SecurityScorecard Revenue, Valuation & Funding (2024)

Intro so right that um four o'clock it's hard to have much empathy you just want a coffee and a snack and not talk about um not talk and not talk about ideas but um it's great to be here it's awesome to see founders share an idea sharing insights from each other there's no one Playbook that works so I think the best ideas that always happen are out of spontaneous interactions like this I'm going to talk in this presentation about customer empathy understanding customer and how it could lead to 10x in the company and share some stories that we learned as we scaled security scorecard so let me actually first tell you how the company got started so about 11 years ago I was a chief security officer in an e-commerce startup called Guild group I'm a security guy I cannot alternate between building things and breaking things so I just hired for this rapidly growing e-commerce fashion startup which was going from a few hundred people to 2000 people in just a couple of years as a first Chief security officer where I was overseeing security of millions of customers and um right around month three Kevin Ryan who is the founder of Guild group Business Insider mongodb he was my boss now he's a friend and a investor into a startup he sent me a message and says Alex I'd like you to come in and present to me what you're doing to make security for guilt and I felt I felt great I prepared the celebrity deck talking about people I was going to hire I talked to him about the fact that I deployed Akamai prolexic for send flood mitigation on the production Network so I shared this elaborate technical Deck with me and I thought I got it covered it's going to be a great meeting I will can he starts flipping through the slides in a printout out of sequence completely ruins the frame of a conversation looks at me and says you're not doing a good job and I was confused like how am I not doing a good job like look at all the things that I put together and Kevin's response was I don't hear enough people complaining about you if you were making enough difference as a chief security officer I'd hear more people complaining about you so he took the advice to heart on a lot of people complained about me but what made a difference but that was actually the inspiration for a security scorecard because I realized about nine years ago that security is Security the only industry where you have no kpis you drive a car you have a speedometer shown to you how fast you drive you go to a doctor they measure your blood pressure you look at a SAS company you have all kinds of metrics LTV to CAC magic number rule of 40 and cyber security with zero I mean if you invested a million dollars into a latest greatest technology and U.S did they become one percent safer two percent safer ten percent safer nobody could tell you and furthermore as we all became interconnected to each other the problem got even worse because you could be doing a good job then you send your paperwork to an outside Law Firm the law firm gets hacked and all of a sudden your sensitive information is out in the open so as well became interconnected actually 65 percent of data breaches today happen due to negligence of third parties which are not even within your control you could use a marketing software an HR software then they get hacked and you're in trouble for example just out of curiosity how many people heard of a Fazio data bridge by raise of hands okay and one person Target data Bridge Target got head no so fuzzy was a small air conditioning company that serviced Target and the hackers broke into it and then they got into Target so nine years ago we had this dream and the dream was why can't they be security score just like you have credit scores why can't you pick up data points non-intrusively from outside for any company in the world and reduce those data points to a score easier said than done because at the moment Market did not exist when we went and knocked on a door of prospective customers we got a lukewarm reception which was a very important lesson for me at the time when you start in a company if the idea is obvious to everybody you're actually too late to the game so you got a time it properly and fast Today forward then to today nine years later with about 600 employees used by thousands of companies worldwide nine of a top 10 Pharmaceuticals Banks all of the top insurance companies using us we exceeded 100 million run rate last year and we're gonna probably grow by at least 50 this year so fast forward until today so the question is where did we go right and where did we go wrong how much of it was good decisions bad decisions and you know we did a lot of um reflection we did a lot of reflection and thought where did we go right where did we go wrong as we scaled the company from two people me and my business partner zero dollars in Revenue so then a co-working space to you know customers and over 46 countries today and employees all over the world Bad ideas so the interesting part is that the ideas that we thought were good actually ended up being bad and the idea is that we thought were bad or like maybe we didn't put a lot of attention to it they actually ended up being good and like you don't quite know what's a good idea what's a bad idea because if you knew it you would have already done it so to share two examples on the right you see this bridge multiplier where in 2015 I got super excited I'm an engineer so I had this idea that you can use a way to compute a likelihood of two portfolios to be too similar just like you can have all houses located in a flood zone and if all houses are in the same neighborhood they can all get flooded because they're in a proximity to each other if you have all of your suppliers using GoDaddy for example to host themselves or all of them are using HubSpot and then HubSpot becomes like the single point of failure so how do you compute similarity between the two portfolios so we came up with a very clever idea to use kilmagorov Smirnoff complexity to compute the difference between portfolios we spent four months 10 team working on it for four months millions of dollars total flop I was the only person in the company who knew how to pitch it myself guys couldn't understand that didn't do anything on the flip side back in 2015 right around the same time on a weekend one of my developers called Josh he uh he looked at a website and said why don't I just take the scores that you guys compute and write a small widget and just put it on a website on anybody who can go get request a score can go type the email we send the score and then we bombard them with marketing messages and it becomes a lead a warm lead and nobody asked them to do it didn't come from me he just went and quoted it on a weekend and became a number one lead generation tool actually even today and Josh has now actually a founder and SEO of our customer success startup about 20 people now I'm an angel investor the reason I put my money in them is because you but on people who take a risk you burn people who are dreamers Risk Takers have a healthy dose of disregard for the impossible so what does it tell us though right like what are these two lessons tell us so they tell us that most organizations overvalue great ideas and that cheap quick experimentation outweighs great ideas every single time and you need to build a culture for people to really innovate because a lot of the time especially as companies grow people are going to say oh I got this two-month project to build a marketing campaign or a website or it's going to take me a month to ship a feature and then you do it and you don't even know if it works ninety percent of the time you think it does but then at the end it doesn't so I'm a huge fan of this five by five by five framework by Mike Craig who is an advisor and a friend professor at Harvard but he came up with this