SecurityScorecardrevenue, valuation & funding

hello everyone my guest today is alexander yampulski he's a recognized expert in the security field running his company security scorecard dot io he's which is the leader in security ratings used by hundreds of customers hundreds of customers like ge mcdonald's pepsi and many others before founding the company he was ciso at guilt group and has held lead technologists and security roles at goldman sachs oracle cinch cast and microsoft he's a published author and active speaker in the security and software development communities and has a phd in cryptography sorry cryptography from yale university all right alexander you ready to take us to the top it's a pleasure to be here yeah i was gonna say like vladimir putin's your best friend every time there's a hack people pay you more money that's how it works well cyprus cyber security is a hot space right now so customers are looking for good solutions all right so tell us what you do and how you make money is it a peer play sas model yeah so we're an enterprise sas company and the idea that we came up with is that the market is moving to the cloud and so companies do business with other cloud companies you might store your files in dropbox you might store your sales leads in salesforce and when companies do all these relationships how do you know that your cloud providers are being as diligent as you are when it comes to protecting your data and we came up with a way of how to non-intrusively from outside measure a security posture of any company in the world and give them a score card a rating or letter grade a b abcdf representing how secure they are well you're basically trying to hack them and if you get in you say you fail so we look for signals that indicate to us whether or not the company is doing a good job for example imagine you're looking at a website and on the on the front of a website it says copyright 2008 well it's 2018 so you just discovered that the company has not updated its systems for 10 years and so we came up with hundreds of different signals like this uh many of them are much more sophisticated than what i just described that indicate what's going on within the company i mean so your your sales tax there obviously works why don't you just email everyone and say you're vulnerable right like it's a fear tactic thing they're all gonna they're all then gonna buy well i mean i think that uh fear uncertainty and doubt is a common technique for many security startups we don't subscribe like we don't subscribe to to this approach we want we want our customers to recognize value from a software that they use so the way that people use us it's a software as a service you pay us annual subscription and how much how much on average per year so on average it's uh two thousand dollars per year to monitor a single company so but you know big companies have tens of thousands of vendors so some people are paying us a million bucks a year some people are paying us twenty thousand so what's that would you say averages though just to avoid every going down every customer cohort you know every contract value could be around 80 to 100k uh per year paid up front okay got it very good but people use us to monitor their suppliers some companies are using us to compare themselves to the industry to competition and prove to the board of directors that their security investments are paying off cyber insurance companies are using us to make underwriting decisions so this concept of security ratings is really beginning to gain traction and just like we have credit scores the security scores have become an integral part to doing business today and how many customers have you scaled to so we have over 450 customers and rapidly growing uh every single year okay what's rapidly growing mean doubling in size doubling okay i mean if i take 450 customers times the acv 80 grand you just told me i mean you're doing north of 3 million a month is that generally accurate um it's it's in a ballpark it's in the ballpark of where we are yeah we're growing very nicely 130 people headquartered in new york growing very rapidly this year okay but i mean that number i mean sometimes people give discounts to their early customers sometimes sometimes that number is high i mean have you guys passed three million a month in revenue or are you below that when the 25 to 30 million arr this year got it okay that's you'll hit that this year or you passed 25 million already we are on way to do it this year on a way to do it okay so if you're doubling year over year that means last year you did what 12 and a half at least or 13. yeah around that number we're growing very nicely that's good what's driving most of the growth are you driving expansion revenue across the current base or adding new customers net new customers so it's both uh you know we are the way that we see a lot of customers use security scorecard is some customers naturally a lot of people say well how how can you really measure security of a company from outside are you really going to be able to see detailed information and when people start looking at our technology and they start deploying and they realize that they instantly gain visibility to tens of thousands of companies who are uh who they're doing business with and that will ultimately help them save time and money and that as a result grows more adoption so we see in lend and expand out of our existing customer base people are happy our net promoter score is in the is in the 60s so like people really like what we do and customer satisfaction is very high what's churn the churn is under 10 percent and that's gross logo churn per year no if you factor in if you factor in the upsell we're we're negative like we're win in the negative double digits people are people are buying a lot more so just be just to be clear annually you're churning at a gross level 10 of revenue when you add back expansion you're net negative we're not 15 like we're around net 15 percent negative negative negative 15. correct or set or said differently you're retaining 115 of your revenue correct yeah okay got it uh that congratulations by the way that's obviously not an easy thing to do so