The Good Business: How to Bootstrap a Business to $10M and Beyond

The Good Business: How to Bootstrap a Business to $10M and Beyond

Speakers: Christian Hyatt, CEO and co-founder, Risk 360

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=rwVlFU7rpuk

Overview

In an engaging and reflective presentation at BSides NYC, Christian Hyatt, CEO and co-founder of Risk 360, shared his nine-year journey of bootstrapping a cybersecurity services and SaaS company from inception to over $10 million in revenue. Titled "The Good Business: How to Bootstrap a Business to $10M and Beyond," Hyatt's talk offered a candid look at the practicalities, philosophies, and strategic decisions behind building a profitable and sustainable company without external venture capital. Far from a typical hyper-growth startup narrative, this presentation emphasized measured, intentional growth focused on robust foundations, cultural integrity, and efficient capital deployment.

Hyatt positioned his company, Risk 360, as a prime example of a "good business" – one that not only achieves financial success but also prioritizes its employees, community, and core values. The insights provided are particularly relevant for aspiring entrepreneurs, current business owners, and even employees within the cybersecurity industry who seek an alternative to the often-pressured, funding-driven startup culture. The talk provided a roadmap for navigating the challenges of business growth, from securing the first million in revenue to scaling beyond $10 million, all while maintaining a commitment to internal well-being and long-term viability.

Background

▶ Watch: Introduction to Christian Hyatt and Risk 360 (0:00)

Christian Hyatt's journey into entrepreneurship began after a career in consulting, where a mentor encouraged him to pursue an MBA with an entrepreneurship focus at Georgia Tech. It was there that he met his co-founder, Christian "CW" Wilson, a West Point graduate, marking the genesis of Risk 360. Unlike many startups that seek rapid venture capital funding, Hyatt and Wilson committed to a bootstrapped model, leveraging their professional services revenue to organically invest in and develop their proprietary SaaS platforms. Risk 360 primarily assists companies with compliance frameworks like ISO 27001 and SOC 2, offers attack surface management (including penetration testing and red teaming), and provides Agentic AI implementation, all supported by their GRC platform.

Hyatt explicitly stated that his presentation was not about hyper-scaling or achieving legendary status overnight. Instead, it was a practical guide for building a company with integrity and purpose over a sustained period. He defined "the good business" by its commitment to its people and community, citing examples like paying nearly $50 million in salaries over nine years, covering 100% of employee healthcare benefits, and offering generous paternity (six weeks) and maternity (three months) leave for its 50+ employees. This foundational philosophy underscores the entire growth strategy, emphasizing that financial success can and should coexist with strong ethical and cultural principles. The talk was structured around three distinct phases of business growth: establishing Foundations (reaching the first $1 million), Building (scaling from $1 million to $10 million), and Scaling (managing growth beyond $10 million).

Key Findings

▶ Watch: Setting expectations: A practical bootstrap journey (2:50)

Hyatt's presentation distilled nine years of experience into actionable strategies, revealing that success in bootstrapping a company to $10M and beyond hinges on a blend of foundational principles, disciplined execution, and continuous adaptation.

For the Foundations phase, reaching the first $1 million in revenue, Hyatt highlighted three critical elements:

1. Getting the Partnership Right: The speaker emphasized the paramount importance of selecting a co-founder with complementary skill sets (e.g., SME/sales vs. operations). Crucially, partners must align on money – openly discussing lifestyle choices, equity split (recommending against 50/50 to ensure clear leadership, even if 51%), base salary, and profit distribution. A shared common "why" beyond financial gain, such as building teams or providing for family, is essential to weather inevitable challenges.
2. Personal Commitment and Accountability: Hyatt underscored the necessity of unwavering personal dedication. This involves securing family buy-in, calculating and saving a year's worth of living expenses to mitigate risk (Hyatt started at 27-28, when expenses were lower), and publicly declaring commitments and goals. This public declaration acts as a powerful accountability mechanism, leveraging the "fear of failure in public" as a motivator.
3. Establishing a Shared Vision (BHAG): Early on, the team needs a Big Hairy Audacious Goal (BHAG). Risk 360 committed to a target of $35 million in annual recurring revenue by 2027, along with a cultural commitment to being "the good business." This BHAG is broken down into annual plans, quarterly updates (with full team fly-ins), and individual goals, creating powerful team alignment and motivation.

