#remember in one of the early books when Jake just had a cockroach in a little matchbox inside his desk?

[tomberensonsghost]

The real reason Jean and Steve didn’t notice anything strange about Tom:

Jean: So, uh. Have you been in Jake’s room lately?

Steve: Yeah, the other day.

Jean: Did you happen to look in his desk?

Steve: You saw it too?!?

Jean: Right??? Why does he have that??? Why is it in a little box???

*wide-eyed, confused silence for several minutes*

[theyearoftheking]

Book Seventy-Four: End of Watch

Does anyone else have a list of books or movies they read/watch, hoping they’ll end differently every time? Like, the end is so traumatic you just can’t stand to watch it... and maybe if a character makes one teeny decision differently, their fate will be positively altered. 

I tried to explain this to my husband once when Titanic was on. I keep watching the movie, and hoping it ended differently. He stared at me like I was a complete idiot. “The ending doesn’t change. The boat still sinks...” But, but, what if it doesn’t this time? Yes, I know I sound like a total lunatic. But that’s also the way I feel about End of Watch.

Spoilers!!! Spoilers!!! Spoilers abound past this point: consider yourselves warned!!!

Maybe this will be the time Bill Hodges goes to the doctor just a little bit sooner, and they catch his cancer before it becomes so advanced. Maybe Bill starts radiation and chemo, and doesn’t leave Holly in this cold, miserable world alone. Maybe after his heart attack, Bill embraces a plant-based diet, and does yoga every morning, and is kind to his body. Maybe, maybe, maybe. Bill’s death is up there with the other heartbreaks Steve has given us: Eddie, Jake, Wolf, John Coffey, Susan Delgado... I could probably keep going, but these are the first characters that come to mind. 

Ugh. So, now that we’re sufficiently down, allow me to bring you back up. In 2016 when this book was published, my daughter was eight, and very enamored with all the games on our iPad. The farting dog app was one of her favorites. But one day she told me about a new game called, “Tap Tap Fish”. I asked her if she was feeling angry/scared/confused/losing track of time/finding herself in a trance while playing this game. She gave me the typical, “Mom, you’re losing your mind” look she’s perfected over the years. But that game, and this book have become something of a running joke in the house, and when she asked me what I was reading, I told her, “Tap-tap-tap-fish-fish-fish-kill-kill-kill...” Ah, some jokes never get old. 

So, End of Watch is the final book in the Bill Hodges trilogy. We find out early on that Bill is suffering from pancreatic cancer, which has spread throughout his body. The prognosis isn’t good, and chemo and radiation will only give him a few more years to live. As Bill is dealing with this prognosis, suicides start popping up with alarming frequency. And then, little Barbara Robinson almost steps in front of a speeding truck, because the voices inside her Zappit handheld game console tell her to end her life. Thankfully, little Barbara is fine, and ends up with a broken leg and a cute boyfriend. Not a total loss. 

But of course the suicides all tie back to Brady Hartsfield, who is still “dealing” with a traumatic brain injury. Come to find out, Brady’s doctor tried feeding him experimental drugs that didn’t help him to recover any of his abilities, but they seemed to help him with a kind of astral-projection, and the ability to speak with people through the Fishin’ Hole game in the Zappit consoles.

So, Brady “works” with his old co-worker Freddi Linklater to purchase a bunch of Zappits, and create a website that distributes them to people who were at the Round Here concert. You remember... the concert where Brady, wearing a vest made of ball bearings unsuccessfully tried to blow up a whole auditorium full of people. The Zappits are distributed, and Brady (in the body of his old doctor) presses the metaphorical green button that sends out suicide ideations through the game.  

Bill, Holly, and Jerome start putting the pieces together, and Holly is the one who makes the connection between the Zappits, and the suicides. And this is the moment when I need to bow down to my girl... Bill’s old partner Pete, and his new partner Izzy disregard Holly’s theory; and Izzy is down-right rude about it. But Holly isn’t deterred. She doesn’t let Izzy’s intimidation get to her. Instead, she goes on to solve the motherfucking case, because that’s what bad-ass bitches do. In case you can’t tell, I LOVE me some Holly Gibney. 

