Special Editions 11.29.16
Ep 10 | 11.29.16

Securing a Deal - Cyber Security Venture Capitalists on what they look for. A CyberWire Special Edition.


Robert Ackerman: [00:00:03] You know, the great thing about venture capitalists and entrepreneurs is they're pretty good eventually at spotting opportunities requiring deep technology-based innovation.

Tom Kellermann: [00:00:13] Cybersecurity has become a must-have rather than a nice-to-have.

Christopher Pierson: [00:00:17] VCs are really expecting a road map to revenue, a plan to revenue.

Dave Bittner: [00:00:22] There's no question that cybersecurity remains a hot industry - that attracts investment. What are venture capitalists looking for, and how do they decide which deals to make? How did we get here, and what's the outlook, looking ahead? We round up some experts as well as some of the top cybersecurity venture capitalists in the industry to find out how they choose and what they expect once the deal's been made.

Dave Bittner: [00:00:50] Time to take a moment to thank our sponsor Cylance. Are you looking for something beyond legacy security approaches? Of course you are. So you're probably interested in something that protects you at machine speed and that recognizes malware for what it is, no matter how the bad guys have tweaked the binaries or cloaked their malice in the appearance of innocence. Cylance knows malware by its DNA. Their solution scales easily, and it protects your network with minimal updates, less burden on your system resources and limited impact on your network and your users. Find out how Cylance is revolutionizing security with artificial intelligence and machine learning. It may be artificial intelligence, but it's real protection. Visit cylance.com to learn more about the next generation of anti-malware. Cylance - artificial intelligence, real threat prevention. And we thank Cylance for sponsoring our show.

Robert Ackerman: [00:01:44] When you come to me, I want to understand the big vision. I want to understand, you know, who's on the team. I want to understand why your value proposition, your solution is particularly compelling.

Dave Bittner: [00:01:56] That's Robert Ackerman. He's founder and managing director of Allegis Capital. They provide seed and early-stage funding for what they describe as disruptive and innovative cybersecurity solutions.

Robert Ackerman: [00:02:06] I want to understand how big of a business you think you can build. And I also want to understand what you think the capital requirements are likely to be. Now, look - this is an art. It's not a science. You know, all of the numbers, the strategy, the tactics are all going to be subject to revision as you engage with the marketplace. But it's the way to begin to, you know, frame an initial conversation. And so I'm basically asking you to give me a graph on a timeline that shows, you know, here's what we need to do in engineering, here's what we need to do in sales and marketing, here's what we need to do in financing. You begin to, at a very high level, paint a picture of how this business is likely to come together. It doesn't need to be perfect. It just needs to be - what do you think today and why? And again, it's the starting point for a conversation with a potential venture capital partner.

Tom Kellermann: [00:03:00] Then you have to be willing to demonstrate both a go-to-market strategy and a technology road map that is at least two years in the future.

Dave Bittner: [00:03:08] Tom Kellermann is CEO and co-founder of Strategic Cyber Ventures, a cybersecurity-focused venture capital fund in Washington, D.C.

Tom Kellermann: [00:03:17] And many organizations seem to think that their technology is sound, and it's perfectly developed, and there's no need for any sort of adaptation or modernization of the capability. And from my perspective, as having been a cybersecurity operator for 19 1/2 years, I would suggest that the adversary will always reverse engineer your technology, and they will always figure out a way to bypass it, just like you see with the advent of sandboxes being ineffective due to sandbox evasion techniques in today's world. And so when you consider that reality, please don't tell me that you don't have a technology road map because you feel like it's perfect. Please acknowledge to me that you may or may not have been granted your patents, and please try to shine a light on what you will do with that investment. If I invest in you, how will you go to market from an engineering investment perspective all the way through sales and marketing. But when you speak to sales and marketing, highlight what industry verticals you're going to target first and how.

Tami Howie: [00:04:20] They think what they have is the best thing out there, and they can't see that there's other competitors.

