BUILDERS podcast

How Zip Security built a vCISO channel by treating consultants as the primary customer, not the middleman | Joshua Zweig

2/6/2026
0:00
20:49
Retroceder 15 segundos
Avanzar 15 segundos

The cybersecurity industry has a problem it created itself. The tools exist to protect most organizations — but deploying and managing them costs seven dollars in services for every one dollar in software license. Multiply that across the eight to ten tools a company actually needs, and you've priced out the majority of the market. Zip Security was built to close that gap with AI and automation. In a recent episode of BUILDERS, we sat down with Joshua Zweig, Co-Founder and CEO of Zip Security, to discuss how he and co-founder Gabbi Merz are rethinking both the product and the go-to-market motion for a segment of the market that's been systematically underserved.

Topics Discussed:

  • How Palantir's edge-distributed operating model shaped Zip's internal culture — and where Josh deliberately diverged from it

  • Zip's hiring thesis practice: what they took from Palantir, what they changed, and why they run it for every single hire

  • The three-bucket framework Josh uses to segment the security market — and why company size is the wrong variable

GTM Lessons For B2B Founders: 

  • Avoid the channel that compresses your price before you've proven your value. Josh made an active choice to skip MSPs despite that being the default playbook for SMB cybersecurity distribution. The reason is structural: MSPs lead with cost sensitivity — the conversation becomes "is this 80 cents a seat?" before you can establish what you're actually delivering. They also serve a bundled model (help desk, device provisioning, security) where Zip's focused security-in-a-box offering doesn't fit cleanly. The channel shapes the conversation, and the wrong channel shapes it badly from the start.

  • Treat channel partners as the primary customer, not the path to the customer. Zip's most productive GTM motion has been building relationships with independent security consultants and vCISOs. Josh's framing was precise: "The right way for us to approach this market is really being laser focused on these folks and thinking about them as much as our customer, if not more than the end user." The structural reason this works: consultants deliver recommendations but don't implement. They hand off a security plan and point at the client. Zip closes that gap — which makes the consultant look better to their client, not just more efficient. Founders building indirect channels should ask whether they're making the partner more valuable to their customer, not just making the sale easier for themselves.

  • Segment by operational security capacity, not company size. Josh's market framework has three buckets: zero-person IT/security teams (where the ops lead or head of engineering is also the de facto CISO), lightly staffed teams of two to five people who have the tools but can't weave them together effectively, and well-resourced teams like Palantir's. His ICP is the first two. A construction company with 800 employees can sit in the same bucket as a 50-person regulated healthcare company — what they share is the absence of the internal capacity to operationalize security. Firmographic proxies like headcount or revenue miss this entirely.

// 

Sponsors: Front Lines — We help B2B tech companies launch, manage, and grow podcasts that drive demand, awareness, and thought leadership. www.FrontLines.io

The Global Talent Co. — We help tech startups find, vet, hire, pay, and retain amazing marketing talent that costs 50-70% less than the US & Europe. www.GlobalTalent.co

//

Don't Miss: New Podcast Series — How I Hire Senior GTM leaders share the tactical hiring frameworks they use to build winning revenue teams. Hosted by Andy Mowat, who scaled 4 unicorns from $10M to $100M+ ARR and launched Whispered to help executives find their next role. Subscribe here: https://open.spotify.com/show/53yCHlPfLSMFimtv0riPyM


Otros episodios de "BUILDERS"