Dave Bittner: [00:00:01] Hi, everybody. Dave here. Our CyberWire podcast team is taking a well-earned break for the holidays. But don't fret - we'll be back January 2 with all-new episodes of our show. In the meantime, we're running extended versions of some of our favorite interviews from 2019. Merry Christmas and happy holidays to all of you. Stay with us.
Dave Bittner: [00:00:25] Thanks for joining us for this Special Edition. Ron Gula is well known in the cybersecurity community as co-founder of Tenable Network Solutions, where over his 14 years as CEO, he and his team grew the company to over $100 million in annual revenue and raised nearly $300 million in funding. These days, Ron and his wife Cyndi run Gula Tech Adventures, where their aim is to support the next generation of cyber technology, strategy and policy. Ron Gula caught our eye with an article he recently wrote titled "Cyber Entrepreneur Pitfalls You Can Avoid." In the article, he gathers a group of tech investors to get their takes on the do's and don'ts of pitching to venture capitalists. He joins us in our studio. Later in the program, we'll hear from DataTribe's Mike Janke to get his opinions.
Dave Bittner: [00:01:14] But first, a message from our sponsors, McAfee. Ideas don't come for free. Budgets are begged for. Long hours are required, the months, maybe even years of research, the sheer human effort of it all - the changes, the revisions, the reworks, the results, the adaptation, the innovation, the collaboration all lead to the final moment when it pays off. And it's perfect, your company's work - as long as it's not compromised. From device to cloud, McAfee harnesses the power of 1 billion threat sensors to design security that moves beyond intelligence to insight so you can move beyond optimizing security products to optimizing your security posture and not just react to threats but remediate threats that matter. Intelligence lets you respond to your environment; insights empower you to change it. McAfee, the device-to-cloud cybersecurity company. To learn more go to mcafee.com/insights. That's mcafee.com/insights. And we thank McAfee for sponsoring our show.
Ron Gula: [00:02:29] When I left Tenable, I had been doing about a year private investing angel seed funds.
Dave Bittner: [00:02:35] That's Ron Gula.
Ron Gula: [00:02:36] And we decided to do this full time. So after about three or four years, I've just seen the same sort of concerns - I'm not going to say complaints - but concerns from the cyber investing community. And it's usually - you know, sometimes they miss out on a deal and they kind of wish they got in on the deal, but most of the time they're saying no to entrepreneurs. And what I wanted to do is try to give an opportunity to capture all the reasons they say no so that anybody out there who wants to start a cyber company or a company any way, you know, can avoid these pitfalls.
Dave Bittner: [00:03:07] Yeah, it's a great list. Let's just go through it together. In your mind, what's the top mistake that folks make when they're presenting to you?
Ron Gula: [00:03:15] So I think for me, personally, it's trying to present everything, somebody who wants to do an hour meeting to do a demo. And that might seem like, holy cow, you know, an hour meeting. Boy, you're really kind of being harsh. But the reality is if you can't engage somebody, an investor, in, like, five minutes - like, what problem are you solving, how do you solve it - if you can't get that across in the first five, 10 minutes, you're probably not going to get an investment from that. So my personal sort of issue is, how do you present what you're doing?
Dave Bittner: [00:03:48] And what do you suppose drives that? Why - is it the nervousness of, oh, my gosh, I've only got an hour in front of these folks - I have to hit them with everything?
Ron Gula: [00:03:56] Yeah, there's definitely a - for first-time entrepreneurs and even second or third - I caught myself doing this at Tenable more than once. You know, you fall back to, well, let me tell you about my degree and where I went to school and what my parents did and - not relevant. You know, it's useful, but it's not the kind of thing you should be leading with, right? Those things are details. And about three years ago, I wrote the five-slide pitch deck, and I referred to this in this particular blog, and it really just is, you know, what probably do you solve? First thing - what problem do you solve? Start with that. Second thing is, how do you solve it? And a lot of times, people confuse those two things. Like, I have a better intrusion detection system. OK, what problem are you solving? You know, that's rough. And then we go on from there about how to present that and make it very enticing.
Dave Bittner: [00:04:45] All right. Well, let's go through some of the other ones. So what are some of the other ones that folks put in front of you?