Dave Bittner: [00:04:26] Tami Howie is CEO of the Chesapeake Regional Tech Council, a nonprofit economic development organization in the mid-Atlantic region. She's also a lawyer and has helped with the successful exits of over 150 companies.

Tami Howie: [00:04:38] They can't see that there's other people that are coming into their space because they think they're so great. And they really need advisors, and I'm really big on having the right advisory board that helps people that have invented something or that has a great company with a tech product. They can help them in all the verticals they need. They need to make sure they're legally sound, that they actually own what they think they own. They need to make sure they're financially accounting for it. They need to make sure that they are marketing it properly. And they need to make sure that the rest of the world understands, and you know, that what they're selling is what they're selling.

Dave Bittner: [00:05:11] Anyone who's started their own company has heard this bit of advice - network, network, network. Dr. Christopher Pierson is general counsel and chief security officer for Viewpost, an electronic payment and invoicing company.

Christopher Pierson: [00:05:24] Making sure that you are networked into the right people that are in the NC world is critical. You want to do so before you need funding. You want to try to meet, sink in and get mentored by CEOs, by VCs, by others that are in this industry. You want to make sure you do that at least a year before you think you're going to knock on anyone's door.

Robert Ackerman: [00:05:47] One of the things that entrepreneurs really need to spend their time with is planning their fundraising effort. Who do they want to talk to as prospective investors and why? And it's not just the firm. It's the individual within the firm. You're looking for people that are focused in your sector, that have experience that you may be able to connect with or allow them to connect with you, that will give them a frame of reference through which to view whatever the startup proposal you have is. The extent that you're not targeting them, you're wasting your most precious commodity, which is time.

Christopher Pierson: [00:06:19] You definitely need mentors and sponsors to be able to support you in terms of making introductions, getting in front of the VCs and actually getting in, starting that relationship.

Robert Ackerman: [00:06:28] Don't cold call. You know, find a way to be introduced to that partner within that firm. You know, frankly, all of us are overwhelmed with potential investment opportunities. We probably look at a thousand a year. You know, and we make a half a dozen investments. And I hate to admit it, but frankly, the companies that are on the top of the stack of things for us to look at are things that came in via referral from trusted, you know, sources - you know, one of our CEOs or people we've backed in the past, other venture firms. So once you work the process of getting down to that target list, you then need to figure out, how do I get a warm introduction to the venture capitalist I want to talk to, so that I'm on the top of the stack, and I at least have an opportunity to tell my story? Remember - the objective of that first meeting is to get to a second meeting. It's not to close the deal. It's not going to happen. But it's to get to a second meeting.

Dave Bittner: [00:07:37] Of course, no deal happens in a vacuum. The investment environment can have a huge impact on how quickly the money flows, how VCs value a company, what they expect to get out of it and how quickly. For a look at today's environment and how we got here, Christopher Pierson and Alberto Yepez give us a rundown.

Christopher Pierson: [00:07:54] In 2015, you had - you know, it was kind of a peak year for VC investment in cybersecurity. You had almost - you know, nearly $3.7 billion invested in that year, globally. This year, about half the year was only $1.6 billion. So folks are really thinking that there is some overcrowding here. There's going to be some synergy and some collaborations and some mergers that need to happen because it is getting very, very crowded. If you take a look at things made from 2012 until the present, there are some definitely marked differences, especially when you take a look at 2012 versus so far what has happened in 2016.

Christopher Pierson: [00:08:29] So back in 2012, you had something of 83 exits and five IPOs in that time frame. In 2016, you have 39 M&A opportunities in terms of exits and only one IPO. So the IPO market has definitely become much harder to egress into, which, for some VCs, that's an issue. They may be looking at time horizons that are at the five-year in terms of an exit and thinking about how you actually push the company out there so that you can get back the funds at a, you know, 8X, 10X what was put in. It becomes an issue in terms of the IPO market not being as accessible. In terms of M&A opportunities, you still see good amounts of activity. Like I said, I think 2015 was a, you know, peak year for cybersecurity investment, but when you take a look at things today, in 2016, you see a little bit of a slowdown, a little bit of a drop-off there. So we're still raising significant funds in 2016, but the flow has been stifled a little bit. And overall, if you take a look at 2012 perhaps as being different from 2016, you not only see differences in terms of funding and deal flow and M&A and exits, you also see differences in terms of where those investments were made. So in 2012 and for a year or two beyond, you saw still a lot of investments in the network and endpoint security area, kind of tried and true.

