On Helping to Build Runecast (Acquired by Dynatrace)
I joined Runecast in 2019 when the company was only four and a half years old and the team numbered just above 20 people. Then we battled our way through an unprecedented pandemic and its effects on global markets and technologies. After we achieved great things together (including getting noticed by the right customers, partners, industry analysts and others), Runecast was acquired by Dynatrace.
Note: What follows is my rudimentary attempt to summarize, from my perspective as a Marketing leader, the last few years at Runecast (before it was acquired). It may provide some small glimpse into other teams such as R&D, Sales, RevOps, HR, and Finance, but by no means represents their major accomplishments (I would personally welcome a similar summary as this from anyone on each of those teams as well).
Contents
- My Start at Runecast
- A Time of Unprecedented Change
–COVID-19 - Post-Pandemic New Normal: Optimization
–Global Partner Enablement
–Lean, Organic Communications
–Leveraging Generative AI
–Aligning Sales & Marketing for Revenue
–Customer Success = More $$$
–Make it Sticky - Accomplishment Highlights
–A ‘Must-Have’ Solution
–Awards Won
–Analyst Coverage - What Comes Next: Keep Making History
My Start at Runecast
Before I took the role at Runecast to develop and grow the Marketing team in mid-2019, one of the aspects that caught my attention was the large volume of sales-enablement content that only a small handful of people had already produced to that point — customer testimonials, case studies, videos, webinars, brochures… and somehow with just over 20 people in the whole company, with only 1 full-time and 2 part-time people on the Marketing team.
That told me what I needed to know about the culture: rather than a big corporate environment (where meetings tend to reiterate the org structure and remind you “We are agile” as an excuse for lack of strategy or planning), it was a culture of enablement, where job titles didn’t matter and everyone could pitch in to get things done. As a person who likes to build and create (rather than simply maintain), it was precisely my kind of environment.
The immediate ROI that Runecast provided customers was unmistakable (conveyed to us repeatedly, in multiple ways, by our customers), but it took me a few months to wrap my head around how Runecast’s technology worked, how its AI and rules engine could be so groundbreakingly proactive. At that point in 2019, Runecast was still in its first incarnation as a predictive analytics tool designed for VMware environments.
A Time of Unprecedented Change
By December 2019, we had broken free of VMware centrism by launching coverage for AWS (and, if memory serves me, also VMware Cloud on AWS) and automated continuous compliance monitoring with more security/regulatory standards.
There began one of our first major challenges (of many) for the Marketing and Sales teams (and Channel Partners): knowing which solutions categories Runecast had suddenly entered into, where the overlaps were, and who our competitors were in those new (for us) areas. The market was so rapidly changing at this time, that any research and planning was sometimes outdated within months or even weeks.
By 2020, Cloud Security Posture Management (CSPM) was beginning to see some overlap from the Cloud Workload Protection Platform (CWPP) category, and soon Kubernetes Security Posture Management (KSPM) entered alongside the new cybersecurity philosophy/mantra to “shift left,” meaning to implement security efforts much earlier in the software production cycle.
From 2020 to 2022, as Runecast rapidly developed from being a VMware-specific analytics tool to being a proactive security platform supporting multiple additional technologies (AWS, Azure, Google Cloud, Kubernetes, Windows, Linux) with a quickly expanding list of built-in security frameworks, at a time when the IT industry itself was undergoing so many rapid changes, it was an ongoing challenge to define a consistent product identity for Runecast and simultaneously position the company and product as a leader in that space — not only for industry analysts or tech journalists to understand where we fit in, but as well our own engineers, marketers, sales team, channel partners, customers, and prospects.
A veteran of security companies (ADT/tyco, Avast, Avira), I had never seen such a high speed of disruption as what I saw in the industry during my first couple of years at Runecast.
Let me back up a bit to…
COVID-19
We were growing, with our proactive AI-powered solution grabbing the attention of IT SysAdmins, CIOs, CISOs, Security and Compliance teams, IT Procurement departments and others on the buying committees. Runecast was selling better, enabling us to invest in growing the company. We hired a few more full-time marketing resources and suddenly… COVID-19.
What an unprecedented dumpster fire that was. We naturally initiated a hiring freeze and doubled down on getting the word out about how Runecast could assist organizations dealing with new remote-work challenges, securing their rapid digital transformation, and — a new universal concern practically overnight — ensuring ‘business continuity’. We could do this by increasing transparency of complex IT environments and highlighting priorities for stability, security, and compliance. We could help them automate what was no longer even humanly possible to keep up with.
We saw a major need for safer human services (they were being targeted by ransomware!) and launched a free COVID license for Healthcare and Educational institutions. We contacted our partners to increase co-branded efforts in reassuring the world that we would do everything we could to help secure mission-critical systems and services. We continued to rapidly develop and sell Runecast and, eventually, we were able to again slowly build headcount to support those efforts.
