Securing VC attention : Cybersecurity startups

This article is a VC’s perspective on the landscape of needs, challenges, and opportunities for startups in Cybersecurity.

As a team of operative VC partners, we bring, to this area, the perspective of someone who has transitioned from IT infrastructure roles to business ownership. The following article highlights the evolving understanding of cybersecurity's importance and explores the challenges and opportunities within the industry.

The Evolution of our own perspective.

At July Ventures, we acknowledge a shift in our own internal perspective to cybersecurity. Initially, from an IT infrastructure standpoint, security measures might have seemed overly cautious. However, with experience in running a business, the necessity of robust security becomes abundantly clear. This transformation reflects a broader trend – as individuals take on more responsibility, the significance of cybersecurity becomes more tangible.

The Ever-Evolving Landscape of Cybersecurity

In today's digital age, where information reigns supreme, cybersecurity has become an essential aspect of protecting our data and critical infrastructure. It encompasses the practices, technologies, and processes employed to safeguard computers, networks, programs, devices, and the information they contain from unauthorized access, use, disclosure, disruption, modification, or destruction.

Cybersecurity threats are constantly evolving, with malicious actors devising ever-more sophisticated techniques to exploit vulnerabilities. These threats can originate from various sources, including:

• Individual Hackers: Motivated by financial gain, revenge, or simply the thrill of the challenge, these individuals may target specific organizations or launch broad attacks.
• Organized Crime Groups: Cybercrime has become a lucrative industry, with organized groups employing advanced tools and techniques to steal sensitive data, extort money, or disrupt operations.
• State-Sponsored Actors: Nation-states may engage in cyber espionage to steal classified information or sabotage critical infrastructure of other countries.

The consequences of a successful cyberattack can be devastating. Data breaches can expose sensitive personal or financial information, while attacks on critical infrastructure can disrupt essential services such as power grids, transportation systems, and healthcare facilities.

The Pillars of Cybersecurity

To combat these threats, organizations must adopt a comprehensive cybersecurity strategy that addresses people, processes, and technology. Here's a breakdown of these fundamental pillars:

• People: Humans are often the weakest link in the cybersecurity chain. Social engineering attacks, such as phishing emails, can trick employees into revealing sensitive information or downloading malware. Security awareness training and education are crucial to empower employees to identify and mitigate cyber threats.
• Processes: Clearly defined security policies and procedures establish a framework for managing and protecting information assets. These policies should address areas like password management, data encryption, incident response, and access control.
• Technology: A variety of security technologies are available to safeguard systems and networks. Firewalls act as a barrier between trusted and untrusted networks, while intrusion detection and prevention systems monitor network traffic for suspicious activity. Encryption scrambles data to render it unreadable to unauthorized users.

Vectors influencing the increased focus on cybersecurity:

• Sophistication of Cyberattacks: The nature of cyberattacks is constantly evolving, demanding more comprehensive defences.
• Regulatory Compliance: Regulations like ESG (Environmental, Social, and Governance) and data privacy laws mandate stricter security protocols.
• Internet of Things (IoT) Proliferation: The rise of connected devices creates new attack vectors that require mitigation strategies.
• Geopolitical Tensions: The global political climate underscores the need for robust cybersecurity measures to protect critical infrastructure.
• Artificial Intelligence and Machine Learning: While AI offers potential security benefits, it also presents risks that need to be addressed.

The Cybersecurity Market: Potential and Challenges

The cybersecurity market is vast and also growing, it is estimated at USD 200-230 billion globally with a 10% annual growth rate. However, India's share is currently around 2% (USD 4 billion), with estimates suggesting a much larger potential market size (USD 2 trillion). This disparity is attributed to:

• SME Cybersecurity Gap: Over half of Small and Medium Enterprises (SMEs) lack cybersecurity measures, often due to a lack of awareness or resource constraints.
• Underfunded Security Initiatives: Even in large organizations, Chief Information Security Officers (CISOs) may struggle to secure adequate funding for security initiatives.
• The Cost Centre Perception: IT and Information Security are often viewed as cost centres, hindering investment in this crucial area.
• Regulatory Penalties: Regulatory and compliance needs are pushing businesses to take action. An example is that of General Data Protection Regulation (GDPR). There are specific penalties to a hitherto lackadaisical approach and potential financial consequences of inadequate security. These penalties highlight the need for robust legal and organizational structures alongside technology investments.

Challenges for Cybersecurity Firms Seeking Capital

• Service-Centric Business Models: Many cybersecurity firms are built by engineers or consultants who offer services and consulting, then develop products to address identified gaps. VCs often shy away from businesses heavily reliant on people-driven services.
• Building Trust: Trust in cybersecurity products and services takes time to establish. VCs seek businesses with scalable models that don't rely solely on blitz scaling (rapid customer acquisition through aggressive marketing).

Recommendations for Cybersecurity Firms Seeking Capital

We, at July believe that there are a set of steps that the cybersecurity firms need to adopt to improve their VC appeal:

• Product-Centric Approach: Pivot from service-based models to product-driven approaches, focusing on automation, tools, and systems to increase revenue per employee.
• De-emphasizing Services: Minimize discussion of services in pitch decks. Package them as onboarding or activation fees to create a standardized pricing structure.
• Channel Strategy: Develop a strong channel strategy, leveraging partners to expand sales and service reach. While engineers may have in-depth product knowledge, experienced channels are better positioned for broader market penetration.
• Building Brand Recognition: Since cybersecurity products are often "promise products" (delivering value over time), building brand recognition through industry analyst reports (e.g., Gartner) is crucial.
• Legal Structure: Establish a sound legal structure, especially if a service component remains unavoidable.
• Targeted Focus: Identify specific geographies and verticals for deeper penetration and leverage the potential for virality within those segments.

?There are also challenges within the VC community and this is for us to do a bit of soul-searching + adaptation. Not all VC firms possess a deep understanding of the cybersecurity space. Partnering with firms specializing in technology or even cybersecurity can be beneficial.

Having said that, VCs aren't the only funding option. Self-funded growth, while slower, allows for equity retention. Exploring strategic investors like channel partners, SaaS companies, or service providers in adjacent areas can also be fruitful.

Conclusion: A Promising Future

The cybersecurity industry presents a wealth of opportunities. It is for the entrepreneur and the start-up to decide if they want to chase growth and valuation (funded by VCs) or think of building a sustainable and independently profitable business.

Building a strong product or service with positive unit economics, coupled with patience and persistence, will ultimately attract the right capital.

?