framework and said imagine you have five Five by Five framework people five days five thousand dollars and it's an artificial constraint and constraints breed creativity and you say okay like come up with an experiment and test the hypothesis so for example if somebody comes to you and says it's gonna take me two months to build the website I'm like how do you do it in 10 minutes they look at me like I'm crazy I'm like well you got to think crazy think creative don't think linearly think non-linearly what about you just putting up a picture in a landing page and seeing how many people click on it but this is very important for the culture of a company that helped us iterate number one number two Jobs to be done framework have people heard of a framework called jobs to be done yeah so that's a hugely important framework for product development people do not buy products and services they hire them to get jobs done in their lives jobs are problems that your customers do so at the end of the day every startup is there to help people do a job and it's very easy to get fixated on features operational metrics but you need to zoom out and say what are the jobs that your customers who are paying you money are actually doing and how's your product your company helping them solve it as a really good book like get that book I have zero affiliation with a Secret Lives of Customers book but I still love the book Secret Lives of customers a very good book and so in that book it poses a question why do you hire a cup of coffee you go to a local coffee shop and you hire a cup of coffee right you pay money so you hired a cup of coffee to do a particular job why do you do it who can tell me just shout out the answers you want to get caffeine anybody else experience of a coffee take a break socialize okay good good so the answer is it's not just caffeine if you run in a coffee shop and you're competing then if you think that the only reason people go to you is to have a coffee then you're gonna compete on quality of coffee a variety of beans that you have that type of stuff maybe you can add some sandwiches snacks but you miss on the point that the job to be done to hire a cup of coffee is totally different so I listed my jobs of why I hire a cup of coffee over the past couple of years sometimes I want to go meet a friend and have an informal chat somewhere outside of my house I used to compete on chess back in college I'm pretty good so I would meet local chess players at five o'clock on a Friday because they would congregate there I wanted to feel alert before I would go to a workout every single morning I would commute into a city go get a coffee draft my day and just that's my routine I've worked on my PhD dissertation back in college I lived in a small tiny Studio was uncomfortable faced the brick wall I wanted to be around people but not talking to people while I'm writing this dissertation so there's a lot of jobs to be done but when you compete on those jobs all of a sudden your coffee shop no longer competes on the quality of beans but you might be competing with wework on what type of Ambience you create you might be competing with social meetup groups by congregating people so it really expands how you think so if you adopt a product-centric lens which by the way we as a company often are very guilty of you start saying Productcentric lens a product-centric lenses you compete on a quality of coffee you get a cup of coffee but a job-centric lens you start thinking how do you create an experience in your coffee shop to have an informal chat get work done on the go if I apply it to what we do we've recently released a module called cyber risk quantification where you can quantify in dollar terms how much your risk exposure Jobcentric lens is if you adopt a product-centric lens you're going to say oh it shows this dollars exposure but if you adopt a job center cleanse why would somebody pay money for it well they might be trying to justify a budget to convince people that we'll lose this much money so I need an investment or you might show to the board that you're doing a good job so you expand your horizon when you think that way now customers pay you exactly proportionate The trick to the value you bring which means the pain you all evade versus alternate Solutions a lot of startups underestimated but this is the trick a lot of the time you might not be getting Traction in a startup but the point is you have a customer he has a set of circumstances and a certain amount of pain inefficiencies you might be standing outside in a rain trying to look for taxi it's not there that's a certain amount of pain so Uber and Lyft recognize the pain where you can now just click a button and order a car without looking for a taxi and it's tied to your credit card and it was a big enough pain where it became a big successful company similarly a lot of the time people underestimate how valuable their solution is right like I mean I think if you're under 10 million on ARR you actually probably did not reach your product Market fit yet like you need to work with the industry to try to cross the chasm and try to really understand deeply how they become a drug and not a vitamin because drugs are must have vitamins are nice to have how do you become indispensable and embedded into your customer life cycle and to do it you have three types of approaches right one approach is you become a system of record like Salesforce where it's almost impossible to rip it out a second approach is you become the company where you have a lot of Integrations like zendesk it's easier to rip it out but you integrate it into the workflows and a third you could become a company like gain site or some other companies where much easier to rip it out but they created a great brand great Community people like it so you create the stickiness to your solution and you need to talk to your unhappiest customers that's your secret of how to scale your company talk to your unhappiest most best of customers they'll tell you the secret and so the deadliest competition is actually not competitors and not your adjacent Solutions but it's doing nothing that's the deadliest comparator that you face and it's a very hard comparator to fight with because before you came along people survived you know things were happening so why is it that now your startup or your company is around why do they really need to have it so that's a very important kind of point to focus on and the next part is as you scale the company the values are not what you put on a wall or what you say it is but it's a behavior it's the positive and the negative behaviors that you embody so it's very crucial to create a customer obsessed culture Create a customer obsessed culture and customer is always a number one priority we hire we fire and we promote based on this I parted ways with an executive who is a smart talented executive um about a month ago and of course the big turnover in a gym I asked her how many customers have you talked to she showed the calendar not many I said okay next week when I talk to you I need to see you talk to customers wasn't happening so we moved to a different role didn't work out so but you have to do what you say if customers are your number one thing do what you say reward promote and Fire based on those things we start every executive meeting with a 20-minute recap of customer stories before we talk about anything else updates okrs kpis roadblocks we start by talking for 20 minutes about stories from the market bad and good that means that we put customer first we invite customers to talk to our town halls we share stories we do calendar audits to make sure that people are mixing those activities every executive is mandated to talk to customers it's not an option and then Amazon has a very famous expression and the most important chair is an empty chair and a room represented in the customer that's the