In the Build phase, scaling from $1 million to $10 million, the focus shifts to strategic refinement and robust operationalization:

1. Niche Down Aggressively: A common mistake for early-stage businesses is being "all things to all people." Hyatt stressed the importance of defining an Ideal Client Profile (ICP) with extreme specificity – detailing not just company size and complexity, but also the individual client avatar (demographics, needs, cities). This clarity informs all aspects of product development and marketing, cutting through market noise and unlocking growth.
2. Profitable Product Innovation ("Digging Small Holes"): As a bootstrapped company, efficient capital deployment is vital. Hyatt outlined a disciplined, iterative approach to new product/service development:

• Define clear investment criteria (e.g., relevance to ICP, $1M+ ARR potential in 18 months, efficient delivery with existing team).
• Start with a single paid pilot project (even 99 cents) to ensure client commitment.
• Conduct 1-3 pilots at cost to refine pricing and delivery models.
• Aim for 3-5 real projects to validate product-market fit. If five customers cannot be found quickly, the initiative is killed. This methodology allows for experimentation without significant upfront capital investment.

1. Building a "Flywheel": Inspired by Jim Collins' concept, Risk 360 developed its own flywheel to illustrate its virtuous cycle of growth: hiring strange renegades → turning them into craftsmen → building artisan products → earning raving fans → earning an inimitable brand → (which enables) hiring strange renegades. This model guides investment decisions and communicates the company's growth engine to the team.
2. Financial Discipline (Finance 101): Hyatt demystified cash flow, explaining that $1 million in revenue typically yields closer to $900K in cash after the cash conversion cycle. After expenses, only about 20% ($180K) remains as profit. This profit is then subject to the 40-30-30 principle: 40% to taxes, 30% to working capital, and 30% as free cash flow (for profit sharing, dividends, or reinvestment). This means $1 million in revenue might only result in $50,000 of free cash flow, underscoring the need for efficient capital deployment. Other critical financial practices include building three months of capital reserves, paying founders a market rate (as CEO), and implementing strategies to get paid fast (e.g., upfront payments, monthly flat billing).
3. Culture as a Competitive Advantage: Hyatt asserted that culture and team are the only lasting competitive advantage. Risk 360 fosters this through annual "grit events" (like the 100-mile relay race or a four-mile hike), which physically symbolize a core value. The company's GWC (Get it, Want it, Capacity to do it) Core Values hiring methodology assesses candidates across eight criteria (GWC + five core values), requiring a minimum score of 16 out of 24. Core values are also integrated into performance reviews and a Journeyman program for manager development, including a decision-making model aligned with values.

Finally, for the Scale phase, moving beyond $10 million, the challenge becomes one of leadership and continuous self-reinvention:

1. Scaling People and Delegation: The primary task for a scaling CEO is to scale the people around them. Hyatt emphasized the importance of delegation, even for tasks the CEO initially performed. He noted that almost all of Risk 360's operational leaders initially served in delivery roles, providing invaluable context. Delegation, while trading profit for time, is crucial for the CEO to focus on "more important" tasks.
2. Systems and Processes (Management Operating System): To enable delegation and continuity, robust systems are essential. Hyatt introduced Risk 360's Management Operating System (MOS), defined by Purpose, Values, Roles, Rhythms, and Goals (PVRRG). This framework provides a common language and structure for how the business runs, enabling the CEO to take sabbaticals without disruption, as Hyatt plans to do for two months.
3. CEO Self-Reinvention: As the company grows, the CEO must constantly level up. This involves joining CEO peer groups to challenge limiting beliefs and gain external perspectives, formal goal setting (using a "5 Fs" model: Faith, Family, Fitness, Finance, Fun), and applying principles like the Crabtree Protocol (derisking as a founder by paying off a primary residence and accumulating $2.5M in savings) or delegating tasks below the CEO's "hourly rate."
4. The "Phase Two CEO" Role: Drawing from Y Combinator's model, Hyatt outlined four core responsibilities for a scaling CEO: setting a clear, ambitious vision with relentless communication; building an exceptional leadership team (ELT), prioritizing "first team thinking" where peers are the primary team; getting mission and metrics right by cascading the BHAG down to individual KPIs; and reinforcing culture through personal example and dedicated time with the team.

