Orca Security Revenue, Valuation & Funding (2024)

Nathan Latka (00:00) Hey folks, my guest today is Jill Garon. He's the co-founder and CEO of Orca Security, which is an agentless cloud security platform built on patented side scanning technology. What that means is it takes read-only access to a customer's cloud, analyzes block storage from the side, and maps vulnerabilities, malware, and misconfigurations across AWS, Azure, GCP, et cetera, without installing an agent, became a unicorn in 2021 and is now pushing from detection into autonomous remediation. Gil, how'd I do? Gil Geron (00:30) Great. Thank you for having me. Nathan Latka (00:32) We're excited to have you. So tell us more about the story here. I I think you guys launched in twenty nineteen, but you weren't you weren't the or were you part of the original founding team or did you join later on? Gil Geron (00:42) I was, I was one of the founders. was the one who basically led our product in engineering at first and became the CEO after three and half years. Nathan Latka (00:56) Okay. I want to talk about what you're doing today and then we'll get more of the backstory, all the growing pains of building a cybersecurity company. Today there's a lot of people hearing about things like you know, you know, Claude or they're thinking about Hermes or some of these agents and security is always a major concern. What are you seeing right now in the space as people try to use more AI but can't compromise their security at the same time? Gil Geron (01:20) What we are seeing is that there's a need to move in a different velocity and to adopt technology like AI that generates more code, more resources, and potentially even more exposure. At the same time, when we try to use traditional legacy tools to secure that, just doesn't fit what we need. And so there's a big layer of adoption and velocity. adjustment that we need to do in order to secure the ad. Nathan Latka (01:53) Can you tell us more? Where can I click on your website as you give the voiceover? What product right now is your newest product specifically focused on helping basically customers do what you just articulated? Gil Geron (02:03) You can actually see right at the front, we call it AI App Gen Security, where we are trying to basically make sure that we are supporting every builder. What we've been able to do is to allow you to discover shadow IT using tools like Lavaball, Go, Trebley, Snowflake, Pupa Bay. We can go on and on like multiple different tools, you know, and, basically secure the ecosystem of the builder. Nathan Latka (02:39) Mm-hmm. Mm-hmm. So I guess maybe the best way to dive deeper here is can you tell me a story? Is there a case study you have permission to share where you can actually tell how a customer used you? Gil Geron (02:49) Yes, we, what we've been doing in the last few months, we've doing a workshop with customers that are leveraging our MCP in order to build their own agentic security. And so what we add is, a customer using Orca to automate some of their security operations. For example, automatically generating authentication. between AI agents and secure them or another customer use Orca to validate different security findings and found exposed websites in compromised location. And basically was able to immediately all of the issues. Nathan Latka (03:41) Mm-hmm. And are you are are you selling to the enterprise, or do you have, you know, millions of customers paying you smaller amounts of money, you know, SMB focused? Gil Geron (03:49) We are still working on the million customers, but we are much more on the enterprise, mid enterprise. And yeah, are selling to businesses that are using public cloud, leveraging AI, basically every company that builds, we are hoping to secure them. And so that makes our target audience quite big. Nathan Latka (04:12) And Gil, every founder is a bit different when they talk about mid market, but most mean, you know, price points between like 30K per year and 100K per year, they sort of define as mid market. Are you basically in that range in terms of average ACV? Okay, Gil Geron (04:24) I'll be tired. Yeah. Nathan Latka (04:25) so higher. So past six figures there. And the reason I bring that up is that obviously determines your sales motion today, which goes back into your growth story. So let's go back now to to day one. How what was the MVP product and how'd you get your first 10 customers? Gil Geron (04:39) One of the biggest challenges in security is usually not technology. It's actually being able to adopt the technology. And what bothers me was that almost every company that had the breach, there were security tools available to actually prevent that breach from happening. And so when we started Oracle, we tried to find the easiest way. to ensure that you are covered in terms