Talking with Ishan Girdhar, CEO of Privva, a vendor risk management company, at ILTACON 2018. 

Kevin O’Keefe: Who am I talking with?

Ishan Girdhar: Hi, my name is Ishan Girdhar, and I’m the founder and CEO of Privva.

Kevin O’Keefe: What does Privva do?

Ishan Girdhar: Privva really helps manage the security assessment process throughout the entire value chain in the legal industry. So, clients are asking law firms a lot of security assessment questionnaires, how they’re protecting that data. So we help them respond to those assessments. And then we also help law firms do security evaluation reviews of all the third party vendors. So all the vendors in this room today, you know, they may touch networks, they may touch data and so we just want to make sure that they have the right measures in place for whether it’s security policies, procedures, architecture, to protect that data.

Kevin O’Keefe: So guys, like you are the cause of why I get contacted by all these major law firms I don’t know on all these privacy and security issues.

Ishan Girdhar: It is, it is and I’m not the problem with that –

Kevin O’Keefe: It is the laws

Ishan Girdhar: – and we’re just trying to make the process easier. It’s the cost of doing business. So we’re trying to actually bring it on the platform so that if you answer one of those questionnaires once and you see the same question over and over again, we can actually duplicate those answers so you’re not starting from scratch every time.

Kevin O’Keefe: And you must create a scoring system, because my CTO said the reason that we’re completing those is that the software is generating some type of story and that it’s allowing us to grade at a certain level. I asked him, I said, “well, how do you know that?” He goes, well, that’s just the way it’s done. He’s this 29 and 30 year old.

Ishan Girdhar: Ultimately, what it’s trying to do is produce a risk score. It’s giving tools to the law firms or the clients to say, all right, where are our biggest risks and vulnerabilities? And so it’s not about just not working with the bottom half. Right? But it’s about putting in a remediation plan to help you get better. You know, they don’t want to stop using vendors for a particular reason, but there’s a responsibility to protect that data.

Kevin O’Keefe: How’d you get into this? I mean, it’s not like you’re just walking down the street and said “okay, I’m going to do this for law firms.”

Ishan Girdhar: So, funny story is that several years back I actually had a healthcare technology company and I was selling software to hospitals and I had to fill these out over and over again and it nearly crippled my business. And so it was a significant challenge and as a startup we were generally not the most secure. So we had a lot of challenges selling to hospitals and kind of went back to my old day job and after that startup moved on, and we just saw more and more of this security assessment process happening and it was all using Microsoft word documents or Excel documents. And we realized – we took a business approach – and we realized this process is not scalable. It’s not efficient for anybody. And so we actually just said, let’s go build a product. We got some seed capital and we hired a team of developers and we were off and running. June of 2016 we started the company, we launched in August of ’16 with our first MVP. And I actually got my first client. I met him two years ago today at ILTACON and we got them on board three weeks later.

Kevin O’Keefe: MVP. Minimal viable product, correct?

Ishan Girdhar: Yeah. So folks understand it doesn’t need to be perfect, it just needs to be viable. And if you ever think it’s perfect, then you’re failing. One of the lessons I’ve always been taught is that, if the developers are ahead of you, then you’re failing as a business. So I always have to be thinking five steps ahead of the developers, because I’m getting client feedback. And so we always got to be iterating and it. And it never will be perfect. And if it is perfect, that’s when somebody wants to acquire you.

Kevin O’Keefe: And it’s tough inside of technology, because your technology people are light years in front of you on the tech and the development thinking but you’re out there with the eyes, you’re gonna keep your head up, you gotta keep your ears open as to what the market is out there. So you got to steer that thing.

Ishan Girdhar: It’s all about listening to your clients, getting feedback, prioritizing that, seeing how it impacts not just the clients that told you about it, but is it something that’s relevant for the entire spectrum or is it something that’s only required for a small select? Because you all have a backlog, but it’s about redefining the backlog based off of your entire universe of clients. It’s about redefining the backlog based off of your entire universe of clients. And I think that’s one of the biggest lessons that I’ve learned was you can’t just be reactionary to your biggest client. You know that whale, we all chase for the whale. But the whale could actually destroy your business because you may be creating something that just isn’t applicable for anybody else. And that’s one of the biggest issues.

Kevin O’Keefe: And at that point you just become an agency.

Ishan Girdhar: Exactly. And then it just kinda goes back to like the Amazon and the Walmart and they just started saying, you know what? Oh, by the way, now we’re going to cut your price. We’re going to cut your price, because they know they own you, the product and the company and now you’re at the mercy of them.

Kevin O’Keefe: Yeah, you’re right. You can produce something if they want to go off and go do this other thing and make you redo it. You got to say, “Hey, I have this solution. This SaaS-based solution.” It covers 90% of everything that people need. We studied it. If you want the next 10 or 15 percent, we’re probably not gonna be able to do that. It’s hard to do.

