humans. Okay? But if it fails, you failed. So you need to make sure that you are still maintaining the speed and the scale while maintaining also the security and the quality. And just so you know, open AI behind check GPT together with jellyfish.
28:51- Eran:
just recently, launched the research, uh, and I think it was at least, uh, two months ago, and they showed that companies with higher AI usage are pushing more bug fixes into the code. Okay? So it’s even the source of, you know, chat, GPT and the likes are saying AI is not perfect. And by the way, why are we calling things copilot?
29:15- Eran:
Because it requires the human to be together with AI to protect to if you, like even put the context in the right way. So guard rails are kept, policies are kept. And, and again, we mentioned earlier, enterprises. Enterprises are not dealing with, 1 million lines of code. We’re dealing with few millions, few million lines of code.
29:38- Eran:
Mm-hmm. I can tell you, we checkmarx and our customers, we are scanning on a given month over 815 billion lines of code. Okay? That’s, that, that’s an enormous, number of lines of code in just one month. And by the way, this is growing exponentially. So, and these are, these are the scales of the enterprise.
29:59- Eran:
Okay? And this is just growing because AI is pushing more and more code into these pipelines, et cetera. So, yes, you need to balance, you mentioned ying, ying, and yang. You need to balance between the bad and the good, but it needs to be in the way that they work together seamlessly. So they don’t kind of hold back the, the advantages of.
30:18- Terry:
Yeah, I get it. I get it. So it’s, it built into the flows as opposed to being something that sits on the outside, reviewing it in.
30:24- Eran:
Yep. Yeah. If it’s bolted in and it’s not merged, then uh, it obviously impacts productivity velocity and, and the likes.
30:33- Terry:
What role do you see the developer observ availability playing in securing the software supply chain in the age of AI first development?
30:43- Eran:
That, that, that’s a great, great question because when we deal with, uh, developer observability and observability in general, you know, we are looking at what’s happening in either staging or even worse, production. Okay? What’s happening in production outages, security vulnerabilities, these kind of things.
31:01- Eran:
That’s kind of production observability. But, in.a traditional workflow when something breaks in production, whether it was generated by ai, AI or not, you know, the flow is DevOps, right? It goes through the ops. there is an automated ticket because the monitoring system found something, a signal, and they alert the developers.
31:20- Eran:
The developers get the ticket. It’s a very slow process, right? Sometimes can take you, with wall rooms and drugs can take you two weeks, sometimes even more to fix a very, severe outage.
31:32- Terry:
Mm-hmm.
31:33- Eran:
In the air of ai, you don’t have this luxury. You don’t have the time to deal with such long, outages.
31:39- Eran:
And this is why developer observability, like we mentioned earlier, this kind of shift left thing, the developer needs to kind of, if you like, sit on the production environments and get first time, real time alerts when something is broken, and then equip his system with AI fixing. So AI can actually fix, as, you know, something happened in production, sometimes even before the user, even spotted or was impacted.
32:10- Eran:
The developer is already working on a fix. So that’s kind of the continuous monitoring, continuous observability and fixing of issues. And the issues can be security, can be functional, can be performance degradation, you name it, right? But it needs to be immediate because if you go through the full loop of Yes, ops found something, or the monitoring or whatever, that’s kind of the old school of observability.
32:35- Eran:
And, the pace of the world right now doesn’t really accommodate. This level of, slow fixing, you need to fix things much, much faster. ’cause the impact is, the time. As time moves, the impact al also, becomes more critical.
32:50- Terry:
And so the AI itself is in this cyclical, testing environment.
32:55- Terry:
Every time that there’s an alteration or addition to the code, then it’s checking the ramifications of that on an ongoing basis.
33:02- Eran:
So in advance, even though Checkmarx is not an, AI monitoring solution, but there are AI monitoring tools. So there can be an AI agent that leaves and is deployed within this production environments and kind of listens in a quiet mode to the environment and has the triggers to alert the developers when something goes wrong.
33:23- Terry:
Hmm.
33:23- Eran:
So this loop that you mentioned, the cycle thing goes from the agent running in production and listening to everything that goes on up until the developer environment that gets alerted and can immediately, get the right logs, telemetry, data, whatever is happening in production and fix the issues even again, in minutes before the users are even impacted.