of security and that you have complete coverage that allows you to make decisions. And so we found a way to connect to your public cloud and basically scan all of your cloud environment without any funding and things that would read only permission. Since then, our primary focus is consistently to make sure that you are able to easily make the right decision, but continue to push the envelope of how to make security something that is extremely easy to adopt so that you are secure. Nathan Latka (05:42) Mm-hmm. Okay. So V one was connect to public cloud, read-only access, help folks identify these threats before they happen. And once you had that MVP built, where did you get tell how you closed your first 10, 20 customers? Gil Geron (05:56) So like almost every good company, was mostly by hand in the sense of like one-on-one with the customers. And I remember our, our actually our first customer after three weeks of using the product, we barely had a UI. We provided all of the information via presentation of the scan. And he said, look. This is too important for me that I won't pay for it. have to pay for you for the product because it's too essential for my business. I need you to commit and I will. Nathan Latka (06:36) That's cool okay. So they committed, they said, Let God let me pay you so you don't deprecate this thing. I want you to keep building it. I can't rely on it if you if you're not making money from me. Okay. Gil Geron (06:43) Exactly. And that was like an amazing time for me that there's a fit here because it was not just using it for free, it was something essential for the day to me. Nathan Latka (06:56) And I believe in twenty nineteen you guys also raised a six point five million dollar seed round from YL Ventures, which you also list on your LinkedIn. Explain to me real the relationship there and why did YL invest in terms of the early traction? Was it that one customer you just told me or something else? Gil Geron (07:12) Well, we invested way before we had a customer. What triggered the investment was that they brought us to meet different security leaders at Nathan Latka (07:27) Y L. Gil Geron (07:28) YR. And one of these security leaders, was actually at a ball game, at a baseball game. He could barely hear us and he asked, like, okay, so tell me what you're going to do. And we told him, Hey, we're going to scan your cloud and we're going to do it without agent. And we'll be able to tell you all of your risk. And he said, okay, so there's two options. Either you guys are a bunch of charlatans or this is the best idea I ever heard. And that's what triggered the investment. Nathan Latka (08:02) So just to be clear, you had success at Champ Point Software. Weil then recruited you to basically be their internal technical diligence person at the venture firm. You then founded the company and spun it out and, you know, had a six point five million investment from Weill as part of that. Gil Geron (08:16) It was more or less in Poland, meaning like Orca was a little bit before the human insider, after the investment, became a wild insider in Poland. Nathan Latka (08:28) Okay, okay. Okay. So fast forward past twenty nineteen, you continue growing. Do you remember what year you guys broke a million dollars of revenue? Gil Geron (08:38) Yeah... I think it was early 2020. Nathan Latka (08:46) What did that feel like? Gil Geron (08:48) It's amazing. It's amazing. Like seeing something you built being adopted by customers. It's an amazing feeling. I think that it's not only that, it's also, even though you can fall in love with your idea and what you're doing, like seeing that people get it and love it is an amazing feeling and also a huge responsibility to make sure you continue to deliver. Nathan Latka (09:17) Mm-hmm. And and did you have experience? I mean, you Gil Geron (09:18) And it's great. Nathan Latka (09:19) guys have raised a lot of capital. You'll have to correct me if my number's wrong, but I think at three, four, five, six, something like six hundred, seven hundred million dollars of total total capital raised to date. Had you been familiar with what it was like sort of getting on that VC train from your prior company, or why'd you decide it was so important to sort of raise and grow as fast as possible? Gil Geron (09:40) and I think what, in the market, we've seen a huge market and opportunity to grow and accelerate company. We've created a platform that contains so many services and so many, capabilities like vulnerability management, PII, now AI security. Kubernetes, because there is so many elements in the platform and we felt that we can build something here that is really significant and we do that. Nathan Latka (10:20) Okay, so you pedal to the metal, you broke a million of revenue, you got your first customers, you're scaling, you're