From Google to Cerbos: Emre Baran's Path to DevOps Innovation

Jake Aaron Villarreal: Welcome to our podcast, From the Ground Up, where we interview startup founders exploring their journeys, their success, challenges, and lessons learned. We hope you'll be inspired in discovering what it takes to build a thriving startup. I'm your host, Jake Aaron Villarreal, and excited to have with us today Emre Baran, founder of Cerbos, who's raised $11 million in funding. Emre, welcome to the show.

Emre Baran: Thank you for having me.

Jake Aaron Villarreal: So, a little bit about Emre. Uh he uh launched Cerbos in 2021 with a mission to make roles and permissions simple to implement and manage so developers can focus on building their core products. Before Cerbos, he co-founded Turkey's largest social network at the time, worked for Google where he built products that generated over a billion dollars in revenue, and is a serial entrepreneur.

Emre, there's a lot here in your background and you're maybe more unique than other uh guests we have on the show because you've got a background of companies that you've launched have had a lot of success, worked for Google which a lot of people haven't, and so there's a lot uh just curiosity about what those experiences were like. But before we really dive in here, walk us through a little bit about you. Where you're from, where you're at and how did you get into technology?

Emre Baran: Sure. Um I, I grew up in Turkey and then went to school, uh went to university in the States. And like every other you know um, not every other but most undergrads I was an undecided major. And by the time I had to declare a major I had enough economics, less economics classes under my belt. And I did two internships at um investment banks and then eventually I decided that banking wasn't for me. And I even found myself doing more coding and building macros while I was doing my banking job that I decided to go back to school and also to major in computer science. Since then uh I've worked in all those companies. And and ultimately I fell in love with technology because um it's all about you know using machines to do repetitive or even things that humans can't do. So that's how my journey started, that's how um I got sucked into technology.

Jake Aaron Villarreal: That's great. You know when you talk about social networks to us today, it's a very normal conversation to think you're part of a social network, you've been on one, your friends are there. But in the early days when they didn't exist, what inspired you to even think about trying to create a social network and how did it come about?

Emre Baran: So uh, let's be honest. I mean, we didn't invent social networks. And back then there was um, this was around circa 2002, 2003 when um you know digital cameras were coming up, people were putting their photos on, everybody was getting an email address, etc. And back then there was like a couple of you know, social networks slowly emerging in the US, namely Friendster and Myspace. And my brother and I looked at this and my brother... I mean all credit to him. He, he, he can spot a lot of things that will have exponential growth from a mile away. And he said, "This is going to be huge and these are all very US-centric, a lot of US people. Let's go build uh the social network for Europe." Uh you know, we grew up in Turkey, we had a lot of friends there, we grew up traveling all around Europe as well. I'm like "Let's go build one."

And so ultimately we built a social network and we launched it with three of our, 300 of our high school friends. And that was a Christmas, I remember so distinctly, Christmas 2003, and 2002 to 2003. And we launched it with 300 of our friends and suddenly by the end of February we had 20,000 users. By the end of the year we had half a million. And in about two, three years we had 7, 8 million users. It was one of those things that you know, being at the right time, at the right place at, at the right time, and not just being lucky but also identifying an opportunity and embarking.

And actually building it from a technology perspective, it was also very challenging. This, these were the times back in 2003, there [was] very limited open source. I mean we built Yonja with MySQL, Tomcat and Apache and a lot of duct tape. And there were no, you know, AWS or Google Cl- Cloud providers. We had to actually order servers every week into a data center and hook them up. And even our you know, it's like it's a fun story, our very first server was a server that we bought that was living in my brother's living room under the table. And as we started running out of bandwidth and everything else, like "We need a bunch more bandwidth than this because it's, it's slow." And we took that server, desktop server to a data center, literally turned it sideways, put it on a rack, and hook it, hooked it up to like a high bandwidth connection. That was our you know, very beginning of that journey. But it was about you know, seeing that potential of how we can connect people, how we can you know get people to be more online and be, you know, present themselves online and share more of their experiences with their friends.

Jake Aaron Villarreal: Yeah, it's you know, so prevalent today, but back then even to be thinking about how you could put that together... was your brother also an engineer?

Emre Baran: He, he studied industrial engineering. He thinks he'd, he can code, but God bless him he can't. I, he can build very basic things, but uh it was, you know, mostly it was me and a couple other engineers who actually initially built it. And then a lot of our challenges was around actually scaling that. And you know, this thing became the most trafficked thing in Turkey and you know, only uh right next to it was like Yahoo Mail at the time and a little bit of eBay and like that one major news site. So there was a lot of lessons learned on how to scale open source, how to scale all these things. And you know we were doing MySQL replication before MySQL replication was a thing. Uh we were doing load balancing, software-based load balancing before that was a thing, and like experimenting with a lot of software.