Ron Gula: [00:04:50] So some of the other issues that come up is just, you know, what is a good idea? And there's a couple of tracks to go on this. But let's say you have - you know, this happens with Tenable, right? Tenable just got an award for being, literally, the best, you know, most comprehensive vulnerability management platform out there. And I'll have somebody pitch me who says, I got 100 more vulnerabilities than Tenable does. Well, do you want to invest in what I'm doing? Maybe it's an intrusion detection system endpoint. Hey, we can do something better than endpoint, better than CrowdStrike. But you look at it and it's basically what I call - it's a 5% better solution.
Ron Gula: [00:05:23] And that is really hard to say no to because as cybersecurity purists, you know, we want the best, right? We want the best threat content, best protection, best, best, best. But if it's 5% better, is it really worth switching out my incumbent, who's probably going to catch up with what you're doing anyway? And everybody kind of overlooks that thing, and it's hard to look an entrepreneur in the face and go, yeah, you are doing something little bit better than everybody else, but no one's going to buy it, and that's tough.
Dave Bittner: [00:05:52] What about exaggeration? You know, someone comes in front of you and they say, either we have all these customers or we have all these solutions. I can see there being a natural impulse to do that, but does your Spidey sense tingle right away? Do you - can you sniff that out?
Ron Gula: [00:06:09] Yeah. So a lot of times, when we get pitches from people, we'll - you know, we'll get the a little bit of the showmanship of it. Like, hey, I just want to tell you, oh, you're the fifth venture capital person to call this week. There's a lot of interest. Great. That's awesome. You know, it doesn't change the fact that there still has to be an investment thesis. Or our phone's ringing off the hook. OK, well, people will say that, but it's - what does it really mean? Is it email? Is it Slack messages? You know, and there's a lot of ways to kind of dig into that. Like, can you show me your Salesforce pipeline? Can you show me your HubSpot thing? Can you show me - you know, can I talk to some of these proof-of-concept people?
Ron Gula: [00:06:48] Another one is people will, all the time - it's not overestimate, but they'll confuse monthly recurring revenue with year-to-date revenue with - you know, if you're going to finish at a certain monthly rate, well, now your annual rate's this. But is that really true? You know, how repeatable and renewable is that business? A lot of time, an investor is going to put the biggest and best number kind of out there, and that's great. If they can do that, let's have a conversation about how to measure the business. It shouldn't be a secret.
Dave Bittner: [00:07:18] You know, one of the things I saw you - in this post, you reached out to some other folks who also are in the investing space. And one of the things that caught my eye was this notion that the tech people might not always be the best people to be doing these presentations.
Ron Gula: [00:07:40] That's definitely - especially in the Maryland, Virginia region, you know, we have a lot of people who are prior military, prior intel, prior government, and they're used to basically saying what they do and how they do it in the most nonamazing way. And they could be completely failing at a technology or completely innovating at something and they're going to pitch it the same way. Unlike I think, you know, founders who come out of an incubator and they've been schooled in how to pitch, schooled in maybe how to present, they might overpresent an idea more than have that substance.
Ron Gula: [00:08:18] So a lot of times, in this region, you know, we've got some really, really good folks who have got great ideas, but they're not presenting it that well. They're not - they don't understand the market. They don't understand, you know, the real opportunity. And that's one of the big reasons I like working with, you know, with DataTribe, with Inner Loop Capital, with a lot of the different folks who've got on that blog there because it can really help find some of the best talent in the market and have them present accordingly.
Dave Bittner: [00:08:45] What are some of the misperceptions that you think people have when they're preparing that meeting with you? Are there common things that they're coming at from just the wrong direction?
Ron Gula: [00:08:54] I think one of the things that I really like to remind people is that getting a round of investment is not the end. A lot of people say, well, if I raised a million dollars for a venture capital firm or $5 million, you know, I'm a success now, and it's like, oh, no, you're going to be at this for five, six, maybe 10 more years. Even when Tenable went public, people were like, oh, congratulations, it's a good journey, I'm like, it's just starting. You know, they are going to be doing a lot of work for a very long time.