scaling. What was the next big inflection point, whether it was a product inflection point, a critical team hire or something else between twenty twenty and call it twenty twenty one? Gil Geron (10:34) I think the big inflection point for us was actually the first time there was a really big incident. Across the world there was a new vulnerability popping up that was extremely important. was log4j. And what we've seen Nathan Latka (10:53) Sorry, Gil, I didn't I didn't hear your cra sorry, what was that big vulnerability? Gil Geron (10:57) There was a package called log4j that had Nathan Latka (10:59) Log for J. Gil Geron (11:01) a big vulnerability across thousands of organizations. And that triggered basically the entire change. And we've seen adoption of customers just using Orca more and more and more. we were just... trying to meet demand in terms of like being able to scale the product as fast as needed. Nathan Latka (11:31) So let me let me try and I'm researching as the same time you're giving me this story. So my research log for shell was disclosed December ninth of twenty twenty one. And it's quote, still the benchmark everyone measures other vulnerabilities against. Do you agree with that? Gil Geron (11:46) Log4Shell is actually a follow-up one. Log4j was the original one, but yeah. Nathan Latka (11:51) interesting. Okay. So log4j, it looks like the bug was a Java logging library and it had a feature where log strings could contain JNDI lookups. And if attacker got the string written to log, log4j would then dutifully reach out to the server, pull down a Java class, and execute it. You're saying you started to see Gil Geron (12:08) Yeah. Nathan Latka (12:10) rapid growth because you were uniquely positioned to prevent that from happening? Gil Geron (12:14) Yeah, we were able to detect it everywhere and people were struggling to find out where it is deployed. And with complete visibility, it allowed us to basically have that ability. Nathan Latka (12:27) So how fast, because of the value you gave to the marketplace by solving this vulnerability, how fast did revenue go but grow between twenty twenty and twenty twenty one? Do you remember? Gil Geron (12:42) If I recall, it was around 12x or even more. Nathan Latka (12:48) Wild. Interesting. So I I'm trying to think what the right question is to ask here because you guys would have had so much inbound, right? If you solved this issue that no one else could solve, I mean, that explains you going from a million of revenue to whatever, 12 million of revenue in 12 months. Gil Geron (13:02) Yeah, I think it's even more, yeah. Nathan Latka (13:04) Yeah. So how did you so okay, so you saw this is your first, would you say that is your first big breakthrough? I mean, that's your first big, big success product wise. Gil Geron (13:12) Mm-hmm. Yeah. Nathan Latka (13:13) How do you, you know, people talk about these S curves. Okay. You have one big win, but eventually that thing is solved. Now you need sort of the next thing. What was the next big S curve? Gil Geron (13:24) So then I think the next big S curve was basically the also happened like pretty soon after in 2022 where there was just huge adoption of cloud infrastructure. And so if in 2021 we proved our worth, we proved Orca can scale. In 2022, we've seen just tremendous adoption by anyone who's using public clouds. Nathan Latka (14:02) Mm-hmm. Mm-hmm. Okay. And same thing as like the log for J vulnerability. You said you corrected me. You said log for shell actually happened afterwards. Did you see another, you know, you know, 12X increase because you uniquely solved that vulnerability as well? Gil Geron (14:17) No, there wasn't another as big event that triggered another spike, but it was much more demand from the market and knowing that Orca is a really significant vendor in the security space. Nathan Latka (14:38) Mm-hmm. And this is obviously you're building trust with customers. If we fast forward now to today, how many customers are you serving all in? Gil Geron (14:45) more than a thousand customers. Nathan Latka (14:47) More than a thousand. Okay. Well, and what is the go forward strategy? Is it to s you know, more wallet share from a thousand customers, or is it to try to figure out how to service, you know, ten you know, move down market a little bit, more of a P L G motion? Gil Geron (15:00) I would say that we have efforts in both directions, both down market but also up market. We still have plenty of opportunities in front of us in both the enterprise and the non-enterprise. As mentioned, we are serving almost everyone who's a builder. so in that sense, are definitely seeing huge expansion and adoption. And I would say in the app market even more so because of the need of every company to adopt AI and to change. in the bigger companies, they