33:45- Eran:
That’s the future.
33:46- Terry:
it’s the future. I mean, you, you think about the time that it saves when you’ve got the rest of the business to, which usually usually do form part of the testing team, it get to a stage where they’re virtually testing what should be the final end finished product that’s already been fully tested.
34:02- Terry:
And so they’re actually working on a finished product as opposed to, you know, that work in progress.
34:07- Eran:
Yep. Yep.
34:08- Terry:
Gets products to market a lot faster.
34:10- Eran:
Yeah. And that is the concept. I think it’s old already, but there is the notion of, you know, digital twins that you’re actually, walking and deploying and delivering something that is not even the final production environment, but it gets you all the experience.
34:25- Eran:
So once you deploy it, you know exactly what to expect. So, that definitely models like with security, you have threat modeling, right? You can put and simulate red teaming and the likes. You can simulate what’s going to happen or even, initiate, the attack on the software in production and et cetera, just, to see how the system will respond.
34:45- Eran:
So you protect yourself or prevent issues, from happening from the get go. Hmm.
34:51- Terry:
It’s fascinating, quite frankly. and. It’s, the more I learn about this, the more I realize the critical nature of security, particularly now that we’ve got the ability to produce and ship products out into the market at such a fast rate, you know, to be able to go through and virtually sidestep the normal checks and measures that have been in place in the past.
35:13- Terry:
And then you’ve got tools and, you know, products that will help you vibe, code through an LLM to get to a stage where you, you know, bandaid and duct tape, three other products together with Stripe and a ui, and then be able to push it out into the market. you know, you’ve potentially got a rogue product that can take payments off people and then, inject itself into their own platforms.
35:33- Terry:
There’s something that, will also,I hope not surprise you, but, you know, we are seeing today, AI models, AI IDs, like, AWS that just launched Kiro. we have a cognition that acquired wind cell. we have vs code, and they’re competing against themselves right now.
35:50- Eran:
Whether who can actually produce more lines of code in a given, time. So I’ve seen, you know, uh, benchmarks of, you know, 30,000 lines of code in a few hours. Okay. Think about it, for software developer just a year ago, you know, to write a thousand lines of code would’ve taken them like weeks, two weeks, or, depending on how sophisticated they are.
36:15- Terry:
Mm-hmm.
36:15- Eran:
Now, in a matter of hours, within a single day, you can generate over 10,000 or even more lines of code. Using ai. Okay? Of course there is computing, there is cost, you know, to these forms and tokens that you are paying. But, think about it. If you are looking at a few weeks of software engineering cost, and the tokens that you are purchasing from an AI vendor, you know, it’s obviously much more, cost efficient, efficient to build software using ai.
36:43- Eran:
And that’s what we are seeing, you know, in the market. Many organizations are laying off software developers and keeping, you know, the architects that can understand the context and the, and build the full, you know, services that operate together. Because at the end of the way, you still need to instruct and orchestrate these AI tools.
37:01- Eran:
So you build what is right. Rather than, you know, hoping for the best.
37:05- Terry:
Yes.
37:06- Eran:
but yeah, we’re in definitely in a very unique situation right now.
37:08- Terry:
it’s interesting that you mentioned the architect. I think, from, from a perspective of certainly the environment we’re in at the moment with AI and its capabilities, it’s that creative side, you know, that the innovation is really still comes from the human beings.
37:23- Eran:
I hope that that stays, you know, for at least the foreseeable future. because, it’s not that we are, smarter. we know what we need to get from a job to job to be done. We know, we know what’s the end goal. Okay? If you’re the executive, you know, like I mentioned earlier, we know that we needed to deliver an agenda, AI application security.
37:44- Eran:
Okay. but it needs to serve X amount of objectives. You know, it has to have the context of an enterprise and has to have the right requirements. So the architects, the solution engineers behind, software engineering, you know, they’re very, very critical and they will continue to be critical.