So, you know, [I] had an engineering background. My brother had a vision, but a lot of the things was he was much more focused on the product management and the CEO job, where you know, we had to also generate revenue for this thing. And back then nobody was pay-, it's still, nobody pays for [a] social network, right? The ads and various other things pay for it. And our audience being mostly in Turkey, we had to actually manage a business in Turkey for all the advertising, etc. revenue from US. And you know, we had our initial, he was instrumental in building that initial team, the sales team and the customer service team. And then you know I took on a lot of the engineering job, engineering challenges.

Jake Aaron Villarreal: When you try and scale a company, you have to go somewhere to learn how to scale. You got to get involved in other people that know how to scale. What was your path to learning how to scale a product or a company?

Emre Baran: So it was... so as you said, there are two different distinct things here: uh scaling a company and scaling a product. So in terms of scaling a company, you know, Yonja at least back then isn't, wasn't that big of a company right. Two, three of us started it, and at peak we were about 20 people and by the time we got acquired maybe 25 people, mostly on customer service. And so there wasn't that much of a challenge there. The bigger challenge actually of um, of Yonja was around scaling the product. It's you know there, you know practically [a] website built on very simple you know um Apache Tomcat and JSP templates. How do you actually handle 8, 10, 12,000 people concurrently being online? So there was a lot of good Googling, a lot of learning, a lot of talking to other you know, back then there were a couple of forums that had similar levels of traffic and pretty much Yahoo and e-, and Yahoo and eBay. There weren't, you know, there weren't that many frameworks, there weren't that many things. So a lot of it was trial and error and trying, you know, building systems that will potentially scale.

So then my journey was ultimately a lot of that scaling was learned at Google. So I you know, I hit a fork in my career where um you know while I was doing Yonja I'd also applied to a business school. And I got into business school, but I had to defer that because the company was grow- growing very fast. And then eventually I had to go to business school, and luckily that was like a one-year very intensive business school called INSEAD, based out of France and Singapore. And I spent a lot of my days, during the day, during the week going uh um you know going to school, and in the evenings actually working. And at the end, end of the business school, the, the goal was for me to go back right, there was like, we had a fast growing business.

But in the meantime, Google came uh to the campus, and that was like one of the very few jobs that I actually, I was excited. I was like "Oh that, that can be an interesting company." Like I didn't want to do you know consulting or business, uh investment banking and various other things. So I'd actually applied to Google and, and then I got recruited into Google. So I, I came to, I came to this fork of where you know I could go back to my own company and keep growing that, or go to Google and learn real scaling. Because Google was you know, back by then, this is 2005, 2006, a global powerhouse. And they had you know huge traffic, they had... you know 90, 90 to 100% of search, search traffic in a lot of companies. And my brother and I, we decided that it would be best for me to go to Google and learn real scaling in terms of a product. And you know spend a year or two there, and then come back and apply a lot of those learnings. So about a year into my, my journey at Google, Yonja got acquired. So then I actually continued at Google and where I actually really learned what it takes to a you know scale a product technology wise, which we, I actually applied a lot of them in my next company.

But also learned about how to operate a very large scale organization. And to this day credit Google, I don't know, back then when I left Google it was about 15, 20,000 employees. But it was light years ahead of any other company of that size. So a lot of my learnings uh from Google, we applied it at Qubit, where we actual... actual learning of my "how to scale a company" happened. Because you know we were three of my colleagues from Google and I, I actually moved to London at that stage um, started Qubit. Um I was the only technical co-founder. I built the product and engineering team. And at the, the you know that company grew from four people to at peak about 320. And that learning journey was full of mistakes, and that's I think how you learn how to scale a company. You have to you know fa- fall into a lot of those traps and make a lot of mistakes and learn by that. And luckily towards the, you know mid to late in my, my journey a lot of podcasts started becoming also very popular. And nowadays a lot of my learning is you know listening to a lot of other people's journeys. And thanks to podcasts like you and other ones we get, we get exposed to those things. Because back in the day it was all about you were lucky if somebody actually wrote a book and published about it.

Jake Aaron Villarreal: Yeah, you know, you mentioned a couple things I just want to go back to, um, and we'll come back to your Qubit company. But with um your social network, you mentioned you got acquired. How did that happen? Because I think the dream for a lot of startup founders is you build a product, you find the market, you get funded, you scale it and then you get acquired and you retire. Like, and your first company that you started got acquired, I think it's amazing whether the numbers were big or not does it really matter. Just the fact there was enough value that someone would want it, that's incredible. And maybe the numbers were huge. But walk us through how that happened.