have a lot more legacy to change. Nathan Latka (15:40) Mm-hmm. What sorts of things are you upselling? You know, founders come on the show and they say, Nathan, we upsell based off seats, off usage, off product upsells. Are you having more success upselling against one of those vectors than the other two? Gil Geron (15:53) We are selling based on, we call it workload. So basically it's based on how big is your cloud. And we are seeing really good success around that. We do have a few licenses that are based on SITS and we have a really nice adoption there, but it's around adopting a new product that was not in the initial offering and not in the sense that you're seeing growth in the amount of users. Nathan Latka (16:22) Interesting. Okay. This makes sense. One way to measure how successful this has been is have you been able to take a customer that signed up at ten thousand bucks a month and get them over to, you know, a million per year? Are you comfortable sharing? I mean, do you have million dollar per year contracts today? Gil Geron (16:36) Yeah, we just, actually like just a couple of weeks ago, had a customer moving from a 300 K contract to $2.6 million contract. Nathan Latka (16:47) What? Gil Geron (16:49) yeah. And it's, the adoption and, and, and I just talked to my team an hour ago and I thought, I'm, I'm, I'm so proud of them because it just says, Okay, there's a really strong relationship that we've managed to build. We've built their trust. We've proved our value and they trust us going forward. It's a big investment for them to do. And so I am, and, and it is not something we're taking for granted at all. Nathan Latka (17:21) No, it's incredible growth. I mean, look, I want to give you all credit where credit's due. I mean, you know, w you know, I'm gonna ask a revenue question, so you can feel free to answer this however you want or avoid it completely. But can we take the numbers you've already given us of the thousand paying customers times the hundred thousand dollar average sort of ACV? That would put you north of a hundred million run rate today. Are you comfortable confirming that? Gil Geron (17:42) I can't confirm. Nathan Latka (17:43) Okay, you can't. That's fair enough. But the other two numbers, we I mean, people can kind of multiply, right? Okay, fair enough. The reason I'm asking this is because you guys, I believe, based off my research, hit your largest, at least publicly announced valuation in the October 5th, 2021 Series C extension. I think you guys raised $340 million of new capital there. There were tons of companies trading at 40, 50, 60x multiples there. And now today, this isn't a negative on you, just the general SaaS market has come down. How have you managed that story internally with folks that are relying on things like options you issued to them back in, you know, twenty nineteen? Gil Geron (18:21) So what I think everyone understand that there's a shift in change in valuation and also headline valuation is something that is not material enough to know what's the small print. And so what's more important is what's your actual valuation? How can you liquidate? that value and we are fortunate to have the opportunity to give some of our employees secondaries. And so that was meaningful and provide them with some liquidity. And going forward, what I think is the most important is to show them where the company is going and what it's going to be worth. And then you can, you know, we are already in a magnitude that you can compare to public market companies. and so if you believe that people are going to adopt AI and going to build software, then there's a good reason for you to believe in Orca in your shares in Orca and, and, and, and, and all my job is just to ensure that you are in the right side of AI. Nathan Latka (19:36) Mm-hmm. Mm-hmm. I'm not a technical person. So if I put my foot in my mouth here, Gil, you can tell me I'm putting my foot in my mouth. Okay. And correct me. But I believe like you and Wiz must be doing similar things because there's well-known litigation in Delaware back, you know, a couple of years ago. Ultimately, Google made a massive bet in this space and bought Wiz in 2025. were you in that conversation? And and how do you think just generally hypothetically about MA conversation in the security space? Gil Geron (20:05) so, there, there's definitely similarities, but the market really needs it. It needs an independent vendor. There's a huge value in being a security focused company because it ensures that all of your efforts, mindset and diligence is around, okay, how do we make sure that we are successful and that we are in, in securing our customers? and, and so in that aspect, I think that the fact that Orca is independent, the market gives a lot of value to customers. And in the sense