Disclaimer: This interview is for informational purposes only and should not be relied upon as a basis for investment decisions. In Practise is an independent publisher and all opinions expressed by guests are solely their own opinions and do not reflect the opinion of In Practise.

{audio:0:02:06} I’m excited to talk to you; I'm also a software developer, so I use Elastic. I also use BrowserStack a lot.

{audio:0:02:10} I’m so happy to hear that. I was going to ask you about BrowserStack.

{audio:0:02:17} I used to do a lot of the stuff I do now with BrowserStack, just manually. I'd just bring up a lot of devices; I'd take my mom's old phone or my girlfriend's iPad and try to test. Now it's just so easy; you open up the different things you want to test on. I'm a front-end developer, so much of it is testing how things work on different devices and browsers. I think it's awesome, so thank you. So you joined Elastic, then left for BrowserStack?

{audio:0:02:50} I did. I left last summer, and BrowserStack was a CMO opportunity. It's one of India's unicorns, and so it was too tempting. It made sense. So you're interested in Elastic?

{audio:0:03:13} That's right. I'm researching Elastic, and I have a hard time wrapping my head around all the areas in which Elastic competes. Also, how they're evolving now, both their sales and marketing strategies. Also, some ideas about the culture, the key people there, and the base of innovation.  

{audio:0:04:09} Before I get to that, do you have a good sense of how Elastic, the company, evolved and its portfolio?

{audio:0:04:18} Yes, I have a sense. I looked at how it started. It felt like it changed a lot over time and added so much more. And a lot of that, I feel, was community-driven.

{audio:0:04:33} A hundred percent. Elastic was officially founded back in 2012, about 10 years ago. I think you probably grew up in Amsterdam, so it has a local connection for you, I think. 

{audio:0:04:57} The company grew by word of mouth and a lot of developer love. Shay Banon wears his love for developers on his sleeve. He's a nerd icon, and the company never really invested in sales or marketing, almost for the first eight years. They had a website with organic traffic, and there was very little ad spend, such as lead targeting. The sales team were primarily order takers. For example, they would get a call from somebody in IT at CISCO, saying, hey, we funded six different dev teams using Elastic; it's getting out of hand. Can you come? Let's put a contract in place. They were essentially booking, and they were good order takers. They didn't have to sell; they were converting open source users to either buy the managed services version to continue to have it on-prem or convince them to move to cloud. There was no demand generation or having to pitch or sell Elastic. So life was good.

{audio:0:06:17} Sales and marketing costs were close to zero, so Shay pumped every penny he had into R&D. One interesting tidbit about Elastic is, up until a year ago, all the development was being done in the US, most of it in California. There was nothing outside of California, which is unusual. If you look at any software in Silicon Valley, you will have an R&D side in Bangalore or Tel Aviv, or Poland; part of Poznań is becoming a hotbed. But for some reason, it was all done in California, so it sucked in a lot more dollars to go into R&D. I was one of the first hires of the CMO, who had just joined. She joined two months before I did, and she hired me to essentially build out product marketing and vertical marketing. Do you know what product marketing is? 

{audio:0:07:30} I have a sense, but you can go into how it applies to Elastic.

{audio:0:07:39} In product marketing, essentially, there are two things. One is sales enablement, arm the sales team with everything they need, pitch decks, collateral, so they can vend. That’s one output. The second output is to create content. These could be to raise awareness of Elastic, or to nurture ROI tools depending on where a prospect is in the buying journey. If they're trying to make a decision, for example, should I go with Elastic, should I go with Datadog or Splunk, the part of collateral you need is perhaps a Gartner MQ report, for example, which helps in decision making. Or an ROI calculator, where you can say, I'm going to save money over the next five years with Elastic because my total cost of ownership is lower. Things like all those tools come with product marketing. Think of product marketing as sitting right between product and sales. 

{audio:0:08:51} Vertical marketing is similar, but now you're focusing on a given vertical. For the last product, I had three verticals; financial services, telecom, and healthcare. The reason we put those three is there were already a lot of proof points, customer case studies in those three verticals. Telecom 5G was picking up steam, which puts a premium on availability because you cannot accord any downtime with a lot of network upgrades. The pitch was, how do you deploy and manage a 5G network with as little downtime as possible and as best as you can on the performance. How well can Elastic’s observability solution help you? So that puts the focus on vertical marketing. 

{audio:0:10:02} I'm curious how that evolved once you joined. Those things came to be as you joined the team, or were they already there?

{audio:0:10:13} No, as I said, there was very little spent on marketing. The CMO was hired to essentially build out all the aspects of marketing. If one piece of marketing was well developed, it was the community engagement team. Elastic is probably one of the best companies in terms of developer advocacy. There are community meetups, I'm sure there is one in Bucharest, and many of these are organized by volunteers; not even Elastic employees. There is a team of 30 or 45 people, spread across the world, who are Elastic employees who engage in developer advocacy. So that was very well developed, but everything else, there was hardly anything. I had to build a team from four or five people; when I left, it was almost 50 spread across the world. 

