An Intro to Cybersecurity for VC's

_{Updated December 2023}

Cybersecurity Industry Overview: Rapid Changes and Key Trends

The cybersecurity industry is noisy, and it changes. Fast.

There's no shortage of cybersecurity firms starting up every week, and there's no shortage of venture capital firms investing in them.

For some people familiar with the venture world, here's a hot take 🔥

In a previous post on On the Art of Selling to Cybersecurity, I summarized the industry like this:

As a result, there is TONS of content about cybersecurity. Much of it, however, is very technical for people already in the cybersecurity world as an operator, or it's straight sales material.

There's also TONS of content on the business of venture capital. Much of it is very financially technical and covers valuations, multiple of invested capital (MOIC), and internal rates of return (IRR) concepts.

But there isn't a lot of content that helps both audiences. It's really hard to find content that gives you enough context to live in both the cybersecurity and the venture capital world.

The Importance of Cybersecurity Knowledge for Investors

So why the need for this kind of content?

Part of the onus for writing this comes from how often I've been asked about it.

Many VCs I speak with are experts in investing but not in cybersecurity and are looking for an orientation or a guide to making cyber make more sense. So I made one!

I also abide by the Three Strike Rule about creating content, so the timing was right.

These worlds are fast changing, and there has been a widening disconnect between companies, industry analysts, and venture capital funding.

The Synergy Between Venture Capital and Cybersecurity

The real reason is that I think the venture capital and cybersecurity worlds are more related than you might think on the surface:

• Both fields require assumptions

• Both fields require value trade-offs

• Both fields have a high chance of loss

• Both fields are part science and part art

• Both fields require you to make future bets on imperfect data

• Both fields are hard to get into and even harder to become an expert in

• Both fields require you to go “a mile wide and an inch deep” (and at times go “an inch wide and a mile deep”)

• Both fields require you to put your time, money, and effort into something that may not be fully proven yet

With public valuations dropping over 2022 and 2023, capital being more scrutinized, and fewer deals happening in the broader markets at the time of writing this (late 2022), there's no better time than to get smarter on your investing thesis.

Private and public markets, macroeconomic forces, and the state of current global affairs affect everything and everyone. If you're not looking at these global puts and takes, you might miss something.

This is a guide for both the seasoned investor and those new to the game.

Use this guide as a primer to help you get valuable cybersecurity industry context from a number of angles.

Essential Cybersecurity Newsletters and Blogs

The business side of cyber

• Venture in Security - a newsletter about cybersecurity, product-led growth (PLG), and venture capital.

• Strategy of Security - Deep research and analysis on the companies, ideas, and trends shaping the cybersecurity ecosystem.

• Cyber Thoughts - a monthly newsletter from Lytical Ventures about cybersecurity and the VC landscape.

• Return On Security (this publication) - Save hours of market research with a weekly review of cybersecurity funding and industry news in 5 minutes, with the occasional deep-drive blog post.

If you're looking for more "business of cyber" content, check out this list:

The business of VC investing in public and private companies

• What's 🔥 in Enterprise IT/VC - market observations and commentary from Ed Sim, a VC investing in IT and cybersecurity for decades.

• The Software Analyst Newsletter - A newsletter focused on the analysis of software companies within cybersecurity and data infrastructure (AI/ML).

• Clouded Judgement - for the more technical and financially savvy investor, Jamin Ball talks about public and private company valuations, MOIC, and more.

Cyber news, stories, broad takes, and current events

• Risky Biz News - news and in-depth commentary from security industry luminaries

• This Week in Security - A weekly tl;dr cybersecurity newsletter of all the major stuff you missed but really need to know.

• Unsupervised Learning - a newsletter from Daniel Miessler about finding the patterns in security, tech, and society.

Must-Listen Cybersecurity Podcasts for Investors

Get the cyber founder's, marketing, and security leadership perspectives

• Secure Ventures with Kyle McNulty - interviews with founders, executives, visionaries, and creators in the cybersecurity industry.

• Bare Knuckles & Brass Tacks - A cybersecurity podcast that confronts the vendor/customer divide with bare knuckles, and offers brass tacks solutions.

If you are into the dual-use realm where National Security and Cybersecurity meet

• Securing Our Future - a podcast from New North Venture (NNV) focused on solving problems in the cyber and national security sector.

Trainings & Bootcamps 🆕

Get more hands-on with interactive training and feedback from experts

• The Cybersecurity x SaaS Bootcamp - A bootcamp dedicated to operators and investors who want to learn how to analyze cybersecurity technologies and the financials behind these companies.

Books 🆕 

Great reference points

• Cyber Defense Matrix - more on the technical front and into the weeds, but it’s a framework that combines NIST and real-world use cases to understand cyber products and landscape

Key Industry Reports and Papers: Understanding Cybersecurity Threats and Business Models

Key security reports about cybercrime and the industry at large

• Verizon DBIR - the annual data breach investigation report from Verizon

For context from the Venture Capital side

• State of the Cloud - the annual report from Bessemer Venture Partners on top trends and insights in the global cloud economy.

• State of the OpenCloud - the annual report from Battery Ventures on the state of cloud markets and building SaaS companies.

• State of Cloud Security - more on the technical side, but the report from DataDog focuses on understanding how organizations approach and mitigate common risks that frequently lead to documented public cloud security incidents.

Not-to-Miss Cybersecurity Conferences

The events you don't want to miss

• BlackHat

• RSA Conference

• Cybertech Global Tel Aviv

• Gartner Security & Risk Management Summit

Final Thoughts: Integrating Cybersecurity Insights into Strategies

Why this collection of seemingly unconnected resources?

This isn't meant to be an exhaustive list but more of a digital garden. Start here and get acclimated or go even deeper if you're already in the game.

I'll prune, trim, and add to this list as time goes on and as I discover new and different content.

See something missing from this list that absolutely needs to be there? Reach out and let me know!

Cheers,

Mike P