that's good stuff talk break down your team for me of 130 how many of them are inside sales well um i would say roughly half of our company in the product technology we're win engineering driven company we believe our vision as a company we want to create a new language for how companies talk about security so we want chief risk officers board members cfos regulators we want them to start using scorecards as part of an everyday dialogue we want people just like people bake into contracts 99.9 uptime requirements we want people to start baking into contracts minimum scorecard requirements uh and that's the vision we're trying to create and so half of our company is dedicated to product and engineering because we believe that ultimately i mean if you have crappy technology and really good sales and marketing team uh that's only gonna last you so long if you have an amazing technology and crappy sales marketing execution then like people are still gonna value your technology yeah like like luckily we have good technology and good sales market and execution but we're dedicating um quite a lot of people in a company towards uh towards product innovation how many how many months does it take you to get back your cac on a customer you know customers customers pay us upfront so you know and given the retention rate that we have uh you know we see in we see in very good economics metrics i don't want to just close it but you know we seen very good efficiency okay but in terms of payback period i mean it sounds like you're south of six months if they're paying you all up front uh depends we're we're we're under a year okay that's fair enough under a year um and when you do so and just to be clear if you're under a year and average acv is 80 grand it means you're willing to spend up to 80 grand to acquire one of these customers where are you spending that typically we see very good network effects out of what we do because if you have a company if you have a company who is using us to monitor 10 000 plus of their suppliers naturally those suppliers also want to know what their scorecard is they want to know how to get better they want to know how to how to improve for example suppose you have a very important marketing relationship and uh that marketing relationship says i'm going to put in 2 million into nathan's podcast but we're concerned about your security well it's going to be an incentive for you to sign up for security square cut because you want to make sure you're protected so the very strong network effects that we see in we've seen good return on investment from conferences from events for example we did a big splash at rsa we launched a new product recently called bridge insights that nobody else in the market has that measures concentration risk we spend heavily on events and just brand recognition how much a year on events would you say more than a million i'm sorry saying them how much it per year on events would you say more than a million yeah we're spending more than a million on the best and then last economics question here before we move on to more of your story lifetime value what do you assume lifetime value is i mean we see in look i mean we see an ltv to cac over over three which is good in the enterprise space yeah so if your cac is 80 grand you're saying more than 240 grand in ltv yeah for sure yeah um interesting okay good tell us more about the back story here so what your launch company in so we launched the company in the beginning of 2014 and the story is that i was a chief security officer at guild group and one day we were looking at a solution that helped mitigate e-commerce fraud it was a software as a service that helped mitigate e-commerce fraud it would look and say hey nathan today is logging in from new york buying two hundred dollars worth of clothes but all of a sudden you in austin texas buying a thousand dollars something is suspicious and so it was a very good solution and we had to integrate our systems with that and we looked at the contract we looked at the penetration test results everything looked great and literally at the last moment when we started integrating with that company we looked at their systems and we discovered unencrypted credit card data floating in their systems and that was an oh moment for me because i realized i could lose my job as a chief security officer due to negligence of somebody else and the question uh really stood out to me the question that nobody in a market is thinking about how to measure security there's got to be a way to come up with objective metrics that measure cyber security and that's what we came up with and we launched the company in 2014 spent most of 2014 building a product and uh saw some very good adoption uh since then and you've bootstrapped if you raised we've raised the venture money how much uh so to date we raised a little bit over 60 million dollars the seed was led by evolution equity and bold start ventures great investors then we did the series a by sequoia capital series b by google ventures and then the series c was led by nokia growth partners intel aksa and moody's participation was when was the series c it was uh it was around october of last year okay and how much was the series c it was 27.5 million 27. okay have you broken 250 million dollar evaluation yet uh so we are flirting with that we are flirting with that valuation yeah i mean right now right now given that we made more headway we should be we should be above that valuation right now so are you planning to raise again this year i mean or do you want to get to break even and cash flow positive so we're in a good position where most of the money that were raised is still in a bank so we don't need to like we don't need to go raise any time soon um right now we focused on growing the business right now are you cash flow positive today or no no we venture back so we're not cash flow positive but you just said all the money is still in the bank yeah a lot of our money is still in the bank we have a very strong quarters we're having very strong quarters with very good cash flow uh like most of the money that we raised is still in a bank we don't need to raise uh yeah but alexander you understand