most important thing is the stuff that we're talking about actually going to benefit the customer the last part I'm gonna mention is you also want to take your customers on a journey and understand who are your customers who are your customers customers if you're a retail customer who do they sell to if you're a cruise line who do they sell to and then you want your Transform your customers company to transform your customers Mike schrake again talks about this quite a bit and he said the Facebook Innovation was the fact that it asked its users to share more openly even if they were introverts they did not do it before it's easy to talk about Henry Ford and people say Oh Henry Ford's idea was a mass assembly line or producing the Model T at scale but in reality it wasn't actually that he recognized that a transformation as possible when people didn't make enough money to buy an automobile so he raised the salaries he envisioned that people are going to travel longer on a weekend when they didn't travel the roads weren't paved there were no Bridges no infrastructure but he envisioned this transformation Google transformed us into people who don't hesitate for a second to type a ill-defined query into Google and believe the results that was a transformation of the customers and that's how you take your customers on a journey and similarly we transform the customers into people who don't hesitate for a second to use a scores to decide whether somebody is trustworthy to do business with so that's some tips and advice you never done you never achieved a milestone you always have to work on it and continuously get out of bed and think about how you evolve but those are some of the things that work for us and as I mentioned this quote by Bill Gates is very relevant your most unhappy customers are your greatest source of learning and so that's my email if you guys have any questions reach out and I think I'll also be hanging out a bit but thank you very much [Applause]

Introduction hey folks my guest today is alex yampulski he's a globally recognized cyber security innovator leader and expert as co-founder and ceo he's led security scorecard since beginnings in 2013 to become one of the world's most trusted cyber security brands alex you ready to take us to the top let's do it all right so you are in a very hot space how do you differentiate yourself from some of the others qual like know before or malwarebytes or others in the cyber security space sure so we don't compete with guys like no before or mail weapons there's a lot of security solutions out there but the insight that we had when we started the company is that a lot of solutions out there but there's no kpis being used to quantify how you're doing so we invented a way to measure and communicate cyber security and and that's a crew and it became a crucial tool to communicate risk to the board to measure suppliers to measure investment targets to measure others we do have competitors in a space but we rated the largest number of companies with we have a broadest and deepest uh amount of coverage we have a marketplace of apps and services and nobody else does compared to us in the rating space what what is the name of your rating that you've sort of branded security scorecode so it literally is called security score like that so a company name yeah like a company name represents basically what we do we give companies scorecards and we teach those companies how to improve the rating and how to become more resilient so i'm seeing obviously everfinance is an example with the 72 security score broken down they score really poorly and f on network security at 52. their dns dns health is 74. their patching cadence is 75 alex i say this like i'm smart i know what the hell those things mean i don't but how many of those kinds of things do you measure we pick up hundreds of different signals from outside non-intrusively you don't need to get a permission or consent and then by sitting on seven years of historical data we reduce all this information into a score and we've demonstrated uh historically that companies with a bad score have a seven times higher likelihood than companies with a good score to suffer a data breach and that actually is what gives us a mode right like the mode is that even if i give you all the source code all architecture all of our 25 plus patterns and said go compete with us you're not going to have this historical data set where we calibrate what data sets com map more accurately to likelihood of a breach and the more information we accumulate the higher the barrier to entry becomes do you need the company's permission to issue a score for example if hubspot's public if can you do an analysis and publish base and say they had a really bad score would it impact their their stock price we don't need to have permission or consent to rate anybody because all the signals we pick up are non-intrusive from outside and a signal could be very simple for example i look at the website of latka magazine and i see at the bottom copyright 2008 hypothetically it's 2021 so it means you've not updated your site for 13 years very simple data point but it points you to what's happening behind the scenes in the company and there could be much more complicated signals like for example malware beaconing outside of your infrastructure indication of poor passion cadence that you're not updating the software and indeed if we look at our customers if we look at users of our solution people base decisions who to do business with who not to do business with who to insure what type of premium to charge for cyber insurance the key business decisions being made based on the scores that we provide this this makes complete sense i want to dive into sort of how you dominate this space how you came up with the score that became industry standard but first how many customers are you serving now Currently serving 350 customers today so we are right now at about 1700 plus uh paying customers right so people who use a scores to rate others we have over 12 million companies in a data set that we rate 1700 paying customers and then there's over uh 25 000 freemium users because any pay and customer can invite for free any other company into the platform and say hey go improve a score if you do business with us and so as a result that drives kind of like additional people to join the freemium funnel as well well i want to talk more about that freemium funnel including this one pager you sent me for your q2 planning where you have effectively three buckets of key results that you focus on and how you're driving the business that way but first take us back you launched the business in 2013 2014 do you remember what year you passed a million dollar run rate so we launched the business uh basically in 2014 and for most of 2014 we were incubating the product so like you know we we really were just building a product in 2014 and so uh we we really surpassed the one million uh run rate for the business only in 2015 because most of 2014 was spent building a product we only really started selling around kind of june july of 2014 and it grew rapidly but the first year we passed a million was in 2015. and do you remember what your starting you know starting price point was i think you're at you're really playing mid-market enterprise now today have you moved up market over the past six years so the way that we operate is it's an annual uh upfront subscription right like you pay annual paid upfront the variability is the number of scorecards you want to monitor and a scorecard is just a company it could be your supplier your investment target and we charge you know look we charge anywhere from a few thousand bucks a year uh for monitoring a scorecard and the prices could go down if you if you want to monitor quite a lot so some people can monitor tens of thousands of score cards you know for example like a private equity