6 ms·

I’ve been wondering recently - why there are almost no security startups in the YC? Cybersecurity is one of the biggest problems in the 21st century, the market

I’ve been wondering recently - why there are almost no security startups in the YC? Cybersecurity is one of the biggest problems in the 21st century, the market opportunity is huge and solutions require to solve hard engineering problems, yet there are no cybersecurity companies funded. Does anyone have the same feeling? Why it would be this way?

new_here 7y ago
Check out https://cylonlab.com/ https://cylonlab.com/ From participating in that, my experience was that it’s really hard to disrupt in cybersecurity because businesses are skeptical about using young companies with no reputation and a beta product. So it’s hard to start showing revenue or traction to get funded. The hunt for revenue then also forces you to focus on things like phishing protection instead of discovering zero days.
andy_ppp 7y ago
My opinion; it has nothing to do with YC... in my experience (worked building software at a security firm) people who are good a breaking things are generally bad at building them.
hkmurakami 7y ago
Are no cyber security companies (1) being founded, (2) applying to YC, or (3) being accepted by YC?
timothy-quinn 7y ago
We exist, but we're just not in the right country :) From my experience working with a number of companies, the challenge seems to just come down to a lack of people in the industry.
alltakendamned 7y ago
Most security companies seem to fall in one of two categories: - consulting - appliances (aka blinky boxes) Consulting seldom requires venture capital and cannot scale at the level VCs expect. Blinky boxes can, but customers are slowly catching on to the fact that adding another blinky box to the network is really not improving their resilience all that much. On top of that, it's not always easy to identify the real economic buyer in an organisation, and e.g. a CISO might not have the authority to decide on installing new appliances but needs to collaborate with e.g. IT. It all makes for convoluted and longer sales cycles.
- djd20 7y ago
  While its not in YC - there are a few SAAS type security startups aimed at SME's - such as https://intruder.io/ https://intruder.io/ who I am a very happy customer of. This to me looks to be high growth.
  - GordonS 7y ago
    There are dozens of these SaaS vulnerability scanning companies, with very little differentiation between them - they basically all run Nessus. It's difficult to see how they could make serious money, certainly not enough to interest VCs.
    - andy_ppp 7y ago
      The only way is to make them free and build a marketplace of accredited and vetted pen testers who you charge to be on the platform. Still how the hell you vet these people is a huge issue.
      - alltakendamned 7y ago
        I think that's what bug bounty companies are doing by changing the model from paying for time spent to paying for (accepted) findings. Personally I don't think any serious pentester will spend considerable time in this model though. That said, I also think that one of the main challenges for buyers of pentest services these days is to evaluate the quality of a report or of the work done. Thoughts on how to improve that are most welcome.
        andy_ppp 7y ago
        Mostly they are cookie cutter bullshit, right.
      - lazyant 7y ago
        https://cobalt.io/ https://cobalt.io/ works more or less like that
LeonM 7y ago
I'm currently in YC startupschool with a security startup, here's what I think is the problem: security doesn't scale easily on the marketing side. For most businesses security equals costs, and no quantifiable savings. Most business don't have budget allocated at all for security. Big corps are the exception, but then you'll have the trust issue: they are unlikely to do business with startups when it comes to security. I have also found that it's hard to find security experts who are willing to work for a startup. Given the salary options that security techs can get at big-corp/government/military, it's hard to be able to compete.
- donaltroddyn 7y ago
  Yes - agreed. I'm working on a product that started out as a a security SaaS, but has pivoted (using essentially the same technology) to an adtech product, because it is much easier to sell an increase in return on advertising spend than it is to sell a security product.
lnsru 7y ago
Security is like having an insurance. So now is the question: pay for insurance now or pay after crash? Or hope it never happens? Many many people underestimate this need and end up not paying. I can guess from experience with secure Bluetooth headset startup, that the need isn’t there yet. Maybe I’ll try with Bluetooth 5 hoping for more demand in couple years.
- antupis 7y ago
  You also might not even know that you crashed in the wall 3 months ago.
jdreyfuss 7y ago
Sqreen (YC W18) is one counterexample, but they came into YC at a later stage of maturity than your average YC company. As to why there aren't many others, that's a great question. It's a hard space to get started in, since security is mission critical for essentially everyone, so that likely doesn't help matters. There's a lot more that needs to go into a viable MVP in cybersecurity than in other areas as well, since there's much less room for error and jank. Those reasons likely contribute, but none of them are hard blockers.

