By Angel Mehta, Managing Director, Sterling-Hoffman Executive Search
Angel Mehta: How did you get involved with Entrust? The last assignment I had at Nortel was heading the e-business and enterprise parts of the business - so the non-carrier part of Nortel. One of the organizations we had was Entrust. We spun that out of Nortel back in the late nineties. I was Chairman of Entrust until I became a 16B Officer at Nortel, which required that I step down.. Three years ago I decided it was time to come over to Entrust again and focus on the security space.
Angel Mehta: Was it viewed as a turnaround situation?
Bill Conner: Yes, when I got here, Angel, it was $30 million of revenue; $55 Million had been spent. We had 1255 employees when I came to Entrust - now we have 503 as of last quarter. So it was a huge turnaround job.
Angel Mehta: A successful one?
Bill Conner: We recently introduced the most new products in a hundred day window in the company's history, and we've enjoyed tremendous deployment of our products. We've had record renewals on our maintenance contracts, which showed us that people were deploying the solution and getting the value. So I'd call that successful.
Angel Mehta: What was wrong with Entrust that resulted in a 'turnaround' initiative being required and what were some of the major changes you had to make when you came in?
Bill Conner: The first thing was getting a handle on the financials. I joined the company in April 2001, literally a day before the earnings call, and on June 4 we had a major restructuring where, in that six weeks, we took the organization from multiple business units, and drove it to a global, functional organization. After that, it was about focus. There had been four acquisitions that were operating as separate businesses. We collapsed them into one - which literally took out 40% to 50% of the workforce. In the restructuring, we took out a lot of senior management as well as more junior employees, and we re-focused our strategy around certain key technologies. We also focused in on certain vertical markets in certain geographics.
We've continually refined the products to lean more towards solutions. Solutions like secure messaging, secure identity management and secure data. We've also overhauled the sales force itself to go more towards a solution sell. In the past security was not sold based on ROI. It was more about, 'Mr. Customer, you had better buy this or else'…
Angel Mehta: Fear-based.
Bill Conner: A fear-based approach. What we focused on over the last three years is how to use security as an enabler, not just to keep people out, but to let people in - because businesses and government are trying to have access to content and information. They want to provide information over the Internet, or through e-mail or files and folders, and do it securely without exposing any information.
Angel Mehta: What is the single biggest difference between leading the enterprise business at Nortel and running a much smaller organization like Entrust? You grew up primarily in a large company environment, with AT&T, Nortel, etc. so it interests me how you adjusted to a smaller organization.
Bill Conner: You're right, it was a big adjustment. When I started running the enterprise piece at Nortel there were 23,000 people in it. The day I left, there were about 12,000. Twelve thousand versus 1,200 at Entrust - that's an order of magnitude difference.
The single biggest difference? At Nortel, you spent 80% of your time working with other organizations to make sure they understood what you think the right things are…to make sure they understand what it is you intend to do. At Entrust, I spend 100% of my time actually doing the right things. Big difference
Angel Mehta: Let's talk about how Entrust is positioned today. What is the business problem the Entrust Suite solves for customers?
Bill Conner: Our focus in the market is a category called "Identity and Access Management". It's really about dealing with digital identities and digital information. Questions like, how do you know who is on either end of a digital transaction, or how do you know what the information is, and how do you protect, encrypt and manage it? That is the basis of what Entrust does and we do that across the three solutions I mentioned: secure messaging within an enterprise, from one business to another, or for enterprise or government to consumer or citizen. We deal with secure identity management from how a server can talk to a server on a Web service model, to a Web portal and how you can use Web certificates to provide a base level of security for provisioning of digital identities in an enterprise, etc.
Angel Mehta: Are you still having to put forward a 'market growth' effort? Or has the category reached a point yet where evangelization is no longer necessary?
Bill Conner: First, I think it's more than just evangelization. If you look at it Angel, since 9/11, awareness about the importance of security has been raised tremendously. Most of that awareness has been around the perimeter, in terms of the number of viruses, the firewalls, and intrusion detection. I think those three areas have gone from low to high awareness, with a pretty good understanding in the marketplace.
The next wave of this is going from awareness to *understanding. Look at the number of phishing attacks that are happening today - depending who you believe, there is anywhere from $1 billion to $3 billion of costs embedded in that. That goes right to the heart of a brand, right to the heart of people's confidence, and those are the kind of things now that you have to deal with. Authentication and authorization in a new model in this digital world.
Most of the CIOs that I've talked to know it's something they need to do and have it as a high priority. The gap is, how do you build the business case and how do you attach that risk to a business risk. That's why I've co-Chaired two different industry task forces. One was the Business Software Alliance with Tom Noonan from ISS who I know you've talked with, and most recently in the Department of Homeland Security one with Art Coviello (National Cyber Security Partnership or NCSP Task Force). I'll put my CEO hat on and say, "\what's my check list for information security governance? What should my Board be looking at and what should I be looking at as a CEO? What should my business units look at and what should my CIO look at?"
It's funny because before Sarbanes-Oxley, if you had IT problems, you fired the CIO. Now, if you have governance issues, you fire the CEO! Part of what was needed was that template around information security governance that a company could use as a global template to navigate this new world that they're into. That's why we (on the NCSP task force) came out with the framework we have. Entrust has been using that framework for almost eighteen months and we have discovered that it is a journey much like quality was 50 years ago, Angel.
Angel Mehta: From an investor's standpoint, is the timing right to enter the security market? You are in a position where you're sitting at or close to the top of the mountain looking down. From that vantage point, is this just another bubble or is the hype around security a little bit different at this time in that maybe it's justified?