So, the Finders Keepers crew end up shutting down the Zappits, preventing anymore suicides, and they follow “Brady” up to a snowy mountain lodge, where they finally kill him. Well, his spirit. His body had been dead for a few days already. Brady’s like a cockroach, you need to stomp on him a few times to make sure he’s really dead. 

The crew then reconvenes in the oncology department a few weeks later to celebrate Bill’s belated birthday. You know it’s coming. But that doesn’t make it any easier...

And then the final section of the book is Holly planting flowers at Bill’s grave, talking to Jerome. The gravestone reads “End of Watch”. God damn it, I feel a lump in my throat again. It’s such a great series, and spawned so many memorable characters. I’ve said it before, but it’s a fantastic series to recommend to people who claim to not like Steve’s books.

Total Wisconsin Mentions: 46

Total Dark Tower References: 68

Book Grade: A+

Rebecca’s Definitive Ranking of Stephen King Books

Doctor Sleep: A+

The Talisman: A+

Wizard and Glass: A+

11/22/63: A+

Mr. Mercedes: A+

End of Watch: A+

Under the Dome: A+

Needful Things: A+

On Writing: A+

The Green Mile: A+

Hearts in Atlantis: A+

Full Dark, No Stars: A+

The Bazaar of Bad Dreams: A+

Just After Sunset: A+

Rose Madder: A+

Misery: A+

Different Seasons: A+

It: A+

Four Past Midnight: A+

Stephen King Goes to the Movies: A+

The Shining: A-

The Stand: A-

Finders Keepers: A-

Bag of Bones: A-

Duma Key: A-

Black House: A-

The Wastelands: A-

The Drawing of the Three: A-

The Dark Tower: A-

Dolores Claiborne: A-

Blaze: B+

Hard Listening: B+

Revival: B+

Nightmares in the Sky: B+

The Dark Half: B+

Joyland: B+

Skeleton Crew: B+

The Dead Zone: B+

Nightmares & Dreamscapes: B+

Wolves of the Calla: B+

‘Salem’s Lot: B+

Song of Susannah: B+

Carrie: B+

Creepshow: B+

From a Buick 8: B

The Girl Who Loved Tom Gordon: B

The Colorado Kid: B-

Storm of the Century: B-

Everything’s Eventual: B-

Cycle of the Werewolf: B-

The Wind Through the Keyhole: B-

Danse Macabre: B-

The Running Man: C+

Cell: C+

Thinner: C+

Dark Visions: C+

The Eyes of the Dragon: C+

The Long Walk: C+

The Gunslinger: C+

Pet Sematary: C+

Firestarter: C+

Rage: C

Desperation: C-

Insomnia: C-

Cujo: C-

Nightshift: C-

Faithful: D

Gerald’s Game: D

Roadwork: D

Lisey’s Story: D

Christine: D

Dreamcatcher: D

The Regulators: D

The Tommyknockers D

Next up is Sleeping Beauties. Fun fact: I got to see Steve and Owen live promoting this book... and I’ve never read it. Second fun fact: Steve was so entertaining and funny in person, I could have listened to him talk for four hours and never get bored. Owen was cool too. 

Until next time, Long Days & Pleasant Nights,

Rebecca

[dalepwithchari]

Lessons from cybersecurity exits

Buy some great High Tech products from WithCharity.org #All Profits go to Charity

Mahendra Ramsinghani Contributor

Mahendra Ramsinghani is the founder of Secure Octane, a Silicon Valley-based cybersecurity seed fund.

More posts by this contributor

Is Symantec getting ready to buy Splunk?

Can the security community grow up?