firm monitoring its investments or a big bank monitoring its vendors and some people can monitor 10 or 20. so the average contract is about you know 40 000 bucks a year paid up front some people pay millions dollars a year paid up front and some people test 10 20k the average is about the average is about 40 000. but the cool part about it is if i charge you to monitor latke magazine right and i charge 20 other people to monitor a lot come magazine i don't incur any additional costs because i recompute the scorecards once a day and then i just resell the data it doesn't cost me anything more to you know to get 20 more customers or 40 more customers to get access mm-hmm and so can i do the math 1700 customers at that 40 000 acv puts you at about a what Monthly recurring revenue a 70 71 million dollar run rate today that's correct yeah like so we're going to finish like we're going to finish this year at about you know anywhere from 70 to 73 million annual recurring revenue like we're growing very rapidly we're consistently exceeding 50 plus growth rate much faster than a direct competitor a direct competitor is barely growing at 20 rate who is your direct competitor bedside is a primary direct competitor yep that's that's kind of the main comparator we have there's a bunch of smaller ones but we don't really see them in bake offs as much and next year we plan to continue the same growth rate so we're going and and more so we're going to by far surpass you know the 100 plus uh next year and and and beyond we actually anticipate we actually anticipate to be able to grow faster next year bit do you know how much revenue bits doing or our estimate those guys are gonna do about 100 million in arr and they're growing kind of barely at 20 percent interesting what stalled them out do you have any ideas maybe you guys maybe your growth has stalled them out well look we beat them we beat them 70 of a time in a bake off uh you know there's many many companies who switch over to us when we ask them why do you switch they say look number one your product just has a lot more value we have workflow automation we have the inside out component called atlas we have a marketplace of apps and services at the end of the day we are a customer first company i'm an engineer right like i was a chief security officer so naturally the way that i run the company it's all about the customer you need to deliver deliver value for the customer the most important share in the room is occupied by the customer and a competitor is more of a sales marketing driven company right like they're focused on p l but they're not as much focused on the customer value and alex we love capital efficiency obviously public markets left capital efficiency as well quantified by rule of 40. it looks like bitsite has raised about 400 million bucks to hit a hundred million of ar so four dollars raised for every dollar of ar you guys i believe have only raised 290 million and you've been more efficient and we're still sitting on almost 200 million in cash that we can use opportunistically for many many options so you've spent obviously you've spent other other money besides just what you've raised because you have revenue coming in but you've spent obviously a way less than you know your competitors have to grow to the same or relatively same amount of arr where where does this thing put look i mean we definitely invest in a kind of a curve it's a new market being created like we believe that security ratings you know when you drive a car you have a speedometer showing to you the speed with which you go in you go to a doctor they measure your blood pressure you buy a stock bond or like a stock instrument you have credit ratings from guys like s p phage and others for cyber security something like that has not existed and we believe it's a market that needs to be that's going to be a huge huge market down the road help me understand growth and valuation Raised you know this is a game you have to play once you're on the vc track and i think you're playing it fairly well you recently raised 108 i believe in april this year 180 million at what basically a billion valuation right correct that was a post money valuation that's the post money yeah so we raised it about a billion post and and take me back to the 50 million dollar round you did in 2019 what valuation was that at oh we uh i mean we're more than tripled right like we're more than tripled basically it was like in the three something like three 320 340 like with more than triple the valuation 340 post money i don't remember the exact number but something like like some something roughly in that range but every round we did was oversubscribed multiple term sheets we believe that within the next 18 to 24 months again we're going to triple a quadruple evaluation of a company or more there's a good opportunity for us to take this company public to an ipo so lots and lots of interesting uh tailwinds in a favor right now what metrics i mean you you and i both study publicly traded sas companies and benchmarks and things what sort of numbers do you think you have to hit to be competitive in a pub you know on your first day of trading if you do decide to go public well look i mean whenever you go public you also by the way of course you want to have a good story but you don't want to have a a story which cannot be further improved right like you don't want to be going public and like nothing else can be improved and it's all downhill from there that's not that's not the story you want to tell you want to tell a story of growth and the story of potential and the story of upside um look i can tell you our net retention is solid right our net retention kind of like a growth a net retention is hovering between 115 to 120 percent i want to increase it by like i want to increase it by about 10 points even further and get it into like 125 to 130 that's definitely kind of a area of attention for us i think from a growth perspective we're doing fine our gross margins are you know our gross margins are very healthy between 75 to 80 percent and we're not worried there so overall i feel like uh it's only just internal execution all the wins on all the tailwinds are in a favor it's really all about just methodical execution and getting the right team together and building additional products that we can cross a lap cell into into our customers to deliver more value for customer base your number one way to drive expansion revenue right now i believe correct me if i'm wrong is to sell more number of score cards tracked uh are there other things you're upselling against right now that think that you think will enable you to get to that 130 140 net dollar retention mark well we need to have more uh modules to cross-sell upsell right we have uh atlas which is the inside out component we have ratings which is the outside in and we're actively building and developing additional modules that our customers are asking us for ultimately at the end of a day it's all about the customer value that's that's what it's all about i'm not sitting and thinking you know oh how do i optimize the metric i'm thinking how do i deliver more value to my existing customers because if you deliver more value to your existing customers they're going to love you they're going to be loyal um and and also you expand your total addressable market right by by doing more of that and so alex in 2022 if you add no new customers and you can only focus on building great new product lines new modules to upsell your current base how much do you think you can grow by in 2022 next year yeah i'm going to grow at least by 50 without adding any new modules yeah sorry without any new ignore new customers if you only focus on expansion revenue in 2022 do you think you can get to 30 40 percent just up selling current current base yeah i'm pretty sure i can yeah like i'm okay actually quite sure that i