Emre Baran: So I think the key thing there was we were actually the market... number one market leader in Turkey. There were, at the time there were many other um social networks that actually started, but we were the ones that actually grew fastest and were, had the market share. So that helps a lot, because at the end of the day, social networks, that is... social network is a B2C product. And a lot of people actually, a lot of you know popularity drives a lot of B2C, B2C products. And as long as you have a decent product that people like to use and you're not, you haven't taken many ro- wrong steps, you know people draw other people in and that's the nature of social networks. People want to be where other people are. People want to find their old friends. People want to hang out with new friends. People want to see a lot of stories shared. So number one the product on its own was a great magnet to actually draw everybody.

Second one is um, it was a great business because it wasn't only an ads business and we also actually generated revenue from PR- you know, Prime Membership. And one of the, the story behind that is, you know, at early days we built Yonja uh, we had very little angel investment from one investor. But that gave us the confidence to go forward. And at some point with all this computing cost and services, servers etc., we had to find some sort of a funding right? Because it had to pay for itself every day. We were spending, we weren't paying ourselves any salary or like minimal salary for insurance and various other things, but there was a lot of server cost. Every week we ordered like four, five, six, 10 new servers so that we could actually handle the traffic, handle, handle pictures and everything else.

So there were two options. Number one is the good old method of advertising right? Talking to publishers. At the end of the day it's a, it's a you know huge audience, a lot of eyeballs and a lot of you know great eyeballs for, by advertising standards: like a lot of young people, you know young professionals who are in the beginning, they were you know prime candidates for a lot of CPG companies etc. So we actually started putting ads and monetizing the traffic through that.

The other thing that we did that none of the social networks nowadays do, maybe you know Elon Musk is trying to do this a little bit with his Twitter check marks, was we actually took a look at our traffic, we took a look at what people do when they come to Yonja. And what we actually suddenly discovered [was] that a lot of our traffic was about, I think 48% or so, was actually people browsing pictures and then right after that people actually messaging. And uh look, and what actually resulted from a lot of these things are people actually dating. Because a, so as a social network, one of the key things that you can actually see whenever you're talking to somebody new [is] how you're connected. Like how do you know that person? Are you connected to that person? Are you first degree connection, second degree or third degree? Which it turns out is a great validation if, when people want actually [to] date somebody. They don't want to date a complete stranger. They want to actually date somebody that's somewhat known to them etc.

Anyway, by looking at all those traffic trends, we actually decided to draw a line between what is social networking and what's dating. And back then there are a lot of you know there, there were the eHarmonys and various other companies that were actually great, they were making a lot of revenue from that. So by drawing that line, we actually said, "okay, here's a fine line. If you want to send..." I believe it was 15 messages or 10 messages. "If you want to send more than 10 messages a day to different people, that's, you know, now you're actually going out of social networking per day into uh you know dating. If you're browsing more than 100 pictures a day, again you're, you're leaving the realm of social networking into dating." And then I don't remember now, it's been 20 years almost, but there were a couple other um you know boundaries that we found. And I, we said "If you want to do any of these things now you're got to become a..." we used to call it the Golden Member. And the Golden Membership was about three to four dollars a month. And through that we also generated a lot of revenue. So, and so at the end of the day, the path to acquisition was we had a viable business that was generating not only revenue but profit, we had a business that had a lot of eyeballs and a lot of people spending time on it. On average I believe per day there was like 48 minutes or 52 minutes, something like that spent on our social network.

And the realization moment for me was one day you know, when I walked into a florist to get I think my grandmother some flowers. And in the background the guy who's working there was on the computer. He said, "hold on a second." He did something and then came. And then I I I immediately recognized our interface. I'm like "Oh my God, the florist is on it!" right? So all of these things are lined up. And at the end of the day, our acquisition of Yonja was by the largest Turkish ISP and their private equity investors. So they, there ultimately it was a bit of a consolidation game for them in terms of the total um you know internet monitors of traffic in Turkey.

Jake Aaron Villarreal: Wow, I love that story and I know that a lot of people don't know behind the scenes how things go down. So to hear it, it sounds like you understood the analytics, you looked at the patterns, you understood there's an opportunity and you had the right people around you to to want to take it on or acquire it. Let's switch gears to Qubit, the company that you raised $75 million, you scaled it to 300 and downsized it. Um this is happening in today's market prevalently from like big companies that we know about to smaller companies. And the lessons that are learned I'm sure [are] very instrumental in just how it shapes you as a leader, but also what you can take from that to your next company or companies in the future. Walk us through what were some of the biggest lessons in that downsize that you went through that you recall as being really incredibly important today.

Emre Baran: So I, I would say I mean my, the Qubit story is pretty much the story of my 30s to early 40s. And there's a lot of me, my, my personal development actually that was aligned to that company as well, right? So we, four of us starting in a room a company and then actually growing and discovering a lot of things along the way. And we were lucky enough though to again, uh, we identify the trend. So first of all, before we actually started the company, and that was the big data revolution back in 2010 had became open source and a, a lot of data that wasn't, that was a- kind of available but not process[ed] or used. And that's one thing that we identified coming out of Google. You know, the, the, the hot bed of data and data, data-driven decisions that we tried to make it available to all these companies.