Ron Gula: [00:09:24] So, you know, I'd like to remind people that you have to define what your success is. If success for you is bringing a product to market and maybe hiring a CEO and raising some capital and focusing on the technology, then God bless you. If you want to be a CEO and take a company public, that's good. You know, it's good to have these goals and defined for them. But a lot of times, when people present, they don't have their own personal goals in order. Therefore, it's really hard to be aligned with perhaps an investor or even to question, do you need investment?
Dave Bittner: [00:09:55] Yeah, it's a really interesting insight. I mean, the - you know, the - what you're talking about here are pitfalls, and I think about some of the emotional pitfalls that go with this as well. Are people ready to give up control? Are they ready to give up a piece of their business? It seems to me like sometimes people can come to the table not having completely dealt with those internal emotional issues.
Ron Gula: [00:10:19] Yeah. So the change of control's an issue, and the giving up, you know, equity is an issue, and they're two very, very separate issues. So let's take them side by side. So the first one I kind of talk about is, you know, what is your goal? Like, if your goal is to bring a product to market, have it acquired, you know, perhaps be a feature on somebody else's platform, then there's a lot of lot of people who've done that and there's a lot of models for that, and you should realize that you can do that without raising venture capital. And if you do raise venture capital, you should really have a good answer for - the money that you've raised should be making you more money in the long term than if you did it on your own.
Ron Gula: [00:10:58] So a lot of times, when people come to us and they've got really good revenue and, you know, oh, we want to raise this a little bit, like, well, wait a second - you're making a lot of money here. Why are you willing to give up 25% of your company just to get to this next - now, things happen. Don't get me wrong. Markets changes - I've had executives pass. I mean, there's really interesting things that happen with companies. There's no - you know, it's not as - that's why it's called venture capital and risk, right?
Dave Bittner: [00:11:23] Right.
Ron Gula: [00:11:24] But then as far as changing control, that's really interesting, and it's a very emotional thing. So the first company I did, we had network security wizards. My wife was CEO. I was CTO. And it was network intrusion. I had great people, but I was - it was small enough that kind of everything kind of went through me. And I see a lot of entrepreneurs who are like that. And that's fine. When we got to Tenable, I had some really, really good co-founders, and we were able to scale. We were able to, you know, grow and attract some really good talent and, like, update our talent along the way.
Ron Gula: [00:11:58] And along the way, you do have a change of control, especially getting ready to go public. But you didn't have - a lot of entrepreneurs don't have that sort of five-year vision or six-year vision of what does this look like? And it's not necessarily even just change in control. It's like, what is that org chart going to look like? You know, do you have a co-founder who's your CTO, who's really your head of engineering? And you really need a product person and a couple other people in that org chart that you're not filling that out. So a lot of times when I hear change of control concerns, I'm like, I think they don't have a vision of what the future accurately looks like.
Dave Bittner: [00:12:30] Yeah, I mean, I can't help wondering if that, you know, entrepreneur's mindset doesn't always align with the person who's willing to take mentorship, you know. They are an entrepreneur because they think they've figured something out, and they have that personality that says, I can do this better than someone else. And so to have the humility - or whatever you want to call it - to say, I don't know how to run a company that's bigger than a mom-and-pop - is that - am I coming to something here?
Ron Gula: [00:13:02] So that happens. What I like - my ideal type of investee or a company-to-invest-in founder...
Dave Bittner: [00:13:09] Yeah.
Ron Gula: [00:13:09] ...Is somebody who has, you know, works some sort of cyber aspect - perhaps the government, perhaps commercial - and then done consulting for a little bit, where they've gotten a better understanding of that problem and, perhaps, have also done customer interactions - know what payroll looks like, know how to run a business. And then when they hop over to doing a product or a technology - a SAS technology platform - you know, at that point, they've got enough skill to kind of get going. So the question really is then, you know, what haven't they done with? They probably haven't done brand marketing. They probably haven't done two-tier channel distribution. They probably haven't OEM'd their technology. There's a lot of things like that that they haven't done, but there's enough stuff that they have done that at least they can get to a million to 3 million ARR, you know, without a big issue.
Dave Bittner: [00:13:55] Well, let's go through some of the positives, then. Let's go through some of the - let's come at this from a positive point of view. When someone walks in and they've gotten - they've got a meeting with you or some of the other folks here that are the investors that you had share this post with you, what are your tips to them? What's the best way for them to make the best use of your time?
