CyberWire Daily - Ron Gula and Mike Janke - VC pitfalls and how to avoid them. [Special Editions]

Episode Date: December 30, 2019

In this CyberWire special edition, advice from a pair of seasoned cyber security investors. Ron Gula caught our eye with an article he recently penned titled "Cyber entrepreneur pitfalls you can avoid." In it, he gathers a group of tech investors to get their takes on the dos and don'ts of pitching to venture capitalists. Ron runs Gula Tech Adventures along with his wife Cindi, where they aim to support the next generation of cyber technology strategy and policy. DataTribe's Mike Janke joins the conversation with his experiences guiding hopeful young entrepreneurs through the pitch process. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the CyberWire Network, powered by N2K. Calling all sellers. Salesforce is hiring account executives to join us on the cutting edge of technology. Here, innovation isn't a buzzword. It's a way of life. You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more.

Thanks for joining us for this special edition. Ron Gula is well known in the cybersecurity community as co-founder of Tenable Network Solutions, where over his 14 years as CEO, he and his team grew the company to over $100 million in annual revenue and raised nearly $300 million in funding. These days, Ron and his wife Cindy run Gula Tech Adventures, where their aim is to support the next generation of cyber technology, strategy, and policy. Ron Gula caught our eye with an article he recently wrote titled Cyber Entrepreneur Pitfalls You Can Avoid. In the article, he gathers a group of tech investors to get their takes on the do's and don'ts of pitching to venture capitalists. He joins us in our studio.

Later in the program, we'll hear from Data Tribe's Mike Janke to get capitalists. He joins us in our studio. Later in the program, we'll hear from Data Tribe's Mike Janke to get his opinions. When I left Tenable, I had been doing about a year of private investing, angel seed funds. That's Ron Gula. And we decided to do this full time. So after about three, four years, I've just seen the same sort of concerns. I'm not going to say complaints, but concerns from the cyber investing community. And it's usually, you know, sometimes they miss out on a deal and they kind of wish they got in the deal, but most of the time they're saying no to entrepreneurs. And what I wanted to do is try to give an opportunity to capture all the reasons they say no, so that anybody out there who wants to start a cyber company or a

company anyway, you know, can avoid these pitfalls. Yeah, it's a great list. Let's just go through it together. In your mind, what's the top mistake that folks make when they're presenting to you? So I think for me personally, it's trying to present everything. Somebody who wants to do an hour meeting to do a demo. And that might seem like, holy cow, you know, an hour meeting, boy, you're really kind of being harsh. But the reality is, if you can't engage somebody, an investor, in like five minutes, like what problem are you solving? How do you solve it? If you can't get that across in the first five, 10 minutes, you're probably not going to get an investment from that. So my personal

sort of issue is how do you present what you're doing? And what do you suppose drives that? Is it the nervousness of, oh my gosh, I've only got an hour in front of these folks. I have to hit them with everything. Yeah, there's definitely a, for first time entrepreneurs and even second or third, I caught myself doing this a ton more than once. You know, you fall back to, well, let me tell you about my degree and where I went to school and what my parents did and not relevant. You know, it's useful, but it's not the kind of

thing you should be leading with, right? Those things are details. And about three years ago, I wrote the five slide pitch deck and referred to this in this particular blog, and it really just says, you know, what problem do you solve? First thing, what problem do you solve? Start with that. Second thing is how do you solve it? And a lot of times people confuse those two things. Like I have a better intrusion detection system. Okay, what problem are you solving?

You know, that's rough. And then we go on from there about how to present that and make it very enticing. All right, well, let's go through some of the other ones. What are some of the other ones that folks put in front of you? So some of the other issues that come up is just, you know, what is a good idea? And there's a couple tracks to go on this, but let's say you have, you know, this happens with Tenable, right? Tenable just got an award for being literally the best, you know, most comprehensive vulnerability management platform out there. And I'll have somebody pitch me and say, I got a hundred more vulnerabilities than Tenable does. Do you want to invest in what I'm doing? Maybe it's a intrusion detection system endpoint. Hey, we can do something better than

endpoint, better than CrowdStrike. But you look at it and it's basically what I call it's a 5% better solution. And that is really hard to say no to because as cybersecurity purists, you know, we want the best, right? We want the best threat content, best protection, best, best, best. But if it's 5% better, is it really worth switching out my incumbent who's probably going to catch up with what you're doing anyway? And everybody kind of overlooks that thing. And it's hard to look an entrepreneur face and go, yeah, you are doing something a little bit better than everybody else, but no one's going to buy it. And that's tough. What about exaggeration? You know, someone comes in front of you and they say, either we have all these customers or we have all these solutions.