can so we like to under promise on our delivery when we scale the company so yes i mean our customers are loyal they're happy and lots of those customers uh buy a lot more from us take me more insider you're an engineer which means you focus on the numbers you you i was in your office we were doing the photo shoot for this magazine and i saw these hanging things and i'm going what is this alex so we have your this is an older one but it'll help us learn here we have your q2 2021 sort of security scorecard okrs help me understand how this okr process works what year what revenue like did you start did you how big were you when you started implementing these and how do they work today sure so okr which stands for objective key results many companies use it google uses it intel uses it initially it was pioneered by andy grove who was a ceo of intel and so always the objective you said kind of like an aspirational objective and then the key result are the measurable results and they cascade to the rest of the company so we tried so we tried doing okrs about four years ago right like four four and a half years ago uh for a company i can tell you that back then we miserably failed right like it didn't work ah so that so and i'm like wait wait a second okay has worked for this company is why they're not working for us the reason was simple we made only one small tweak now every monday we have a stand-up exact meeting for all vps and above and we start that meeting by going over the ocrs what did you say you were going to do last week what what did you actually do and so it creates social pressure and it creates accountability for people to report on the progress and that small subtle tweak where now you just do like a group meeting and you report weekly and your progress made all the difference and so to give an example back in q2 one of the objectives that we had was to launch a marketplace like we wanted to create an ecosystem of apps and services on top of a platform that we created and so we had an objective build the best in class marketplace and we had two underlying key results number one launch a press release which announces at least five new partners joining in the marketplace so the key r was how many people signed up in a press release and the second key result was to measure how many times was the marketplace mentioned as a win reason when we baked off against the competition and we wanted to make sure that that win reason goes to 15 of a time a marketplace was a driver for the win and so we measured it relentlessly we launched the marketplace with a lot of incredible partners like csc domain register scannable vulnerability scanner uh red sift hacker one microsoft one microsoft teams and many others and our customers loved it it delivered value and it helps us differentiate and win more deals so you hit this one the headline what june 2nd 2021 security scorecard launches integrate 360 marketplace to enhance value for customers by finding managing and mitigating cybersecurity risks so you guys you kick that one in the butt your other two objectives the first one the second one was enhanced customer education and onboarding and it was interesting what you used to measure this you said we're gonna use pendo to measure our stickiness score and we want to improve that i believe by 45 by the end of the quarter tell me more about that one yeah so the big initiative for us again focused on how do you provide value for the customers was how do we educate people about what security ratings can do for them because if i give you a score how do you use it how do you communicate to the board how do you hold your suppliers accountable so we built a whole team responsible for onboarding education and then we measured the output we measured in pando which is a tool to attach to kind of how people use your product we measured was the stickiness actually being improved and so that one also worked really well and again the trick was the trick in startups you don't know what's a good idea what's a bad idea so you need to try a bunch of things and then you see what sticks but when once you see that it sticks you need to just relentlessly drive execution measure it and hold hold people accountable for delivery there's no magic there's a lot of hard work a lot of hard work and obviously measuring is important the last thing you measured increased the percent of existing both paid and free clients contributing private data to your platform from 363 companies to a thousand companies why is that important and did you hit that goal well it's important because we believe strongly that our job is to help companies improve their score and so companies have a you know outside and scores have limitations and companies need to have a way to provide feedback to provide commentary just like you know if you have a restaurant you could have customer reviews on yelp but the restaurant should be enabled also to provide its own story provide its pictures provide its menu and so similarly we believe that we need to create opportunities with we give companies a score they need to be able to improve it influence it provide inside out data inside out feedback commentary and so that was an important goal for us to really foster that uh inside out communication love that wrapping up here you know obviously when you go public you always see companies in their s1 braze just filed they'll say how many accounts they have over a million bucks in arr it's just the one contract where are you guys at today how many accounts pay more than a million a year uh so we don't disclose that number right like we don't disclose this number publicly but the number has been very meaningfully growing right like i can tell you i mean there's no concentrated risk right like there's no concentrated risk in our revenue there's no like one customer accounting for no no not looking for rent i can tell you but i can tell you we have a whole variety of customers across government insurance private equity right like and you know we have a whole slew of customers and those guys are paying us millions of dollars a year and deploying us on on their entire portfolio right so it's been it's been happening more and more um and the finance alex can we say can we say more than 10 is that fair i won't push you harder more than 10 customers with greater than a million of your contracts yeah i think it's fair yeah okay i think that's cool but you're also building top of funnel it's not just bottom you have twenty three thousand uh freemium or twenty five thousand freemium accounts worth seventeen 1700 have converted to paid that 6.8 percent conversion to paid is this a critical focus for you moving forward is converting more freemium too paid um you know it's a focus but it's not the critical focus our uh i mean we are really just focused we believe that every company in the world is going to every company in the world should have a scorecard you know every company in the world should have their own scorecard so we're much more focused on making sure that every company out there has access to a tool for free they can sign up for free they don't need to pay anything and they can control their reputation and that's been a much bigger focus for us to make sure that we create those distribution channels for them to sign up all right alex before we wrap up with the famous five you're sitting on something interesting here potentially pre-ipo company you passed a million in 2015 do you remember what year you passed 10 million run rate um i mean it must have been around i mean it must have been around 2017 i mean i have to again check the numbers but i would i mean i would assume it was around 2017 right like it was a fairly typical like it was a fairly typical story right like triple triple double double double so i think we did i think we did uh i think we did a couple of million in arr in 2015 then we tripled right