To: ceo@cybersecuritystartup.com

Subject: Lessons from cybersecurity exits

Dear F0und3r:

What a month this has been for cybersecurity! One unicorn IPO and two nice acquisitions – Zscaler’s great debut on wall street,  a $300 million acquisition of Evident.io by Palo Alto Networks and a $350 million acquisition of Phantom Cyber by Splunk has gotten all of us excited.

Word on the street is that in each of those exits, the founders took home ~30% to 40% of the proceeds. Which is not bad for ~ 4 /5 years of work. They can finally afford to buy two bedroom homes in Silicon Valley.

Evident.IO Investment Rounds and Return estimates

Date

Select Investors

Round Size

Pre

Post

Dilution

Estimated Returns / Multiple of Invested Capital

Sep 2013

True Ventures

$1.5m

$5.25m

$6.75 m

22%

44X

Nov 2014

Bain Capital

$9.8 m

$18.1m

$28.0 m

35%

10.7X

Apr 2016

Venrock

$15.7 m

$35.0 m

$50.7 m

30%

6X

Feb 2017

GV

$22.0 m

$73.6 m

$95.5

23%

3.1X

My math is not that good but looks like even some VCs made a decent return. Back of the envelope scribbles indicate that True Ventures scored an estimated ~44X multiple on its seed investment. Others like Bain snagged a ~10X on the A round investment and Venrock which led the Series B round took home ~6X.

We see a similar pattern with Phantom Cyber, which got acquired by Splunk for $350 million. A little bird told me that they had booking in the range of $10 million. But before we all get too self-congratulatory, lets ask – why did these companies sell at $300 million to $350 million when everyone in the valley wants to ride a unicorn? Clearly, funds like GV, Bain and Kleiner could have fueled more rounds to make unicorns out of Evident.io and Phantom Cyber.

Phantom Cyber Investment Rounds and Return estimates

Date

Select Investors

Round Size

Pre

Post

Dilution

Estimated Returns / Multiple of Invested Capital

April 2015

Foundation Capital

$2.7m

$8.3 m

$11.04 m

14.50%

31.7

Sep 2015

Blackstone

$6.5m

$26.7 m

$33.2 m

15.90%

10.5

Jan 2017

KPCB

$13.5m

$83.0 m

$96.5 m

13.90%

3.6

(Data Source: Pitchbook)

Some of the board members might have peeked at the exit data gathered by the hardworking analysts at Momentum Cyber, a cybersecurity advisory firm. Look at security exit trends from 2010-2017. You might notice that ~68% of security exits were below $100 million. And as much as 85% of exits occur below $300 million.

Agreed that there are very few exceptional security CEO’s like Jay Chaudhry who grew up in a Himalayan village, and led ZScaler to an IPO. This was Jay’s fifth startup and he kept over 25.5% of the proceeds, with another 28.3% owned by his trust. TPG Growth owned less than 10%. After all, he himself funded a substantial part of the company (which raised a total of $110 million).  But not everyone is as driven, successful and it’s ok to sell if the exit numbers are meaningful. Remember what that bard of avon once said:

For I must tell you friendly in your ear,

Sell when you can; you are not for all markets.

(Shakespeare, As you Like It, Act 3, Scene V)

(68% of security exits occur below $100 million. M & A Data from 2010-2017. Source: Momentum Cyber)

My friend Dino Boukouris, a director at Momentum Cyber, offers some sage advice to all founders who are smitten by unicorns. “Before a founder raises their next round, I would reflect on the market’s ability to purchase companies. The exit data says it all. As you raise more capital, your exit value goes up, timing gets stretched and the number of buyers who can afford you drops.” Dino has a point, you see. As we inflate valuations, your work, my dear CEO, becomes much harder.