And of course because of that Qubit grew very fast, very quickly right. So there was four of us in 2010 and about 2016 by the time we raised our last Series C 40 million, we after that we actually reached about 300, 320 people. And the lesson learned there was that we actually grew too quick, too fast before we actually realize our product-market fit. And it turns out you can have a product-market fit in one market, and you may completely not have another product-market fit in another market. So it turns out that you know, we actually operated in the UK. Mostly in the UK market, Qubit was a market lead there. When you walk in Main Street, which is the High Street in, in UK, 90% of the brands that you see on, on the UK Main High Street were, are customers, their e-commerce businesses were, are customers. We understood really well how those e-commerce businesses operate and, and it worked. Because in the UK back then there was a good mix of what companies looked for, which is a good mix of professional services and technology right. A lot of companies not only buy technology from you, they want actually your professional services, your advice and various other things.

However, when we actually looked uh, when we tried to expand in the US markets, you know, we slowly started losing our product-market fit. Because a lot of companies were looking for self-service, and they didn't want professional services. And throughout our journey, a lot of the times when we were lacking something in product, we always tried to make it up with professional services. And nobody minded that in the UK. But in the US, suddenly you're starting to lose uh trust between your, between the company and the customer and they actually start questioning it, which eventually turns, leads into a churn. So, and we thought we had the product-market fit in the US and we scaled US up very fast, which in turn ate a lot of our funding. And suddenly it, you know, we started spending way more in customer acquisition cost than we would get in a lifetime value for, from a customer. Which you know it's a great, it's a great way of learning why, why investors care about that ratio. And um eventually that led to us, you know, growing the company, having all the operations, all the sales and everything else ready and, to you know, to pour a little bit of fuel on the, on the fire. Our average customer acquisition time was between six months to nine months, right? Or sometimes up to a year. So that means you need to actually make that much of an investment before you can see a dime from a customer. And now imagine you're doing all of this with a huge sales team, sales and marketing and operations team on the ground. And suddenly all of those customers that you're spending more than one year of revenue to acquire, they're not renewing their contracts. And suddenly you find yourself in the hole. And that was the journey, right? So that, and that led a cascade across the company.

And there, there was a bit of a failure of our product management. There was a little bit of failure of our sales and marketing in terms of strategy trying, not understanding, not seeing the signals up right and trying to compensate that with, you know, throwing more you know bodies at a problem. Whereas you know, we should have actually taken the earlier step to stop all of that, fix the product and get there. And throughout that you know downsize, once you actually hire all these people and then you realize the writing is on the wall, you know the goal is to save the company, survive so that we can actually live another day to fight. And that led to of course some hard decisions to you know, start, start shutting offices down, start downsizing and various, various other things.

And from my perspective, when I was actually running the engineering team and running the product team etc., the biggest learning was around, as a company is growing and scaling, we're adding more bodies. And every time you add a new body it's actually, actually you're hiring... you know, when you start the startup you hire a lot of generalists because you got to cover so many different areas. And then as you actually grow now you, you, you don't need as many generalists. You need to start getting specialists for every single area. However, the biggest challenge is as the tide starts turning... so now you're, you're, you have a lot of specialists in the company and you're downsizing, but you know ultimately you're maintaining some people in the company... but those specialists now need to become generalists again because they can't just do one job or they can't just focus on one area. We need to be able to go back to that startup mindset where everybody needs to do everything. So that has been a great learning around you know, and a challenge when, when it comes to downsizing.

Jake Aaron Villarreal: Yeah, that's, I, I love how you explain that. I went through a similar scenario where we had a company and we took a product and brought it to market and we invested way more in the people than actually the revenue coming in and we, we were upside down for a long time until we had to start making those hard decisions. It's not just a business decision, it's an emotional one too because they're real people that you've built relationships with and you have to say "you've done a great job, unfortunately it's not working out right now." And so I think you get battle-tested emotionally as well, not just absolutely educated. You know, there's like you know, business is 80% psychological. So if you're in tune with how that works you can weather the ups and downs. But there's an emotional aspect to it I think that I, no founders and everyone goes through and they understand it, but you don't always understand it until you have those hard decisions to make. So I...

Emre Baran: I'll give you a tip on how I coped about that, uh coped with that. So first of all, you're absolutely right. When you, when you have to go through that it's a business decision. And for some people whose first job or the only job they've known or a job that they've you know they've grown up with is this, it's very hard to separate that emotional connection from a business connection and actually to be leaving a company however. Um so it's, and there have been people that we had to let go and it's been, it's always hard, right? It's, it's because each one of those people also, each one of those employees also have friends that are staying. So there's still a connection to those people. It's not like you're never going to see them again.