Technical Deep Dive

▶ Watch: What defines 'The Good Business' and its values (4:00)

While "The Good Business" talk is not a deep dive into specific security vulnerabilities or exploits, it provides a comprehensive "technical deep dive" into the business architecture and methodologies that underpin a successful, bootstrapped cybersecurity company. The "technical" aspects here refer to the structured, repeatable processes and frameworks that Risk 360 employs to build and scale its operations and product offerings.

Risk 360's Hybrid Business Model

Risk 360 operates on a hybrid business model, a critical "technical" decision for a bootstrapped entity. It combines professional services with SaaS platform development. The professional services arm includes:

• Compliance Framework Implementation: Assisting companies with frameworks like ISO 27001, SOC 2, and others. This often involves program implementations, with Risk 360 sometimes acting as the auditor.
• Attack Surface Management (ASM): This constitutes the offensive security side, encompassing traditional penetration testing and red teaming.
• Agentic AI Implementation: Helping companies integrate and optimize AI within their operations.

Crucially, the revenue generated from these services directly funds the development of Risk 360's proprietary SaaS platforms:

• An Attack Surface Management platform that complements their offensive security services.
• A Full Circle GRC platform designed for companies to manage their entire compliance program.

This approach ensures that product development is self-sustaining and tied to actual client needs identified through service delivery, a core tenet of efficient capital deployment in a bootstrapped environment.

Product and Service Innovation: The "Digging Small Holes" Methodology

One of the most detailed "technical" methodologies presented was the process for innovating new products or services without external funding – termed "digging small holes." This innovation flywheel prioritizes profitability and rapid iteration:

1. Investment Criteria: Before any new product or service is considered, it must meet specific criteria, such as:

• Relevance to the existing Ideal Client Profile (ICP).
• Potential for at least $1 million in Annual Recurring Revenue (ARR) within 18 months.
• Efficient deliverability, ideally leveraging existing team members.

1. Paid Pilot Project: The first step is to secure a single paid pilot project. Even a nominal fee (e.g., 99 cents) is preferred over free Proof of Concepts (PoCs), as it ensures the client has "skin in the game" and is serious about the solution. If this pilot fails, the concept is immediately killed.
2. One to Three Pilots at Cost: If the initial pilot is successful, the next phase involves 1-3 pilots priced "at cost." This stage is crucial for price discovery, understanding the willingness to pay, and refining the delivery model. The pricing may be experimental, with a focus on understanding profitability and effort required.
3. Three to Five Real Projects: The final validation step is to secure 3-5 "real projects" at the determined market price. Hyatt emphasized that if a company cannot find five customers for a new offering relatively quickly, it should "stop wasting our time." This rapid validation process ensures that significant capital is only invested in offerings with proven product-market fit. This iterative, data-driven approach minimizes risk and maximizes the efficiency of limited capital.

The Risk 360 Flywheel Model

Hyatt detailed Risk 360's adaptation of Jim Collins' Flywheel concept, a continuous cycle of momentum for growth:

1. Hiring Strange Renegades: The cycle begins with a focus on talent acquisition, specifically recruiting top graduates and experienced professionals from Georgia Tech, large consulting firms, and major security companies.
2. Turning Them into Craftsmen: These hires undergo rigorous training programs to develop subject matter expertise and internalize the "Risk 360 way."
3. Building Artisan Products: Empowered craftsmen then develop and deliver artisan products and services, including the ASM and GRC platforms and high-quality consulting.
4. Earning Raving Fans: Superior products and services lead to highly satisfied customers, characterized by low churn and a high rate of expansion within existing accounts.
5. Earning an Inimitable Brand: This consistent delivery of value and customer satisfaction builds a strong, defensible brand that is difficult for competitors to imitate.
6. Hiring Strange Renegades: The strong brand, in turn, attracts more top talent, restarting and accelerating the flywheel.