like to about six or seven and then we doubled uh rapidly so that was kind of like a good trajectory for us yup no that makes sense the reason i'm asking is i'm trying to back into what a revenue multiple you raised at uh in 2019 so it sounds like you were around uh what i mean you were like a 30 35 million run rate in 2019 30 35. yeah something around that yeah but healthy growth you think you'll grow 50 from 71 million this year end of next year you'll think you'll break what 85 90 million are no we're gonna exceed it we're gonna break a hundred next year yeah i love it look at this guy's confidence he's just looking right in the camera said we're breaking 100 next year do you file to ipo next year do you think it's 2023 i mean we are being opportunistic we are well funded we're sitting on plenty of cash we're optimizing the company we're increasing the shareholder value we're not in a rush to do it because for us ipo is just a branding event at the end of a day but look we're sitting on plenty of cash we bid competitors a lot a lot of time we're taking away customers from them we're growing faster than them we've got a better more innovative product um i think within the next couple of years we'll be strongly contemplating to do it next year but within like you know 18 to 24 months we'll be strongly considering it folks you heard it here first alex let's wrap up with the famous five number one favorite book i love good to great by jim collins number two is there a ceo you're following or studying um [Music] i mean look i study everybody right like i like to study everybody um um [Music] i mean i love the work that kevin ryan does he was my boss of guilt he founded mongodb business insider i'm a big fan of kevin so so yes i talk to him i follow him number three what's your favorite online tool for building security scorecard what's my favorite online tool for building security yeah like pendo is a good example but name something else um i use evernote a lot every day i start i use evernote to organize my thoughts and how much sleep do you get every night not nearly enough right i usually go to sleep around 11 to midnight and i get up around 7am so about seven hours of sleep and fair uh situation married single kids uh merit uh two kids a boy 12 years old and a girl 10 10 years old so they keep me they keep me busy excited and occupied and and she's quite the trick-or-treater you should you shared with me before the show and how old are you alex i'm 40. 40. last question something you wishing you knew when you were 20. something i wish when i was 20 well uh at the time i wasn't dating anybody so i i wish i wish i would have met more people back then guys security scorecard the standard and understanding if your site is at risk or not and how good you're doing private equity firms use it over 1700 paying customers use it paying average forty thousand dollars per year paid up front they'll break a 72 million run rate this year up fifty percent year over year they broke six million run rate back in 2016 10 million 2017 30 million 2019 fast trajectory here as they focus on adding additional modules to help founders beef up their security 115 net dollar retention and growing rapidly feels very good about breaking 100 million bucks in ar next year alex thank you for taking us to the top thank you one more thing before you go we have a brand new show every thursday at 1 pm central it's called shark tank for sas we call it deal or bust one founder comes on three hungry buyers they try and do a deal live and the founder shares back end dashboards their expenses their revenue arpu cac ltv you name it they share it and the buyers try and make a deal live it is fun to watch every thursday 1 pm central additionally remember these recorded founder interviews go live we release them here on youtube every day at 2 p.m central to make sure you don't miss any of that make sure you click the subscribe button below here on youtube the big red button and then click the little bell notification to make sure you get notifications when we do go live i wouldn't want you to miss breaking news in the sas world whether it's an acquisition a big fundraise a big sale a big profitability statement or something else i don't want you to miss it additionally if you want to take this conversation deeper and further we have by far the largest private slack community for b2b sas founders you want to get in there we've probably talked about your tool if you're running a company or your firm if you're investing you can go in there and quickly search and see what people are saying sign up for that at nathanlacka.com forward slash slack in the meantime i'm hanging out with you here on youtube i'll be in the comments for the next 30 minutes feel free to let me know what you thought about this episode and if you enjoyed it click the thumbs up we get a lot of haters that are mad at how aggressive i am on these shows but i do it so that we can all learn we have to counter those people we got to push them away click the thumbs up below to counter them and know that i appreciate your guys's support all right i'll be in the comments see ya

hello everyone my guest today is alexander yampulski he's a recognized expert in the security field running his company security scorecard dot io he's which is the leader in security ratings used by hundreds of customers hundreds of customers like ge mcdonald's pepsi and many others before founding the company he was ciso at guilt group and has held lead technologists and security roles at goldman sachs oracle cinch cast and microsoft he's a published author and active speaker in the security and software development communities and has a phd in cryptography sorry cryptography from yale university all right alexander you ready to take us to the top it's a pleasure to be here yeah i was gonna say like vladimir putin's your best friend every time there's a hack people pay you more money that's how it works well cyprus cyber security is a hot space right now so customers are looking for good solutions all right so tell us what you do and how you make money is it a peer play sas model yeah so we're an enterprise sas company and the idea that we came up with is that the market is moving to the cloud and so companies do business with other cloud companies you might store your files in dropbox you might store your sales leads in salesforce and when companies do all these relationships how do you know that your cloud providers are being as diligent as you are when it comes to protecting your data and we came up with a way of how to non-intrusively from outside measure a security posture of any company in the world and give them a score card a rating or letter grade a b abcdf representing how secure they are well you're basically trying to hack them and if you get in you say you fail so we look for signals that indicate to us whether or not the company is doing a good job for example imagine you're looking at a website and on the on the front of a website it says copyright 2008 well it's 2018 so you just discovered that the company has not updated its systems for 10 years and so we came up with hundreds of different signals like this uh many of them are much more sophisticated than what i just described that indicate what's going on within the company i mean so your your sales tax there obviously works why don't you just email everyone and say you're vulnerable right like it's a fear tactic thing they're all gonna they're all then gonna buy well i mean i think that uh fear uncertainty and doubt is a common technique for many security startups we don't subscribe like we don't subscribe to to this approach we want we want our customers to recognize value from a software that they use so the way that people use us it's a software as a service you pay us annual subscription and how much how much on average per year so on average it's uh two thousand dollars