Email impersonation isn’t as flashy as other threat vectors.And yet, it’s one of the most abused attack vectors in the world.
In this episode of Scaling Cyber, I sat down with Sacha Matulovich, Co-Founder and Chief Strategy Officer of Sendmarc, to unpack how a company born in South Africa built a global business around one of cybersecurity’s most overlooked — and most critical — problems: email domain impersonation and DMARC compliance.
This conversation isn’t just about email security.It’s about distribution, go-to-market discipline, and what it really takes to scale a cybersecurity company from outside the usual power hubs.
🎧 Listen to the full conversation on Scaling Cyber: 👉 YouTube | Spotify | Apple Podcasts
From Email Marketing to Cyber Defense
Sendmarc didn’t start as a “cybersecurity idea” in the traditional sense.
Its founders came from the email marketing world, where delivering billions of legitimate emails forces you to deeply understand how email infrastructure actually works.
That background created a unique perspective:
If you truly understand how email is delivered, you also understand how it’s abused.
When Sacha’s co-founders discovered DMARC — the global standard that prevents email domain spoofing — they saw both a security gap and a market gap.
The problem?DMARC is powerful, but painfully complex.
“The world doesn’t need to understand all the acronyms,” Sacha explains.“They just need their domain to not be weaponized.”
That insight became Sendmarc’s core strategy:Do the dirty dishes so customers don’t have to.
Building from South Africa
Unlike many startups, Sendmarc didn’t begin with a grand vision of global domination.
They started local:
* Talking to customers they could meet face-to-face
* Selling on day two
* Getting immediate feedback on value, pricing, and pain
Only later did reality hit:This wasn’t a regional problem.
Within the first year, Sendmarc had customers in more than 10 countries.
“Whether we liked it or not, we had built a global business.”
South Africa, often seen as a disadvantage, became an unexpected strength:
* Founders used to solving hard problems
* Limited local market forcing early efficiency
* A global diaspora that helped open doors abroad
Education Before Enforcement
Sendmarc entered the market before DMARC became mandatory.
That meant years of:
* Explaining why the problem existed
* Proving that impersonation was real
* Convincing buyers before Google, Microsoft, and Yahoo forced compliance
One early GTM trick?They demonstrated the attack.
“If I can send an email pretending to be you — and it lands — the value becomes obvious immediately.”
Later, when big tech enforced DMARC, the conversation shifted:From education to execution.
And Sendmarc was ready.
Distribution as a Strategy
One of the most valuable parts of this conversation is Sendmarc’s channel journey.
They didn’t chase every route at once.
They layered it deliberately:
* Direct sales to validate value and pricing
* MSPs and resellers to scale reach
* Distributors — once GTM maturity existed
* OEM partnerships for massive distribution leverage
Crucially, Sendmarc made a hard decision early:They would be partner-first, even if it meant giving up margin.
“We chose trust over short-term revenue.”
That clarity allowed partners to invest confidently — and helped Sendmarc scale without building a massive direct sales force for a relatively low-ACV product.
Why Some Distributors Work — and Others Don’t
Sacha is refreshingly honest about distribution:
* Big distributors aren’t always the answer
* If you don’t matter to their revenue, you don’t matter at all
* Commitment must go both ways
One of Sendmarc’s most successful partnerships started with a simple rule:Skin in the game on both sides.
A funded head.A minimum commitment.Shared accountability.
The result?Focus, execution, and growth.
DMARC as a GTM Superpower
DMARC has a unique property most cybersecurity sectors don’t:Everything is visible in DNS.
That means Sendmarc (and its partners) can:
* See which domains are vulnerable
* Know which competitors are in place
* Track failures and history over time
This turns security telemetry into a go-to-market engine.
Instead of cold outreach:
“We can see your problem… and we can fix it.”
For Sendmarc, DMARC isn’t just a security control.It’s a sales accelerator.
OEM Partnerships and Earning a Seat at the Table
Landing OEM partnerships with global vendors — including Sophos — didn’t happen overnight.
Sacha’s explanation is simple, and brutally honest:
* They worked harder than competitors
* They were flexible
* They over-delivered
* They showed up in person
“What we lacked in brand, we made up for in effort.”
In cybersecurity, trust still happens face-to-face.Flights, conferences, awkward first meetings — all part of the cost of scale.
Focus Over Expansion
Despite growth, Sendmarc has resisted the temptation to become “everything email security.”
Their strategy is clear:
* Be the best in anti-email impersonation
* Expand carefully into adjacent problems
* Solve distribution, not just technology
As Sacha puts it:
“DMARC isn’t a technology problem anymore. It’s a distribution problem.”
The Real Lesson: Get Out of Your Comfort Zone
One of the most human moments in the episode comes when Sacha describes attending his first cyber conference in London.
No friends.No recognition.No shortcuts.
“It felt like standing alone at a bar, hoping someone would talk to you.”
Years later, those same conferences feel very different.
The lesson?Community matters.Relationships compound.And growth is uncomfortable — until it isn’t.
Final Takeaways for Cyber Founders
* Not all important problems are sexy but they can be massive
* Distribution is a strategy, not a checkbox
* Partner trust beats short-term margin
* Being early means educating; being ready means executing
* If you’re building outside the big hubs, effort is your unfair advantage
Thanks for reading Scaling Cyber! Subscribe for free to receive new posts and support my work.
🎙️ About the Episode This conversation is part of Season 1 of Scaling Cyber — the show where founders and leaders from outside the US and Israel share how they’re building global cybersecurity companies.
Host: Ignacio Sbampato — cybersecurity executive, former Chief Business Officer at ESET, and founder of BridgerWise. Guest: Sacha Matulovich, CEO & Co-Founder of BforeAI.
This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit scalingcyber.substack.com