Christopher Pierson: [00:09:55] In that 2014 area, everything - you know, I can remember back to a RSA Conference that year in 201. It's a - everything had a little sticker, so to speak, on it that was threat intelligence, included threat intelligence baked in. We're a threat intelligence company. It was kind of the good buzzword, the good keyword that folks were using, as information sharing was popping up more and more, even though it had always been there. You know, so you saw the market move from network and endpoint into this threat intelligence world. Now what you see in 2016 - a little bit at the end of 2015 - is this morph into behavioral detection or AI. The artificial intelligence, we're not necessarily there to AI. We're more on automated cybersecurity or cybersecurity automation.

Christopher Pierson: [00:10:41] But in 2015, at the end of 2015 and indefinitely in 2016, you see a lot more deals, a lot more interest in this AI automated security behavioral NetFlow types of area. And of course, cloud has been one that's as - there's been a push more to Azure and to Google and to AWS. You see those options hopping. But you do see a shift from the traditional tried-and-true. Prevent the infiltration to a market that is more dominated by VCs looking at who's doing something sexy and cool with exfiltration or behavioral or NetFlow analysis. So you do see a lot of shifts there from that - like I said, from that 2012 to 2016 area.

Alberto Yepez: [00:11:25] The groupings of acquirers has almost tripled, if not quadrupled.

Dave Bittner: [00:11:31] That's Alberto Yepez, co-founder and managing director of Trident Capital Cybersecurity, one of the largest funds that exclusively invests in cybersecurity companies.

Alberto Yepez: [00:11:41] Before, the only companies acquiring cybersecurity companies used to be cybersecurity companies, like Symantec, McAfee, Check Point - the big ones. Then after that, the system companies like IBM, Oracle, enter the market to become acquirers. Now, what we've seen is companies that are in the industrial base - companies like GE, Siemens, Bosch - enter the market and are looking for acquisitions, so almost a whole new category of players coming in and buying companies. Then the cloud companies are also coming in and looking for security. Before, people were just - it was AWS. But if you look at the landscape, how Microsoft is pushing - trying to get Azure to be comparable to AWS, IBM is trying to figure out what their play is going to be, Oracle has a cloud, Google has entered the market. So it gets very, very exciting.

Christopher Pierson: [00:12:42] So 2017, as I look ahead, I think that we're going to see a few interesting selections being made in network and endpoint security. And those are going to be the folks that are using more of this automated cybersecurity, more like the Taniums and Silo, Red Canary - those types of companies that are doing behavioral analytics, NetFlow analytics, automation and security there. I think that threat intelligence - you're going to see a little bit more of a convergence there. You know, companies are using one solution or the ISACs are using one solution, and I think we're going to see a little bit of convergence there. I think behavioral detection is - and that's where you get the behavioral detection/AI. That's going to continue to blossom. I have a few worries there that we have too many companies that are at such a small size. That is actually creating quite a crowded market in that space, quite a crowded market. And so I think what you're going to see is some strategic buys in that area. So you have, you know, folks like, you know, Darktrace and LightCyber and others doing interesting things in behavioral detection. But I think we're going to see even some convergence there.