I can see there being a natural impulse to do that, but does your spidey sense tingle right away? Can you sniff that out? Yeah, so a lot of times when we get pitches from people, we'll get a little bit of the showmanship of it. Like, hey, I just want to tell you, you're the fifth venture capital person to call this week. There's a lot of interest. Great. That's awesome. You know, it doesn't change the fact that there

still has to be an investment thesis or our phones ringing off the hook. Okay. Well, people will say that, but it's what, what does it really mean? Is it email? Is it Slack messages? You know, and there's a lot of ways to kind of dig into that. Like, can you show me your Salesforce pipeline? Can you show me your HubSpot thing? Can you show me, you know, can I talk to some of these proof of concept people? Another one is people will all the time, it's not over overestimate, but they'll confuse monthly recurring revenue with year to date revenue with, you know, if you're going to finish at a certain monthly rate, well, now your annual rates this, but is that really true? You know, how repeatable and renewable is that, that business? A lot of time an investor is going to

put the biggest and best number kind of out there. And that's great. If they can do that, let's have a conversation about how to measure the business. It shouldn't be a secret. Transat presents a couple trying to beat the winter blues. We could try hot yoga. Too sweaty. We could go skating. Too icy. We could try hot yoga. Too sweaty. We could go skating. Too icy. We could book a vacation. Like somewhere hot.

Yeah, with pools. And a spa. And endless snacks. Yes! Yes! Yes! With savings of up to 40% on Transat South packages, it's easy to say, so long to winter. Visit Transat.com or contact your Marlin travel professional for details.

Conditions apply. Air Transat.com or contact your Marlin travel professional for details. Conditions apply. Air Transat. Travel moves us. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data,

and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. One of the things I saw in this post, you reached out to some other folks who also are in the investing space. And one of the things that caught my eye was this notion that the tech people might not always be the best people to be doing these presentations. That's definitely, especially in the Maryland, Virginia region, you know, we have a lot of people who are prior military, prior Intel, prior government. And they're used to basically saying what they do and how they do it in the most non-amazing way. And they could be completely failing at a technology or completely innovating at something

or going to pitch it the same way. Unlike, I think, founders who come out of an incubator and they've been schooled in how to pitch, schooled in maybe how to present, they might over-present an idea more than have that substance. So a lot of times in this region, you know, we've got some really, really good folks who have got great ideas, but they're not presenting it that well. They don't understand the market. They don't understand, you know, the real opportunity.

And that's one of the big reasons I like working with DataTribe, with Interloop Capital, with a lot of the different folks we've got on that blog there because it can really help find some of the best talent in the market and have them present accordingly. What are some of the misperceptions that you think people have when they're preparing that meeting with you? Are there common things that they're coming at from just the wrong direction? I think one of the things that I really like to remind people is that getting a round of investment is not the end. A lot of people say, well, if I raised a million dollars for a venture capital firm or $5 million, you know, I'm a success now. And it's like, oh no, you're going to be at this for five, six, maybe 10 more, 10 more years. Even when Tenable went public, people

were like, oh, congratulations. It's a good journey. I'm like, it's just starting. You know, they are going to be doing a lot of work for a very long time. So, you know, I'd like to remind people that you have to define what your success is. If success for you is bringing a product to market and maybe hiring a CEO and raising some capital and focusing on the technology, then God bless you. If you want to be a CEO and take a company public, that's good. You know, it's good to have these goals and define for them. But a lot of times when people present, they don't have their own personal goals in order. Therefore, it's really hard to be aligned with perhaps an investor even question, do you need investment? Yeah, it's a really interesting

insight. I mean, what you're talking about here are pitfalls. And I think about some of the emotional pitfalls that go with this as well. Are people ready to give up control? Are they ready to give up a piece of their business? It seems to me like sometimes people can come to the table not having completely dealt with those internal emotional issues. Yeah. So the change of control is an issue, and giving up equity is an issue. And they're two very, very separate issues.