This model serves as a strategic framework for investment and team communication, ensuring all efforts contribute to a cohesive growth engine.

Management Operating System (MOS)

To ensure organizational clarity and enable effective delegation, Risk 360 implemented a Management Operating System (MOS), built on the acronym PVRRG:

• Purpose: The overarching vision and mission of the company.
• Values: The core principles guiding decisions and behaviors, integrated into hiring, firing, and performance reviews.
• Roles: Clearly defined responsibilities (e.g., using a RACI matrix) and an organizational chart to avoid ambiguity.
• Rhythms: A consistent cadence of meetings and communication, such as weekly tactical meetings (e.g., 10:36 AM), quarterly on-site meetings, and annual kickoffs.
• Goals: A hierarchical structure of objectives, nesting the company's BHAG down to individual employee goals.

This MOS provides a "technical" blueprint for how the company operates, fostering a common language and understanding across the entire team.

GWC Core Values Hiring Methodology

Risk 360's approach to talent acquisition is highly structured, integrating core values directly into the hiring process. The GWC (Get it, Want it, Capacity to do it) Core Values methodology involves training interviewers to assess candidates across eight criteria: the three GWC elements and the company's five core values. Candidates are ranked on a scale of 0-3 for each criterion, and a minimum aggregate score of 16 is required to be considered for a position. This ensures cultural fit and alignment from the outset, a critical factor for maintaining the "good business" ethos.

Demo / Proof of Concept

▶ Watch: Foundations: Avoiding common pitfalls, focusing on essentials (6:00)

Christian Hyatt's talk, "The Good Business: How to Bootstrap a Business to $10M and Beyond," did not feature a traditional technical security demonstration or a live proof of concept of a software exploit. Instead, the presentation itself served as a "proof of concept" for a highly disciplined and iterative business growth methodology.

Hyatt detailed a specific approach to validating new products and services, which he termed "digging small holes." This methodology (discussed in the "Technical Deep Dive" section) is essentially a business-centric proof of concept process. It involves a structured progression from defining investment criteria, to executing a single paid pilot project, then 1-3 pilots at cost, and finally seeking 3-5 real projects to confirm product-market fit before scaling. This iterative and financially prudent process is Risk 360's "demo" of how to prove the viability of a business idea or new offering within a bootstrapped framework, minimizing risk and maximizing capital efficiency.

Defensive Implications

▶ Watch: Key foundation: The invaluable role of mentorship (6:30)

While the talk is not about cybersecurity defenses in the traditional sense, it offers profound "defensive implications" for building a resilient and sustainable business in the competitive cybersecurity landscape. These insights equip entrepreneurs and leaders with strategies to defend against common business pitfalls, market pressures, and organizational decay.

1. Defense Against Financial Instability:

• Capital Reserves: Building three months of working capital reserves is presented as a fundamental risk management strategy. This financial buffer protects the company from unexpected downturns, cash flow gaps, and market shocks, allowing operations to continue calmly without entering "crisis mode."
• Efficient Cash Flow Management: Understanding the cash conversion cycle and the 40-30-30 principle (40% taxes, 30% working capital, 30% free cash flow from profit) is crucial. This knowledge defends against unrealistic expectations of profitability and ensures that capital is deployed intelligently.
• Aggressive Payment Collection: Strategies to get paid fast (e.g., upfront payments, monthly flat billing) are vital for bootstrapped businesses. This defends against liquidity issues that can cripple growth, especially when operating without external funding.

1. Defense Against Talent Loss and Cultural Erosion:

• Robust Culture as a Moat: Hyatt explicitly states that culture and team are the "only lasting competitive advantage." Investing in initiatives like annual "grit events," generous employee benefits (100% healthcare, long parental leave), and a supportive work environment defends against high employee turnover and burnout.
• Values-Based Hiring and Management: Implementing the GWC Core Values hiring methodology ensures that new hires align with the company's ethos, defending against cultural dilution. Integrating core values into performance reviews and leadership development (e.g., the Journeyman program) reinforces these principles, preventing organizational drift and fostering a cohesive team.
• Clear Vision and Alignment: A well-communicated Big Hairy Audacious Goal (BHAG) and a cascaded goal-setting system (from BHAG to individual KPIs) defends against employee disengagement and lack of direction, ensuring everyone is pulling in the same direction.

