From Claroty to Twine: Building a Top-Down Security Company

Why 250 conversations came first#

Twine did not start with a product thesis and look for evidence to support it. Justin and his co-founders ran more than 250 in-depth conversations, and let those conversations decide which problem was worth building for. Identity risk won because practitioners kept returning to it unprompted.

This is the same instinct we see in the founders we work with. Entro ran 200 interviews before writing code. Twine ran 250. The pattern is consistent enough to be a rule: the teams that validate hardest are the ones who can articulate their difference later, because they have heard it described in their buyers’ own words.

Trust is the sales currency#

Justin is direct about what actually moves an enterprise security deal. It is not the campaign, the booth, or the volume of outbound. It is whether the buyer believes you. Security buyers are pitched constantly and have learned to discount everything that sounds like a claim.

That has a practical consequence for how you spend. Visibility is only the first step, and on its own it is close to worthless. A conference badge scan is not a relationship, and a competition final is not a customer.

Standing out at RSA and in the Sandbox#

Justin walks through how his team prepared for trade shows and innovation competitions, and what separates the companies people remember from the ones they walk past. The preparation starts long before the event, and most of it is about narrative rather than stand design.

We have watched this from the other side. Undifferentiated brands get commoditized, and the vendor a CISO remembers is the one that wins. The one they forget competes on price.

Building a moat when the models keep improving#

The last stretch of the conversation deals with a question every founder in this market now carries. If a general model can do a growing share of what your product does, what is left that is defensible? Justin’s answer is depth in a vertical: the context, the data and the workflow that a general model has no access to.