System Thinking

Business is a machine that requires regular tuning

Think of your business as a machine. A complex, human-run piece of machinery.

In the early days, your entire focus should be on finding product/market fit. Can you build something that others will pay for? It’s as simple as that.

Once you get to repeatably being able to add new customers, you need to continue to expand the machinery. Unfortunately, things are never going to be as focused as in the early days. You will have conflicting priorities:

• Do you work on new features or fixing what’s not perfect?

• Should you expand into vertical markets or stay horizontal?

• Do you hire people to generate more leads or to follow up on them?

• Do you try to reach more new customers or expand the existing ones?

• Do you hire more engineers to work on features or to help customers?

There are no easy answers to these questions. One framework that can help is system thinking. Functional leaders, heads of various departments will generally focus on their area. They want to optimize within their function of Sales, Marketing, Engineering or so on. One of the most important roles as an executive, especially at the C-level is to ensure good allocation of attention and resources across departments.

It helps to think of your company as a machine, a flawed machine that requires frequent tuning. You must make sure you are providing the right mix of resources as you expand.

As you look to the business in how it’s performing what are the current bottlenecks? What is the biggest impediment to growth? If you could add just one more headcount or fix one bottleneck, what would that be? That’s where you need to invest.

It’s a useful exercise to occasionally look at your company and imagine it doubled overnight. Twice as many employees, twice as many customers, twice as many support incidents. In all likelihood there will be ten times as many headaches. Which systems will break under this added load?

If you’ve got headcount and dollars to spare, making new investments is fine. But you should also be thinking about what investments you’ve made that have not yielded excellent results. These old projects are gunking up your engine.

Sometimes there’s a project that continues to tread water delivering mediocre results. And if you dig in, you might find that no one is excited about. However, because of sunk costs, it’s unlikely the project leader will come to you to kill it. Can you repurpose the people on something more valuable?

The Lesson of Duo Insight

In the early days, Duo was growing 100% or more year over year and one of our growth vectors was based on people searching for two-factor authentication. We were concerned that as the market saturated, that number would decline. Where would our leads come from?

One fine Monday morning, Jono, the CTO and co-founder, came in with a new prototype application he’d developed over the weekend. His hypothesis was that we could increase interest in two-factor authentication by showing people that this was the best way to prevent phishing attacks —emails that attempt to steal someone’s credentials by getting them to login to a bogus system. The results of Jon’s phishing simulator would enable security professionals make a business case for implementing two-factor authentication and our broader Duo security platform.

We tested it internally and the reaction was mixed. The best phishing emails are those that invoke strong emotions and urgency. We used emails with subjects about HR, bonus payouts, parking, you name it. While most employees appreciated the need for security vigilance, no one ever felt good when they were tricked by a phishing message, even when the site turned out to be innocuous and included tips on how to avoid future scams.

Although the prototype was impressive, it required a couple weeks of additional design and engineering work to turn it into a commercial-quality product. And naturally, we had to create marketing launch materials, train the sales people, and so on.

We launched Duo Insight at a major conference as a free tool to help companies assess their risk of phishing scams. And then… nothing. Since broad phishing tests usually require high-level corporate approval, most tests were run on small subsets of employees. Rather than leading people to buy two-factor authentication as we hoped, most of the users sought security training for their employees, a business we did not want to enter.

So the ad-hoc team that had launched the first version kept at it, making improvements adding more customization and better integration into our main product line. We had to scramble when the Duo.com domain was blacklisted by ISPs —ironically, we were flagged for sending phishing emails. Marketing and sales lined up more case studies and more content to reinforce the logic of going from phishing tests to two-factor authentication.

There was still no significant impact to our lead funnel. More work was done, but Duo Insight lost whatever internal momentum it had. Eventually, Ash, the head of product came to me to throw in the towel. It’s always hard to kill a product, especially when it’s built by a co-founder. Luckily, Jono was one of the least ego-driven co-founders I’ve worked with.

As cool a product as we thought Duo Insight was, it never delivered on its promise of making our lead generation stronger. When logic and market forces collide, the market wins. So we put the product in a state of benign neglect, where it could still be used and would get bug fixes, but there would be no additional investment.

We then redeployed the team to more important projects including a FedRamp effort and new features in our platform product to secure laptops and mobile devices. Despite our disappointment in Duo Insight, everyone was happier to be working on projects that would have bigger impact. Some time after Duo was acquired by Cisco, Duo Insight was shut down in favor of Cisco’s existing phishing assessment service.

Surprisingly, there are still commercial products out there that charge more and do less than Duo Insight did and seem to generate ongoing business. Maybe there’s an opportunity there, but I doubt it will ever be as good as the core businesses at Duo.

Yes, that’s another corny picture up top: two guys fishing on Long Lake, Traverse City, Michigan, before the snow. What are your biggest bottlenecks to growth? Are there resources you can deploy that could overcome these limitations?