{audio:0:11:17} The same is true for other aspects of marketing. Things like brand; what does Elastic stand for, and what is the narrative? Shay didn’t care for any of that. You talk to him about searchable snapshots, and he gets all excited. The entire marketing function had to be built out, end to end. Sales was growing at the same time, but remember sales, up until two years ago, as I said, they were order takers. Now, you need people who are hunters and farmers. Elastic is a classic land and expand. The initial build size might be very small. Take Oracle as an example; there are at least 13 different development teams inside Oracle. One team may start using Elastic, and then it's up to Elastic to evangelize it inside Oracle, find other champions to spread the word, and grow that account. Twilio would be a good example of a company that has done that well. We tried to copy; why reinvent the wheel? Hotspot would be another one that has done this expansion well. 

{audio:0:12:49} Sales was also hiding a lot of seasoned hunters and farmers; account managers who know how to grow an account, and hunters who know how to land an account. There was heavy investment into both sales and marketing in tandem during the trimester. The other thing is, Elastic never tried to engage with the likes of Gartner or Forrester. Shay didn't have a very good opinion of them. He thought they were a waste of time. So we engaged with Gartner, Forrester, and Ovum; we inserted Elastic into Gartner’s Magic Quantum and the Forrester Wave. That happened when I was there, and I played a key role in making that happen. One of the questions I saw in your note was how was Elastic different from the competition. 

{audio:0:13:56} The best analogy I can give you is Elastic is like going to a toy store and buying Lego blocks. You can come home and make a plane, you can make a train, you can make a bus, whatever you want. That is Elastic; that was Elastic for a long time. The target persona for Elastic is the developer; it's you. Or the back-end developer. You’re a front-end developer, and Elastic appeals to a back-end developer. The focus was more on the number of integrations and how rich the APA sector is. How good are the tools, and the documentation. In other words, all of the energy went into making Elastic the best toolkit it can be. Do you want to analyze logs? Go for it. Do you want to do threat hunting? Have fun.

{audio:0:15:01} Whereas the competition, whether it's Datadog or Splunk, focused on the practitioner, not the developer. The target user of Splunk's security SIEM, security information and event management is the soft analyst, not the developer. If you're comparing how easy it is to use, Elastic is much lower than Datadog or Splunk because Lego doesn't sell you a fully assembled anything; the fun is in assembling it and creating your own. It’s the same with Elastic. Until IPO.

{audio:0:15:48} Elastic went public in late 2018. There was a lot of feedback from Wall Street saying, this is great; it's open-source. So you're selling a tool kit, and it's free. Why should I invest in a free toolkit? Elastic looked at the three dominant use cases at that time. Log analysis was number one. Everybody was using Elastic to analyze logs and using Kibana to build some passports. Log analysis became observability.

{audio:0:16:34} Security was another one, especially in the US. The Department of Defense was using Elastic in a big way for things like threat hunting and anomaly detection, so security was a natural second use case. And then just enterprise search, just how we don't think about using Google to search the internet. Within your own firewalls in a large enterprise, there's no equivalent. Google used to have an enterprise product that they discontinued. Now you have Algolia, Coveo, and a couple of others, so that was the third use case. Elastic decided to productize these three solutions, but there was a huge gap. Even though they labeled them, it was still a toolkit, so there's been a lot of investment into making them much more usable out of the box and also making them richer. 

{audio:0:17:41} Observability is a relatively new term. We used to have infrastructure performance management from people like Cisco or NetApp; anybody selling infrastructure, whether it's networking hardware or storage hardware. They gave you tools to monitor and tune whatever hardware you were buying, and that was IPM, infrastructure performance management. Then you had companies like DynaTrace and AppDynamics, focusing on application performance. So those were two separate markets; managing infrastructure, managing applications. They both converged into this thing called observability, and it happened in parallel to DevOps. The whole DevOps revolution with CI/CD and how you now have integrated teams, observability grew along with it. Elastic had a lot of product gaps. So did other vendors. I cannot think of a single company that can check all the boxes. People like DynaTrace, who were very good in application performance management, had to add features and tuning when it came to infrastructure and vice versa. 

{audio:0:19:14} I love the Lego analogy. I think it's a great way to think about it. It seems like the customizability you have at Elastic and the platform's versatility just enables you to do so much. What do you think about the cost aspect of it? It seems that across the board, Elastic was more cost-effective than Splunk in security or observability, and it was more cost-effective than Algolia. I tried Algolia as well as Elastic, and Algolia gets very expensive. And I love the performance. With Splunk, the difference in logging especially is massive. Why is that not driving more people to Elastic?

{audio:0:20:07} The pricing model for Elastic is usage-based pricing. When Elastic introduced usage-based pricing, it was revolutionary. Most companies were charging based on the number of users, servers, and nodes. On most all those pricing algorithms, you pay whether you use it or not. Let’s say you have paid for 15 users; five of those 15 may be super users. In other words, it’s typically this banana distribution where you have very few who use it a lot, and then you have extremes, so you end up wasting money. Elastic decided to go with a usage-based pricing model. It doesn’t matter how many people use it, you only pay for the compute resources you consume. There's no price for ingesting data; you just pay for the compute. That was the start of the pricing model. It was controversial. 