38:02- Eran:
In my mind, my only, I wouldn’t say concern, but still challenges to understand how developers, you know, fit into this new model of AI coding. and at least again, for the foreseeable future, the existing developers will still play a significant role because. there is no single application in the market today, whether it’s mobile, web, enterprise, et cetera, that does not consist of legacy code that you need to maintain, proprietary code, open source, and AI code.
38:32- Eran:
So there are so many different generations of code that consists of an application of an enterprise application that requires the human being that maintains, that knows everything around that. so you cannot delegate, these things to an ai environmental agent, if you like.
38:49- Terry:
let’s switch things back to marketing, for a moment. Aside from being a tech executive, you are also a prolific content creator and keynote speaker. What advice do you give for product marketers looking to build public authority and credibility?
39:03- Eran:
So, It’s definitely, the keyword for me is value.
39:06- Eran:
Okay? I always drive things via value, okay? if someone comes to read either a blog that I wrote, a LinkedIn post, or comes to listen, to a keynote that I’m giving, and by the way, this week I’m speaking at an event. I have my session over there. If, let’s say, I dunno, 10 people, 20 people, 100 people are coming to listen.
39:27- Eran:
You speak and they’re wasting one hour of their day, which is a lot, okay? You need to be respectful of their time, which means you need to make sure that you are delivering value to them if they come out of your session or if they, after reading your content a bit smarter or they got the value that they were expecting to get, you did your job properly.
39:49- Eran:
If you just kind of either gave them a self speech or if you just gave them, I dunno, things that they could have found easily on the web and. AI today gives you a lot of information, okay? You need to be very unique. You need to have your specific, unique value, to your audiences. And some of the s are going to be very technical.
40:07- Eran:
Some are going to be executives, right? If you’re not able to do that, you won’t be successful as product marketing. And when you think about that and apply it to product marketing per se, the profession, right? When you are leading, and you asked earlier, you know, about the go-to market for messaging and positioning, right?
40:26- Terry:
Mm-hmm.
40:26- Eran:
What I’m telling, all of my direct reports each and every time when we are launching a new product to the market, you know, is continuously ask when you are getting a feature rolled out from a product manager, you know, always ask the so what per each product up until you exhausted the so what?
40:45- Eran:
When you reach the wall, it means that you understood the exact value. And I can give you an example. Let’s say, you have a web application and it has, a submit button, right? And you say, okay, that’s my feature. Okay? But that’s not value. Clicking the submit doesn’t give you as a user anything, right?
41:02- Eran:
What’s behind the submit, okay? what’s the value? So you can say, okay, when I click the submit, then I get into a platform that allows me to do what? Do something, okay? But you understand where I’m going, right?
41:16- Terry:
I get it.
41:17- Eran:
So what is very, very deep and what I’m seeing very often is that product marketers and marketers, you know, are not taking it all the way down to this final.
41:27- Eran:
So what, and that’s where you are missing the value to your, buyers, if you like, to your target audience. And if you’re missing that, obviously you won’t be successful in your go-to market activities, no matter how much money you put, into your investment. So you need to be very clear, very sharp, and exhaust all these, so whats, if you like, and if you do it properly, you’re in a good path to succeed.
41:49- Terry:
So it’s like the thought around finding the root cause is you keep asking five whys. You keep asking why until it’s exactly the same. so what, why does that matter? It’s like, I like
41:59- Terry:
it
41:59- Eran:
and it’s so simple. But still, if you see, and I work with a lot of product managers throughout my career, even from the product management perspective, and they are the architects of Dell features, if you like, you know, they won’t get down to the full or the final.
42:16- Eran:
So what in their, journey they will give you? Yes. we are giving you a very sophisticated, authentication capability. it was harder to do it previously and now it’s easier. Okay, why would someone want to pay more for that? Or why would someone upgrade his version to get to that new thing?
42:34- Eran:
And then, oh, okay. And then the discussion continues and finally you get down to, okay, this exact, yeah, it saves him, I don’t know, 60% of his time throughout the day, 60% of the time for a specific task translate into money how much money he can save. Because if he’s doing that 20,000 times a week, you know, you can quantify that into dollars and that’s an easy exercise to do.
42:59- Eran:
Not that many are doing that, unfortunately.