If you don’t believe Dino, let’s look at another recent exit, PhishMe, which was acquired by a private equity consortium for $400 million. That’s a nice number, correct? At the first look, you’ll notice that the dilution and financial return patterns are similar to that of Phantom. Except that PhishMe took 7 years and consumed $58 million of capital, while Phantom took 3 years and consumed $22.7 million. Timing and capital efficiency matter as much as exit value. It’s not just the exit value ~ but how long and how much. Back to my man, Dino who will gently remind you that for the 175 M & A transactions in 2017, the median value was $68 milion. Read that last sentence again — very slowly. $68 million. Ouch!

PhishMe Investment Rounds

Date

Round size

Select Investors

Pre-money Valuation

Post

Dilution

Returns / Multiple of Invested Capital

July 2012

$2.5m

Paladin

$10 m

12.5 m

12.20%

32.0

March 2015

$13 m

Paladin

$61 m

$74 m

13 %

5.4

July 2016

$42.5 m

Bessemer

$155 m

197 m

21%

2.0

(Data Source: Pitchbook)

Two years ago  in Cockroaches versus Unicorns – The Golden Age of Cybersecurity Startups cybersecurity founders were urged to avoid the unicorn hubris. A lot of bystanders, your ego included, will cheer you as you get higher valuations. But aren’t we all rational human beings, always making data based decisions?

Marc Andreessen will remind you that his best friend, Jim Barksdale, once said “If we have data, let’s look at data. If all we have are opinions, let’s go with mine.”   Since 2012, my VC friends have funded 1242 cybersecurity companies, investing a whopping $17.8bn. But chief information security officers say that they don’t need 1242 security products. One exhausted CISO told me they get fifteen to seventeen cold calls a day. They hide away from LinkedIn, being bombarded relentlessly.

Enrique Salem (former CEO of Symantec) and Noah Carr, both with Bain Capital are celebrating the successful sale of Evident.io. They pointed out that the founders — Tim Prendergast and Justin Lundy had lived the public cloud security problem in their previous lives at Adobe. “Such deep domain expertise allowed them to gain credibility in the market. It’s not easy to earn the trust of their customers. But given their strong engineering team, they were able to build an “easy to deploy” solution that could scale to customers with 1000s of AWS / Azure accounts. Customers were more willing to be reference-able, given this aligned relationship.”

(Source: Momentum Cyber)

You, my dear CEO, should take a page from that playbook. Because Jake Flomenberg, Partner at Accel Partners says, “CISOs are suffering from indigestion. They are looking to rationalize toolsets and add very selectively. New layer X for new threat vector Y is an increasingly tough sell.” According to Cack Wilhelm Partner at Accomplice, “Security analysts have alert fatigue, and CISOs have vendor fatigue.”  You are one of those possibly, wouldn’t you agree?

Besides indigestion and fatigue, the CISO roles have become demanding. William Lin, Principal at Trident Capital Cyber, a $300m fund pointed out that “the role of CISO has bifurcated into managing risk akin to an auditor and at the same time, managing complex engineering and technology environments.”  So naturally, they are managing their time more cautiously and not looking forward to meeting one more startup.

Erik Bloch, Director of Security Products at SalesForce says that while he keeps an open mind and is willing to look at innovative startups, it takes him weeks to arrange calls with the right people, and months to scope a POC. And let’s not forget the mountain of paperworks and legal agreements. “It’s great to say you have a Fortune 100 as an early customer, but just be warned that it’ll be a long, hard road to get there, so plan appropriately” he pointed out.

So, my dear founder, as the road gets harder, funding slows down. Look at 2017 — ��despite all those big hacks, Series A funding dropped by 25% in 2017. Clearly, many of our seed funded companies are not delivering those Fortune 100 POC milestones. And are unable to raise a Series A.  Weep, if we must, but let us remind ourselves that out point solutions are not that impressive to the CISOs.