{audio:0:21:17} Then Gartner, in its MQ on observability, put a note asking Elastic to change the pricing model, which is very hard to estimate. Let’s say you work for Nestlé. You have an IT budget, and you have to estimate how much you will spend on Elastic per month to manage your budget. It's super hard. You’re going to pay based on usage, and there's no easy way to estimate what your usage is going to be for a given month. Instead, if it's user-based or it's number of servers, it's easy. You know exactly what you're going to pay. That lack of predictability created an opportunity for people like Splunk to create some confusion. 

{audio:0:22:11} So we did put out some very easy-to-use calculators and estimation tools. Depending on the deal's size, there were also ceilings in certain cases. Even though you may not be able to estimate every month, there was a ceiling that gave you some confidence so that suddenly you're not going to be looking at a million dollars in one month because somebody used it too much. The other thing I think is worth mentioning is that, even though Elastic talks about CLI solutions, there are no CLI SKUs. I hope you know what a SKU is; maybe not. A SKU is a stock-keeping unit, like when you buy something, it has a label that you can scan, and that's what happens in supermarkets.

{audio:0:23:20} But for Elastic, you are buying the whole thing when you're buying Elastic. You're not buying just observability. You cannot buy observability, and you cannot buy security just by itself. You buy the whole thing. That helps because you can use it to analyze logs; you can also use it to threat hunt without worrying about whether you have the security license for Elastic. It doesn't matter. You just ingest data and do whatever you want with that data. That's one of the reasons why Elastic can be cost-effective because there's no artificial limitation on the use cases. You can pretty much use it horizontally, anyway you want. 

{audio:0:24:10} That makes a lot of sense. But might it come across as expensive for someone looking at it for only one use case? Does that happen? Because you have to get everything, which is a great deal, but maybe you don't want everything. 

{audio:0:24:26} Completely. If you think of these three solutions, a company has three buying centers. Security buying decisions are typically made by the CISO, the chief information security officer, or the VP of infosec. Observability is all on the infrastructure side, it's typically the CIO, or it could be a VP of infrastructure or application software. Then enterprise search is very much in IT. If I'm an account executive and I have Nestlé as one of my accounts, I have to sell to at least three completely different personas, completely different buying centers, and three different budgets. To whom Elastic will be more appealing will very much depend. Granted Elastic has a larger developer log, it's almost a given that Elastic will already be in use at Nestlé, even though the CIO may not be aware of it because people love Kibana, and they download Elastic, so it's already there. That's true for almost every company. We used to joke that everybody uses Elastic; some of them pay.

{audio:0:26:00} I think very few pay; from what I know socially, a very small number of people actually pay.

{audio:0:26:07} That’s why Elastic Cloud is so powerful and why Elastic has been pumping a lot of money into the cloud. Because if you're using Elastic as a service, you pay. Everybody pays. The downloaded version is very hard to monetize, and I don't know if you're aware of this, but up until about six months ago, there was a big gap between the features you get when you download Elastic versus the features you get when you use it as a service. That was a big hurdle. Even if you understood that moving to the cloud is easier because you don't have to muck with downloading it and keeping it up to date, the lease, patching it, tuning it, you still had this feature gap, and Elastic has closed that gap. That hurdle is gone, which I think is a huge plus. 

{audio:0:27:06} It's not that hard to walk into a company that's using Elastic on-prem and make up a very strong business case that they will save money if they move to the cloud. Elastic is not the easiest product to download. Every four or six weeks, there is a major new release, so it becomes a full-time job for a small team. That’s a big sales motion for Elastic. All they have to do is convince the customer using elastic on-prem to move to the cloud. They've been doing that, it's a very dominant sales motion for Elastic, and that's why the cloud becomes key to monetize and spread. 

{audio:0:28:05} The other thing with Elastic is it's cloud-agnostic, so you can use Elastic on Microsoft Azure, AWS, Google Cloud, and Alibaba. There's even a Russian cloud; I forget the name. I'm sure Elastic has shut it down now. But Elastic can be cloud-agnostic. In other words, it's customer choice. Datadog, for example, is available only on AWS. If you standardized on Google Cloud, tough luck; you can only use it on AWS. So that's an advantage. Also, in terms of the number of locations at Elastic, there are almost 50 different locations worldwide, so proximity or data, I don't want data to leave my borders; all is possible.

{audio:0:29:03} Or you want to be as close as possible to the data you're indexing. Is that a reason to move to the cloud? Is that strong enough?

{audio:0:29:13} Yes, latency. Latency, especially if you have to move a lot of data around, is definitely a consideration. The other big thing is there has always been a tiff between Elastic and AWS. It was a big distraction. For Shay, it was emotional. He felt like, here I am, a small company, and here comes big Amazon, and they're stealing my code. The worst insult for a developer is somebody stealing your code and not thanking you for it or even acknowledging it.

{audio:0:30:02} Or not contributing back, at least on an Elastic framework.