per year to monitor a single company so but you know big companies have tens of thousands of vendors so some people are paying us a million bucks a year some people are paying us twenty thousand so what's that would you say averages though just to avoid every going down every customer cohort you know every contract value could be around 80 to 100k uh per year paid up front okay got it very good but people use us to monitor their suppliers some companies are using us to compare themselves to the industry to competition and prove to the board of directors that their security investments are paying off cyber insurance companies are using us to make underwriting decisions so this concept of security ratings is really beginning to gain traction and just like we have credit scores the security scores have become an integral part to doing business today and how many customers have you scaled to so we have over 450 customers and rapidly growing uh every single year okay what's rapidly growing mean doubling in size doubling okay i mean if i take 450 customers times the acv 80 grand you just told me i mean you're doing north of 3 million a month is that generally accurate um it's it's in a ballpark it's in the ballpark of where we are yeah we're growing very nicely 130 people headquartered in new york growing very rapidly this year okay but i mean that number i mean sometimes people give discounts to their early customers sometimes sometimes that number is high i mean have you guys passed three million a month in revenue or are you below that when the 25 to 30 million arr this year got it okay that's you'll hit that this year or you passed 25 million already we are on way to do it this year on a way to do it okay so if you're doubling year over year that means last year you did what 12 and a half at least or 13. yeah around that number we're growing very nicely that's good what's driving most of the growth are you driving expansion revenue across the current base or adding new customers net new customers so it's both uh you know we are the way that we see a lot of customers use security scorecard is some customers naturally a lot of people say well how how can you really measure security of a company from outside are you really going to be able to see detailed information and when people start looking at our technology and they start deploying and they realize that they instantly gain visibility to tens of thousands of companies who are uh who they're doing business with and that will ultimately help them save time and money and that as a result grows more adoption so we see in lend and expand out of our existing customer base people are happy our net promoter score is in the is in the 60s so like people really like what we do and customer satisfaction is very high what's churn the churn is under 10 percent and that's gross logo churn per year no if you factor in if you factor in the upsell we're we're negative like we're win in the negative double digits people are people are buying a lot more so just be just to be clear annually you're churning at a gross level 10 of revenue when you add back expansion you're net negative we're not 15 like we're around net 15 percent negative negative negative 15. correct or set or said differently you're retaining 115 of your revenue correct yeah okay got it uh that congratulations by the way that's obviously not an easy thing to do so that's good stuff talk break down your team for me of 130 how many of them are inside sales well um i would say roughly half of our company in the product technology we're win engineering driven company we believe our vision as a company we want to create a new language for how companies talk about security so we want chief risk officers board members cfos regulators we want them to start using scorecards as part of an everyday dialogue we want people just like people bake into contracts 99.9 uptime requirements we want people to start baking into contracts minimum scorecard requirements uh and that's the vision we're trying to create and so half of our company is dedicated to product and engineering because we believe that ultimately i mean if you have crappy technology and really good sales and marketing team uh that's only gonna last you so long if you have an amazing technology and crappy sales marketing execution then like people are still gonna value your technology yeah like like luckily we have good technology and good sales market and execution but we're dedicating um quite a lot of people in a company towards uh towards product innovation how many how many months does it take you to get back your cac on a customer you know customers customers pay us upfront so you know and given the retention rate that we have uh you know we see in we see in very good economics metrics i don't want to just close it but you know we seen very good efficiency okay but in terms of payback period i mean it sounds like you're south of six months if they're paying you all up front uh depends we're we're we're under a year okay that's fair enough under a year um and when you do so and just to be clear if you're under a year and average acv is 80 grand it means you're willing to spend up to 80 grand to acquire one of these customers where are you spending that typically we see very good network effects out of what we do because if you have a company if you have a company who is using us to monitor 10 000 plus of their suppliers naturally those suppliers also want to know what their scorecard is they want to know how to get better they want to know how to how to improve for example suppose you have a very important marketing relationship and uh that marketing relationship says i'm going to put in 2 million into nathan's podcast but we're concerned about your security well it's going to be an incentive for you to sign up for security square cut because you want to make sure you're protected so the very strong network effects that we see in we've seen good return on investment from conferences from events for example we did a big splash at rsa we launched a new product recently called bridge insights that nobody else in the market has that measures concentration risk we spend heavily on events and just brand recognition how much a year on events would you say more than a million i'm sorry saying them how much it per year on events would you say more than a million yeah we're spending more than a million on the best and then last economics question here before we move on to more of your story lifetime value what do you assume lifetime value is i mean we see in look i mean we see an ltv to cac over over three which is good in the enterprise space yeah so if your cac is 80 grand you're saying more than 240 grand in ltv yeah for sure yeah um interesting okay good tell us more about the back story here so what your launch company in so we launched the company in the beginning of 2014 and the story is that i was a chief security officer at guild group and one day we were looking at a solution that helped mitigate e-commerce fraud it was a software as a service that helped mitigate e-commerce fraud it would look and say hey nathan today is logging in from new york buying two hundred dollars worth of clothes but all of a sudden you in austin texas buying a thousand dollars something is suspicious and so it was a very good solution and we had to integrate our systems with that and we looked at the contract we looked at the penetration test results everything looked great and literally at the last moment when we started integrating with that company we looked at their systems and we discovered unencrypted credit card data floating in their systems and that was an oh moment for me because i realized i could lose my job as a chief security officer due to negligence of somebody else and the question uh really stood out to me the question that nobody in a market is thinking about how to measure security