Um the way that I, one way that I coped with, and I actually mentioned this to some, it's a bit controversial. But I always thought about it this way: unfortunately you know it's when, when it's a business decision, you have to, you have to make it happen. But when we think about the, that business decision you know when somebody actually as a manager, you know I employed probably more than 300 people within my team over, over the t- period of you know 10 years. And you know some people came, some people quit, some people were let go, various other things. But at the end of the day I was always at the receiving end of somebody, you know, I, I always knew when somebody on a Monday morning at 8:00 a.m. put a meeting for the, for in the afternoon, it's like you know what's going to happen. They're gonna come and leave, right? And in the, in the US it's employment at will. In the UK usually people have a one-month notice, so they actually tell you that they're about to leave. So the way that I coped with it is like, "hey, like when we actually let people go, now the, the, the entire equation is reversed right. I, we didn't let 'em go right away on that day, we're actually giving them one, their one month notice." So at the end of the day it's a bit of a you know karma in a sense that it's a balance, right? And just like you can leave, I can let you go as well. But it's all on the same terms, right? We each, we give each other a month of notice. We, that's, that's enough time to get each other ready for it. You know, probably this happened to me way many more times than the number of people actually we had to let go. So you know, once I was able to logically think about that I came to like better terms uh with it. But um hopefully that might actually be helpful to all those listeners who actually have to go through a similar, similar journey.

Jake Aaron Villarreal: Yeah, I, I'm sure it's going to have uh an impact on, on some people for sure. What was the outcome of the company once you downsized and got into survival mode and then rein- what was the exit?

Emre Baran: Uh it, it, it eventually got acquired. So we actually went through these trials and tribulations I believe twice, but at the end of the day it was acquired by a an e-commerce personalization, e-commerce search and merchandising company. Because it was actually a good complement for their business.

Jake Aaron Villarreal: I, I've went through a similar scenario like that and it's always good to know that it, you had enough value built in where it ends up in good hands and you know you get something out of it too. Maybe the lessons are the, the most important part you got out of it, but you know you see it through and you kind of grow from it.

Emre Baran: I think the most important lesson there is again, it's the company survival right? It's the technology that you built, as long as the technology you built or the product you built has value as a business, there's always somewhere it can actually um plug into. Um the you know the, the, and again from a personal perspective as a founder etc., the success story is always different right? So there are some, we always hear about the billion dollar exits or you know, and those make the news, but not many of those just regular exits where a company gets acquired by somebody else so that it can survive and actually its technology survives, its teams actually continue building, it doesn't make the headlines that long, that much.

Jake Aaron Villarreal: Yeah, I hear you. Let's dive in now to Cerbos, your current company. And I'm going to just read through a little bit of content here and you can correct me if it's off. But we really read about you in TechCrunch and we read the article was bringing your product to the cloud and, and kind of the, the content reads as "Cerbos exists in a space broadly known as Identity and Access Management, IAM, a $13.4 billion market that's expected to double in the next five years. Your product at its core is about decoupling authorization process from an application's main code base, making it easier to scale their access management system. This is particularly important as companies transition from monolithic software to microservices." Correct me if that's accurate or if it's not, and if it's not accurate let me hear you, and if it is let's dive into what inspired you to build it.

Emre Baran: It is accurate. And if I may summarize it in one word, in, in one sentence: Cerbos ultimately makes implementation of roles and permissions very easy. It enables so that developers don't have to build all of that logic into their code, scale, and make it extensible. And what led us to build this company was that we had to actually go and build authorization layers multiple times in our careers as co- as a founding team. And every time we had to build it we had to spend you know, a month here, two months there, three months there with an engineering team of three to four people so that our product can have roles and permissions built in it.

And when you think about that, it's a bit of, it's a bit crazy because a lot of times when you're building software a lot of the infrastructure that you need nowadays is available off the shelf right. A lot of people, nobody you know, go- going back to the Yonja days, we had to actually get servers physically, hook them up, put you know, put operating systems and get it all going. And nowadays nobody does that. Nowadays you actually just you know go on Amazon one click or go to Google Cloud one click, you have servers available to you. And we, so similar thing is actually now when you look at the software stack that you're building, there are frameworks that are readily available so you don't have to actually think about how to handle your HTTP calls, your APIs. Or there are authentication providers available so you don't have to do your own username password storage and lookups and all the security bells and whistles around it. There are services that do all of your you know email sending, your payment processing, your SMS sending, your um various other infrastructure pieces that you give it for, you take it for granted that you build on your software on top of.

However, authorization is still not available off the shelf at the, the same quality as all these other services are. And but that h-, when that happens, you you know, good engineering teams actually need to build something in there that will actually stand the test of time as their companies grow. And we, to build, I, I had to build that in at Yonja so that you know that, you can think of Yonja as a customer um as a social network. But it had a whole another department in the back office which is around customer service right, handling spam, abuse. We had those Gold Membership that you had to actually handle payments. And suddenly you have an office, bunch of people in different roles that you need to control who can do what: who can restore an account, who can refund the payment, who can you know change an account status or look into, investigate a, a report. So we had to build roles and permissions there.