Ron Gula: [00:14:18] So the ones that just knock it out of the park are the ones who know exactly what they want. They have a sense of how the company is going to play out, both from a revenue point of view, staffing - they have a model of what the next two or three years looks like, maybe at the seed stage maybe, you know, but maybe next year - you know, that type of thing. But if they're at the million, you know, runway - you know, or more than that - they're going to talk about milestones that they can hit, that as a potential investor, you could look at that and say, hey, I disagree with that, but I could work with that. You know, so that - those are the ones who hit it out of the park. The ones who don't hit it out of the park are the ones who can't answer those questions - like how do you make money? Who's your buyer?
Dave Bittner: [00:15:02] (Laughter) Right.
Ron Gula: [00:15:02] What valuation are you looking to raise at? You know, a lot of times it's this dance of, hey, we want to raise a million dollars. Well, what kind of percentage are you looking to sell? And well, we're kind of seeing what the market bears. OK, I mean, we can throw something in, you know, but that's usually - it's a hard - it's usually better when there's a lot of alignment, you know, with multiple investors and what the folks want.
Ron Gula: [00:15:27] Also, back on the positive side, you know, is do they have a sense of what the world looks like? So if they're going to give away a freemium technology - you know, like, Signal, you know, Wickr - they all have different freemium things they can give away, how does that play into them, you know, getting to $10 million in revenue? Is there some sort of benefit that they're giving to humanity that also creates a small problem where there's an - you know, an ability to do an enterprise sale? You know, that kind of thing. If anybody has that kind of vision, that usually gets investors pretty excited because most investors in cyber - don't get me wrong; they want to make a good return - they're in it because they think there's an opportunity to fix things and that creating, you know, a company through capitalism is the best way to solve a lot of these problems. And if you can appeal to those kind of senses, you're going to do well as well.
Dave Bittner: [00:16:17] How should I approach my - the degree to which I sugarcoat the risks?
Ron Gula: [00:16:24] So there's a lot of risk, you know. So there could be risks in your staff. You know, are your three co-founders, you know, going to be around for a while? Do they have visibility? You know, do you have a risk? Are there five competitors coming out? Are you pretending like there's no competitors? Like, if there's 100 people doing what you're doing, it doesn't matter if you're the best because there's 99 other people who are going to steal your revenue and your - they're going to dilute your brand and that kind of thing, you know, if you're not based in the U.S.
Ron Gula: [00:16:51] And you know, we've got a lot of great - America's the land of opportunity. But frankly, if you're incorporated outside of the United States, there's not as much protection as there is inside the United States. Are you physically near your investors? This is - I get this one quite a bit. Like, if you're - do I have to travel to see you, right? Now, some people like virtual stuff. They like Google Hangouts. I'm in three or four in my company. I do a Hangout once, twice a month, you know, and it's great. And I see them in person occasionally, which is phenomenal. Other people really want - you know, they lament having to go from coast to coast to, like, fly to a board meeting. So all of that can be risk.
Mike Janke: [00:17:34] Seeing the massive volume of startups that we do pitches - over 300 a year...
Dave Bittner: [00:17:40] That's Mike Janke, co-founder of DataTribe, a cybersecurity startup studio in Maryland. He's a multi-time CEO and company founder and former Navy SEAL. Full disclosure - DataTribe is an investor in the CyberWire.
Mike Janke: [00:17:54] The problem is - and by the way, this is a problem I had as a multi-time CEO myself - not understanding kind of the process, right? Just because a CISO says this is interesting; this is great; let me introduce you to a couple of my guys; let's do a trial, you know, does not mean - it's not even 50-50 whether you actually are going to end up with a sale. There are so many other competing things, processes, budgets, timelines that go into it that that barely puts you at the door, right? So I often teach them - wait a minute. You know, you've got a slide here of all these people who like you and said that's cool, and maybe you're doing pilots.
Dave Bittner: [00:18:43] So I'm pitching to you. You're a potential investor, and one of the slides on my deck says, hey; I've got all these people who are ready to sign up and buy our product.
Mike Janke: [00:18:53] Right.
Dave Bittner: [00:18:54] And it's probably not quite a hundred percent accurate.