{audio:0:30:07} And AWS was very blatant. They called it Elasticsearch, and now they call it OpenSearch, so that created confusion in the market; customers didn't know. They thought AWS's Elasticsearch was a partnership between Elastic and AWS, but it was not, which led to the license change. The good news for Elastic is all that is resolved. I've seen a lot of public data where the partnership between AWS and Elastic is getting stronger. Giant go-to-market campaigns, all that is very positive for Elastic because it was a big distraction. We were spending way too much energy internally on this than we should have because Shay took it personally. 

{audio:0:31:06} How do you feel that came across? In the end, it feels like there were 1% or 2% of open source purists that looked at that and said OpenSearch is the real open source because of SSDL and the restrictions that come with it. Yes, uncertainty enters; let's say I want to build my business on top of Elastic and then Elastic maybe doesn't want to. Elastic might never do it, but there is the possibility that they could come and shut everything down because I don't publish my source code, which of course, most companies don't, which is the SSDL kind of requirement. Do you feel that created meaningful uncertainty, or did that evaporate quite quickly?

{audio:0:31:58} There was a lot of debate as we prepared to announce the license change. We knew that the reaction would be pretty strong from at least some purists in the open-source world. We did a lot of things proactively, so we made a list, and we contacted all our customers and said, this license change has zero impact on you because you're a paying customer. The SSDL time limit is almost the equivalent of a poison pill in takeovers because it says, if you download the software and then you offer it as a service, you cannot do that. And if you do that, you then have to publish all the code. In other words, it had only one purpose, to stop AWS. That was the only purpose. 

{audio:0:32:58} Even though we expected a strong reaction, we were surprised by the intensity. You may have seen some very personal tweets. Some developers called Shay a turncoat, a traitor, and some used some language that I won't repeat, but it was very personal for some of them. But it died down pretty quickly. It was there for maybe two or three weeks and cooled off. It was not an easy choice for Shay. In many ways, AWS forced his hand to make that license change. But it's been almost a year and a half, so things have moved on. I don't think anyone is focused on it anymore. 

{audio:0:34:03} Let's go back to cloud because I thought that was quite interesting. I read about the CPO at Wells Fargo, and he talked about how he's letting new apps and teams adopt Elastic, but he's going to keep the main things on Splunk. I guess the idea behind that was compliance, and basically, why break something that doesn't work. It's not my money. Yes, it's three or four times more expensive, but why change something that works. He was stressing the compliance aspect a lot. I don't know to what extent that's a meaningful differentiator. Is it just a more mature product that the authorities have kind of okayed? But you did say financial was one of the big verticals. I'm just trying to understand, what's the twist when we're looking at these big banks? Why is it such a big hurdle to implement Elastic?

{audio:0:35:08} I’m sure you’ve heard this: God created the world in seven days because He didn’t have to muck with and install this. So Splunk is the incumbent and DynaTrace would be the incumbent, regarding APM. The biggest friction with Splunk is moving data because you have to index. In other words, once you've pulled all the data into Splunk, it can be nightmarish to migrate it to, say, the Elastic platform or any other platform. So Elastic's approach is never to replace Splunk completely from day one. That’s impossible. So instead, what we have always done is find greenfield opportunities but then get an entry point and, over time, migrate out of Splunk. There is a startup called Cribo; look them up. They have created a business, and all they do is help you migrate data out of Splunk.

{audio:0:36:49} I was about to ask about that. It sounds like that's an opportunity to streamline the whole process.

{audio:0:36:54} Huge opportunity. If you look at some of Cribo’s ads they say, how would you like to save 80% of your budget? Let's get rid of Splunk. It's a very aggressive, in-your-face sort of advertising. I used to joke that Elastic should acquire Cribo and just go after Splunk in a big way. And Cribo is not the only one, I've come across at least half a dozen of these companies that will help you get away from Splunk, and it's true that you can have a lot of tangible savings as you move out of Splunk. But it's hard; it's not just data migration but also many processes such as training your staff. In other words, you have to take into account many things, and the migration itself can be a long project that has to be funded with a programmer; it's not just flipping a switch. 

{audio:0:38:09} In accounts where Splunk is already present, Elastic's strategy is to get in and sort of surround Splunk. The goal is to reach a critical point where it becomes easy for the customer to say, it doesn't make sense for me to use both Splunk and Elastic and let's just standardize on one. But that takes some time. This is true in financial services, and this is true with the US government. Those are the two big verticals where Elastic uses this sort of approach. 

{audio:0:38:54} Finding the champion is the key. If you want to replace an existing vendor, step one is to find a passionate champion who will fight for you. We learned never to underestimate Splunk because they have a pretty aggressive sales team. They know how to sell top-down, whereas Elastic focuses on the developer. We rarely go to the C-suite, whereas Splunk will start at the top and try to push it down. They go where the check is written. 