All the founders I know are trying to raise a formulaic $8m Series A on $40m pre. But not every startup that wants 8 on 40 deserves it. Revenues and growth rate, those quaint metrics matter more than ever. And some investors look for the quality of your customers.  Aaron Jacobson of NEA, a multi-billion dollar venture fund says, ”A key value driver is a thought-leader CISO as a customer. This is often a good indicator of value creation.“

Stage

Expected Revenue Run Rate

Estd. Round Size

Angel

None

Up to $2m

Series A

$1.5m to $3 m

$5m to $8m

Early VC

$5 m to $8 m

$15m to $25m

Late Stage VC

$6m to $10m

$30m to $50m

When markets get crowded and all startups sound the same, investors seek quality, or move to later stages.  They like to see well proven companies, that have solved a lot of basic problems. And eliminated riskier stumbling blocks. Like product-market fit, pricing and go-to-market issues. Naturally, the later stage valuations are rising faster. Money is chasing quality, growth and returns.

Median Post-Money Valuation by stage for cybersecurity companies (Source: Pitchbook)

The security IPOs offer a sobering view. This is a long journey, not for the faint of heart. Okta moved fast, consumed ~4X more capital as compared to Sailpoint and delivered great returns.

Company

Year Founded

Years to IPO

Total Capital raised prior to IPO

Revenues (2017)

Post Money of last round prior to IPO

Market Cap at IPO

ZScaler

2008

10

$180m

$176 m

$1.05 bn

$3.6 bn

Okta

2009

8

$231 m

$160 m

$1.18 bn

$2.1 bn

Forescout

2000

17

$159 m

$220 m

$1.0 bn

$806 mn

SailPoint

2004

13

$54.7 m

$186 m

N/A

$1.1 bn

Security IPOs (Source: Momentum Cyber, Pitchbook)

Innovating with go-to-market strategies

In the near term,  the big challenge for you, dear security founder, is selling in an over crowded market. If I were you, I’d remember that innovation should not be restricted to merely technology, but can extend into sales and marketing. We lack creativity when it comes to marketing – ask Kelly Shortridge of Security ScoreCard. She should get some kind of BlackHat award for developing this godforsaken Infosec Startup Bingo. If you find any startup vendor that uses all these words, and wins this bingo, please DM me ~ I will promptly shave my head in shame. We got here because we do not possess simple marketing muscles. We copy each other while our customers roll their eyes when we pitch them.

Sid Trivedi of Omidyar Technology Ventures wants to work with the developer focussed startups. He says, “Look at companies like Auth0. The sales efficiency on developer-focused platforms is tremendous. You can go to a CISO, CIO or CTO and point out that X number of developers are paying to use my technology. Here are their names, why don’t you talk to them? And then, let’s discuss an enterprise license for the full company?” That approach works like magic. Overwhelming majority of the software IPOs like Twilio, Mulesoft, SendGrid are developer platforms.”

If you go top-down in a hurry, you can crash and burn. I am aware of an impatient security vendor who used executive level pressure at a Fortune 50 company. They kicked their way into the POC. And got kicked out by the infosec team. The furios infosec team destroyed the vendor in a technical assessment. I was told that the product was functional but the vendor’s impatience and political gymnastics killed the deal. Let us not forget simple truth: many times CISOs turn to their subordinates for advice and decision-making, so don’t just sell to the top. Nor ignore the rest of the people in the room.

With more noise, the buyers freeze. Margins shrink. Revenues and growth slows down. Which means it’s harder to get to your milestones before your next round. Running out of cash is not fun. Nor is a down round, layoffs and such. So while this is easier said than done, please raise less and do more. And maybe, just maybe, you can keep 40% of a $350 million exit.

If you have questions or existential dilemmas, you can always find me, chatting with a friendly VC in South Park.  Or I’m always around in a trusted secure world of Signal.

Stay safe at that annual security stampede called RSA.

Kindly,

Mahendra

PS: Let’s not forget to express our gratitude to those analysts at Momentum Cyber and Pitchbook for painstakingly tracking every investment, analyzing and presenting meaningful data. They help us look at the forest, and make our journey easier. Send them a thank-you tweet, some wine, chocolates, flowers or home-baked cookies.

[Read More …]

Lessons from cybersecurity exits