43:02- Eran:
Yeah, yeah. Really get down to the true benefit, not just the surface level feature.
43:06- Eran:
Exactly. Exactly.
43:08- Terry:
As a market leader, I guess there’s, you know, I look at. Any brand that’s leading in their market, and there’s a certain level of momentum that’s built anyway, you launch something new to the market and there’s just already the channels and the mediums that will pick that up because you are the market leader.
43:24- Terry:
It’s something of interest to talk about and to share. But what’s been your most effective tactic for building more momentum pre-launch? You know, was it social content, influencer engagement, the analyst relations, or is there something else?
43:37- Eran:
I think it was always a mix of things.
43:39- Eran:
because if you want to get, kind of visible to many, whether it’s decision makers, even your customers, you know, you want to exhaust a few different, tactics, because not always the first one, even though you think it’s good will work for you. So engaging with,I would say boutique or niche analysts, right.
43:59- Eran:
I found it to be very, very successful because you’re not paying the premium price, but you’re getting very, very talented analysts that can give you very good feedback that you can apply and sometimes engage with these analysts to go to market together with them. Okay. And suddenly, you know, because the forests of the world and the gardeners knows about also the other, smaller tier analysts.
44:23- Eran:
so that’s one tactic. Another one, getting this embargo media, interviews, before a press release comes out. You know, giving, giving this exclusivity, to a specific, Forbes or, information or the wild magazine and the likes, seems quite, and it’s, by way, it’s owned media publication.
44:42- Eran:
It’s not paid. And that’s also something which is very, very important. You might need to pay wired if you want to read, the article, but for you as the one that. Put out this, article, you’re not really paying, but to your question, you need to have a very strong story. You need to have a very strong punchline so they will really, understand that there is meat for them.
45:04- Eran:
to put it again, you know, behind a paywall or a gated, form. because they have their own brand to protect, you know, if they publish just bullshit or sell speech, uh, they will lose their audience, eventually.
45:17- Terry:
Yeah.
45:17- Eran:
so it’s definitely, a very strategic game that you’re playing and it’s never with one.
45:23- Eran:
I would say, channel you need to actually do it across multiple channels. One of them can be the analyst, the other one can be a media outlet. The other one, can be, social. You mentioned, you know, you can very be very smart about social media, whether it’s paid or organic. You have the, your website, a strong website today brings you hundreds and thousands of visitors in a given day.
45:45- Eran:
Okay. putting aside the SEO and everything around that, which also makes, makes an impact, right? SEO and by the way, ai, SEO, or L-L-M-S-E-O, it’s also becoming the new normal, nowadays. So, the digital channels are very, very critical here as well. So, it’s another channel, it’s not just one.
46:04- Eran:
That’s my bottom line. You need to play across all of them. And you need to play differently across all of them because what works for one doesn’t work for the other.
46:13- Terry:
I mean, I know this is getting down into the weeds a little bit, but particularly on your website, I was, had a very interesting, interview, about a month ago, with another product marketer.
46:22- Terry:
And, she spoke specifically about the one person, one message. have you had the opportunity to ab test your homepage with the three buttons there? and how did you land on that being the best outcome?
46:35- Eran:
So, we are doing this ab testing every day, almost every day.
46:39- Terry:
Mm-hmm.
46:39- Eran:
to, check our SEOs and everything around our content.
46:43- Eran:
What works, what doesn’t work, the engagement, the intent. So we are measuring everything through different tools. we actually have also some AI SDLs within the system, like, sophisticated drift. if you like.
46:55- Terry:
Yep.
46:56- Eran:
so, in my mind, it’s not a one and done. it’s an AB testing that you’re doing constantly because, you know, as a big company, as Checkmarx, we are constantly maintaining and updating the content on our website.
47:08- Eran:
Some of them is messaging, the other one is resources. So we need to make sure that, you know, if we just put up a, a new press release or we just announced that we are leaders in Gardner or Forrester, we have a new ribbon, we have a new resource. Is it being. Downloaded is, are people clicking on it?
47:25- Eran:
People actually even paying attention to that. So it’s always about continuous monitoring and testing of the website. So we are always keeping in touch with our audience, and serving them where they are.