{audio:0:39:37} Algolia, I think, does the same. They go to the head of ecommerce, while, of course, it's very bottom-up. It's an advantage, I guess; it's almost like a Trojan horse. You go inside the organization and slowly spread, and as people get excited about what you're doing, Elastic picks up. That was my sense that there’s a big opportunity because of how versatile the platform is. How it starts small, for just existing customers for Elastic, then can spread across the organization, and multiple teams, multiple use cases emerge.

{audio:0:40:12} Yes, completely. The power has shifted. If you go back even 10 years before SaaS became so mainstream, the person writing the check had a lot more power. Back then, unless something was approved, you couldn't even get it installed. But now, you just need a credit card, and maybe for $10 or $20 a month, you can experiment without getting any approvals. In other words, it's become much more democratized, and that benefits Elastic. It's also true that it hurts somebody like Splunk, who is used to selling at the top. They find it harder and harder. Even if the CIO is convinced, he cannot push it down if his developers hate it.

{audio:0:41:09} My biggest realization, I guess, was that at least earlier on, the biggest enemy to Elastic in terms of getting people to pay is Elastic itself because so many companies use the self-managed solution. Even big companies, I'm surprised many don't want to go to cloud because they have more customizability, I guess, than the self-managed solution. Because many of the cloud contracts are smaller value, at least you don't have really big customers on cloud. Is there a reason for that?

{audio:0:41:50} First of all, there are some big customers on cloud. One of the top travel companies in Europe is on Elastic Cloud; they became a customer almost two years ago, and it's a $5 or $6 million a year build size. But like I said, there was a big feature gap between what's in the cloud and what's in the on-prem software, which was a big hurdle for companies to move because they would lose features they were using. But that is gone; Elastic has closed the gap. Second, storage was a concern because depending on which cloud provider you're using, whether it's AWS or Microsoft, depending on their pricing model, you have to pay two people. You have to pay Elastic and Microsoft, or you have to pay Elastic and Google, and that second piece was expensive, depending on how much data you have to put on the cloud. That was a barrier as well. That started to change when Elastic introduced searchable snapshots about 18 months ago. Are you familiar with searchable snapshots? 

{audio:0:43:20} No, can you tell me more about it?

{audio:0:43:23} When you think of terabytes of data, you usually think of it in three layers. It's hot, cold, and frozen. Some data is hot, it's very recent, and you want to access it immediately. Then there's the second layer which is cold. A good analogy would be a bank. If you want access to this year's statements, you can get them immediately. You may have to wait for the next five years, and then beyond five years; good luck. Sorry. Companies very diligently, especially if they have a chief data officer or a data management team, would spend a lot of energy trying to define the attributes or the parameters of hot data, cold data, and frozen data. Typically, frozen data would sit in an Amazon S3, where it's very cheap. You don't want to pay much because you don't know if you need it. You may never touch it. 

{audio:0:44:37} The problem, especially with security, is any data can be valuable when it comes to security. You may want to go back 10 years and look for some anomalies over the last 10 years. There are plenty of use cases in security where you want to go back in time, and searchable snapshots allow you to search through all your hot, cold, or frozen data at pretty much the same speed. Because of the challenge with frozen data, the latency is very high. It could take a day to get a response back. But with searchable snapshots, it's to do with indexing. You'll get the gist of Elastic's work if you read the blogs on searchable snapshots. Clever indexing makes it seem like everything is accessible even though you could clear your data. That feature made it affordable for a large enterprise to put all their data in AWS because suddenly, they're not paying. If they do the layering well, they can control the costs. I think that's just starting to catch up, and you're going to see that driving the shift to the cloud.

{audio:0:46:08} That makes a lot of sense. How large of an opportunity do you think cloud is relative to the existing business? Will a lot of it shift to cloud?

{audio:0:46:21} I think so. The logic or the rationale is the same; most of your workloads should be in the cloud. It's going to be very hard today for a CIO to say, I need my own data center; I will never use the cloud. That's gone. It was dead even five years ago; now, nobody believes that. There could be some workloads you want to control, fine, but there's no reason for the majority of your workloads to stay in-house. The same logic and the same financial modeling can apply to Elastic. There's been a great trend that I think can make or break Elastic. One of the selling points for Elastic is its a database, a SQL query engine, and a visualization tool. All three rolled into one. That gives you fast results with little latency, so that's a big selling point for Elastic.

{audio:0:47:42} Unfortunately, Elastic has to compete with different competitors in each solution. Enterprise Search, go fight with Algolia and Correo. Observability, go fight with Datadog and then replace Splunk. Security, go fight with CrowdStrike and Exabeam. That's distracting. You suddenly have 20 competitors. The long tail of competition is even more, which can be distracting and exhausting, and some of these companies have been at this game a lot longer than Elastic.

{audio:0:48:20} DynaTrace has been doing APM for a long time, and AppDynamics has been doing it for a very long time. How can Elastic come in and catch up? It doesn’t make sense. So what Elastic has been trying to do is change the playing field. The only way you can beat the chess master in chess is not to play chess. Convince them to play some other game you're good at, and then you can beat the chess master. That’s what Elastic has been trying to do. Instead of competing on observability separately from security or enterprise search, Elastic has been saying, don't look at it like that. It's all about how I can get value from the huge volume of data I have. The use case may change, but what you're doing fundamentally is the same. You're searching through data and want quick results; you want visualization. If you're doing log analysis, that's observability. If you're doing threat hunting, that’s security. If you’re simply searching for all customer records, that’s enterprise search. That’s how Elastic sells it. My position messaging was all about that.

