What’s next for cybersecurity, according to Index Ventures’ Shardul Shah

0:00This episode of Equity is brought to you by Schneider Electric. Schneider Electric, your energy technology partner.

0:06Alex Wilhelm: Hello and welcome back to Equity TechCrunch's flagship podcast about the business of startups. I'm Rebecca Balan and this is the episode where we bring on industry experts to help us explore a trend in the tech world and dive deep. Concern over AI safety and rogue agents has sent cyber stocks rising in recent weeks and led to a surge of investment in new startups promising to solve novel cybersecurity issues. We're seeing nine-figure checks and valuations that wouldn't have made sense a few years ago. Nobody understands this better than Shardul Shah of Index Ventures. Shardul was an early investor in Wiz who led the cloud security startup through its monster$32 billion Google acquisition.

0:42Alex Wilhelm: And he's got an eye towards what new cyber categories will emerge in the near future.

0:51Alex Wilhelm: Shardul, welcome back to the show. Thank you, Rebecca. Appreciate you having me. Yeah, nice to see you again so soon. We ran into each other at a dinner you were holding. Index Ventures was holding a couple of days ago, or I guess at the time of this recording, last week. So I'm really excited to chat to you about some of the things you've invested in and what your thoughts are on where AI is going and how it's affecting the world of cybersecurity. So just to back up a little bit, you have been at Index Ventures for a while now. You joined in 2008? Yeah, it's been almost 20 years. And I must say, Rebecca, you're one of the best dinner guests we've hosted.

1:30You're very engaged. So I encourage others to invite you, too.

1:34Alex Wilhelm: Yeah, I have a tendency for waxing a little philosophical. So I'm glad everyone humored me. It was a fun discussion. Yeah, I think it was a good discussion and really nice food. So thanks for that. So you've covered a broad range of things, right? Cybersecurity, AI, enterprise software, infrastructure. You also came on equity. Our listeners recall your voice or your face back in March when Google bought Whiz for $32 billion. So we've got a lot to catch up on since then. I would love to hear a little bit about some of the other cyber bets that you've made recently. Yeah. And so much has changed since we last met.

2:11I think if you sum up the market caps of public companies, it's close to a trillion dollars of valuation exposed to cyber companies. And I think that speaks to the permanent, resilient need for security that's only growing as there's more technology in the world. So I think it's really relevant to think about not cyber as a cycle, but if AI represents a new category of security. Hmm.

2:40Alex Wilhelm: I mean, there is kind of a cycle we're going through at the same time. I mean, maybe that's not the way you want to think about it. But, you know, we had recently Daryama Day's letter about pacing the frontier. A lot of, you know, researchers are quitting these firms saying that they're concerned about, you know, mostly extinction events. But there's also this, you know, a lot of that is or can be manifested, I think, through cyber attacks, whether that's humans using AI to perform cyber attacks or AI that kind of goes rogue and loses the plot. So it's like AI is simultaneously creating this cybersecurity crisis and a cyber investment boom at the same time.

3:18And I mean, you have a good eye into Wiz.

3:22Alex Wilhelm: How has their day-to-day, if you're aware, changed over the last few months? Yeah. And just before getting into Wiz, I think one of the things I learned about you at dinner was that you have a good eye for philosophy. So I'm curious, have you watched like Dr. Strangelove? No, I haven't. So Stanley Kubrick, like 1946, had this incredible satire, right? It's a kind of psychotic general who has the ability effectively to end the world. And my call is for Christopher Nolan to remake Dr. Strangelove because we're back. And, you know, satire aside, I think you pointed it out that on one hand, there's always a security need to protect ourselves from ourselves.

4:14And second, there is a security need that's born from adversaries that have an incentive. And so I do think it's appropriate to think about WIS in so much if we bring it not to 1946 to this decade. Ami, the co-founder and CTO of WIS, talked to me about this from the beginning of the business, which is how do we manage both of those needs for security? And so I think it's really prevalent. And I think it's the beginning of how this AI security category is actually going to be reshaped.

4:46Alex Wilhelm: Okay, I gotta I gotta check out some Dr. Strangelove then. I mean, it's like a word. You hear that that phrase or I guess the movie title before, but I've never actually looked into it. It's worth the watch. Maybe we'll have like a film event. Yeah. Yeah, that'd be cool. So, okay, so it's bringing about a new category of cyber. You've invested, you or at least Index has invested in companies like 7AI, right? They do AI security agents. There's Frame. This is AI enabled human risk and security training. Stop me if I'm wrong about any of these. Yeah. Core, which gives identity for agents, Apex. How do these embody this shift that we're seeing?

5:22Yeah, so take a big step back. You're a decision maker at an organization, and you're thinking about managing risk in your business. I think the first thing to actually do, and if any listener is on the board of any company of any size, my advice would be to try to offload some risk. And the way to do that is through cyber insurance. And so I am on the board of a company called Coalition, but I'm not trying to talk my book because if you make a considered purchase of cyber insurance, you have to go through a broker, and that broker is going to help you choose the best solution that fits for your organization.

5:56But I think that's the first thing to do. The second is to think about people, process, and technology. And so if you get to technology, you start to think through choices between incumbent vendors and startups. Now, again, as a mere venture capitalist, I'm very biased around startups. And the way I think about most incumbents is they're selling parachutes that are made of patches with kind of sketchy stitches. So it might make you feel good to have it on your back when you jump out of a plane. But gosh, like your life is in a little bit of danger. However, it's not so easy because again, if you're a decision maker, you're getting pelted with pitches from a thousand plus security vendors.