Mike Janke: [00:18:59] Yeah. It oftentimes, you know, at this stage - early-stage startups, they're out talking to a lot of people, so they'll put a logo. Hey; we had a great lunch with, you know, the VP of intel at this company, and so we're going to put the logo up. These are the people that are interested in us. The problem that happens is, in these scenarios, you lose credibility real quick with venture, who sees a lot of stuff. They look at it and go, OK. These guys really don't know what they're doing, right? So there are ways to approach it because whether we work with them, I want them to leave out of these doors having a better chance to get funded.
Dave Bittner: [00:19:45] Right.
Mike Janke: [00:19:46] So that's a big area, and there's not a lot of information out there for a startup, a CEO, a founding team to really know that, you know? So my idea is to help them understand more from the dark side.
Dave Bittner: [00:20:05] Yeah. But what's the proper way for me to share that information with you? How do I frame it in such a way where I'm expressing the optimism that I'm out there beating the bushes and trying to drum up business but not exaggerating to a way where I'm going to lose my credibility?
Mike Janke: [00:20:22] That's a great question. So there are many, many ways to do it. The first point is do not put that in your projections, right?
Dave Bittner: [00:20:32] OK.
Mike Janke: [00:20:32] So you had lunch. That doesn't mean you're getting a 250K sale from the CISO.
Dave Bittner: [00:20:38] Right.
Mike Janke: [00:20:39] Nine out of 10, we see meetings being projected that - here's one. We're going to close them from a lunch. That's No. 1. No. 2., how you couch it is interest. You just, on the slides - interest - these are the people we met with. We're in various stages with them. These are some of the reactions we got, which - you could put a quote. CISO of Ford says, wow; that is very compelling. It does things others don't. Let us run a pilot. That tells venture or a very sophisticated angel you understand the process. It's OK to say, I don't have a single sale. But what that shows is you've been out there, and you've assimilated information back that says, yeah, it sounds on the surface like we got something - they would be interested.
Dave Bittner: [00:21:34] Right. Nobody's saying to you, no, I'm not interested. You know, that's a dumb idea. Please go away.
Mike Janke: [00:21:40] Exactly.
Dave Bittner: [00:21:41] No. I would never buy that in a million years.
Mike Janke: [00:21:43] You got it. That's an indicator. But what we see is, nine out of 10 times, people then show the next slide the hockey stick that says, six months from now, we're going to have 5 million in revenue, you know?
Dave Bittner: [00:21:55] Sure, sure. Yeah. Well, let's move on to the next one here, and you mentioned stage-appropriate funding. What are we getting at with that one?
Mike Janke: [00:22:03] Oh, yeah. That's probably my biggest, and it's another area where - most venture will not tell a founder that. They'll just make a little checkmark, right? The problem is - and it's not fair a lot of the times, but there's so much information out there. A founder can get this information where - when people come in and pitch and they're at this very early stage and they'll show the next three years of projections. Year one, we're hitting 11 million. Year two, we're going to have 120 million in revenue. There isn't a company in the history of the world that has ever done that, right?
Dave Bittner: [00:22:45] OK.
Mike Janke: [00:22:46] So the huge credibility gap there - the second part of it is we're-out-for-seed stage. We need $12 million. There are no seeds in cyber or data science that are getting 12 million. So stage-appropriate means you're getting a million, possibly 2 million at seed. You're taking 8 to 10 million at A, you know, 20 to 75 at B.
Mike Janke: [00:23:13] So when you match those two stage-appropriate things up, which are I'd like to raise $12 million for this idea, and I'm going to hit $120 million in revenue next year, you've just lost everything because two things - one, in today's day of startup world, you could just go on Google, and there are blogs and articles and data sources that'll show you what is norm, how to present, right? The other is does that person sitting across the room from me really have any idea, a basic understanding? No. Right? So that means I'm starting from really raw material, which is a risk, you know. You don't need to be a five-time CEO, but even a first-time CEO can just have coffee with somebody and get information about it. So stage-appropriate investing really puts you in an area where you're having a really contextual conversation with somebody.
Dave Bittner: [00:24:19] Do people recover from these sorts of mistakes? If I sit down in front of you and I make these errors, do I have any chance?
