Why This CISO Buys From Cyber Startups First - Zach Lewis, CISO @ University of Health Sciences and Pharmacy

Zach Lewis runs IT and security at a university on a tight budget, and when he needs a problem fixed, he goes looking in the startup community. He's been a sub-10 customer at Concentric AI, a very early customer at Island, a design partner for Jazz DLP, and he ran an email security product from a barely-out-of-stealth startup for four years. He explains what he gets for buying early, what he needs to see before he'll take the bet, and why your LinkedIn message almost certainly isn't how you'll reach him.
In this episode
Why a four-year run with a sub-10 email security startup turned Zach into a repeat startup buyer
The trade he makes for being early: lower pricing locked in for three or five years, and features built in weeks
What he watches during a design partnership: the whole problem solved, the team growing, the product moving fast
How his DSPM vendor ended up working like a remote member of his team
Why nobody inside the university pushed back on buying from startups
10 to 20 LinkedIn pitches a day, three replies in seven years, one purchase, and where he finds new vendors instead
How a deal actually gets funded in a July-to-June budget, and why something usually gets switched off first
Why two out of three startups he sees are pitching shadow AI, and why he covered it with tools he already had
About the guest
Zach Lewis is CIO and CISO at the University of Health Sciences and Pharmacy in St. Louis, a Venture Advisor at Glilot Capital Partners, and the author of Locked Up (Wiley, 2026), the story of his university's response to a LockBit ransomware attack. He was named Non-Profit CISO of the Year in 2023.
Notable quotes
"I've done a 5-year on a couple startups just because we want to lock in that low pricing."
"Best email security product I've ever seen."
"I don't think anyone even really knew they were a startup, nor did they care."
Chapters
00:00 Intro
03:18 Advising at Glilot and the St. Louis "cyber mafia"
07:23 What he listens for in a first startup conversation
09:31 How a design partnership really works
13:37 Why legacy DLP failed and what Jazz does differently
16:41 His first startup bet: email security
20:00 Price, multi-year lock-ins, and features in weeks
21:00 How much time early-stage vendors actually take
23:38 Does anyone push back on buying from startups?
24:38 Sorting out AI security without adding tools
28:04 "Stop messaging me on LinkedIn," and what works instead
33:28 How deals close: budget cycles, sunsetting, the CFO
39:09 Buying after a breach
41:00 Locked Up
43:31 Visionary or smoking crack
Support the show
The Cyber Go-To-Market Talk is the show for cybersecurity sales leaders, founders, CROs, and go-to-market operators looking to improve cyber sales performance and build more predictable revenue growth. Hosted by Andrew Monaghan, founder of Unstoppable.do, covering cyber sales leadership, revenue leadership, sales onboarding, forecasting, pipeline generation, and cybersecurity go-to-market execution.
Follow me on LinkedIn for regular posts about growing your cybersecurity startup
Want to grow your revenue faster? Check out my cybersecurity sales consulting and training
Need ideas about how to grow your pipeline? Sign up for my newsletter.