Ask HN: As a new SaaS business, how do you find your first 10 paying clients? * you don't have SOC2 certification;
* actually you don't have any security certification
* you can hardly pass the financial or IT security questionnaires with big ticket companies
* you have two employees. How do you get your 10 paying clients? Greateful for your thoughts. |
The main pushback we see is the following: 1) It is hard to get budget carved out for new enterprise software without explicitly showing saved time, saved money or more money. The best bet is to find a "champion" will will work with you to build out case studies and sell internally. The issue for that person though is they are going out on a limb and that is a double edged sword.
2) We were selling software to someone that essentially did the same job as our software. It created a lot of feet dragging and undermining. It wasn't in a malicious way but its hard to go in and disrupt the "old school" way of doing it.
With all that being said, the more customers you get, the easier it gets. The early ones can work with you to build out case studies that let you narrow down the key benefits and that can be used to sell new customers.
My friends that successfully sell software for a living often sell software that everyone already owns a version of and they know exactly who to speak to. I think those are the two hardest parts and once you can get past that, again, its just about saving time, saving money or making more money.
Getting there thought might take quite a while :)
In my experience selling to the enterprise things like SOC2 and ISO270001 simplify and reduce friction in the sales process, but they're often not showstoppers.
When you pitch your product to your business sponsor, they're buying based on the value you deliver, a trust in you as a seller, and a conviction that the product will solve their problem. And then once they start to involve IT and procurement and security, then all of a sudden the focus shifts away from value and towards risk and cost management.
By having SOC2, a rock solid pen test report, ISO270001, etc. you can fast-track a ton of these processes. But otherwise, as you note, they'll throw big Excel sheets at you with questions for which many of your answers will likely be "No".
Answering "no" on questionnaires is not a showstopper. Your response on financial questionnaires will most definitely raise business continuity red flags. Your response to the security questionnaire will definitely raise data security red flags. But ultimately these questionnaires are an effort to get a full picture of the risk profile of working with you, not a test where you need to score 100/100.
So in your case, your focus needs to be on the business sponsor. They will be presented the risks from your security and financial reviews, but if you have adequately articulated the value of your product, presented an aura of business stability and growth, operated from a customer-focused mindset, then they will have the conviction to accept the risks presented by the other teams.
And sure, sometimes one of your answers will be a showstopper. So then it's up to you to look into whether you commit to fixing that showstopper as part of the contract. One of my contracts required us to get ISO270001 certification within 2 years - but we were still able to close the contract.
We closed a contact for a business critical system with one of the top 50 companies in the world, who demanded a financial review when we had months of runway.
There's always a path.
Feel free to email me if you have more questions.
So the answer may be: you don't do SOC2 clients unless you already have connections. I could be wrong but I sell in SMB space so I may be biased.
Oh and you have to do it manually regardless. No ads. No content marketing etc. Talk to those potential customers.
These 10 clients, are also the ones that are going to allow me to raise capital from a VC.
It's quite brutal to be honest.
Be careful -- that is a common(?) way for VCs to also say no -- "come back when you have 10 clients" which next time becomes "come back when you have 50 clients" and it goes on forever. Not saying that is the case here, but, don't put all your eggs in one basket that you will be ready to raise when you have 10 clients.
https://www.joincolossus.com/episodes/74462352/behrens-when-...
Their original business idea was to build a usable API wrapping existing APIs for shipping, and sell it to mid-large ecommerce merchants. But they didn't have any existing customers and none of these larger customers wanted to buy their service as they didn't have proof of being able to handle volume. Instead they decided to target a different market niche, tiny ecommerce businesses -- but the problem with those customers is that they have no idea how to use an API, so Shippo had to build a shipping UI on top of their original API offering, and they'd sell the UI to tiny customers, until they built up enough volume and credibility to start winning some API sales to the original market segment they wanted to sell to.
Try to think if there is a subset of companies that expierice the problem your startup solves in a more dire way than others.
I’m getting around some difficult compliance issues by allowing on-premises installs. You might be thinking “well that’s not SaaS”, but at least some big-name SaaS providers (e.g. GitHub Enterprise) offer that.
In the same time, you cannot go wrong with selling to 10 clients if this is something withing the reach. In the same time this can be very strenuous when you run on small budget and the runway is within sight.