Similarly at Qubit, very similar story where you know when we started our product we actually just built a very quick and dirty authorization layer where you know everybody was either a super user or a read-only user or you had no access. Suddenly now we were doing actually professional services on behalf of our customers. So then our customer, customer service team had to actually assume some of these roles. And then suddenly we started getting customers with you know thousand users or hundreds of users within their organization that need to be able to do these things, but they don't want everybody to have same rights. So there's governance that plays into, plays into this. So we had to actually go and build that authorization layer two, three different times based on all of our customers' requirements. So, and every time you build that, it means the engineering team that's building that infrastructure, that layer, is not focusing on a real customer requirement. In order to make your software better, you're actually going back and building infrastructure.

And we saw that uh in the market ultimately you know, authorization... and in the IAM space, authentication is handled right. In the IAM space directories are handled. Since 1980s there's LDAP which was decoupled, it started with. Now there's Microsoft Azure Directory, Cognito and various other directory services. And the security space and IAM there's logs, log management and all the action logs etc. is handled. But there's still not a single solution that's actually reliably handling authorization. And we ultimately set our course on solving that challenge.

Jake Aaron Villarreal: So if you're a software company or an engineer that's building a platform and you want to embed your solution into their product, how long does it take to do that?

Emre Baran: It's a um, so always with software development is like "how long is a piece of string?" But uh that being said, it's ultimately you know, for a very b- you know, people um, normal RBAC which is Role-Based Access Control, or ABAC, it takes you know five to 10 minutes to be able to implement this. And then you get, in return you get an API that you can actually connect to from anywhere on your stack where you can actually check the permissions of whether a user is able to do an action on a resource or not. So a, I would say you know, five to 10 minutes to get started, you get to have your very basic implementation. And depending on how complex it gets down the road, you can actually you know, it may take a bit longer.

Jake Aaron Villarreal: Sounds like the real benefit is not just having that as part of their platform without having to build that in their infrastructure, but also time. Like it saves them a ton of time having to build this, which is money and also maybe you lose out on market share if you're trying to get to market with your own product. So, so that to me sounds like an incredible solution um for anybody that's building technology or software. Um when you went to get funding for your company, what was that like? And we ask this question because for founders that haven't raised capital yet, it's a double-edged sword. You go out and raise the money, you give up part of your company to do it and the pressure is on to build, get to market and hopefully have a success before the money runs out. So there's pressure from the found-, from the investors to actually do something, execute and grow. But when you went out and got funding for this, what was the process like? How many times did you have to pitch before you got the funding? And then how much pressure is on you now from your investors to actually make this work?

Emre Baran: So when, so we were slightly lucky because we actually went to market around March 2021 which was COVID times, which was a lot of VCs were taking a lot of calls. But I also capitalized on that. So when, so before let's, let's go, let's go get the story straight. Before we actually went on funding we built a product, we built a prototype, we had you know, we had probably about 100, 120 interviews with potential customers in different companies. You know, "here's the idea we have, we're thinking about this. Like what are your needs, how do you, how would you implement this?" and various other things. So the product that prototype that we've built was built on top of our experience with the, having to deal with this, and potential customers and what they're looking for.

At that point we had a prototype that uh you know, pot- customers and investors can actually take a look at, and we had a you know a demo that we can actually show. And after the demo it wasn't smoking mirrors, we could actually leave the product behind because it was kind of open source that they can actually play with. So on the back of that, um prior to going out and doing a proper funding round, I actually uh did a couple of calls with friends who now happen to be VCs. And I was only soliciting feedback around "hey what do you think about this product? What are the you know, what do you think, this has a shot? Where, where do you think this fits best?" And suddenly I started getting interest from those friends right, friends who are VCs are saying "hey this is interesting, this plays in this space, this plays in this security space, space which is a true horizontal when it comes in software."

And suddenly as I started seeing the interest there, I suddenly realized "hey, this is actually a very big opportunity," which you know initially in my mind I'm like "okay it's a good business, it's a good layer of software that a lot of people think." But you know going back to as you quantified this IAM space, I wasn't fully aware of the market size there. Once uh you know I became aware of that, then I gra- grasped the whole, all you know um uh the, the, the potential there. And then me and my co-founder decided to actually, number one, form a company, because now this is going to get real. "Is this something we want to do long term?" And yes, we, the answer was yes. And the second thing was "now, this is where COVID kind of helped us and accelerated, I was willing to talk to any VC who wanted to talk to me." And I ended up talking to 89 different VCs and I still have, have that uh sheet here. And again this was our luck at the COVID times. A lot of VCs were doing a lot of calls and a lot of these calls were actually on video conference right. So, and my you know, I opened up my cal- calendar from 7 a.m. to 11:00 p.m., so that covered pretty much all of Europe, Eastern, you, Asia and all of the US. And yeah, I spoke to 89 different VCs. Some were interested, some were not, some were not. But as you know I tried to narrow down the process and started putting time pressure etc. And so there were both VCs and angels or like large check angels.