Bill Conner: It's not about hype. I think the hype was the fear side. The reality is that there are lots of vulnerabilities out there and more importantly, there are many business uses where security can help. You can extend your business to your customers, your suppliers, your partners, and do it in a safe and secure manner that doesn't cost you productivity or the types of class action suits that can come out of legislation like California SB1386.
I like to use the Quality process as a basis for comparison. What was the first thing that people said about it? There really wasn't a lexicon for quality and, you know, the first book was published and all of a sudden you had a parade of Quality Experts and new techniques. It didn't start with quality in Six Sigma…and I remember in the corporate world the first thing you said was 'cost or quality.' Many people said you can't afford quality. But if you look at what's happened over 50 years, the concept of quality has become a fundamental way of reducing cost, bringing value, and differentiating. I think information security will be the same.
Now, contrary to that, if you listen to Tom Ridge, and if you listen to a lot of the people certainly in the United States and other governments, they say the legislation's coming because it is a different world and 85% of the critical infrastructure lies in private hands. So, as they say, we are at war, and cyber terrorism is a new war front - separate from air, land and sea. It's the Network. So that is certainly a driver.
Angel Mehta: Do people who understand security really well - for example, yourself, and other industry insiders - have a greater paranoia about what could go wrong? I remember that the most paranoid I was about getting sick was when I was studying biology…
Bill Conner: Absolutely. I mean, why have I spent so much of my personal and corporate time on this information security governance? What increasingly keeps me awake at night is the sheer risk we face - every single day. Our economy is at risk. Those of us who are practitioners in the security space, and understand it, understand that the risk countries and industries are running right now is just immense. It's not a question of "if" a disaster will occur. It's a question of "when" and "where" and "how severe", and that's the stuff that you worry about because most people just don't have a good enough understanding. As an industry, I don't think we've done a good enough job of moving out of the hype and moving into the kind of framework you need to manage and prioritize. We haven't made our solutions easy for enterprises to adopt and protect the information they need to run their business.
Angel Mehta: How have the expectations of CEO competency changed from the time you joined Entrust to now?
Bill Conner: I think that in this kind of market and with these kinds of stakes, shareholders, employers and constituents expect CEO's to have a hands-on working knowledge of every aspect of the business. It's a tall order for us. It's even a taller order for bigger companies that are more diversified. However, that is the expectation. Your ability to have had operational experience, and at various disciplines or functions or geographies that your businesses work in, are paramount now because at the end of the day you're the one signing and attesting to it. I think that's a big difference. It's important for the employees to know you're comfortable at their level, as opposed to just the level of the executive offices. They need to know you're watching and you're involved. There's an old saying that goes, "Trust everybody but always cut the cards". That's the world we're living in now.
Angel Mehta: I've heard it put another way…'Have faith in the Lord, but always build your house on high ground.' [Laughing] So, tell me, how do you tell if an executive whose experience has been in running a billion dollar business can actually survive in a smaller entity?
Bill Conner: It's a critical issue. There are a couple of challenges the CEO making that move has to deal with. One is the huge change in the size of your staff. In a large company, you would always be able to find talent from within. When you go to small companies and start cutting through that amount of experience, either geographically, or functionally, it is not even close to the depth you have in a larger company. That means, you're going to bear more of the weight…and you're going to have to have a different balance of hiring versus promoting from within to get the right balance.
Angel Mehta: Does it take more or less energy to run a smaller company?
Bill Conner: It's takes a whole different level of energy to run a smaller company. At a small company a CEO is carrying the leadership role and overseeing the same amount of work that the Securities and Exchange Commission requires at say, Nortel. So that takes a lot more personally out of you in terms of your own passion and energy - not to mention drawing on the operating expertise. If you don't have it, you'll get exposed - because there aren't a lot of other people, especially in turnaround situations, that you can just hand things off to given the timeframes and the risk you have.
Angel Mehta: How do you ensure that information about how the company is doing at the lower levels reaches you as CEO at the top before things spiral out of control?
Bill Conner: The key is to have enough fortitude to be able to first think about your own mistakes. To look yourself in the mirror when you're shaving and go "damn that was a mistake" and deal with it. I think it is critical that you be paranoid, you be relentless on yourself and the mistakes you make because at the top, if you're not, it's awfully hard for others to tell you you're making mistakes…people in the organization aren't going to tell you about the bad things unless you really are open to hearing about them - and confronting your own blunders first. There are no easy decisions at the top - if you can cope with that, information will flow easier from the bottom.
Angel Mehta: Tell me about the evolution of Bill Conner. If you were to take a freeze frame of Bill today and then one of Bill 15 years ago, what would the differences be in terms of approach to leadership or temperament? How have you personally changed as CEO?
Bill Conner: Well, I looked a lot skinnier because I had a lot more time for exercise. [Laughing]…But beyond that…I think there are a couple of things. First, I make tougher decisions faster. Particularly in terms of dealing with Personnel - either in terms of accountability or performance or attitude. I was a hell of a lot more patient with leaders or managers in the past. The second thing is that in past lives, I focused more on development of human capital. In this market that's hard to do, and it's certainly much harder to do in a small company. Which does not mean it's not important to do it - it's just that you don't have the time. You just have to hire people that can hit the ground running.
Bill Conner is Chairman and CEO of Entrust. Before Bill joined Entrust, he held various senior executive positions at Nortel Networks, including president of Nortel Enterprise Networks and e-Business Solutions. He was named "hi-tech marketer of the year" in 2000. Conner joined Nortel Networks in 1992 from AT&T, where he served in various leadership positions. He can be reached for feedback at: bill.conner@entrust.com.
Angel Mehta is Managing Director at Sterling-Hoffman, a retained executive search firm focused on VP Sales, VP Marketing, and CEO searches for enterprise software companies. He can be reached for feedback at: amehta@sterlinghoffman.net
