Customer acquisition was Bugcrowd's hardest challenge due to early hacker stigma
Casey Ellis · He tested his pitch on Uber drivers—then built a cybersecurity platform to $180M raised. | Casey ... · PMF Show · Oct 13, 2025 · at 31:53
Bugcrowd founder Casey Ellis discusses navigating the supply versus demand challenge when building a two-sided cybersecurity marketplace.
0:00 / 0:33exact quote · 33.3s
▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark
“Customers, a hundred percent. Like I was cheating a little bit on the supply side because I was already a part of that community. So I already had, you know, some degree of like trust and different things like that. And then Once you kind of drive a message across that bridge of trust and people have a good experience, then they tell their peers and it kind of grows out from there and that's how you get your network effect, right? So like that was always kind of easy. The harder part was going to customers and saying, Hey, here's this crazy idea. Like it was really this idea of unseating folks and their opinion of hackers is just inherently bad.”
quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →
More from Casey Ellis
VC rejection usually reflects poor founder communication, not investor stupidity
“My job is to understand this industry, like the market, the future of the market, where it's going, like see around corners, do all those different things. Like that's my job. And my job is to be the best in the world at that. Their job Is to be the best in th…”
Founders should exhaust personal networks before hiring sales reps pre-Series A
“Like don't think about marketing funnels or PLG or like hiring salespeople or any of that stuff until you as a founder have figured out how to tap out your existing networks. I think the bulk of the power that you're going to have pre series A is probably goin…”
Startups should never hire just one initial salesperson; always hire two
“Then I hired two salespeople, because if you're going to do that, you never hire one, you always hire two, because that way they compete with each other and G each other up.”
Hourly pen testers cannot match unconstrained crowds of adversaries
“The problem that I had with it was this idea that, like, you know, the whole reason that we're here as a cybersecurity defender industry is because of this crowd of adversaries, right? It doesn't look like one person being paid by the hour. It looks like this …”
Founders must not sell risk-reducing security products to compliance-only buyers
“Never sell security to people that don't care. If you're trying to position a product that's genuinely going to reduce risk, don't try to sell that thing to people that only care about compliance or only care about checking the box.”