{audio:0:49:36} The challenge is that if you're trying to pick a tool for observability and you're not comfortable, you could get fired if systems go down. Even though you understand the power of Elastic, you want the safe bet, and you don't want to get fired. You say, you know what? I'm just going to go with Datadog because that seems like the safest solution, even though it may be good for the company long-term to go with something like Elastic.

{audio:0:50:10} Datadog built on Elastic, is that right?

{audio:0:50:21} So much is built on Elastic. That was the first thing that caught my attention; so many platforms and businesses are built on Elastic, and the technology was very powerful. But that was my main concern as well; I got overwhelmed. I usually only have to look at a couple of competitors, but now I'm like, in each of these pretty big areas like you said, there's 20 plus, there's the long tail of them, and it feels like people want to take the safe bet. Elastic will have to build stories and show success, which will build credibility.

{audio:0:50:54} Exactly. And so the market plan to watch is the convergence of DevOps and SecOps into DevSecOps. If you go to LinkedIn, there are already job postings for DevSecOps managers from some companies that are early adapters. In other words, if those two converge, then Elastic's story becomes much more urgent. Over time – and it will take some time – purchasing decisions and buying centers that are separate today will converge. If the DevOps and SecOps teams merge and security becomes part of development from day one and coding, you want a tool that can speak both languages. You want a common data plan; you want a common visualization plan. That makes Elastic’s story that much more urgent and powerful. 

{audio:0:52:03} In my opinion, Elastic has to do everything it can for that convergence to pick up the pace, and the way to do that is what you said. Find early adopters in financial services or healthcare, and show social proof. That's what Elastic has to do, more social proof. We need to see recognizable names embracing Elastic. The other big part of it was Shay stepping down as CEO. He was a reluctant CEO; he didn't want to be the CEO. He loves technology; he's a nerd, so he did it until he could find somebody and hand the job to them. Ash is top-notch. I had the chance to work with him almost daily. He has a strong security background, having worked at Akamai and McAfee. He's very customer-obsessed, which Shay was not. Shay was more products, he loved his product, and if a customer doesn't use it, they don't know any better. They have poor taste. He was like this proud chef. If you don't like what I'm cooking, something is wrong with you.

{audio:0:53:36} In comparison, Ash is very much customer-focused. He is focused on, for example, how to bring attrition down. Especially with SaaS, if you can reduce attrition by half a percentage point, what it adds to the pipeline is huge. It's much easier to do than trying to go find new customers or expand. To reduce attrition, you have to drive adoption; you have to make it easy to use because if you're using it, you're not going to give it up. In other words, Ash is focusing on all the right levers. Paul Appleby, who's no longer with the company but since his departure six months ago, was developing sales and including the top-down motion, not as loudly as at Splunk, but creating c-level messaging. Getting into Gartner's MQ is a good way to give comfort to a C-level executive. Gartner said they are a visionary, so don't fire me. All that has happened, which gives me a lot of confidence.

{audio:0:55:14} You covered Ash and Shay, which is great. There's been a lot of movement and attrition at the C-level, but I guess for the better in some ways?

{audio:0:55:32} Rearranging Elastic for the new five years or the new 10 years, it’s a new Elastic.

{audio:0:55:39} Yes, the culture at Elastic is that of a typical startup, very left-leaning and very woke. Shay was very woke. And very transparent. They would have an AMA, an Ask Me Anything every Monday morning. People would ask about politics, and he would answer. I though, don't do this. Why are we talking about this in a company ambiance? But he was like that. For him, you bring your whole self to work, so he'd take on topics like racism or the election debacle, what happened in the US on January sixth of last year, things like that which typically in a typical corporation in the US and Europe, you don’t. There are certain things you don’t talk about; it's understood that they are out of bounds. 

{audio:0:56:39} But Elastic was not like that. It was a culture that promoted diversity and embraced everything. With Ash, he's getting Elastic to be the vendor of choice for enterprise and, at the same time, not losing some of the things that made Elastic one of the best places to work. It's a tricky balance, but that's what he's trying, to tone down some of the wokeness while trying to keep that culture. I think some of the attrition is natural because there are people who have been with the company for eight to 10 years. That's exhausting. 

{audio:0:57:23} When I left Elastic, it was almost 180 bucks, so they also made enough money to say, you know what? I'm going to take a year off. I think the pandemic also convinced some people that this is a good time to just chill and spend time with family. Some of the attrition is very natural. That's the thing. Most people don't leave; the attrition was quite low and distributed. It has been distributed from day one, not just because of the pandemic. And the product is so cool. How can you not love the product? 

{audio:0:58:16} I'm curious because you mentioned what we discussed as the Elastic make or breakers. What other things do you think are maybe not make or break, but close to that, like important key things Elastic has to get right for the business to function as Ash envisions?