So let's take them side by side. So the first one I kind of talk about is, you know, what is your goal? Like if your goal is to bring a product to market, have it acquired, you know, perhaps be a feature on somebody else's platform, then there's a lot of people who've done that. And there's a lot of models for that. And you should realize that you can do that without raising venture capital. And if you do raise venture capital, you should really have a good answer for the money that you've raised should be making you more money in the long term than if you did it on your own. So a lot of times when people come to us and they've got really good revenue and, you know, we want to raise this a little bit, it's like, well, wait a second,

you're making a lot of money here. Why are you willing to give up 25% of your company just to get to this next? Now things happen. Don't get me wrong. Markets changes. I've had, I've had executives pass. I mean, there's, there's really interesting things that happen with companies. There's no, you know, it's not, that's why it's called venture capital and risk. Right. Right. But then as far as changing control, that's really interesting. And, and it's a very emotional thing so the first company I did we had network security wizards my wife was CEO I was CTO and it was network intrusion I had some great people but I was it was small enough that kind of everything kind of went through me and I see a lot of entrepreneurs who are like that and that's that's fine when we got to Tenable I had some

really really good co-founders. And we were able to scale. We were able to grow and attract some really good talent and update our talent along the way. And along the way, you do have a change of control, especially getting ready to go public. But a lot of entrepreneurs don't have that sort of five-year vision or six-year vision of what does this look like. And it's not necessarily even just change of control. It's like, what is that org chart going to look like? You know, do you have a co-founder who's your CTO, who's really your head of engineering, and you really need a product person and a couple other people in that org chart that you're not filling that out? So a lot of times when I hear change of control concerns,

I'm like, I think they don't have a vision of what the future accurately looks like. concerns, I'm like, I think they don't have a vision of what the future accurately looks like. Yeah. I mean, I can't help wondering if that entrepreneur's mindset doesn't always align with the person who's willing to take mentorship. They are an entrepreneur because they think they've figured something out and they have that personality that says, I can do this better than someone else. And so to have the humility, whatever you want to call it, to say, I don't know how to run a company that's bigger than a mom and pop. Is that, am I coming at something here? So that happens. What I like, my ideal type of investee or a company to invest in, founder, is somebody who has, you know,

works some sort of cyber aspect, perhaps the government, perhaps commercial, and then done consulting for a little bit where they've gotten a better understanding of that problem and perhaps have also done customer interactions, know what payroll looks like, know how to run a business. And then when they hop over to doing a product or a technology, a SAS technology platform, you know, at that point, they've got enough skill to kind of get going. So the question really is then, you know, what haven't they done with? They probably haven't done brand marketing.

They probably haven't done two-tier channel distribution. They probably haven't OEM'd their technology. There's a lot of things like that that they haven't done, but there's enough stuff that they have done that at least they can get to a million to three million ARR without a big issue. Well, let's go through some of the positives then. Let's come at this from a positive point of view. When someone walks in and they've got a meeting with you or some of the other folks here that are the investors that you had to share this post with you. What are your tips to them? What's the best way for them to make the best use of your time? So the ones that just knock it out of the park are the ones who know exactly what they want.

They have a sense of how the company is going to play out, both from a revenue point of view, staffing, but they have a model of what the next is going to play out, both from a revenue point of view, staffing, they have a model of what the next two or three years looks like. Maybe at the seed stage, maybe next year, that type of thing. But if they're at the million run rate, or more than that, they're going to talk about milestones that they can hit

that as a potential investor, you could look at that and say, hey, I disagree with that, but I could work with that. So those are the ones that hit it out of the park. The ones who don't hit it out of the park are the ones who can't answer those questions. Like, how do you make money? Who's your buyer? What valuation are you looking to raise at?

A lot of times it's this dance of, hey, we want to raise a million dollars. Well, what kind of percentage are you looking to sell? And, well, we want to raise a million dollars. Well, what kind of percentage are you looking to sell? And well, we're kind of seeing what the market bears. Okay. I mean, we can throw something in, you know, but that's usually, it's usually better when there's a lot of alignment, you know, with multiple investors and what the folks want. Also back on the positive side, you know, is do they have a sense of what the world looks like? So if they're going to give away a free freemium technology, like Signal, Wicker, they all have different freemium things they can give away. How does that play into them getting to $10 million in revenue?