there's got to be a way to come up with objective metrics that measure cyber security and that's what we came up with and we launched the company in 2014 spent most of 2014 building a product and uh saw some very good adoption uh since then and you've bootstrapped if you raised we've raised the venture money how much uh so to date we raised a little bit over 60 million dollars the seed was led by evolution equity and bold start ventures great investors then we did the series a by sequoia capital series b by google ventures and then the series c was led by nokia growth partners intel aksa and moody's participation was when was the series c it was uh it was around october of last year okay and how much was the series c it was 27.5 million 27. okay have you broken 250 million dollar evaluation yet uh so we are flirting with that we are flirting with that valuation yeah i mean right now right now given that we made more headway we should be we should be above that valuation right now so are you planning to raise again this year i mean or do you want to get to break even and cash flow positive so we're in a good position where most of the money that were raised is still in a bank so we don't need to like we don't need to go raise any time soon um right now we focused on growing the business right now are you cash flow positive today or no no we venture back so we're not cash flow positive but you just said all the money is still in the bank yeah a lot of our money is still in the bank we have a very strong quarters we're having very strong quarters with very good cash flow uh like most of the money that we raised is still in a bank we don't need to raise uh yeah but alexander you understand how those two things can't be the same right you can't say all your venture money is still in the bank but then also say your cap your cash flow positive well the money from serious c meaning uh got it yeah that's that's what i mean uh you know we we didn't have to raise the series c front also so we have enough money for multiple years uh we're not planning to raise any time soon uh but you know we focused on growing a business and really unlocking the massive opportunity here there's a lot of companies that are kind of in i would say maybe a tekken is from a different angle like no before comes to mind stu and he's kind of going at it from bottoms up approach and it's not necessarily a rating per se but there's a lot of companies that i could see where it makes natural sense for them to try and make you an acquisition offer if someone came and offered you 500 million bucks for the company do you sell well i mean i talk to everybody i talk to customers investors strategic partners you always talk to people uh but you know our focus right now is we want to create we want to recognize our vision as i mentioned our vision is to create a new language for how people talk about cyber security if you think back to kind of like a interesting business analogy if you think back to henry ford henry ford's innovation was not the fact that he came up with a low-cost automobile or that he pioneered a very efficient assembly line henry ford's innovation was the fact that he envisioned a society where many regular people will be automobile drivers like people didn't drive automobiles only rich people could afford automobiles and so henry ford envisioned when many people all over the world will be drivers and so we're envisioning a similar world where cfos chief risk officers general counsels i use enough scorecards to measure and quantify risk and this world doesn't exist today but we're marching towards that vision and um that's really a goal that's what we're focused on all right very good i like the vision let's wrap up here with the famous five alexander number one what's your favorite business book sure so uh one of my favorite uh business books is uh behind the cloud by uh by mark benioff about how he created salesforce it's a very good book where he talks about the history of salesforce many of the tricks that he used to build it and that's one of my favorites number two is there a ceo you're following or studying right now sure well i'm a big fan you know i'm a big fan of elon musk i think that he's a very inspirational guy he's a very smart guy i met him a couple of years ago at a sequoia capital offside and i you know i learned a lot of interesting things just from a casual conversation with him uh when i asked him how does he know that what he's working on during the day is really making a difference he said to me at the end of each day he reverse engineers his day and says how did i spend my time which meetings did they attend who did they speak to were they things i could have delegated were the things uh that i shouldn't have been doing and that was uh very good advice so yeah elon musk is one of my uh favorites number three what's your favorite online tool for building a business so i like to use evernote i i'm a big fan of uh i'm a big fan of evernote how i start each day and each week is i basically create a list in the beginning of which week and i say here the three most important tasks that i need to get done this week and here are the batch tasks that i just kind of need to get done but you know they might not be as important and i always ask myself if i do these two or three things how am i gonna advance the vision how is the company gonna be better and i love like so i use evernote religiously every single day number four how many hours of sleep to get every night so uh it changed i used to like i used to be a big believer that i should work as much as possible but you know you realize as you get older that you need balance so i try to get seven to eight hours of sleep i typically go to sleep around 11 to midnight and i wake up at 6 a.m uh and you know you always want to have a good lifetime balance and what's your situation married single you have kiddos married and uh two kids nine year old and a six-year-old oh good and how old are you so i'm 37 37 okay last question alexander take us back to your 20 year old self what do you wish that he knew yeah so that's a you know that's a kind of you know that's a that's a good that's a good question so there's a there's a good question somebody somebody asked me that question once uh the person asked me what do you think is a job of a goalkeeper in soccer and i answered well uh you know the job the job of a goalkeeper is to prevent the other team from scoring and the person said no that's wrong the job of a goalkeeper is the same as it is for every other player in the field it's to win the game it's not like it doesn't matter if you're a soccer player or goalkeeper you all a single team you will work towards the common goal and so one thing i would give advice to myself if i met myself at 20 think more about how to build cohesive teams how do you get people to follow you how do you get people to work together it's a bit of a cliche advice advice but high performance teams are what make or break a company it's a huge huge difference guys there you have it from alexander focus on your team he launched security scorecard back many years ago after he realized a big vulnerability at his prior company and said wow i could get fired for this i've got to create a standard he's now focused on creating the standard security metric which hopefully gets used by many many companies launched in 2014 today he's working with over 450 customers uh doing north of uh 2 million bucks per month in revenue hoping to break that or sorry hoping to break that 25 million ar mark later this year doubling year over year so healthy growth uh net negative revenue uh churn which is obviously a healthy metric to be at 80 000 bucks on cac is a max 12 less than 12 month payback period lifetime value to kak obviously super healthy with a team of uh 130 people based in new york alexander thank you for taking us to the top thanks nathan