7 Go-to-Market Lessons from Building a Category from Three Security Breaches

7 Go-to-Market Lessons from Building a Category from Three Security Breaches

Most founders build products to solve problems they’ve observed. Itzik Alvas, CEO and Co-Founder of Entro Security, built his after experiencing the same catastrophic failure three times. In a recent episode of Category Visionaries, he shared how repeated breaches at Microsoft and a healthcare organization became the foundation for pioneering an entirely new category: non-human identity management. His journey offers tactical lessons for B2B founders navigating category creation, unconventional branding, and the transition from seed to Series A.

Lesson 1: Exhaust Existing Solutions Before Building New Ones

The instinct to build is strong, especially for technical founders. Itzik took a different path. After being breached twice at Microsoft and once as a CISO, he didn’t immediately start coding. “After being breached for the third time. And after not being able to find solution that will help me resolve the problem, you know, I started to think maybe I should build something,” he explains.

The sequence matters: identify the problem, search exhaustively for solutions, confirm the gap, then build. This approach does two things. First, it validates genuine market need—if you can’t find a solution after serious searching, others likely can’t either. Second, it gives you deep knowledge of why existing approaches fail, which becomes your competitive edge.

For founders considering building in a space, the test is simple: can you articulate exactly why every existing solution falls short? If not, you haven’t done enough homework.

Lesson 2: Category Creation Requires Different GTM Mechanics

When Entro started, non-human identity management wasn’t a recognized category. “That’s a very new category. We helped pioneer that,” Itzik notes. “Were the first company out there to do that, and now there are a lot of companies.”

This creates a specific GTM challenge. “We needed to build that category. We needed to drive a lot of market education about why is it a serious problem,” he explains. The work isn’t just competing for deals—it’s creating the conceptual framework that makes deals possible.

Itzik’s framing of the problem demonstrates this: “Developers, DevOps users are the ones who are creating permissioning. Them, using them are without security oversight and they scatter them around so they, you know, committing them into code, they are sending them over slack and no one is actually managing their lifecycle, no one is deleting them, no one is making sure their permissions are right side.”

Category creation means your marketing budget goes to education first, conversion second. You’re teaching the market to recognize a problem they didn’t know had a name. Only after that awareness exists can you compete on solution quality.

Lesson 3: Design Partners Trump Paying Customers Early

In the initial months post-seed, Entro focused on a specific type of customer. “Out of the gate you want, you know, some design partners, you want some customers paying or not paying, whatever, but you want someone that understand the problem, want to solve the problem, and is willing to give you feedback about what you’re doing to make sure that you’re advancing it right direction,” Itzik shares.

The emphasis on “paying or not paying, whatever” is deliberate. Early stage, the currency isn’t revenue—it’s feedback quality. Design partners who understand the problem deeply and will tell you when you’re wrong are more valuable than customers who pay but don’t engage.

This approach also creates reference points for your category creation work. When you’re explaining a new problem to the market, being able to say “here’s how Company X experiences this” makes the abstract concrete.

Lesson 4: Differentiation Through Branding Works When Substance Backs It Up

Cybersecurity branding follows a template: “The usual cybersecurity companies are blue and white and somewhat black and very serious approach,” Itzik observes. Entro went the opposite direction.

“I led security for a long while and, you know, I wanted something that looks and feels more, you know, young and fun and that’s definitely the approach that we went to. Yeah, the main, the main goal was to make it as fun as B2C, but definitely still B2B company.”

The risk is obvious—appearing unserious in a serious market. When asked if the playful branding cost deals, Itzik’s response reveals the underlying logic: “I don’t know if someone came into the website and left because they feel like that’s not serious enough for them. Hopefully, you know, the logos out there and the customer acquisitions and the stuff we’re doing means more.”

The lesson: bold branding creates memorability, but customer logos and product performance create credibility. You need both. The branding gets you attention in a crowded market, but the substance closes deals. Neither works in isolation.

Lesson 5: Events Have Different Jobs—Know Which One You’re Hiring For

Most B2B companies approach events tactically: attend, booth, leads, done. Itzik’s framework is more surgical. “I think that you should force yourself, what is your goal coming into that event?”

He breaks events into distinct categories: “Big boots over there. I’m not sure if they are very helpful in terms of, you know, legion and creating new leads and creating pipelines, but they are great for brand awareness and for positioning and some other, you know, events are the other way around. They are great for pipeline creation but not that great for brand awareness.”

The operational implication: “You need to understand what you’re trying to get out of that event. And then, you know, you can align the other stuff like the size of the boot on which people to bring in and what to do over there.”

This prevents two common mistakes. First, measuring the wrong outcomes—expecting pipeline from a brand awareness event or vice versa. Second, making misaligned investments—spending for a large booth at a pipeline event when a smaller presence would suffice.

Lesson 6: Product-Market Fit Means Customers Use Your Product the Same Way

Itzik draws sharp distinctions between seed and Series A requirements. At seed: “You need to mainly sell an idea, but that should be somewhat of a calculated risk in terms of you’ve done your market research, you interviewed your customers, you are getting to repetitive circle with your market.”

At Series A, the bar shifts: “You should have customers, you should have reached the $1 million mark. Your customers should use your product, love your product. All of them should use it in the same way, by the way, like if you’re, if each customer is using a different portion of the product, that’s not, not as good as it can be.”

That last clause deserves emphasis. Product-market fit isn’t just customers who pay—it’s customers who use your product identically. Scattered use cases suggest you haven’t found the repeatable motion yet. When every customer implements differently, you don’t have a product—you have a services business disguised as software.

Lesson 7: Your First Category Becomes Your Beachhead for the Next

Itzik’s long-term vision extends beyond non-human identities: “To lead the identity market, for sure. And there are a lot of companies that have done great things with the identity market. Most of them are more often on premise solutions and the cloud is much larger.”

This reveals strategic category thinking. Non-human identity management isn’t the endgame—it’s the wedge into the broader identity market. By establishing category leadership in a specific, solvable problem first, Entro creates the credibility and customer base to expand into adjacent spaces.

The principle applies beyond cybersecurity. Your first category should be narrow enough to dominate but adjacent to something larger. Category leadership in the narrow space becomes your qualification to compete in the broader one.

Applying These Lessons

Entro’s journey from three breaches to category leadership demonstrates that pioneering new markets follows patterns. The work begins with exhaustive problem validation, continues through sustained market education, and succeeds through consistency—consistent product usage, consistent messaging, consistent execution.

For founders considering whether to build in an existing category or create a new one, Itzik’s experience offers a framework. Category creation isn’t inherently better than competition, but it is different. It requires more market education, longer sales cycles, and bolder positioning. The payoff? If you succeed, you don’t just win market share—you define the market itself.