Is there some sort of benefit that they're giving to humanity that also creates a small problem where there's an, you know, an ability to do an enterprise sale, you know, that kind of thing. If anybody has that kind of vision, that usually gets investors pretty excited. Because most investors in cyber, don't get me wrong, they want to make a good return. They're in it because they think there's an opportunity to fix things. And that creating, you know, a company through capitalism is the best way to solve a lot of these problems. And if you can appeal to those kind of senses, you're going to do well as well. How should I approach my, the degree to which I sugarcoat the risks? So there's a lot of risk, you know.

So there could be risks in your staff. You know, are your three co-founders,-founders going to be around for a while? Do they have visibility? Do you have a risk? Are there five competitors coming out? Are you pretending like there's no competitors? If there's 100 people doing what you're doing, it doesn't matter if you're the best because there's 99 other people who are going to steal your revenue and they're going to dilute your brand and that kind of thing. If you're not based in the U.S.

And we've got a lot of great, America's a land of opportunity, but frankly, if you're incorporated outside of the United States, there's not as much protection as there is inside the United States. Are you physically near your investors? I get this one quite a bit. Do I have to travel to see you? Now, some people like virtual stuff. They like Google Hangouts.

I'm in three or four of my companies. I do a Hangout once, twice a month, you know, and it's great. And I see them in person occasionally, which is phenomenal. Other people really want, you know, they lament having to go from coast to coast to like fly to a board meet. So all of that can be risk. be can be risk. Seeing the mass volume of startups that we do pitches over 300 a year. That's Mike Janke, co-founder of Data Tribe, a cybersecurity startup studio in Maryland.

He's a multi-time CEO and company founder and former Navy SEAL. Full disclosure, Data Tribe is an investor in the Cyber Wire. The problem is, and by the way, this is a problem I had as a multi-time CEO myself, not understanding kind of the process, right? Just because a CISO says, this is interesting, this is great, let me introduce you to a couple of my guys. Let's do a trial. You know, does not mean it's not even 50-50 whether you actually are going to end up with a sale. There are so many other competing things, processes, budgets, timelines that go into it, that that barely puts you at the door, right? So I often teach them, wait a minute, you know, you've got a slide here of all these people who like you and said, that's cool.

And maybe you're doing pilots. So I'm pitching to you, you're a potential investor. And one of the slides on my deck says, hey, I've got all these people who are ready to sign up and buy our product. And it's probably not quite 100% accurate. Yeah. Oftentimes, you know, at this stage, early stage startups, they're out talking to a lot of people. So they'll put a logo. Hey, we had a great lunch with the VP of Intel at this

company, and so we're going to put the logo up. These are the people that are interested in us. The problem that happens is in these scenarios, you lose credibility real quick with venture who sees a lot of stuff. They look at it and go, okay, these guys really don't know what they're doing, right? So there are ways to approach it because whether we work with them, I want them to leave out of these doors having a better chance to get funded. So that's a big area. So that's a big area. And there's not a lot of information out there for a startup, a CEO, a founding team to really know that, you know. So my my idea is to help them understand more from the dark side. Yeah. But what's the proper way for me to share that information with you? But what's the proper way for me to share that information with you?

How do I frame it in such a way where I'm expressing the optimism that I'm out there beating the bushes and trying to drum up business, but not exaggerating to a way where I'm going to lose my credibility? That's a great question. So there are many, many ways to do it. The first point is do not put that in your projections. All right? Okay. So you had lunch. That doesn't mean you're getting a $250K sale from the CISO.

Right. Nine out of ten, we see meetings being projected that here's when we're going to close them from a lunch. That's number one. Number two, how you couch it is interest. You just, on just on the slides to interest these are the people we met with we're in various stages with them these are some of the reactions we got which you could put a quote so so a Ford says wow that is very compelling it does things others don't let let us run a pilot that tells the venture or a very sophisticated angel you understand the process it's okay to say I don't have a single sale but what that shows is you've been out there and you've assimilated information back that says

yeah it sounds on the surface like we got something they would be interested. Right. Nobody's saying to you, no, I'm not interested. You know, that's a dumb idea. Please go away. Exactly. No, I would never buy that in a million years.

