Qualys CMO May Mitchell Takes ROCon to the Business Level

Hey everyone, welcome back here to our day two coverage of Rockon in the beautiful Fairmont Hotel here in Austin. I'm really happy to have our next guest. I interviewed her, I don't know how many of you watched last year's Rockon, but I interviewed her last year.

She had just recently joined at that point, right? CMO Mae Mitchell at Qualys. Mae, it's great to have you back here.

How are you? Thank you. Doing really, really well.

Sorry- Exciting to be here ... it is. Well, there's a buzz here, right?

Yes. A palpable buzz. Yes.

I think a lot of it has to do with a lot of announcements from Qualys. I think a lot of it has to do with the layout this year is very conducive to energy, right? It's energy conducting, if you will.

I- Yeah. It's like a continuous flow. Yeah.

It really... I mean, and we're sitting, people can't tell 'cause they're only looking this way. We're sitting kind of at the end of the hallway, but it goes on, and the partner booths are there.

It's a really nice thing. I mentioned last year you had just recently started with Qualys. You were kind of feeling your way and putting your stamp on things.

So it's been a year now, you've had a chance to really settle in. I personally, I've been going to what was the QSCs, Qualys Security Conferences, when Philippe first broke them out of RSA. God, 15 years ago, 12 years ago, something like that.

Last year, of course, was the first Rockons. Yep. Beyond the change of the name, let's start with that.

What's different between the QSC versus Rockon? And then let's talk about what's different from last year to this year. Yeah, it's a great question.

So last year I had literally just started. I came on, and I had five weeks to transition from what QSC is to something related to risk operations. We didn't even know it was going to be called.

Working closely with Sumed, the product team, and the rest of the marketing team, we thought that Rockon- Right ... was the brand that we wanted to put the stamp on. So it was taking all the learnings from many, many years from QSC, which was really about the Qualys development and customer community.

Yeah. That they've spent so much- It's a user group, a giant user group. Absolutely, and people love the training piece of it.

Yes. What we did at Rockon is we knew that we needed to lift the conversation, up-level the conversation, because cyber risk is business risk. And so we needed to do that with the content.

Content first, the content narrative, and then also getting outside speakers at a very high level. So that was really the first phase of it, was transitioning, letting all of our base know QSC has officially transitioned to Rockon. They all sign up.

We are still having the training. We are also not charging. This is the only conference that I am aware of that we do not charge.

For training- I agree with you ... conference, everything with the meals and everything. And people really appreciate that.

They really appreciate that. Absolutely, especially in today's market. Yeah.

We do a lot of these obviously for a living. Yes. I do conferences.

I told you I was here last week in the same hotel, same everything. Unheard of, that it- Yeah ... no charge to get in, right?

Yeah. But you know what? That allows your practitioners, your...

Because the C-level people, they have budget. Yeah. But for the practitioners, they always have to justify buying a ticket to it.

Absolutely. Absolutely. So last year was the first one.

We learned a lot from it, and then we went around the world. Because we do a Rockon in every major region, and we did five of them. So today is the second annual for the Americas, and we've grown, 30% of the attendees are prospects.

Really? Yes. Not present Qualys customers?

That's correct. What? That's fantastic.

Absolutely, and the other thing is we also have the level of attendees, director level and above, director, VP, head of, advisor, president, COO- Right ... board members. That's 25%.

Really? So that's growing. I think that's also a case of you leveling up the messaging, the content- Yes ...

for leadership. But, I want to be clear, if you're not a C-level person, you're still welcome here, and there's still plenty- Absolutely. Absolutely ...

there's the training. Yeah. There is still the customer advisory panels.

There's a lot of camaraderie, right? Yeah. This is not becoming a C-level only event.

That's right. It's both. It's quite inclusive.

Yeah. The strategy behind Rockon is that we start off with training, so a lot of the practitioners come in. We have three different tracks, three different levels, and they get CPE credits and all that.

Then they encourage their business leader to come for the conference which takes place on the third day and the fourth day. General session, a lot of keynotes, a lot of CXO panel. Yeah.

This morning we have our partner panel talk about the services after they've learned about the technology. Now they come in today, learn about, hey, who's going to help me pull all this together? What type of questions should I be asking my partner today?

Then in the afternoon, we have two tracks. We have a business level track, then we have outside speakers in every single one of the modules. Beautiful.

And then also we have a technical or operational track, and how do we make all this technology come alive? And the customers speak as well. So they share with audience their learnings.

Love it. So that's the conference, and we're thrilled to have it in Austin for a key reason. Not only do you have fantastic music, food- Not again, food ...

but we take a look at where are most of our customers coming from. So it's an easy way for- Yeah ... centralized people to get in the cars, and also it's very easy for customers from the East Coast and the West Coast to come- It's right in the middle ...

Absolutely. We left out one of the tracks. The pre-conference and the- The- Yes ...

the hallway track. Yes. Because I'm going to tell you something about Rockon.

If you're out here, it is true. I was here, we were here all day yesterday. I'll be here all day today.

The Qualys executives, everyone from yourself, Sumed, Kumar, almost the entire C-team is out here in the hallway, surrounded by people, regular people, executive people. Yeah. Not security guards, not- Yeah ...

engaging with people. Completely. The hallway track is the best track in the whole conference.

It really is. It really is. The other thing that's new this year is, we have over 12 sponsoring partners.