47:37- Terry:
Yeah. so how do you balance then those leading indicators like engagement or demo requests with lagging indicators like, you know, annual, run rate and product usage?
47:47- Eran:
So, again, we have some tools that are embedded into our website that can measure.the user intent. and we can see also by the user itself, that the origin, the geography that he’s coming from and everything around that we can, serve him, or kind of guide him through the journey of, you know, when he is clicking on a specific solution page, you know, up until he gets to the request a demo or book a meeting or whatever.
48:12- Eran:
we are able to give him the right, journey. And it’s a very tailored one. Okay. So, we actually prepared a set of journeys with different tools, different messages that pops up, and in a specific moment in time. We will also pop up, this ai SDL if we identify a strong intent to either.
48:35- Eran:
Book a meeting or, maybe more advanced in the purchasing, journey as well. So we even launched the AI agent for, the bio for the audience, if you like. So, we can start a conversation in a much more serious way. but it’s a mix of, you know, web strategies, some AI tools that we bake into our website.
48:55- Eran:
and we are actually also mixing our, content, to meet, you know, all these tofu bofu mofu of the world. and you know that we have three ICPs, we have three different personas that we are serving.
49:07- Terry:
Yes.
49:07- Eran:
each has their own, objectives and interests.
49:10- Terry:
I’m really curious because we play in that space as well in that live chat field ourselves.
49:14- Terry:
Why do you leave it so late in the buyer’s journey to engage the A-I-S-D-R? Why not bring it forward and have you done AB testing with that?
49:23- Eran:
So, yes, we have done, and, I cannot say the name of, but we are switching to a much more sophisticated, we actually switched already to a much more sophisticated ai, SDL.
49:35- Eran:
and by the way, that’s a different conversation to have. What’s the role of an SDR going forward? if we have time, I can give my, zero sense, on that. but I think, ai, SDRs, you don’t want to involve them at the first.second or few seconds when someone just gets into your website and scrolls, you need at least to see some intent, okay.
49:55- Eran:
Some direction. And based on that, yes, you are correct. That’s when the AI is the out comes into play. but you already have some context that you can use, to start a conversation. Hey, I’ve seen that you, looked at, you know, the A SPM model that we have, or you click to download the garner, research.
50:12- Eran:
I, and the conversation obviously continues. Yeah. But it’s with context and that’s the key word here, the context.
50:18- Terry:
yes. And that’s one thing the SDR very good at from a knowledge based perspective. They have the context, but also then the depth of knowledge
50:26- Eran:
you took my zero sec, sense that I wanted to say the depth of knowledge.
50:30- Eran:
That’s what’s lacking today, because SDRs usually don’t have all the right answers. for all types of questions. Usually SDR continues to learns, you know, AI DR continues to learns from your website, from the content, from previous conversations, and is becoming way more smarter again, not because SDRs are not smart because they don’t have the depth of knowledge as you mentioned.
50:51- Eran:
Yeah. so, that’s much more efficient,
50:54- Terry:
interesting. across our customers and we have, some enterprise level customers, we’ve found that it depends very much on the audience as to whether or not there’s a higher level with engagement with an AI SDR versus a real person sitting in the live chat.
51:08- Terry:
And so that’s been very interesting too. I’d imagine with your audience that the very. You know, developer and technical, they would be more happy to chat to an AI person rather than a real person anyway. That would be their own.
51:19- Eran:
You, you would either win or lose them, in a very short, amount of time.
51:22- Eran:
They don’t play games. They know what they are looking for.
51:25- Terry:
Yes.
51:26- Eran:
They either want to see a demo or they want to ask a specific question about a specific thing. and if you can respond to that very quickly, yes, they will move to the next level, if you like. in the buying journey, if you are stalling or if you don’t know the answer, then yes.
51:41- Terry:
Yeah. Yeah. look, I wanted to ask you another question, but I think you’ve already answered it in terms of the, you know, what’s the one campaign or launch that you’ve been most proud of and why? I get the sense it’s the last one.