how those two things can't be the same right you can't say all your venture money is still in the bank but then also say your cap your cash flow positive well the money from serious c meaning uh got it yeah that's that's what i mean uh you know we we didn't have to raise the series c front also so we have enough money for multiple years uh we're not planning to raise any time soon uh but you know we focused on growing a business and really unlocking the massive opportunity here there's a lot of companies that are kind of in i would say maybe a tekken is from a different angle like no before comes to mind stu and he's kind of going at it from bottoms up approach and it's not necessarily a rating per se but there's a lot of companies that i could see where it makes natural sense for them to try and make you an acquisition offer if someone came and offered you 500 million bucks for the company do you sell well i mean i talk to everybody i talk to customers investors strategic partners you always talk to people uh but you know our focus right now is we want to create we want to recognize our vision as i mentioned our vision is to create a new language for how people talk about cyber security if you think back to kind of like a interesting business analogy if you think back to henry ford henry ford's innovation was not the fact that he came up with a low-cost automobile or that he pioneered a very efficient assembly line henry ford's innovation was the fact that he envisioned a society where many regular people will be automobile drivers like people didn't drive automobiles only rich people could afford automobiles and so henry ford envisioned when many people all over the world will be drivers and so we're envisioning a similar world where cfos chief risk officers general counsels i use enough scorecards to measure and quantify risk and this world doesn't exist today but we're marching towards that vision and um that's really a goal that's what we're focused on all right very good i like the vision let's wrap up here with the famous five alexander number one what's your favorite business book sure so uh one of my favorite uh business books is uh behind the cloud by uh by mark benioff about how he created salesforce it's a very good book where he talks about the history of salesforce many of the tricks that he used to build it and that's one of my favorites number two is there a ceo you're following or studying right now sure well i'm a big fan you know i'm a big fan of elon musk i think that he's a very inspirational guy he's a very smart guy i met him a couple of years ago at a sequoia capital offside and i you know i learned a lot of interesting things just from a casual conversation with him uh when i asked him how does he know that what he's working on during the day is really making a difference he said to me at the end of each day he reverse engineers his day and says how did i spend my time which meetings did they attend who did they speak to were they things i could have delegated were the things uh that i shouldn't have been doing and that was uh very good advice so yeah elon musk is one of my uh favorites number three what's your favorite online tool for building a business so i like to use evernote i i'm a big fan of uh i'm a big fan of evernote how i start each day and each week is i basically create a list in the beginning of which week and i say here the three most important tasks that i need to get done this week and here are the batch tasks that i just kind of need to get done but you know they might not be as important and i always ask myself if i do these two or three things how am i gonna advance the vision how is the company gonna be better and i love like so i use evernote religiously every single day number four how many hours of sleep to get every night so uh it changed i used to like i used to be a big believer that i should work as much as possible but you know you realize as you get older that you need balance so i try to get seven to eight hours of sleep i typically go to sleep around 11 to midnight and i wake up at 6 a.m uh and you know you always want to have a good lifetime balance and what's your situation married single you have kiddos married and uh two kids nine year old and a six-year-old oh good and how old are you so i'm 37 37 okay last question alexander take us back to your 20 year old self what do you wish that he knew yeah so that's a you know that's a kind of you know that's a that's a good that's a good question so there's a there's a good question somebody somebody asked me that question once uh the person asked me what do you think is a job of a goalkeeper in soccer and i answered well uh you know the job the job of a goalkeeper is to prevent the other team from scoring and the person said no that's wrong the job of a goalkeeper is the same as it is for every other player in the field it's to win the game it's not like it doesn't matter if you're a soccer player or goalkeeper you all a single team you will work towards the common goal and so one thing i would give advice to myself if i met myself at 20 think more about how to build cohesive teams how do you get people to follow you how do you get people to work together it's a bit of a cliche advice advice but high performance teams are what make or break a company it's a huge huge difference guys there you have it from alexander focus on your team he launched security scorecard back many years ago after he realized a big vulnerability at his prior company and said wow i could get fired for this i've got to create a standard he's now focused on creating the standard security metric which hopefully gets used by many many companies launched in 2014 today he's working with over 450 customers uh doing north of uh 2 million bucks per month in revenue hoping to break that or sorry hoping to break that 25 million ar mark later this year doubling year over year so healthy growth uh net negative revenue uh churn which is obviously a healthy metric to be at 80 000 bucks on cac is a max 12 less than 12 month payback period lifetime value to kak obviously super healthy with a team of uh 130 people based in new york alexander thank you for taking us to the top thanks nathan