I had 19 term sheets at the end of the day, so... which became a problem right. It's a great problem to have, don't get me wrong right, but it's a problem because now 19 people are saying yes to you and you need to choose the right ones. Like how do we actually, you know there's no way we, you can have 19 investors on, on your cap table. Because also when it comes to VCs they want to put a significant amount of cash because they need to justify the returns and the process. So you know, just to you know, answer your question going back is like, the pressure was on me to number one, to pick the right set that would actually understand this business so that later on uh you know I can have a healthy relationship with them where you know, when they put a pressure on me we're actually all on the same page. So that's when a lot of you know, again analytics kicked in. Looking at all these investors like "what are they good at? Which ones of, which one of them actually understands a SaaS business? Which one understands an open source business? Which one understands a developer tool?" Because every single one of these have different dimensions that impact your business model and you know what you don't want is the wrong VC trying to push you for growth or for different you know... pressure you for different, different angles that are not right for our business time.

So at the end of the day we you know chose you know what some classified as a "party round," but the way that I looked at this is it takes a village to start a company and I wanted to have the best support village around me in order to get this company going. So you know, chose a VC who understands developer tools as our lead investor, chose a VC who's very good at SaaS businesses, chose a VC that has a lot of... two VCs actually that have a very large portfolios of startups which are, are potential customers for us, potential initial customers. A VC that understands open source software and open source licensing. A VC that you know, that's geographically great uh, that you know it's connected to a lot of our next stage investors. Um, somebody that um, what else? I'm sorry, like there's so many VCs, but at the end of the day those were the dimensions. And when I looked at all the terms I'm like "okay here are the ones that we're going to go with." And suddenly you know when you look at it there [were a] couple of very well knowns that are actually sitting in one category and unfortunately you have to say no to some of them. And you know I had uh you know broke some hearts and I was actually feeling really bad about it as well because I'm like "it would have been amazing to work with them but I can't have two of them, two, two of the VCs with the same, same value proposition sitting on the cap table."

Jake Aaron Villarreal: I never knew that you actually can, you, you should turn away investors that um you know that could potentially help you grow a business. I guess if you have enough investors to choose from then you have a good problem to, to have.

Emre Baran: It was a great COVID problem. I mean just to reflect back to my Yonja fundraising and Qubit fundraising uh rounds that we've done. I mean we just you know, in my career we just finished uh last, when was it, last March we just closed... I just did my 10th round with, with investors right? And it is you know, up till that round it was only one term sheet, and maybe when we had two term sheets I'm like "oh we have a competitive situation here." Whereas with Cerbos, when we did our first seed, you know, suddenly it's, it's very weird to say this, but suddenly money became... money wasn't an object anymore. It was like money was commoditized because everybody was you know giving terms, very favorable terms. And we didn't actually go and take the, in, the highest terms either, because at the end of the day you need to think about this as like "what, what happens in the next round? How much do you need to grow to cover that?" And there's a you know, fallout if you...

Jake Aaron Villarreal: Yeah, the patterns that we're seeing are very similar to what you go through, which is when you get investors to, to give you money for whatever startup you have, what's the trade-off, what do they give you as well? You know, do they have a big network they can introduce your product to? Do they have connections to a strategic industry that you don't? So I think it's important to also look at what do they bring aside from the money, because the money's there, but what can they do to help you build or scale a company?

I want to go back to one thing you talked about before you even brought the product to the table to get funding, which was you had roughly 100 or 120 meetings or conversations with companies or people that might be interested in your product. You left it behind, they tried it. You know, as a company that's just starting out, you know, I'm sure a lot of founders wish they had a network that they could have 120 meetings with or presentations or demos or sales pitches. How do you even start to get that volume of companies you're going to present a new idea or product to?

Emre Baran: I mean, it always starts with people you know right? Because those are the warmest introductions. Those are the people who are willing to take a, 10 minutes from their job and listen to your pitch and evaluate. But of course not all of them were people actually we knew. But you know when, when you start thinking about that, this, it's, it's almost going back to my social networking background, right? There's a first round, a circle around you, and then the people that people know, and then the people that people know. So the classic thing was after talking to my contacts I'm like "who else do you know who might be interested in this? Who else have you worked with?" So start tapping into their network. And similarly, which I think worked in our favor really well, as I was talking to investors, one of the things that I was always... the VC, one of the things that I was, I was always testing is like "hey, who in your portfolio can we talk to?" Which served us in two ways. Number one, we got an introduction to a brand new company that we can get actually feedback from. Number two, we always knew that feedback would make it back to the VC, which kind of you know strengthened our case. So it, it was a lot of networking that in that sense. But always you know, keeping connec-, keeping to warm connection or war- warm connections, connections.