Christopher Pierson: [00:13:52] And I think that with the increased likelihood of, you know, kind of the big three sector-based attacks from an infrastructure perspective, critical infrastructure perspective - that being energy and telecom and finance - I think that this area of, you know, Internet of things cybersecurity is going to pop a little bit more than it has. There are some good companies that are out there that are developing solutions in this space, you know, definitely tracking folks like, you know, Argus and Bastille and ThetaRay, but there doesn't seem to be anyone with any hold on the market. I think given the attacks that we just saw now - what is it? - three weeks ago, with the denial attacks, in terms of denial - distributed denial-of-service attacks that were via IoT devices. I think that we're going to see a lot more focus there, as attacks naturally morph into the home environment or home impact. But definitely, you know, AI, automated security behavior analysis and NetFlow - that area is going to be super interesting. Exfiltration companies that move - right? - into that area entirely, kind of like in Silo - I think is going to be very interesting - and the IoT area as well.

Tom Kellermann: [00:15:13] So 60 percent of our decision is based on the team.

Dave Bittner: [00:15:17] Tom Kellermann.

Tom Kellermann: [00:15:18] And it's not necessarily whether it's someone I want to work with - although, you know, your gut and your Blink is always giving you advice - but it's really a question of the team dynamics, the cultural fit of that team itself, the honesty in that team themselves, the acknowledgement of the team and the leaders of that team, usually who are the CEO and CTO, that other team members may be able to step up their game, while - they may need to be replaced.

Christopher Pierson: [00:15:46] You want to make sure, above and beyond anything else, that there's a right cultural fit. If this is not someone that you want to be on the phone with on a Sunday or a late night or early morning or a call in a crisis situation and ask for help, you should not do the deal with them. A lot of times, people pay attention to the deal terms, and let those override common sense culture and personality items. You want the person sitting in the seat next to you, when things get really hot, when things don't go the right way, you want that person to be someone that you can talk to, that you can relate to, that you can have a business and a personal relationship with.

Alberto Yepez: [00:16:23] And don't look for somebody that just looks exactly like you. Look at someone that has more experience, that is going to challenge you, that you could work with.

Robert Ackerman: [00:16:32] The process of building a company is anything but a straight line.

Dave Bittner: [00:16:36] That's Bob Ackerman.

Robert Ackerman: [00:16:37] In order for a venture capitalist to be, you know, effective in working with a team and hopefully bringing their experience to bear and helping that team get through the minefield which is inherent to every startup, you know, there needs to be chemistry. There needs to be, you know, a connection. You need to be able to talk to each other. There needs to be trust. If you don't, you're inevitably going to end up with an antagonistic situation, where you're working at cross-purposes, and that only increases the risk of building your company.

Tom Kellermann: [00:17:08] The willingness of that team to acknowledge their own deficiencies and to complement their creative competitors is paramount. So many times I've gone into organizations who poo-poo and disregard their largest competitors without doing a feature-based comparison and acknowledging some advancement by a competitor that they themselves should have achieved.

Robert Ackerman: [00:17:36] From a venture capitalist perspective, you know, first, second and third - we invest in people. You know, we like big markets, we love differentiated technology, you know, we value compelling, differentiated solutions. But at the beginning and the end of the day, it's all about investing in people. And so it's the background of the people, it's their temperament, it's their personality, but it's also - can you establish that trusted relationship?

Dave Bittner: [00:18:04] Speaking of people, sometimes there's one person in particular who can slow down a deal or even kill it - a reluctant founder holding on too tight.

Robert Ackerman: [00:18:13] If you plan to bring in a venture capitalist, you better get over control, and you better understand that you're going to be sharing. The best venture capital investor partnerships are ones where there truly is a partnership.

Tami Howie: [00:18:25] Owners always get in their own way.

Robert Ackerman: [00:18:26] Tami Howie.

Tami Howie: [00:18:27] Nine times out of 10, you know, you are passionate, that is your baby, that is your child - that's not just for cyber companies. Every CEO thinks they can do everything. But the true smart CEOs and the serial entrepreneurs that have been out there hire people that are so much smarter than them in certain verticals, so that they can get out there.