One thing worth mentioning is great leadership. Throughout the pandemic, our CEO and his Co-Founders worked with us in the trenches and helped us to focus on enabling our customers, which in turn resulted in us frequently being a thorn in the sides of competitors that had far greater financial resources than we did.
Around the end of the COVID-19 pandemic, after organizations had globally rushed so much digital transformation to enable remote work and business continuity (a short-lived buzzword at the start of the pandemic), a new solution category — Cloud Native Application Protection Platforms (CNAPPs) — was introduced (probably late 2021 or early 2022) by industry analyst Tom Croll, who was at the time with Gartner.
We recognized that this consolidated CNAPP category — which encompassed IT Operations Management (ITOM), CSPM, KSPM, CWPP, CIEM, and other prior solution categories — was where we would likely find the best fit for our vision of Runecast, and so we began to align our R&D roadmap to Gartner’s ideal CNAPP vision, with frequent analyst briefings and feedback on how best to make a major impact in that space. We as well consulted with other analyst firms, to ensure that we were not seeing things only from one analyst firm’s perspectives.
Post-Pandemic New Normal: Optimization
During the pandemic, from talking with various industry analysts we learned their perspectives of our biggest strengths, weaknesses, and opportunities to expand our CNAPP capabilities for IT teams. We aligned our company OKRs to the major goal of being “a leading CNAPP vendor by 2025.”
This ‘North Star’ aim gave us the clear sense of purpose that we needed to start growing in all the right ways. We began to increase our customer base and revenue by continuing to transform into a bonafide security company — via, among other aspects, providing unparalleled vulnerability management and continuous compliance auditing (i.e. not just on the day of a formal audit), which leveraged Runecast AI Knowledge Automation, or RAIKA (already for quite a few years before any mainstream Generative AI hype launched by OpenAI).
Global Partner Enablement
We educated our Channel Partners on how to properly position Runecast as a security-focused CNAPP. We focused our marketing communications around our strongest security enablers and feature differentiators, which included automated/proactive alignment with vendor best practices, risk-based vulnerability assessment, continuous compliance monitoring, on-prem (and even offline) capabilities, and many more unique benefits to customers. An IDC analyst called us “a Swiss Army Knife for VMware teams,” and the value went way beyond that, as Runecast was also known as “the on-prem CNAPP” — meaning that, while most of our competitors in the CNAPP space began in the cloud and didn’t cover on-prem, we began on-prem and evolved to also secure operating systems (OS), cloud, and containers.
Lean, Organic Communications
We did everything we could to increase our brand awareness via technology-focused industry events, PR, analyst relations, influencer engagement, etc.— at the same time operating as lean as possible. “How can we best make an impact with no budget?” became our semi-amusing internal mantra, and we found that when we shared it with service providers, they often returned with much better offerings (who doesn’t like an underdog?). I remember asking partners and service providers many times: “Sure, A, B, and C would be ideal, but how can we make an impact together organically? What if we co-brand somehow, so it’s a low- or no-cost win-win for us both?” Or frequently we would make a point that, being small, we couldn’t afford to pay for services — only results.
Leveraging Generative AI
Long before the general public heard of ChatGPT, we were doing everything we could think of to increase individual, team, and company efficiency. When OpenAi released ChatGPT publicly, we immediately set up slack channels about it and regularly discussed how we could use it — in any business situation — to be even more productive than we already had been. Of course some situations warranted more careful approaches, due to privacy and security aspects, but we did not let those situations limit our overall leveraging of this new power. Company leadership encouraged its use and paid for the extended capabilities of ChatGPT-4 for the whole company.
Aligning Sales & Marketing for Revenue
We also focused on revenue-generation efficiency. This included working closer with the SalesOps (RevOps) team’s data and continuing to integrate it with what we could see on the Marketing side (transforming Salesforce vs. HubSpot issues into Salesforce + HubSpot insights). Eventually, we got to a point where there weren’t Sales and Marketing ‘sides’ to the funnel but instead multiple places to work together on optimizing conversion rates at every step in the funnel.
Customer Success = More $$$
Additionally, we formed a cross-team Customer Success Management (CSM) task force, to proactively brainstorm ways to both enable CSMs and improve Runecast customer experience. We listened to our CSMs and what they were hearing from customers, sometimes having calls with customers ourselves, and then involving R&D, Product, Support, Marketing, and Sales teams as needed to address any areas where we thought we could optimize the customer experience (CX).
Make it Sticky
As a result of our learnings from our CSM and Sales teams, to ensure customer retention we also started new initiatives to share Runecast’s value to other teams within the org and other ways to make the platform ‘stickier’. So not only SysAdmins, for example, but also Vulnerability teams, Compliance teams, etc. This not only helped to increase gross revenue retention (GRR), it also helped to improve our year-on-year annual recurring revenue (ARR) growth via cross-sell and upsell opportunities. The more people within an org who saw Runeast in action, the more that they realized it provided other needed capabilities — which could also save them money by consolidating their other disparate tools.
