DCDR.io

My domain renewal emails arrived the other day reminding me that it's been four years since I started my blog which eventually led to some courses, a couple of books and DCDR.io

There's still not a solid income-generating idea here (well, maybe an idea but certainly not the execution) but it's not time to give up yet.

On to year five...!

Every discovery call or demo adds one more idea to the pile of shiny objects that I want to add to DCDR. It's so tempting to make DCDR the Swiss Army knife of risk management software.

But, it's more likely to become a mess because I don't have the technical ability to add everything in a neat, elegant way. Plus, each of these features takes away from the core functionality, particularly right now. So, I need to remind myself to keep saying no.

Diamond hands aren't just for WSB bros: I need to hold on to the core vision and deliver on that, not get distracted.💎 🤲

In the past week, I demoed DCDR to two groups, both of whom had been users of the original app. These were very different types of organization, which really helped me differentiate between an off-the-shelf user and an enterprise client.

First, I onboarded one of the previous clients who is, I think, my ideal user for a TEAM account. He's in a highly regulated industry, security, and working a great deal on investigations to support litigation. Meanwhile, he's the only person doing QAQC / governance for an organization that works in over a dozen countries.

(*DCDR has two levels of off-the-shelf paid pla: PRO and TEAM. Both have the same basic features but TEAMS have additional tools to help with collaboration and reporting. PRO and TEAMS have limited customization and are cloud-based.)

Second, I demoed DCDR with the security team for a large service company. They have a huge global footprint but a small team with a significant reporting / governance burden. They are also publically traded which increases the scrutiny of the risk management process. They would require an ENTERPRISE account due to the degree of customization they need and the likelihood that the data will need to remain on their own systems which throws up additional engineering challenges for me.

Despite the very significant differences in size of organization and type of business, both have:

• A need for standardized tools to help support the overall risk management system
• A shortage of time / resources
• A high proportion of staff with a low-level of understanding of the risk assessment process, even those who are responsible for parts of the system
• The need for a platform that is a Swiss-army-knife of risk management tools

So the basic premise of the tool will work for both. The smaller org is on a trial now and is very happy with what's there now. The larger firm asked for some additional features which were already in the pipeline / easy fixes so I hope to get them on a trial by the end of January.

The big challenge will be the engineering demands of building something that meets a corporate IT team's requirements.

However, both are great examples of the 'perfect' user for each typs of plan (TEAM / ENTERPRISE).

LEARNING

This will help me figure out my marketing approach as I can now scope out these two use cases more thoroughly.

I NEED TO:

1. Refine the avatar of the TEAM user and then find all the similar orgs who match this profile. That's going to be my initial list of targets. I estimate that there are 30 or so companies like that within my 1st / 2nd degree network so I just need t make that happen.

2. Build towards the enterprise in slow time so I don't get distracted but use this bid / tender process as a way to refine what that use-case looks like and scope out if that's where i want to go.

Despite the long journey below, I'm not ready to give up quite yet so I've decided that 2021 will be the year of DCDR 2.0. The app is rebuilt in Anvil and working really well (apart from the occasional SNAFU when I break it and have to run to my tutor for help).

I still get the same excited response from people when they see it and I know that the need is still there because spreadsheets are still the most coon tool in use.

So the need is there and I think DCDR meets it. Plus, I just had two previous demo clients get back in touch asking for new trials.

I still have a lot to learn and am terrible at marketing but I've put a lot into this and I'm not quite ready to throw in the towel yet.

There are a lot of lessons to add to the journey below that I will add over time but, for now, I'm a new indiehacker and want to hold myself to account by doing everything in public this year.

I also hope that:

1. I can encourage other non-technical founders to have a go at building something themselves and,

2. show other older folks (I'm 48) that it's not too late to have a go.

Zoho was always an interim solution to let me build an MVP / version 1 of DCDR but I thought I would be able to run that long enough to let me validate the idea and build up a user-base to fund a 'proper' build. Unfortunately, I had to call support about something else and they asked why I had a payment function enabled.