Robert Ackerman: [00:18:45] Everybody's capital spends the same. What you're looking for is, over and above the capital, what resources, what experience, what network can a venture capitalist bring to the business that helps mitigate risk and improve the probability of success? That comes at a price, and that price is, you know, equity. And so, you know, you will receive investment capital, but you're going to suffer dilution. So again, you're back to, you know, an equation where you're trying to optimize, you know, what you're getting and what you're giving in return. I think one of the real mistakes that entrepreneurs make - and I can see this as a two-time entrepreneur myself, early in my career - you know, is insisting on control. Control is an illusion. You have influence, and what you want is the people sitting around the table with you who can bring complementary skills and experience and networks to the problem-solving that is inevitable in building a company from a concept.

Alberto Yepez: [00:19:46] Control - there is a false sense of security because you may be controlling this small island, but if you really want to go after the global opportunity, you have to open up and trust the people, the same people - the same way you trust people that come in and help you build the product. And your executive team - in the same way you're going to add members of your board and investors. So my biggest advice is control is elusive. It is very hard to relinquish. But at the end of the day, you have to trust people that have alignment with you.

Tom Kellermann: [00:20:21] If you are the CPO and founder, and you're wearing the CEO hat, you should be willing to take that load off your shoulders. You should be willing to unburden yourself. And someday, hire a professional CEO, someone who has run corporations and organizations before, to come in and serve as your partner, so that you can focus on what you are best at. That is their Achilles heel. They're holding on so tight to their baby. They don't want it to go away to college. They need to appreciate the fact that their technology needs to grow, your organization needs to grow. They're having the conversation with us and others because they want just that. They should appreciate that the value of their creation and the historical impact of their creation will be far greater once they allow it room to grow, and they can achieve that by acknowledging that they need to give up some semblance of organizational control, internally, so that they can create a far more global team.

Tami Howie: [00:21:22] That's one of my biggest challenges over the years with my clients, is I have to tell people, this is not your child. It is a business decision. So as soon as they can let go of this product, this company being their child and they view it as a business person, then the deal always goes so much smoother.

Robert Ackerman: [00:21:43] If you want to be good in our business long term, you develop a BS detector really, really quick.

Dave Bittner: [00:21:47] That's Bob Ackerman. He says there are some common mistakes people make when they're looking to engage with a venture capitalist.

Robert Ackerman: [00:21:53] I think that one of the real challenges for a lot of entrepreneurs is - there's a proclivity to come in with perhaps a little more hubris than is constructive. There are things that, you know, we all hear all too often - we have no competition. Everyone has competition. It may be a direct competitor. It may be competition for budgets. But everybody has competition. Identify those upfront. Take control of that challenge and own it, if you will.

Robert Ackerman: [00:22:26] The next mistake I see people making is, of course, our financial projections are conservative. I have never had anyone come in and say, our projections are just wild-ass guesses. Inevitably, people come in and tell me, you know, these are all conservative. You don't need to go there. Just talk about how you see the business coming together, what the thought process is, you know, behind the financial projections you have, what the variables are and where you came down on those variables. Again, what you're trying to reflect is that you are a master of the subject matter, that you've thought about the business, the variables in building the business, that you know what the knowns are, but you also can identify with the unknowns are.

Robert Ackerman: [00:23:12] And engage the prospective investor in a conversation. You know, if you engage them in a conversation, you begin to build a rapport. You know, you begin to develop a plan or a shared vision around the business opportunity, and you know, that goes a lot further than walking in with, we've got all the answers, nobody can teach us anything, we have absolutely no competition, and by the way, there's 13 other guys that I'm going to be meeting with, you know, over the next two days, the financing will be done by the end of the week. When you start making those kinds of statements, you just undermine your own credibility.

Alberto Yepez: [00:23:51] Do your homework. Not all venture capitalists are equal. I made the same mistake when I was an entrepreneur. I would just try to talk to every single venture capitalist that wanted to talk to me. It's good for practice, but it may not derive a lot of return. There are groups that are specialists, and I would go to people that understand the industry to try to get funded. It's a short list, but you are better off because, even though they decide not to invest, they'll give you some very good feedback.