Jake Aaron Villarreal: I love that.

Emre Baran: And, and, and at some point actually I also remember we've done a round on, I believe we use User Interviews or something where you know, I wanted also like a non-biased like feedback from the out, cold. And we actually spoke to about 10 different companies or 10 different people from different companies that we recruited and got their feedback as well.

Jake Aaron Villarreal: Really important. So Cerbos, um, we've talked a lot about the company, where you're at today. How, how big are you now as a company and where, where is the company located? It's distributed, remote, correct?

Emre Baran: Correct. We are legally in the UK, a UK company. But uh we are distributed across I don't know how many time zones. Anywhere, we are anywhere between you know New Zealand, Philippines, Turkey, Serbia, Bosnia, UK, Portugal, Maryland... I'm sure I'm leaving a country out somewhere in there.

Jake Aaron Villarreal: Very international. How big is...

Emre Baran: So we are about 12 full-time uh employees. And then we also have uh additional team members that are working with us part-time. And this is actually is one of those other decisions that we made. Like not everybody has to be full-time right, not every function has to be full-time. So we actually leverage a lot of professionals in different you know, on a contractor basis. But we also treat them as just full members of our, of our company. We have you know, everybody's engaged with them on Slack conversations. But you know, if you ask where the company's running, the company's running on, on Slack asynchronously and fully remote.

Jake Aaron Villarreal: You know, it's funny you mentioned that about part-time or we call it fractional workers today, where there's just a huge demand for "I need the work done, I need it done at a high level, but I also don't need to spend a full-time salary for somebody," at least in, at some point in your company. And eventually you grow it to a point where maybe you do. But you know, our business, we pivoted a little bit too and a large amount of our work today is companies that are bringing on fractional or part-time workers on a contract basis you know, globally and it's been...

Emre Baran: One more dimension to add, one more dimension to add there is "job done right" by senior and experienced people. So we actually pay a lot of attention to that, which is when you know, when we get somebody fractional we... I mean it's great, I've done this for years at Qubit, we had a very great triangle where we actually brought up you know people who didn't have much experience and brought them up. But when we're operating in an environment when there is no office and there's no learning by osmosis, we actually don't have that time or capacity to be able to train people as much as you could do in phys- in a phys- physical office. So that's why it's very important to have senior and ex- experienced people who know what they're doing.

Jake Aaron Villarreal: Yeah, 100% agree. If somebody wants to learn about Cerbos, where do they find you and if they want to connect with you directly, where would they connect with you?

Emre Baran: So uh, Cerbos is cerbos.dev. Um our website. Or you can just Google Cerbos, I believe by now we've won the SEO games everywhere in the world. It just comes up as the first, first result. I am on both Twitter and LinkedIn. Uh on Twitter I'm @emre and on LinkedIn I'm Emre Baran.

Jake Aaron Villarreal: Great. Emre, if there, is there anything before we wrap up that I haven't asked you that you want to share?

Emre Baran: Um I mean, in many dimensions if you let me talk I'll talk till tomorrow morning, but I guess um the, the key thing is for entrepreneurs who are listening to us, for people who want to build software, I would have one piece of advice which is: build something that you're passionate about. Because it's a roller coaster ride. There'll be good days, there'll be bad days, and on those bad days one thing you need is you know encouragement to keep you going. And a lot of that comes from passion to solve a problem, passion to serve customers, passion to deliver a technology to improve life, to improve the world. And if you are only doing it for commercial success but nothing else, sometimes that runs out. So focus on what you're passionate about bringing to the world.

Jake Aaron Villarreal: I love that. Well on that note, I want to thank you and give a big shout out to Emre for taking his time today and sharing all these valuable lessons to our listeners. And to our listeners, thanks for joining us, it means the world to me as we continue to go through these episodes and learn. I'm your host Jake Aaron Villarreal signing off, but can't wait to connect with you again on the next episode. Until then, sayonara.

Before we wrap up I want to give a big shout out to all the entrepreneurs that have joined to make this podcast possible. And for all the listeners for listening, it means the world to me that you chose to spend your time with us today. I'm your host Jake Aaron Villarreal signing off for now, but can't wait to connect with you all soon on the next episode. Take care.

This show is sponsored by Match Relevant, a company that helps venture-backed startups find the best people in the market and they do it in three simple steps. First, they sit down with founders to understand their story. Second, they tell their story into multiple candidate channels. And third, they schedule interviews within 48 hours. Find us at matchrelevant.com to learn more about how we do it.

‍