Legions of security vendors clamoring for your attention every day. New ones popping up all the time. Each of them claiming to have the tool, technology, or expertise no potential victim can be without. Which ones deserve a piece of your finite time and capital?
It’s a predicament familiar to any IT provider responsible for building a security stack deep enough to keep clients safe but lean enough to be affordable. And it’s also, as it happens, pretty much the same quandary faced by another core component of the tech industry ecosystem: venture capital firms.
Granted, VC firms have a lot more cash at their disposal than the average channel pro. Collectively, venture capital funds worldwide cleared $2 trillion of assets under management for the first time ever last September and had close to half a trillion dollars in uninvested “dry powder” at their disposal as of May, according to researcher Prequin. They also have skilled number-crunching analysts on staff and access to input from some of the world’s most knowledgeable subject matter experts.
Yet fundamentally, the central challenge a VC fund that invests in cybersecurity startups confronts daily is identical to the one an MSP or solution provider faces: sifting through a mass of potential partners for the ones worthy of their money.
“It’s exactly the same thing,” says Alberto Yépez, managing director of Forgepoint Capital. Founded in 2015 and focused solely on cybersecurity, the company has raised $770 million to date, deployed over $500 million of it, and helped launch AlienVault (bought by AT&T in 2018), Area 1 (bought by Cloudflare this February), and Attivo Networks (bought by SentinelOne this March).
Today, it owns a piece of security testing and attack surface management vendor Bishop Fox, network detection and response vendor IronNet, and threat hunting/MDR vendor Huntress, among nearly three dozen others. Forescout, a security automation vendor among Forgepoint’s holdings, completed its recently announced acquisition of SOC-as-a-service company Cysiv just last week.
Forgepoint puts a lot of effort into evaluating potential investments, and has identified five criteria for picking winners. “You need to align all five to be successful,” says Yépez. They’re not the exact same qualities a channel pro should look for, but they’re similar enough to make thinking like a venture capitalist useful just the same.
1. How big is the market opportunity?
This is an obvious, vital consideration for venture capital firms seeking to maximize ROI, but according to Yépez, even more important for MSPs.
“Because MSPs don’t have a lot of resources,” he says. “Why am I going to go invest in a small market when I have very few resources?”
Size, though, isn’t the only variable to consider. Forgepoint looks as well for rapid growth and plenty of “white space”—unclaimed sales territory that newcomers have room to seize for themselves. A firewall startup, after all, is going to have a hard time grabbing market share from the likes of Palo Alto and SonicWall.
Rather than rely solely on input from vendors or industry analysts to measure market size, Yépez adds, Forgepoint goes straight to the end users themselves, and so should channel pros.
“It begins with the customer,” he says. “We always try to get a view of what the customer is looking for and what is not being met by the existing players.” Last month, in fact, the company shared CISO priorities survey data it collected from very small to very large businesses.
2. Who are the players in this market?
Once you’ve found a relatively young, high-growth market with lots of upside potential, the next step is researching vendors poised to conquer it.
“Who has received prior rounds of financing?” Yépez asks. “Who are the investors? Who’s done the seed [funding]? What is the background of the entrepreneur? Are they serial entrepreneurs who have the domain expertise?”
It made an impression on Forgepoint, for example, that Tenable CEO Ron Gula was an angel investor in Huntress. “This is a guy that built a multibillion dollar business and he’s taken it public,” Yépez observes.
Channel pros should scrutinize a potential vendor partner’s credibility the same way, he adds. “Is this company going to succeed?” he asks. “Are the investors proven? Have they scaled businesses?” No one, whether they’re an MSP or a VC, wants to place a big bet on a risky business.
3. Is the IP unique?
The more differentiated a vendor’s technology, the likelier it is to prosper.
“We look at defensible technology, that it cannot be replicated,” Yépez says. What set Huntress apart for example, he continues, was a platform carefully designed for buyers without a big business’s in-house expertise and budget.
“They said, ‘we’re going to do something different in creating a platform. It’s going to be easy to consume, easy to deploy,'” Yépez explains. “That was defensible technology, uniquely, uniquely differentiated, and hard to replicate.”
4. What’s the go-to-market strategy?
For Forgepoint, what matters most about a startup’s sales model and partner strategy is its scope.
“We always look for businesses that can create leverage and scale,” Yépez says. What channel pros should look for, he continues, is different.
“Are they channel friendly?” he asks. “Will it be easy to do deal registration? Are they going to eventually go around me?”
5. Who runs the business?
Even a company with one-of-a-kind technology, few competitors, a lot of potential customers, heavyweight early backers, and a smart, scalable go-to-market plan can fizzle out quickly if its leadership team isn’t up to the task of realizing all that potential.
Forgepoint therefore looks closely at an investment candidate’s senior management, Yépez notes, pointing once more as an example to Huntress, a company founded by former NSA cyber operators who spent time working at an MSP before launching the business to learn the market from the inside out.
“We were very impressed with Kyle and his team,” says Yépez of Huntress CEO Kyle Hanslovan. And rightly so, he maintains. “The company is growing almost 100% year over year,” Yépez notes. “Very rare, a little bit like a SentinelOne.”
Channel pros with the hard-nosed discipline of a VC firm can have equal success spotting rarities.