Tom Kellermann: [00:24:25] Make sure that you're going to choose a venture fund or an angel investor who can add value to you beyond just writing a check.

Dave Bittner: [00:24:34] That's Tom Kellermann from Strategic Cyber Ventures.

Tom Kellermann: [00:24:37] Really understand what they've done in the past. Look at their current numbers of their portfolios. There are a lot of venture capitalists out there, as well as strategists, that may have already invested in your competitors, who are not telling you this and are only sitting there with you to conduct a brain-drain exercise, or they just want to invest in you at a small amount to ensure that they have cornered the market on that security control. Be wary. Look at who they've invested in. If I'm going to go to market strategy, pick two industry verticals that you think you can make it rain in, if given the right team, if given the right resources, and explain fully how you would deploy those and over what period of time, from a staffing strategy perspective. Acknowledge your own weaknesses, and speak to how you could see yourself improving both your leadership, both - and your strategy and, finally, your team. If you have to give up the reigns as founder to become the CTO and founder, you shouldn't be willing to do that if you have the right chemistry with the CEO or COO that you bring in.

Tami Howie: [00:25:47] Well, my first advice is you should plan, from Day One, for your exit because there's certain things that happen at your exit that, if you haven't planned for at the beginning, then you will not be able to sell your company at the price you want to, and you will not be able to go public. So when you first start your company, you should figure out, am I going to be an exiting company, or am I going to be a lifestyle company? And then, you know, as you go along each year in your planning, you should say, OK, are we going to be an exiting company or a planning company or, you know, a lifestyle company? And if at any point in those conversations you decide that you are going to have an exit, then you need to make sure that you get real accountants in the door and have your accounting up to par because you're going to have to - if you get sold to a public company, you're going to have to roll your financials into that public scope, and you need to make sure that you are tight on your numbers.

Tami Howie: [00:26:39] And you also need to make sure that you have a board structure and an advisory structure that is attractive because you can have the greatest product in the world, and if people don't believe what you have is great, then they're never going to be interested in buying you or taking you public. So I guess the two most important things, I would say, is make sure you have a great board or advisory board and, also, make sure that you have your legal house and your accounting house in order.

Robert Ackerman: [00:27:06] Building a startup is a lot like crawling through a minefield in the middle of the night. You know, there's two ways to get through it. There's the Brio (ph) method, which has a relatively high level of attrition. You're likely to get something blown off. Or you can go find a map. You know, in a domain like cybersecurity, which moves so quickly, you need to find a map. You need to have somebody who can help you run through that minefield because if you have to stop, if you have to get on your hands and knees, if you have to crawl - you know, game, set, match - you inevitably lose. So this is an area where, you know, advice to the entrepreneur is - you know, you're looking for an experienced cybersecurity investor that has been working in this space for years, that has the experience, that has the network, that has the customer relationships that can help you build out a team, that can keep you off of those mines, as you run through the minefield.

Tom Kellermann: [00:28:03] We do all of that because we want to see them grow. And we're not just trying to flip companies or crack a whip on them and force them to grow quickly. We're in this for the long haul. So - and we just want to become members of their team - not coaches, but members of their team. So just see us as an added franchise player or two on a football team that's going somewhere.

Dave Bittner: [00:28:30] And that's our CyberWire Special Edition. My thanks to Bob Ackerman, Tami Howie, Alberto Yepez, Tom Kellermann and Christopher Pierson for being a part of our show.

Dave Bittner: [00:28:39] Be sure to check out our daily cybersecurity news briefing podcast at thecyberwire.com.

Dave Bittner: [00:28:45] The CyberWire podcast is produced by Pratt Street Media. Our editor is John Petrik. Our social media editor is Jennifer Eiben. And our technical editor is Chris Russell. Our executive editor is Peter Kilpe. And I'm Dave Bittner. Thanks for listening.