{audio:0:58:42} Expansion would be the second one. Because the initial build size can be relatively small, but the overall opportunity can be huge. Wells Fargo is a great example. Or Oracle. Any big enterprise with a lot of dev teams creates so much opportunity for Elastic to expand, and expansion requires both sales and marketing. On the sales side, you need a dedicated accounting who know what they are doing, and you need many hours to do the research, to properly do the search, come up with an org structure, find champions, and then marketing has a role to play. 

{audio:0:59:25} We call it DBN, or dot com-based marketing, where you start doing things like webinars, the swag explosion where you flood a dot com, floor the customer with a lot of Elastic swag: coffee mugs, t-shirts. Twilio, how popular is this? They call it swag explosion. Even if one developer uses Twilio, a big box will come. They interest the developer to just distribute the swag to everybody. Things like that, which Elastic has not done before. Shay's sales strategy was that developers would love it and use it. All that is happening in marketing and sales. Expansion, I think, is a big lever for Elastic to grow and just keep moving people from on-prem to the cloud as fast as they can do it.

{audio:1:00:21} That's almost a flaw for revenue, where you don't have to go sell Elastic, you don't have to convert them, you're competing with yourself. Just unplug on-prem, and move to the cloud. That will become easier now because there's feature parity between on-prem and cloud. Those are the things that Elastic has to do, and they’re doing it.

{audio:1:00:56} One of my last questions would be that I see things change a lot for me as a developer. Many companies come in and acquire something because they may be focusing on a specific niche. Databrick Spark, I think I heard many good things about their AI, and probably Elastic's will never be as good as Spark's, or Algolia is so good out of the box, and you can just plug in and play. Are these tail risks to you or things Elastic can conquer over time? How do you think about these different aspects where maybe Elastic falls behind? How does that impact the business?

{audio:1:01:48} For the global 2000, the top 2000 companies in the world, Elastic is a platform sale. You have to approach selling to the global 2000 as a platform where you can do multiple things. Below that, mid-market down, go head-to-head with Algolia and enterprise search. It's a dual approach, and that's the core market strategy of Ash. The opportunity with the global 2000 is humungous, I think. Remember, Elastic has not yet invested much in Asia. The bulk of the revenue is still in the US and Europe. Asia is a big untapped opportunity. I've seen, just watching LinkedIn, that Elastic hired a lot of community evangelists in Asia, China, and India, so those could open up untapped markets with Elastic. Especially with Elastic being available on Alibaba, it is easier for some Asian customers to move to the cloud.

{audio:1:03:15} It seems as if you look at LinkedIn as an indicator of what sort of people they're hiring and what sort of people are leaving. I feel like you do that a lot? Is that something I should be doing as well?

{audio:1:03:32} Yes, you can also set up alerts so you don't even have to look. They'll just shoot you an email. Before Elastic, I was with a company called Equinix; a completely different market product. We had a problem because we were trying to sell something called interconnection, which enterprise IT had never heard of, and we wanted champions. We wanted just a handful of accounts we could tout as case studies. So we looked for CIO changes, we set up alerts on LinkedIn so anytime a new CIO was hired in a company, we would go and say, we would love to make you a champion. How about winning an award in your first year in your job? People who come in new at the C-level want to make a mark quickly. You have six months to a year to do something that people will remember you for, so anytime you’re trying to sell something, like a platform sale, that’s your window of opportunity. We used to do that, and we did that at Elastic as well. Any new CIO would move to the top of the list.

{audio:1:04:52} Do you feel like they got more social proof in your time at Elastic? Did you manage to get those champions?

{audio:1:05:16} Yes. The way to get customer case studies or social proof is to pay salespeople. Salespeople are like vending machines. We created a program where they would be paid for every customer they could get. We did video case studies because these days, very few people want to read, and most people want to watch. We even had TikTok versions of video case studies. Nobody wants to watch a 30-minute video. They want 30 seconds, so we made a TikTok version. Many investments are going into social proof, which I think is required. 

{audio:1:06:07} To go back to AWS, it seems like it has dissipated. The relationship with AWS as a cloud provider seems pretty good, but what do you think? Even though there's no more confusion in the marketplace, it doesn’t seem like if you're on AWS, it feels like a no-brainer to use their version. Do you feel like that’s the case? Is there a reason to come to Elastic if you just have OpenSearch? Maybe it's behind in a couple of features. What do you think about that?

{audio:1:06:54} The gap between AWS OpenSearch and Elastic will continue growing fast because Elastic comes up with a new release every six weeks. It's going to be hard for AWS OpenSearch to keep up. That’s number one. Second, I wouldn’t be surprised if AWS pulls the plug on OpenSearch at some point. Because if they want to compete with Elastic and be an alternative to Elastic, they have to invest heavily in R&D. If they don't want to do that, then OpenSearch simply becomes a search tool. If you're already an AWS customer, you have all your workloads on AWS, you're using NET 3 and you need log analysis, yes, use OpenSearch. There will always be customer use cases that apply because it’s the easy button. 