Ishan Girdhar: It’s an awesome point. It’s something we’re actually going through right now. We have a new product that we’re looking at, and we told the prospective clients, “I can get you 80% of the way there, but you’re going to have to adapt your methodology a little bit to come back to us. You know, we can’t create the perfect solution. We can’t create the perfect solution. You know, everybody’s got their own flavor and methodology. So we really think about how risk is contextual – everybody defines risk a little bit differently, so I can’t create one model, but I can create a framework and allow them to sort of drag and drop. We’re trying to modularize that and let them bring their own touch.

Kevin O’Keefe: When you transitioned from your other job, how did you support yourself in this gap period? And it can be a gap period for a long time.

Ishan Girdhar: Yeah, it’s interesting. You know, I’m very fortunate and I have some really great partners, some very successful people who have supported me both strategically and financially.

Kevin O’Keefe: How did you find them? Actually, one of them is an old friend, childhood friend who’s a very successful entrepreneur and his business partner. And we’ve tried many different things. And we’ve worked on different projects together and you know, they went on to greater things and they said, hey, let’s, let’s really try to put our resources behind this idea. And we’ve raised a series of seed rounds from these partners as well as professional investors, entrepreneurs, and vc funds. So that’s really been funding the business.

Kevin O’Keefe: So it sounds like a lot of relationships.

Ishan Girdhar: It’s all relationships, it’s all relationships.

Kevin O’Keefe: I’m not sure that young entrepreneurs, when they start and they gotta develop the perfect technology and they gotta get this technology, they put descriptions around, that somehow it’s going to sell. No, it takes knowing people, asking to be introduced, just spending time with people.

Ishan Girdhar: Yeah. And I think one of the lessons that I’ve learned is you’ve got to be able to sell the product before you have the product. So, you know, I always say I was doing sales pitches upriver from the conference room of my old job and I had a couple of leads that really were starting to materialize purely off of a presentation that we made and mockups that we made in Word Art and that’s when I decided to take the leap. Those early adopters are buying you. They’re buying the belief that you’re going to build a successful product, and that’s how this actually really started.

Kevin O’Keefe: Belief is so true, because I tell the team, I say, well wait a second, it doesn’t have to be perfect. I didn’t have a color printer and I didn’t have a letterhead, so I had to put the seven elements of what I provided on a fake logo, and they put it on an overhead projector at a major law firm. And I was kind of laughing, but it led to another meeting and they decided to proceed with a huge firm. But I didn’t have it yet. I did not have it.

Ishan Girdhar: And if you are being truly innovative, the perfect model doesn’t exist and so they don’t even know what perfect is and that’s important.

Kevin O’Keefe: Were there low points along the way where you went, “is this going to make it?”

I mean as good and bad as it sounds, I always say, you know, we’re a day away from success and we’re a day away from failure, you know, and there definitely were some low points. There’s a sale cycle process with every company and so, you know, that period from February to June, which is post-budget, everybody came through, December, January were great, and then February hit and people just stopped taking our phone calls and for five, six months we just didn’t make any progress. You really start to question yourself. I mean, there’s going to be slow periods. You just gotta stay positive, you got to stay with it and believe in yourself, believe in the product and when you have those low points, just make sure you go back and service those clients that you have, because renewals are the most important thing. And so that’s what we really focused on was refining when we realized that there was not a sale going to happen.

Kevin O’Keefe: What was the one point where you said “this is going to work.”

Ishan Girdhar: I still haven’t had that day.

Kevin O’Keefe: If someone asked me that, I’d be saying that too, but I do remember when a couple of checks came in from some large companies, and I thought, “maybe this is going to fly.”

Ishan Girdhar: I can’t say that there’s a day that we sort of had that. We sort of say like, hey, when we go win a big client, we sort of don’t even take that step of congratulating. Our mindset is, all right, well how do we double down with that? If we go get a big client, that means there’s two more that should be reference clients out of that. So we’re starting to get traction. We’re getting into the corporate world. So the legal industry has been a great stepping stone for us. I mean these are some of the most critical vendors that the corporates have and now we’re starting to get into the large Fortune 100, Fortune 500. We’re being asked to participate in RFPS, and that’s really what has me, has the team, really excited and I think we’re, I think we’re, poised to –

Kevin O’Keefe: So how many people do you have right now?

Ishan Girdhar: We have about 10 people right now.

Kevin O’Keefe: Which, you do a lot of stuff. If you think about it, with ten people you cover a lot of ground. What would you tell an entrepreneur just thinking about starting today? Biggest lesson.

Ishan Girdhar: Biggest lesson is if you’re thinking about an idea, come up with a plan, stick with it. Don’t pivot too quickly. You know, there’s going to be a period when you’re going to go through some adoption, you know, lessons learned, road, bumps. You’ve got to persevere, and really challenge yourself. And the one thing I will definitely say: it’s not luck. It’s hard work. It’s hard. It is really, really hard work. And, it’s all about what you put into it.

Kevin O’Keefe: Thank you very much, that was great.