of, you know, there is so many people ask me, including internally, are we going public? Are we going to be a private company? And to be honest, my answer is pretty simple. Like if anyone has $32 billion to give me, then I'll take it. Because I think it's good for the company, the employees and my investors. And at the same time, I think that the questions of public private is much more determined around valuation, liquidity and opportunities in the market versus as a goal. It's a point in time. It's not a goal. Nathan Latka (21:30) Google paid thirty two billion for whiz. You know this space well. Did they overpay? Gil Geron (21:35) No, I don't think so. Nathan Latka (21:37) Okay. Okay. Interesting. I wasn't expecting that answer. I thought you might say they overpaid. Gil Geron (21:42) I think we can do more. Nathan Latka (21:44) I like that. How many folks are full time at the business today? Gil Geron (21:47) 400 in place. Nathan Latka (21:49) Four hundred. Wow. Okay. Great. Interesting. As we wrap up here, anything else you want to touch on in terms of AI? Obviously it's a rapidly moving space. There's a big black hat conference last week. Anything else you want to touch on I haven't asked about? Gil Geron (22:01) I think the big thing in the market is around like, how do you, are you able to secure your company in this age where everyone becomes a builder? And this is big on companies because it could literally lead to bankruptcy. We've already seen several incidents related to fast adoption of AI and, and, and I think it's great to adopt technologies and it's our It should be our focus to ensure that when you're doing it, you're doing it securely. And that's why as a vendor, we are putting so much effort to ensure you have what it takes to secure your environment. Nathan Latka (22:39) And guys, if you want to check that out, obviously you can go to Orca and check them out. Gil, I do want to ask one last question here. Again, you can punt on this one. You can't confirm obviously revenue today, but I think you guys passed like 40 or 50 million back in late 2022, 2023. Is that old enough data where you can confirm that, or do you not want to comment on that either? Okay, Gil Geron (22:57) I'm sorry, I can't comment on that. Nathan Latka (22:59) so the only thing we have confirmed is basically you grew from a base of a million, at least 12x from 2020 to 2021. on the back of the blog for J Vulnerability. So we just know you're north of 12 million of revenue, at least what you're confirming. Okay, fair enough. We'll leave it at that. I appreciate you coming on. any other places you want folks to follow you online besides the website? Gil Geron (23:18) I'm on LinkedIn, I'm on the website. Thanks guys. Nathan Latka (23:22) All right, guys, you met at MetGill here again, launched in 2019. they said, listen, we can connect to your public cloud in a read-only way to help you get ahead of vulnerability vulnerabilities, raised a 6.5 million seed so they can move faster. And it's a good thing they did because a big JavaScript vulnerability came to light in 2020. It was called Log4J. They broke a million of revenue that year and more than 12x based on that vulnerability. They were then well positioned to continue, obviously, raising capital off that success. Today, they've got customers upgrading from 300 grand. To 2.6 million per year, a team of 400 folks as they look to continue to scale past a thousand customers in this age of AI. They're seeing a lot of their customers building on top of Orca's MCP to build their own security agents, which is unique as well. Gil, thank you for taking us to the top. Gil Geron (24:06) Thank you, have a good one. Nathan Latka (24:07) All right, guys, cut. Heather, you're gonna kill me for pushing him, aren't you? I have to. It's what we do on the show. Heather Oest (24:13) I know. It's okay. Gail, you did a great job. Nathan Latka (24:14) He was good. Gil, Gil, Gil Geron (24:16) Thanks. Nathan Latka (24:16) you were you were great. Gil Geron (24:18) I had a huge echo at the beginning because one of the previous links was still open. Nathan Latka (24:24) I'm so sorry. Gil Geron (24:26) But I managed to find it halfway through and so it was easier. Nathan Latka (24:29) You sounded great on my side, so I apologize for that. Gil Geron (24:33) Okay, I'm glad because for me, there was an echo, so I hope it wasn't heard on your side. Nathan Latka (24:38) No, it was my biggest fear in this show is I wanted to give you credit for the technical IP you've built, but I am not a deep engineer. So I wanted to make sure I wasn't shoving my foot in my mouth. But it sounds like we nailed we we got it. We nailed it. All right. Heather Gill, thanks for your time. See you guys. Heather Oest (24:54) Thanks very much, folks. Bye. Nathan Latka (24:56) Bye.