{audio:1:08:03} But if you’re serious and you have sophisticated use cases, or you're not on AWS, I think the market is big enough. If you draw Venn diagrams, if there are AWS customers who have trivial use cases for log analysis, it would probably be the sweet spot for OpenSearch. And AWS is a big company. If you look at other examples, MongoDB or even Snowflake, there's a lot of competition. Elastic is not alone. AWS and Snowflake are partners, but they compete, too. AWS has always taken the approach of customer choice; may the product win. 

{audio:1:08:54} I think it will become a non-issue as time passes, especially as the gap widens because Elastic is putting in things like NLP, natural language processing. The pace of innovation is just amazing, and it will not let up. Since Ash came on board, Elastic now has R&D teams in Tel Aviv and Bangalore, India. In both places, the dollar goes farther, and I think the pace of innovation will pick up even more. That should be Elastic's strategy, increasing the distance between AWS OpenSearch and Elastic, but people look at OpenSearch as just a log analysis tool.

{audio:1:09:57} Yes, and Amazon maybe just doesn’t have the focus on it. The people who work on OpenSource might also have other projects, but it's just not their focus. I think that because, of course, if they wanted to pour in the resources and compete head to head, they would probably do well. But it doesn't seem like that. 

{audio:1:10:19} If you look at AWS’s analytics portfolio, OpenSearch is one of 15 things. There’s Athena, there's Redshift, there's EMR. In other words, AWS has so many more powerful things to focus on than trying to compete with Elastic on OpenSearch. And AWS is a very frugal company. They don't hire armies of people. That's another reason; it's not like Microsoft, for example, or even Google.

{audio:1:11:00} Thinking about OpenSearch and in general, I guess it's the easy button. Because with Azure, you also have Azure Search. I'm guessing there's always a built-in solution with your existing cloud provider, but it's not the same. Elastic is, just like you said, a toolkit.

{audio:1:11:24} The analogy I give is that you're traveling. You're staying at a Marriott, in your hotel room, and you want a cup of coffee. There happens to be a Starbucks store inside the Marriott. So that serves your purpose, you want Starbucks coffee, you’re at the Marriott, you get it. But that will never replace going to a Starbucks store where you have the full menu, and you can pick and choose whatever you want. It's a convenience thing. I'm already on AWS and need a search tool; OpenSearch is great. But if you want observability, the whole set of features, it will become a problem for AWS to continue to match.

{audio:1:18:39} It seems across the board. Elastic has the things that the others don't, which is how you make those things scalable and all that back-end stuff, and they just need to make it super easy, like the front-end stuff. Algolia has all these prebuilt components that you can just plug in, say what index you're searching through, give some options, and that's it; it just works. And you can fine-tune the rules in the dashboard. I guess that's an opportunity for Elastic to make it a no-brainer.

{audio:1:19:16} Completely; it's called an a-ha moment. With a lot of the SaaS companies, it's product-led growth. They all have free trial periods, and with Elastic, it's two weeks. So for two weeks, you test Elastic, and you must hit your first a-ha moment within those two weeks. If it's within the first two days, even better. Because if you don't say a-ha in the two weeks, you're probably not going to become a paying customer. 

{audio:1:19:52} Datadog, for example, as a comparison, is super easy to use; you can get you’re a-ha moment pretty quickly. Even when I was there, the product management team started putting a lot of energy into figuring out if someone signs up for a two-week trial, what exactly do we do? Step one, step two, how can we help them, so they get their a-ha moment. Same with BrowserStack; a lot of people buy Automate, their automation testing suite, and don't know how to use it. They just stop using it. The key is to get the user who signs up to their first a-ha moment as quickly as possible. 

{audio:1:20:42} I guess they will embrace the challenge because it’s an obvious thing to convert these people.

{audio:1:20:46} Data ingestion was the biggest bottleneck.

{audio:1:20:52} For instance, they have the web scraper and started building these different tools to make it easy for you.

{audio:1:21:01} When I saw the web scraper, I thought it was quite cool, they'll just do the work, and I don't have to. If I was going to use it for that use case, and I saw they just keep trying to make it obvious how you can use Elastic. Of course, Algolia does it better, but for Elastic, at least that's low-hanging fruit. I hope they take it.

{audio:1:21:28} I’m pretty sure, especially given that we now have Ash in the CEO seat, I’m confident.

Elastic Positioning & Growth Strategies

Former VP at Elastic

inpractise.com/articles/elastic-sales-and-marketing-strategies

Executive Bio

Former VP at Elastic

Interview Transcript

Related Content

Datadog, Open Telemetry, & A History of Observability

Principal Developer Advocate at Honeycomb and Former SRE Leader at Google

Selling Microsoft Office 365 Commercial

Former Modern Workplace Leader, Americas at Microsoft

Chronosphere: Datadog, Prometheus, & Centralizing Observability

Sales Account Manager at Chronosphere

Elastic: Customer Perspective

Former Director at BAI Communications, an Elastic Customer

Partner Interview