51:52- Eran:
well, practice brings perfection as we say. and I think, yes, the adjunct thing, in my mind, at least from my personal involvement, was the best.
52:00- Eran:
not just because of, you know, numbers of, you know, people that attended customer engagement, et cetera. It actually built pipeline and, bought us, revenue while we reach ga. You know, it’s unprecedented. Usually, you start selling the product, you know, after the announcement and you build the momentum slowly in our case, we have seen adoption while we’re rolling it out.
52:27- Eran:
Gradually to an early access program for the TIC Summit that we launched for the analyst engagement and, for leadership content that we put out there. summits with specific customers like small cubs, if you like, customer advisory boards. A set and the end result was that yes, we build pipeline for the future, near future, but we also generated revenue from a very fresh new platform that we launched just a few months ago.
52:54- Terry:
Congratulations. That outstanding outcome.
52:57- Eran:
Thank you so much,
52:57- Terry:
You’re very proud of it. what do you think is the biggest myth about AppSec marketing today?
53:03- Eran:
What’s the biggest,I think, the noise. And the complexity, you know, and yes, not everyone is an AppSec, professional. it’s a very, you know, unique area of expertise. And developers are not AppSec professionals or expert. We know that, the myth is that, yeah, AppSec takes a lot of time. It generates a lot of noise and it slows everyone down.
53:28- Eran:
And to be honest, up in, different tools. And also quite a few years ago, that was the reality. so you can say myth and reality, you know, that’s kind of a contradiction, but things kind of drove the myth to become even a reality. What we are seeing right now is that with ai, with agents, you know, you are able, as a developer, you don’t need to be an expert in AppSec.
53:52- Eran:
You don’t need to be a cybersecurity guru or something like that. if it. Properly serving you where you are mentioning earlier the workflows. So if you are able to, use the tools that eliminates the noise for you, suddenly, okay, I’m doing my walk. I’m only getting three alerts, a day. And by the way, they’re getting sold autonomously.
54:16- Eran:
and it can be checkmarx it can be some other vendor. It doesn’t matter. That’s where things are heading with regards to application security. It’s all around agents taking control over the tasks, becoming more sophisticated, helping you remediate, prevent things as they happen in real time. So the developers kind of,are by themselves, hopefully eliminating the myth around AppSec that is too noisy, slowing us down, unreliable, you know, et cetera.
54:45- Eran:
So, I hope that this is changing this old fashioned meat that’s been around for the past. Few decades even. but I think it’s changing ai. We talked about good AI and bad AI, right? I think the good thing about AI within AppSec, it’s, the change within this old, and kind of annoying myth around, AppSec.
55:05- Eran:
So I do hope that this is changing right now.
55:08- Eran:
I think it’s beyond hope. I think you’re actually leading the race there. I think. yeah. it’s there. so what was a mistake that you made early in your product marketing career and what did it teach you?
55:18- Eran:
I think one of the mistakes in my mind was, and I talked earlier about communication, et cetera, right?
55:25- Eran:
Each company is built different, each organization is built different, but at the end of the day. I will take one sentence that one of my previous CEOs, was saying at the sales kickoff, you know, back then we had like 200 or 300 people in the room and he was asking everyone who is, a salesperson in the company, if you can just stand up and you start seeing like five people, 10 people, 20 people, okay.
55:48- Eran:
And he was repeating the question only after he was repeating it for 10 times. Everyone in the room kind of stood up. And then they understand that each and every individual from the developers to the support engineer is supporting the pipeline, supporting the sales of the product. Because the success of the company, the way you sell the product, makes the company successful.
56:11- Eran:
Makes you as in the individual, whether you are the developer or the support engineer or, I dunno, hr, everyone is a salesperson within a company. And once you understand that. It’s a mind shift because it means that’s when a sales rep is asking a question over email, you never disregard them. Okay.
56:30- Eran:
Because you are also a seller. Okay? So if something comes from sales, they need a specific document, they need a specific, answer to a specific question that this customer was asking, okay. Or they don’t know how to compete in a competitive situation against a smaller vendor or a bigger vendor, and you’re not supporting them, that’s a mistake.
