How many customer interviews should a cybersecurity startup run before building?

Twine ran more than 250 conversations before settling on identity risk, and Entro ran 200 before writing a line of code. The number matters less than the discipline: keep going until you can describe the problem in your buyers’ own language rather than your own.

Do trade shows like RSA actually generate pipeline for early-stage security companies?

Only when visibility is converted into trust. Justin’s view is that the event itself produces attention, and attention decays fast. The work that pays off is the narrative preparation beforehand and the follow-through afterwards, not the stand.

How do you turn validation interviews into design partners?

The people who gave you an hour of their time already understand the problem and have signalled they care about it. Justin describes going back to that group first, which is why the validation process doubles as an early pipeline.

What is a vertical moat, and why does it matter now?

It is defensibility that comes from depth in one domain: proprietary context, data and workflow that a general-purpose model cannot reach. As large language models absorb more general capability, the generic layer of a product stops being a differentiator.

From Claroty to Twine: Building a Top-Down Security Company

Phill Keaney-Bolland· Co-founder and Designer, YayaJanuary 21, 20262 min read

With Justin Woody, Co-founder, Twine Security

Listen on Spotify Listen on Apple Podcasts

Key takeaways

Two hundred and fifty validation conversations came before the roadmap, not after it.
Trade shows and competitions like the RSA Innovation Sandbox only pay off if visibility converts into trust.
Design partners are built out of validation interviews, so the research doubles as pipeline.
A vertical moat matters more once large language models make general capability cheap.
Focus is a decision about what to drop, and most teams drop too little.

Why 250 conversations came first
Trust is the sales currency
Standing out at RSA and in the Sandbox
Building a moat when the models keep improving

Why 250 conversations came first#

Twine did not start with a product thesis and look for evidence to support it. Justin and his co-founders ran more than 250 in-depth conversations, and let those conversations decide which problem was worth building for. Identity risk won because practitioners kept returning to it unprompted.

This is the same instinct we see in the founders we work with. Entro ran 200 interviews before writing code. Twine ran 250. The pattern is consistent enough to be a rule: the teams that validate hardest are the ones who can articulate their difference later, because they have heard it described in their buyers’ own words.

Trust is the sales currency#

Justin is direct about what actually moves an enterprise security deal. It is not the campaign, the booth, or the volume of outbound. It is whether the buyer believes you. Security buyers are pitched constantly and have learned to discount everything that sounds like a claim.

That has a practical consequence for how you spend. Visibility is only the first step, and on its own it is close to worthless. A conference badge scan is not a relationship, and a competition final is not a customer.

Standing out at RSA and in the Sandbox#

Justin walks through how his team prepared for trade shows and innovation competitions, and what separates the companies people remember from the ones they walk past. The preparation starts long before the event, and most of it is about narrative rather than stand design.

We have watched this from the other side. Undifferentiated brands get commoditized, and the vendor a CISO remembers is the one that wins. The one they forget competes on price.

Building a moat when the models keep improving#

The last stretch of the conversation deals with a question every founder in this market now carries. If a general model can do a growing share of what your product does, what is left that is defensible? Justin’s answer is depth in a vertical: the context, the data and the workflow that a general model has no access to.

Phill Keaney-Bolland

Co-founder and Designer, Yaya

Co-founder and designer at Yaya, and host of the Cult Products podcast. Fifteen years designing products, brands and UX across multiple industries before narrowing to cybersecurity, and lectures on design at Imperial. Works with cybersecurity founders on positioning, strategy and the website that has to carry a launch, across identity, cloud security, AI agents and software supply chain, including Twine out of stealth and Geordie AI, which won the RSA Innovation Sandbox in 2026.