4 ms·
Most security companies seem to fall in one of two categories: - consulting - appliances (aka blinky boxes) Consulting seldom requires venture capital and cann
by alltakendamned 7y ago
Most security companies seem to fall in one of two categories:
- consulting
- appliances (aka blinky boxes)
Consulting seldom requires venture capital and cannot scale at the level VCs expect.
Blinky boxes can, but customers are slowly catching on to the fact that adding another blinky box to the network is really not improving their resilience all that much.
On top of that, it's not always easy to identify the real economic buyer in an organisation, and e.g. a CISO might not have the authority to decide on installing new appliances but needs to collaborate with e.g. IT. It all makes for convoluted and longer sales cycles.
- djd20 7y agoWhile its not in YC - there are a few SAAS type security startups aimed at SME's - such as https://intruder.io/ https://intruder.io/ who I am a very happy customer of. This to me looks to be high growth.
- GordonS 7y agoThere are dozens of these SaaS vulnerability scanning companies, with very little differentiation between them - they basically all run Nessus. It's difficult to see how they could make serious money, certainly not enough to interest VCs.
- andy_ppp 7y agoThe only way is to make them free and build a marketplace of accredited and vetted pen testers who you charge to be on the platform. Still how the hell you vet these people is a huge issue.
- alltakendamned 7y agoI think that's what bug bounty companies are doing by changing the model from paying for time spent to paying for (accepted) findings. Personally I don't think any serious pentester will spend considerable time in this model though. That said, I also think that one of the main challenges for buyers of pentest services these days is to evaluate the quality of a report or of the work done. Thoughts on how to improve that are most welcome.
- andy_ppp 7y agoMostly they are cookie cutter bullshit, right.
- lazyant 7y agohttps://cobalt.io/ https://cobalt.io/ works more or less like that
- andy_ppp 7y agoYes, I think the other problem with this approach is the terrifying consequences if the blinky box get's hacked. I think the trick would be - somehow allow the blinky box to be secure (how do you even do updates if the networks you are "protecting" are not on the internet), this is difficult. And then giving the boxes away for free with a limited amount of stuff they can do without pen tester involvement. Still is massively problematic.
- catwell 7y agoSome startups don't fall in those categories, for instance https://www.sqreen.com https://www.sqreen.com which recently raised $14M from Greylock.
- ecares 7y agoAnd they wet through YC :D