56:49- Eran:
So, to make it, short, my answer was understanding how important is, to support your sellers within the organization. It’s not just selling by value, as I mentioned earlier, but being there for each and every ae and thinking about yourself as a seller of your platform. And, once I learned that’s kind of key for your success as a product marketer, it actually changes everything that you do from, a go to market standpoint.
57:15- Eran:
You think about, okay, if I am DAE right now in front of, I don’t know, a Wells Fargo or whatever large, organization, what tools do I have to make sure that I’m selling my product successfully? Do I have the objection handling against my top comparator ready in my back pocket, et cetera? So once you understand that, you know, you’re doing again, your job much, much better.
57:39- Terry:
Excellent. Excellent. And I think that particularly in, organizations where there’s, heavy on the technical side with engineers and so forth, it’s very easy to see sales as more of an annoyance and a pain. And they should know, because there’s not that level of, Tech, deep product technical knowledge, right?
58:00- Terry:
But sales have need a different skill set to be successful in their job. I think it’s easy for that, you know, that more siloed effect to happen. So I think that was, a brilliant, brilliant insight. Thank you.
58:09- Eran:
Of course, by the way, a successful seller knows how to wrap everyone around them, so they are successful as well.
58:16- Eran:
Okay. Because you need to think about yourself as a seller, whether you are, again, HR or product marketer or marketer, but the seller also, if you are a good seller, you need to make sure that you are orchestrating everyone so they support you when and where you need them, to be successful on your own.
58:32- Eran:
and that’s, again, that’s a, key for a good seller. in my mind,
58:36- Terry:
it’s a team play an organization. We had this conversation yesterday, quite frankly, that, you know, there’s often, in my experience, it’s been seen that, you know, the sales team is the most important part of the business because they’re the ones that are bringing the deals in and, you know, feeding everybody well.
58:51- Terry:
The reality is, you know, without HR, they don’t have the people and the compensation plans to deliver without. The product, development team, they don’t have a product to sell, you know, without a cash department. They don’t have people following up to make sure the payments get made to pay their wages.
59:06- Terry:
it’s all such an intricate, you know, intricately linked network of, different functions that actually provide the organization as for success as a whole.
59:16- Eran:
Yeah. That’s a village as we say.
59:18- Terry:
Absolutely. Takes a village. and one last question for me. what’s the best AI tool or stack that you are currently using at Checkmarx?
59:25- Eran:
so when everyone is using, chat GPT, it’s not, I wouldn’t say it’s the best AI tool, but everyone is using that. I think there are two tools that in my mind, have very strong potential within, especially within the marketing department. One of them that we are using that’s, in my mind, a decent one, not perfect, but decent, is called pg.ai
59:47- Eran:
pG from a pipeline generation, ai. And that’s a good tool for sales apps, that they can kind of use to get into specific accounts, specific,individuals within an account, understand some of, you know, the recent news, within the account so they can have the context when they’re reaching out, et cetera.
01:00:04- Eran:
And the other one is, I mentioned earlier this AI SDR of the world, and that’s a tool called Qualified. and, qualified.com or qualified.ai. I don’t remember the website. Yeah. But that’s another tool that, I think, is a decent one. very modern, quite sophisticated, not as old for us.
01:00:21- Eran:
so I can give you too much depth insight, but, it’s a good one, to consider. Yes.
01:00:26- Terry:
Yeah, yeah, yeah. No, I’m very familiar with qualified PGAI. I’ll check out. So we’ll have a look at those. Are there any questions that I should have asked you that I haven’t yet, Eran?
01:00:37- Eran:
No, I think you challenged me to the maximum.
01:00:39- Eran:
and, I really enjoyed that conversation. Terry, very thought provoking questions. had a pleasure, honestly.
01:00:45- Terry:
It’s been wonderful. You’ve certainly given me a lot of insights and challenged my thinking on a few places as well. I appreciate that.
01:00:51- Terry:
So, Eran Kinsbruner thank you very much for joining us on the chat today. It’s been a wonderful conversation.
01:00:57- Eran:
It was my pleasure. Thank you so much for having me, Terry.
2026 © All rights reserved Chat Metrics
Made with ❤ in Melbourne, Australia