Accomplishment Highlights
As a company, Runecast grew from around 20 people in early 2019 to around 70 by 2023. An aspect of the culture that I found remarkable was that such a small team represented about 25 countries — by home base, nationality, or other origins. I’ve never seen such a fast pace of development (with so few bugs!) at any company prior to Runecast, and I was continuously amazed at how much we could do with so few people — also in Sales, Marketing, RevOps, Finance, and HR. As results are king, I won’t focus on activities here, but in 2022 our Marketing, Sales, and Sales Engineer (SE) teams were involved in almost 90 industry events!
A ‘Must-Have’ Solution
In the early days, one of the biggest accolades that we received was from the VMware vCommunity, where several vExperts referred to Runecast as a “must-have” solution for VMware-based environments.
From banks to hospitals, from universities to government and defense, we knew from our customers that we had built something amazing. The German Aerospace Center (DLR) even credited Runecast with helping them to grow food in space.
From the end of 2015, when Runecast 1.0 was released at VMworld in San Francisco, to the start of 2024, when Dynatrace announced its acquisition of Runecast (in our 10th year), Runecast secured a US patent for its innovative technology, was named a Cool Vendor by Gartner, won 10 industry awards, and was a finalist for about 30 other award categories.
These awards were not ‘pay-to-play’ but ones where we submitted our capabilities, and judges decided that our RAIKA-powered innovations offered greater value for customers than other entrants’ products. That also does not take into account the accolades from customer reviews on peer review websites such as G2 or Capterra.
Awards Won
During the first 4.5 years (the launch of a startup, before I joined Runecast)
- 2015 — Virtualization Review Editors Choice Award
- 2016 — V4 Startups & Scale-ups ING Workshop Award
- 2017 — Tech Trailblazers — Virtualization
During the next 4.5 years (transforming ‘startup’ into ‘scaleup’)
- 2020 — computing’s Cloud Excellence Awards — Cloud Security Product of the Year (SMEs)
- 2020 — computing’s Digital Technology Leaders Awards — Best Place to Work in Digital (SMEs)
- 2022 — UK Enterprise Awards — Most Innovative Enterprise IT Operations & Security Enabler
- 2023 — Frost & Sullivan’s New Product Innovation Award in the European CNAPP Industry
- 2023 — computing’s Security Excellence Awards — Enterprise Threat Detection Award
- 2024 — teissAwards — Best Vulnerability Management Solution
- 2024 — teissAwards — Best Security Compliance Product
Runecast may not have been a household name, but behind the scenes we helped to stabilize and secure the critical systems and services used daily by 100s of millions of people around the world.
Did we achieve our goal of being a leading CNAPP vendor by 2025? As a CNAPP solution, Runecast laid claim to enabling some of the biggest forward-thinking customers on the planet and earned Frost & Sullivan’s 2023 New Product Innovation Award in the European CNAPP Industry.
Analyst Coverage
Research Coverage (Highlights) from 2023
- IDC Market Glance: Future of Digital Infrastructure Ecosystem, 2Q23
- Gartner 2023 Market Guide for Vulnerability Assessment
- Frost Radar™: Cloud Workload Protection Platforms (CWPP), 2023
- Frost Radar™: Cloud-Native Application Protection Platforms (CNAPP), 2023 report
- Frost & Sullivan’s 2023 European New Product Innovation Award for Delivering an Al-driven Unique CNAPP
What Comes Next: Keep Making History
Like the old Zen proverb says, “Before enlightenment, chop wood. After enlightenment, chop wood.”
With Dynatrace’s acquisition of Runecast on 1 March 2024, an exciting new chapter awaits the CNAPP space, the observability space, and the overall security and IT industries. The majority of Runecasters were provided new roles at Dynatrace, but naturally there were a few redundancies.
I stayed on for three months to assist with Runecast →Dynatrace knowledge transfer — in the areas of Analyst Relations, Public Relations, and Marketing — and now my path leads elsewhere.
I am grateful for all that I learned, from Runecast’s humble beginnings all the way through to the M&A transition… and I look forward to taking on another endeavor to help build something.
Some personal accomplishments of which I am proudest
- Helped to get Runecast noticed globally and acquired
- Mentored a protégé at Runecast to take on my people and operations management role as Head of Marketing
- Was the top Social Media influencer at the last 3 companies
- Helped make Avira a global contender (beyond the DACH region)
- Helped build Avast into a Unicorn
I’ve worked for large corporations (e.g. five years at ADT/tyco Security, which had around 14K employees), but I feel more comfortable building than maintaining — and thus prefer to help smaller companies fulfill their founders’ dreams, to grow into (and get noticed as) major industry players.
That said, beginning in June 2024, I will join another leading security vendor in the scaleup stage, and you will be hearing more from me about security innovations in coming months.