You got it. That's an indicator. But what we see is nine out of 10 times people then show the next slide, the hockey stick that says six months from now, we're going to have 5 million in revenue, you know? Sure. Sure. Yeah. Well, let's move on to the next one here. And you mentioned stage appropriate funding. What are we getting at with that one? Oh, yeah, that's, that's probably my biggest. And it's another area where most venture will not tell a founder that. They'll just make a little checkmark, right? The problem is, and it's not fair a lot of the times, but there's so much information out there, a founder can get this information where when people come in and pitch and they're at this very early stage

and they'll show the next three years of projections year one we're hitting 11 million year two we're going to have 120 million in revenue there isn't a company in the history of the world that has ever done that right okay so the huge credibility gap there. The second part of it is we're out for seed stage. We need $12 million. Okay. There are no seeds in cyber or data science that are getting $12 million. So stage appropriate means you're getting a million, possibly $2 million at seed. You're taking $8 to $10 million at A, you know taking eight to 10 million at A, 20 to 75 at B.

When you match those two stage appropriate things up, which are, I'd like to raise 12 million for this idea and I'm going to hit 120 million in revenue next year, you've just lost everything. Because two things, one, in today's day of startup world, you can just go on Google and there are blogs and articles and data sources that'll show you what is norm, how to present, right? The other is, does that person sitting across the room from me really have any idea, a basic understanding? No. Right. So that means I'm starting from really raw material, which is a risk. You know, you don't need to be a five-time CEO, but even a first-time CEO can just have coffee with somebody and get information about it.

So stage appropriate investing really puts you in an area where you're having a really contextual conversation with somebody. Do people recover from these sorts of mistakes? If I sit down in front of you and I make these errors, do I have any chance? Not with that at Tribe. But that's why we take the time and effort. The first thing is to tell them truthfully. So oftentimes investors and venture doesn't necessarily want to, you know, cause somebody discomfort.

Right. And they'll say, say well that's great well Sarah will schedule something for you in 2031 right it's just not for us right exactly but by because somebody did it for me right so I'll sit there and go hold hold the presentation guys let's walk through because when you walk out this door, I want you to have another stab at it. So I always couch them before you go in and blast out your deck to 72 people, sit with somebody, get a rational check because you only get one shot. And if people got this You only get one shot. And if people got this and then you come back to them, they're not even going to answer.

So I always try to say, what did somebody do for me, which is guys? And I'll even pull up my laptop. Let's go to the Google. You know, what is seed round? What is A round, right? Right. So that's why. Right. Right. So that's why. How much, if any, sort of back channel communication goes on among the investor community as these folks are out making their pitches? Are you all sort of giving each other a heads up or here's, you know, here are the good things. Here's the

things you got to watch out for. Is that is that a reality? Yes. I would say that that's much, much more prevalent in mainstream venture where they're looking at A rounds, B rounds, and writing $150 million checks for E rounds because there's a smaller pool that they're kind of looking at. But when it comes to early stage, not so much. Simply because you get these things in, you got to have a good filter. And because as a founder, the one thing I hated the most was no response or a response three weeks later. Tell me now, no, yes, no. I mean, if it's not in your investing wheelhouse, give me an answer. Hey, good luck to you. You know, right. Right. The talk among venture usually happens when you see something and you go, hmm, that's interesting.

And a real negative side, which is, oh, man, this is not real good, right? And it's not couched in a way as, what are your thoughts? Venture's too egotistical. Everybody's the smartest in the world. Right. I don't need Sequoia. You know, that's... I want to give Ron Gula the last word here so let's wrap up I want to put you on the spot here a little bit and say you know

if there's if there's one pitfall if there's one thing do not do when you come it to to present in front of you what would it be not describing the problem that you saw if you don't describe the problem you solve correctly, and we jump right into your go-to-market or the market or your technology, I'm always going to be coming back to, like, why do I need this? So that's the biggest mistake people make. They talk around it? They talk about the solution and not the problem.

And I see this a lot in the identity space. I see this a lot in the SOC. I see this a lot in the SOC orchestration, automation space, because there's lots of tech. Let me show you how cool this tech is. Is it cloud-based? Is it Google-based? Is it Elastic-based? Is it Upshall? What problem are you solving again?

You sell this to MSPs, to operations? It's a hard thing to say. What problem do you solve? Ron Gula, thanks for joining us. Thank you. Our thanks to Ron Gula and Mike Janke for joining us. We'll have a link to Ron's article, Cyber Entrepreneur Pitfalls You Can Avoid, in the show notes. For everyone here at the Cyber Wire, I'm Dave Bittner. Thanks for listening.