Yes. Okay? And we had over, a lot more, but we have space for them.

And so it's technology partners- Right ... like a Claroty or an Nozomi for the IoT space, so there's integration with our platform. There's also a lot of service partners that are here.

Mm-hmm. And then, we also have the resellers from the cyber community. Yes.

We do have a couple of distributors as well. Yeah. So they're all here.

They're all lined up along the hallway, right in front of the demo station, and also right in front of the Rock Experience. So the- And the lunchroom ... way it should work out.

Yes. Never underestimate that people like to see you on the way in and out of lunch, right? Yes.

Stop at a booth. The other really cool thing that we did this year is everyone gets a hotel key card, whether they're staying at this venue or any other surrounding hotels. And this is a branded QR code that is only available for all the attendees.

They get VIP information, content to help them operationalize the AI Rock. And all information- I didn't realize you had to pay these people registration I put it in there. There you go.

Now I know. I learned something. Great.

Well, the other side's a hotel meal, the menu, but this side is all the- No, I see that when you registered. That's right. Now I go get it.

You mentioned you do five of them, right? Because even at free, for someone to come from Asia or Europe, it's a trip. Where else do you do ROCons?

Okay, so we have a major ROCon for all major GOs. Bring them all together, we anchor it, and that's where the training. We do have a ROCon CXO, it might be two or three hours, for VP level and above, just roundtable conversation.

We may do it in other major locations. We also- Like last year. Yeah.

You did North America. Yes. And then we do London.

Yeah, did London for sure. We do one for public sector in the- Oh, really? Yes.

Oh, that's great. C. area, Virginia area.

Yep. We went down to São Paulo for Brazil. Wow.

It was awesome. Right after Black Hat. People don't realize how big a market Brazil is.

Big. Very modern city, and with great customers. A lot of them are here, actually.

Really? They come up here. Well, that's the thing about Texas.

They can attract. It's not that far from- Yeah ... South America.

Exactly. And then we are going, the next ROCon is going to be in Mumbai. Didn't you do Pune last year?

It was in Mumbai last year, yes. Oh, it was in Mumbai. Yeah.

You're coming back to Mumbai. Absolutely. And of course, that's a huge base.

Yeah, completely agree. You've got to go where the people are. Yeah.

There are people there. Yeah. Fantastic.

So you do, you cover almost every region in there. Yeah. Excellent.

Let's talk about the content, though. You mentioned the tracks. Yeah.

Different tracks aimed at different level of people. The training. Yes.

From what I, I sat in mostly in the keynotes, right? Yeah. A lot of announcements.

As one would expect when we're living in historic times now, with this AI and post-MiTM, what that means for security. You would expect the kind of change and product kind of announcements that we're seeing here. But as you sit as the CMO, is it resonating this year?

There's a lot of people who are walking around a little dazed, right? There's so much going on so fast. Yeah.

So much change. Yeah. How's that resonating?

Well, first then, AI is like, you can't have a conversation today without the word AI popping up. I'd say that this year alone, we have... Remember last year it was called ROC.

Yes. And then Risk Operations Conference, or ROCC, meaning Risk Operations Center. Right.

Now, we at Black Hat, we introduced AI ROCC. Right. Right?

I think people get that. I think our narrative, I think our three core principles, AI speed detection, and then prioritizing it, and then the autonomous remediation. Finding out which ones matter based on business risk, and how do we eliminate as fast as possible the ones that do matter.

I think those three concepts are absolutely resonating. The how, the steps, that is why we have the conference here, so we can learn about it. Yeah.

I love it. It really, I told someone this at breakfast today. When my wife, when I ask my wife a question, she says, "Hold on, let me check with ChatGPT," you know AI has arrived, right?

Because she's not a technical person, but even she's using it. What I find, I said this yesterday, I'm interested in your opinion. Last year, we had ROCC.

Last year, we had AI. Yeah. Black Hat had AI.

Yes. And that was just, what, three months ago, right? I know.

But here, I feel like the clock has moved or the page has turned. It is. It's agentic now.

This is an agentic native ROCC. Yes. And we just finished a session, how do you build agents?

Yeah. So we have our agent family here. Mm-hmm.

But one of the sessions, how do you build your own? Right. And how do you bake that into your workflow?

So we're getting a little bit level deeper. And that's the- I think you have to ... that's the purpose of this, and we have customers sharing their learnings with everyone else.

So it's not just Qualys people speaking, but also it's important is, the business track is how do you have that narrative to your board members? How do you have the AI narrative to your CFO, to the legal team? So, we're really highlighting a lot of this because this is the feedback that everyone gave to us last year at ROCon, and we're happy to have it.

Any good marketer should take the feedback and- Absolutely ... make it work for you. Absolutely.

And our partners love it because they feel like they're really immersed in the conversation as well this year. And they're being heard. Yes.

Don't underestimate it. May, you've done a fantastic job. You could visibly see the difference in- Thank you so much ...

Not just you, I should mention. The entire Qualys, yes. The entire Qualys team is a real, from the C-level folks that I mentioned to your marketing team, the PR, analyst relations, everyone.

It's a great job. Yes. And I'm not a casual observer.

We do conferences for a living. Thank you for being here. I appreciate it.

Thank you so much. I appreciate it. Fantastic.

May Mitchell, CMO of Qualys. We've got a full day here of our second day of ROCon coverage. Stay tuned, we're live.

We're coming back in a minute.