1. Defense Against Market Fragmentation and Wasted Resources:

• Strategic Niching: The imperative to niche down and define a precise Ideal Client Profile (ICP) defends against market fragmentation and the inefficiencies of trying to be "all things to all people." This focus allows for deeper expertise, more targeted marketing, and a stronger competitive position.
• Disciplined Product Innovation: The "digging small holes" methodology provides a robust defense against wasting precious bootstrapped capital on unvalidated products or services. By requiring paid pilots and rapid customer validation, it ensures that investments are made only in offerings with proven market demand.
• Flywheel Strategy: Articulating a clear flywheel (like Risk 360's "hiring strange renegades" to "inimitable brand" cycle) defends against scattered efforts and ensures that all strategic investments contribute to a reinforcing growth mechanism.

1. Defense Against Founder Burnout and Leadership Bottlenecks:

• Effective Delegation: Learning to delegate, even tasks the CEO initially excelled at, defends against founder burnout and creates opportunities for emerging leaders. This allows the CEO to focus on higher-level strategic functions, preventing themselves from becoming a bottleneck.
• CEO Self-Reinvention: The need for continuous personal and professional development (e.g., joining CEO groups, formal goal setting, applying the Crabtree Protocol for personal financial de-risking) defends against stagnation and ensures the leadership remains capable of navigating increasingly complex challenges.
• Robust Management Operating System (MOS): Implementing a structured MOS (PVRRG) defends against operational chaos and dependency on single individuals. It establishes clear processes, roles, and communication rhythms, ensuring business continuity even during leadership absences (like Hyatt's planned two-month sabbatical).

In essence, Hyatt's talk provides a blueprint for building a "defensible" business—one that is financially sound, culturally strong, strategically focused, and led by adaptable individuals, allowing it to thrive organically and sustainably over the long term.

Key Takeaways

• Strategic Partnerships are Foundational: Choosing a co-founder with complementary skills, aligning on financial expectations, and sharing a common "why" beyond money are critical for long-term business success.
• Niche Down Fiercely: Overcome the fear of turning away revenue by precisely defining your Ideal Client Profile (ICP). This focus unlocks growth, clarifies messaging, and ensures efficient resource allocation.
• Bootstrapped Innovation Requires Discipline: Employ an iterative "digging small holes" methodology for new product development, starting with paid pilots and rapidly validating market fit with 3-5 real customers before scaling.
• Culture is Your Ultimate Competitive Advantage: Invest in a strong, values-driven culture, integrated into hiring, performance reviews, and leadership development. This fosters loyalty, attracts top talent, and builds an inimitable brand.
• Financial Prudence is Paramount: Understand the reality of cash flow (e.g., $1M revenue yields ~$50K free cash flow). Build capital reserves (three months' operating expenses), pay market rates, and prioritize getting paid fast.
• CEOs Must Continuously Reinvent Themselves: As the company scales, the CEO's role evolves. Effective delegation, participation in CEO peer groups, and a focus on setting vision, building the leadership team, defining metrics, and reinforcing culture are essential for sustained growth.

About the Speaker(s)

Christian Hyatt is the CEO and co-founder of Risk 360, a cybersecurity company specializing in compliance, attack surface management, and GRC solutions. Hyatt began his career in consulting before pursuing an MBA at Georgia Tech, where he met his co-founder. His personal "why" for building Risk 360 stems from a childhood experience with poverty, which instilled in him a deep motivation to bet on himself and ensure financial stability for his own family and his employees. He is married to his high school sweetheart of 15 years and has three children. Hyatt is a proponent of the "good business" philosophy, prioritizing employee well-being and community impact alongside financial growth. He is also an author, with a book on his entrepreneurial journey slated for release in July.