KnowBe4 — Why 2024 Stalled, and How 2026 Defuses It
Purpose: the founder's unique contribution to Monday's 3:30 workshop-approach meeting. The seniors (Dom, Gary) own the technical demo and the success story. This is the lane only the founder can take: the insider read on why the first attempt didn't convert and what structurally changes the answer this time. Sourced from Sam's pre-departure Glean pull (founder wasn't on the account in 2024).
The 2024 facts (Sam's pull)
- The workshop worked. "KnowBe4: Cortex Hands-on Lab," 9/18/2024, Clearwater FL. phData: Dominick Rocco, Christina Bope, Matt Carlin + Snowflake. Internal follow-up: "delivered a successful Cortex Workshop," positioned SNOW+phData in front of business leaders, "sparked demand" for "Talk to Your Data" (BI chatbot, Cortex LLMs → SQL).
- The follow-on died on budget, not fit. Last open opp "KnowBe4 - Snowflake AI MVP" ($85k TCV) → Closed Lost 2025-01-08, Loss Reason = Budget. Last-step note: "Met with [KB4 business lead] and team and they don't have budget allocated for partner implementations." Account mapping: "Highly engaged Cortex AI workshop prospect; budget-constrained." Tied to Dan Coletti (AE).
- KB4 told us exactly what they wanted. Core pain = a "sea of reports"; RevOps wanted an AI interface to get answers immediately instead of digging through dashboard tiles. Critically: they wanted answers from the curated data mart / LookML-style semantic layer, NOT raw tables — they'd already done the transformation work to encode business logic. Snowflake positioned Cortex Analyst (structured) + Cortex Search (unstructured). Session was split business "art of the possible" + technical hands-on lab; KB4 explicitly wanted customized internal use cases, not generic AI hype.
The read (founder's synthesis — flag as opinion, not fact)
1. 2024 was a commercial failure, not a technical one. The capability landed; demand was real. What died was an $85k partner-implementation services motion with no budget line. So the 2026 winning move is not "demo better" — the demo already worked. It's a delivery shape that defuses the exact objection that killed it.
2. 321GO / CAF is the structural answer to "no budget for partner implementations." The thing that stalled it was the cost/shape of partner-led custom services. Productized/accelerator delivery (321GO + CAF) lowers that services cost — the same dollars buy a repeatable assessment→build motion instead of a bespoke implementation. This is the "where this goes" narrative Dan is already excited about, now anchored to the real loss reason rather than pitched in the abstract. Reinforced by the overnight competitor brief: Big-3 SIs sell named destination accelerators; the repeatable mid-market assessment-to-build engine (= CAF) is unclaimed whitespace. ([[2026-06-28-snowflake-si-cortex-positioning-caf-gap]])
3. Leadership changed → the budget "no" may have left the building. Dan flagged leadership turnover since 2024. The person/org that said "no partner-implementation budget" may be gone; fresh budget authority = a genuinely new shot, not a re-pitch to the same skeptics.
4. The approach is validated by KB4's own 2024 words. They asked for answers from the curated semantic layer, not raw tables. That is precisely the semantic-view / governed-SQL story the founder's workshop design (Bronze/Silver/Gold) and Gary's demo (NL → governed SQL over a semantic view, gap-detection → Send-to-Architect → RBAC-extend) already deliver. We're not guessing at fit — we're answering a requirement they wrote down.
5. Demo-skin refinement (resolves this morning's open question). KB4's 2024 ask was about their internal RevOps/BI ("sea of reports"), not their security product data. So if we reskin the teaser toward KB4's domain, aim at an internal-business-ops use case (RevOps reporting), not phishing-sim / training-completion telemetry. NVD stays perfectly fine as the pure-capability teaser; the founder's call is whether the marginal resonance of an internal-ops skin is worth the build given Gary's NVD demo already exists.
What the founder brings Monday (the contribution)
A one-paragraph "why 2024 stalled + how we defuse it" that nobody else in the room can deliver:
2024 didn't fail on capability — the workshop sparked real demand; the $85k follow-on closed-lost on budget for partner implementations. Two things change the answer in 2026: (a) leadership turned over, so the budget authority that said no may be gone, and (b) our 321GO/CAF accelerator path lowers exactly the partner-implementation cost that stalled it — repeatable assessment-to-build instead of bespoke services. And we're not guessing at fit: KB4 told us in 2024 they want answers from the curated semantic layer, not raw tables — which is the governed-SQL/semantic-view story we're already building. The approach for the half-day should lead the business audience with the RevOps "sea of reports" pain, show the governed semantic-layer answer (Gary's demo as the destination), and frame the commercial path as productized, not a custom services quote.
This slots cleanly under the meeting's three asks (approach for the half-day · who to bring on-site · a relevant success story): the founder supplies the approach framing + commercial reframe, Dom supplies the Crowdstrike success story, Gary supplies the demo.