Mike Janke: [00:24:26] Not with DataTribe. But that's why we take the time and effort. The first thing is to tell them truthfully. So oftentimes, investors and venture doesn't necessarily want to, you know, cause somebody discomfort.
Dave Bittner: [00:24:50] Right.
Mike Janke: [00:24:50] And they'll say, well, that's great. Well, Sarah will schedule something for you in 2031, right?
Dave Bittner: [00:24:57] (Laughter) It's just not for us.
Mike Janke: [00:24:58] Right, exactly. But by - because somebody did it for me, right?
Dave Bittner: [00:25:03] Right. Right.
Mike Janke: [00:25:07] So I'll sit there and go, hold the presentation, guys. Let's walk through it because when you walk out this door, I want you to have another stab at it. So I always couched them - before you go in and blast out your deck to 72 people, sit with somebody, get a rational check because you only get one shot. And if people got this and then you come back to them, they're not even going to answer. So I always try to say, what did somebody do for me with just guys (ph)? And I'll even pull up my laptop. Let's go to the Google.
Dave Bittner: [00:25:43] (Laughter).
Mike Janke: [00:25:43] You know, what is seed round? What is A round, right?
Dave Bittner: [00:25:49] Right.
Mike Janke: [00:25:49] So that's why.
Dave Bittner: [00:25:49] How much, if any, sort of back channel communication goes on among the investor community as these folks are out making their pitches? Are you all sort of giving each other a heads-up or here's - you know, here are the good things; here's the things you've got to watch out for. Is that a reality?
Mike Janke: [00:26:07] Yes. I would say that that's much, much more prevalent in mainstream venture, where they're looking at A rounds, B rounds and writing $150 million checks for E rounds because there's a smaller pool that they're kind of looking at. But when it comes to early stage, not so much simply because you get these things in, you've got to have a good filter, and - because as a founder, the one thing I hated the most was no response or a response three weeks later. Tell me now - no, yes, no. I mean, if it's not in your investing wheelhouse, give me an answer. Hey. Good luck to you, you know.
Dave Bittner: [00:26:56] Right. Right.
Mike Janke: [00:26:57] The talk among venture usually happens when you see something, and you go, hmm, that's interesting, or a real negative side, which is, man, this is not real good, right?
Dave Bittner: [00:27:15] Yeah. Yeah.
Mike Janke: [00:27:16] And it's not couched in a way as, what are your thoughts? Venture's too egotistical. Everybody's the smartest in the world.
Dave Bittner: [00:27:25] (Laughter) Right.
Mike Janke: [00:27:25] I don't need Sequoia. You know, that's - yeah.
Dave Bittner: [00:27:29] Yeah.
Dave Bittner: [00:27:29] I want to give Ron Gula the last word here. So let's wrap up. I want to put you on the spot here a little bit and say, you know, if there's one pitfall, if there's one thing - do not do when you come to present in front of you, what would it be?
Ron Gula: [00:27:46] Not describing the problem that you solve. If you don't describe the problem you solve correctly and we jump right into your go to market or the market or your technology, I'm always going to be coming back to, like, why do I need this? So that's the biggest mistake people make.
Dave Bittner: [00:28:02] They talk around it?
Ron Gula: [00:28:03] They talk about the solution and not the problem. And I see this a lot in the identity space. I see this a lot in the SOC orchestration, automation space because there's lots of tech. Let me show you how cool this tech is. Is it cloud-based? Is it Google-based? Is it elastic-based? Is it a - what problem are you solving again? Why - who - you sell this to MSPs, to operations centers? It's a hard thing to say - is what problem do you solve?
Dave Bittner: [00:28:31] Ron Gula, thanks for joining us.
Ron Gula: [00:28:33] Thank you.
Dave Bittner: [00:28:37] Our thanks to Ron Gula and Mike Janke for joining us. We'll have a link to Ron's article, "Cyber Entrepreneur Pitfalls You Can Avoid," in the show notes.
Dave Bittner: [00:28:46] Our thanks to McAfee for sponsoring our program. Visit mcafee.com/insights and find out why McAfee is the device-to-cloud cybersecurity company.
Dave Bittner: [00:28:58] For everyone here at the CyberWire, I'm Dave Bittner. Thanks for listening.