As it turned out, this violated the terms of service and I was going to have to change my plan to allow me to run a paid-for service on the platform which would be $20+ per user per month. This was my bad but the cost was going to make Zoho prohibitive plus it still wouldn't do everything I thought I would need so it was time to switch platforms.

Enter Anvil, a platform I'd been looking at for a long time. I made the decision to switch over the summer and started to learn how to build in Anvil using python.

https://anvil.works/

The second sale was completely out of the blue. So much so, that I actually called the guy, thinking he'd made a mistake and accidentally bought a subscription instead of taking the free trial.

Luckily, the purchase was intentional.

He'd seen info about DCDR on a community group for security professionals and wanted to use it for his firm. Interesting use-case and one that was a little outside of the core functionality but very much something that would work and maybe a new niche to target.

I had hoped that this would be the second of many sales but, as it tuned out, it was the last for 2019 and into 2020.

Finally, one of the warm leads came through and bought six licenses for a year for $2,300. This was very exciting for lots of reasons but a big one was that they were part of a very small group with very specific needs.

I hoped that their adoption of DCDR would be a great test case to show how DCDR could help others in that niche. Interest from the other firms was there and there were lots of trials and demos but most fell through or died off over time.

This group was very busy operationally and also suffered from a high turnover of staff so this made getting their attention very hard. It also meant that, even though DCDR would save them a lot of time in the long-run, they didn't have the time to look at it properly in the short term.

I added bulk import and offered concierge onboarding but no-one else bit.

But I'd at least made a sale so it gave me hope that this was still viable.

A year later, I was still stuck in a rut with limited interest and no sales. I was trying to spin too many plates with courses, consulting and other distractions so DCDR was becoming a side project that I was putting some money into but not enough care and attention.

I tried Capterra and Google ads which did generate sign ups but no conversions to paid plans.

I had cleaned up my website a bit but, overall, the whole thing looked crappy and even I wasn't excited.

But, but, but...

There were still people who went crazy when they saw it because the need was still there. That meant that there were a few warm leads I was working on, hoping that one would come through.

After a year-ish playing with the MVP, I had something that worked but I noticed that people weren't knocking my door down to buy DCDR.

It was time to learn how to market.

1 - I emailed the people I knew in the risk and security industry.

2 - I managed to build an email list of a few hundred security managers on the US East coast and cold emailed them.

The upshot was about 20 demos and maybe five signups. Overall the feedback was that it was OK but it wasn't firing people up because:

a) It didn't include incident management which refected that particular group's need.

b) folks from big firms felt their IT department wouldn't touch it

c) it didn't automate enough of the process

So the takeaways were:

i) Add incident reporting as almost everyone I spoke to asked for it. This was an easy fix so I added that.

ii) concentrate on SMEs who would be more likely to work with a cloud app. Check

iii) Add a long-future action to look at a way to have an on-prem solution for larger orgs. Check

iv) build tools to educate people on the process. This was an easy fix as I already had some training courses I'd created so I built one on risk assessment.

iv) consider how to build libraries or more of a step-by-step workflow to help people through the process.

(Play quick 12-year work / life montage here.....)

My boss: "Good news, we've been acquired by [big five firm]."

Me: "That's great. What an amazing opportunity for us to grow with the new firm."

My boss: "Um, well, unfortunately, our team isn't part of the acquisition."

Me: "Oh...."

---

Everyone worked very hard to help we few exiles (and it was only a few of us) to join the new firm but this wasn't possible for some of us.

We parted on good terms and I now found myself with time on my hands. I wondered if the risk assessment tool problem had been solved since I last gave it any serious thought so I started to do some research.

As it turned out, it hadn't.

Spreadsheets were still the order of the day and the software solutions were pretty clunky.

Unfortunately, despite many attempts, I couldn't code but I thought I would have time now so I started to think about building my own tool in earnest.

Luckily, I came across Zoho Creator (https://www.zoho.com/creator/) around this time which allowed me to drag and drop elements together to build a clunky MVP.

So now I had something to start with.