new_here 7y ago

Check out https://cylonlab.com/ https://cylonlab.com/ From participating in that, my experience was that it’s really hard to disrupt in cybersecurity because businesses are skeptical about using young companies with no reputation and a beta product. So it’s hard to start showing revenue or traction to get funded. The hunt for revenue then also forces you to focus on things like phishing protection instead of discovering zero days.

andy_ppp 7y ago

My opinion; it has nothing to do with YC... in my experience (worked building software at a security firm) people who are good a breaking things are generally bad at building them.

hkmurakami 7y ago

Are no cyber security companies (1) being founded, (2) applying to YC, or (3) being accepted by YC?

timothy-quinn 7y ago

We exist, but we're just not in the right country :) From my experience working with a number of companies, the challenge seems to just come down to a lack of people in the industry.

alltakendamned 7y ago

Most security companies seem to fall in one of two categories: - consulting - appliances (aka blinky boxes) Consulting seldom requires venture capital and cannot scale at the level VCs expect. Blinky boxes can, but customers are slowly catching on to the fact that adding another blinky box to the network is really not improving their resilience all that much. On top of that, it's not always easy to identify the real economic buyer in an organisation, and e.g. a CISO might not have the authority to decide on installing new appliances but needs to collaborate with e.g. IT. It all makes for convoluted and longer sales cycles.

djd20 7y ago
While its not in YC - there are a few SAAS type security startups aimed at SME's - such as https://intruder.io/ https://intruder.io/ who I am a very happy customer of. This to me looks to be high growth.
- GordonS 7y ago
  There are dozens of these SaaS vulnerability scanning companies, with very little differentiation between them - they basically all run Nessus. It's difficult to see how they could make serious money, certainly not enough to interest VCs.
  - andy_ppp 7y ago
    The only way is to make them free and build a marketplace of accredited and vetted pen testers who you charge to be on the platform. Still how the hell you vet these people is a huge issue.
    - alltakendamned 7y ago
      I think that's what bug bounty companies are doing by changing the model from paying for time spent to paying for (accepted) findings. Personally I don't think any serious pentester will spend considerable time in this model though. That said, I also think that one of the main challenges for buyers of pentest services these days is to evaluate the quality of a report or of the work done. Thoughts on how to improve that are most welcome.
      - andy_ppp 7y ago
        Mostly they are cookie cutter bullshit, right.
    - lazyant 7y ago
      https://cobalt.io/ https://cobalt.io/ works more or less like that

LeonM 7y ago

I'm currently in YC startupschool with a security startup, here's what I think is the problem: security doesn't scale easily on the marketing side. For most businesses security equals costs, and no quantifiable savings. Most business don't have budget allocated at all for security. Big corps are the exception, but then you'll have the trust issue: they are unlikely to do business with startups when it comes to security. I have also found that it's hard to find security experts who are willing to work for a startup. Given the salary options that security techs can get at big-corp/government/military, it's hard to be able to compete.

donaltroddyn 7y ago
Yes - agreed. I'm working on a product that started out as a a security SaaS, but has pivoted (using essentially the same technology) to an adtech product, because it is much easier to sell an increase in return on advertising spend than it is to sell a security product.

lnsru 7y ago

Security is like having an insurance. So now is the question: pay for insurance now or pay after crash? Or hope it never happens? Many many people underestimate this need and end up not paying. I can guess from experience with secure Bluetooth headset startup, that the need isn’t there yet. Maybe I’ll try with Bluetooth 5 hoping for more demand in couple years.

antupis 7y ago
You also might not even know that you crashed in the wall 3 months ago.

jdreyfuss 7y ago

Sqreen (YC W18) is one counterexample, but they came into YC at a later stage of maturity than your average YC company. As to why there aren't many others, that's a great question. It's a hard space to get started in, since security is mission critical for essentially everyone, so that likely doesn't help matters. There's a lot more that needs to go into a viable MVP in cybersecurity than in other areas as well, since there's much less room for error and jank. Those reasons likely contribute, but none of them are hard blockers.