6:44And it's so difficult to appreciate the distinction between snake oil and a real solution. And so it's really challenging to actually think through risk management, but I think it starts with insurance and then it actually begins with people in process. I'm happy to talk about any of the companies that you alluded to or others, but I think that's a really important step back framework.

7:10Alex Wilhelm: I didn't even know cyber insurance was a thing. Like, I mean, I guess it doesn't surprise me that it is. But would you say there's like a whole industry based around this kind of need? You know, I love my mom, but I probably really didn't think about sunscreen until I was an adult. And so, you know, there are like basics that are really healthy choices to make that some of us don't encounter because of whatever circumstances that were brought in. And that's how I think about cyber insurance. Eventually, it may become compulsory or even mandatory. But ahead of that, I think it's worthwhile organizations thinking about the prudent choice of just offloading a little bit of risk through cyber insurance.

7:56Alex Wilhelm: And which companies are doing this? Coalition, which also recently bought like Allianz's cyber insurance business. So you have massive companies in the world like Beasley and others that are providing insurance to all sizes, all industries, all geographies. Yeah, I mean, this just furthers the point that there is a lot in like AI is really creating the next cyber boom, right? And it's taking some interesting turns, right? We're seeing cyber stocks start to surge amid, you know, concern around advanced AI, CrowdStrike and Palo Alto networks were at the time of this recording doing pretty well, but who knows what the market sentiment on the day that this gets published will be.

8:40Alex Wilhelm: So Index, just to take a step back, Index raised recently, what was it,$2 billion across three rounds. So I think you've got 3.5 total capital going at the moment. Yeah, that's about right. And that's following Wiz's exit, which you guys did great with. You had like, what was it, like a 12 % stake worth about$3.8 billion, if my homework is correct, at the time of the sale. You're close, a little shy, but that's okay. A little shy, okay. Yeah, don't be too modest. So how much when you're when you're thinking about like allocating funds, like how much in the next few months are you trying to find new solutions for cyber?

9:20Yeah, I'll try to take the question in two parts. First, when it comes to cyber, we do try to invest in platforms. Ultimately, we think enterprises want to partner with platforms, not point solutions. And these are businesses that have multiple use cases for multiple people and multiple product areas over time. 70EI is a great example of this. And that's a company that's aiming to be the foundational security company. And they build as an AI-native business from the get-go. Again, that's really important and different from incumbents. And it's analogous and it rhymes with whiz, how they started from the get-go as a platform with a point of view around cloud, although that category had existed for a decade.

10:09So I do think startups have a natural advantage in how they build themselves. Second, to your point, there are existing categories like identity, where in the past, organizations would think about managing human identities. And today, they manage both human and agent identities. And so our belief is there's a new platform that's required that has new primitives to manage agentic identities, which operate very differently than human identities. And thus, new core is born. Or alternatively, we believe entity risk, human and non-human entity risk, is different today than in the past. And so Tal Shlomo, who came out of Wiz and created Frame, is really relevant for this new age.

10:56That said, it might sound like we're really intentional and thoughtful and thematic about how we invest in security. But the truth is, as Index, we invest almost as a collection of artists, right? We have the seed fund, a venture fund, a growth fund. And these are the three families that you allude to that add up to$3.5 billion. But it's the same group of individuals who are investing across the three. And our objective is to be the first investor in category-defining companies. And that's the starting point. How we get there, the craft of investing, whether it's thematic or a view on a business model or most often a view on a founder is very personal to each investor at index.

11:45And so we don't step into a new fund with the view on how are we going to allocate capital by sector, right? It's more organic and a little bit more chaotic.

11:58Alex Wilhelm: It's interesting. Okay. So it's more organic. It's based on the founder. You mentioned Frame, which the founder came from, Wiz. I wonder if you're because of Wiz becoming such a powerhouse in this space, you know, that will lead to others kind of branching off from that company and starting their own startups. You'll almost immediately have a connection with those founders and you'll be able to do your due diligence and know if they're, you know, worth investing in, if they're interesting founders. You know their pedigree already. I guess what I'm asking is, do you imagine that Wiz will become sort of a, like a PayPal, a Palantir, if you will, in terms of being one of those category-defining companies that spawn others within the category?

12:45Yeah. Well, the founders of Wiz, the first business where I had the opportunity to serve on the board about a decade ago, Adelum, actually had companies that came out of that talent pool to start new businesses. Armis is one terrific example of a company that's enjoyed great success after the team left Adolam. Wiz is, to your point, somewhat similar because Asaf, Ami, Yanon, Roy, the founders of Wiz attract really ambitious entrepreneurial individuals and they celebrate their growth and impact in the next leg of their career and journey. And to your point, we also invest in a business called Enigma.

13:25Jonathan Jacoby was a member of the Wiz team and he's working on a robotics foundation model. When we invested in this business, we actually shook hands before the company was incorporated, frankly, before we knew what they were going to do. They probably had an idea, but I certainly didn't imagine myself as a robotics investor. And here we are. And so I do think Wiz is unusual in so much as there's so much density of entrepreneurial talent that I do imagine that talent exploring new adventures. And even on the commercial side, I think it's amazing that Dolly Rajik, who ran Go to Market for Wiz, is now the CRO of OpenAI.

14:10And I think that was an absolute coup because Dolly is really the best go to market leader on the planet. And so you're absolutely right. Wiz attracted a real dense talent core. What moves our world forward? Energy. History has been shaped by it, revolutions won with it, and progress dependent on it. For 190 years, Schneider Electric has been a leading force in this story, creating the technologies that harness energy and transform the competitive landscape. And today, in the dawning era of energy and industrial intelligence, Schneider is helping customers build more efficient, resilient, and sustainable operations across every sector, from data centers to homes, from buildings to industry.

14:52Schneider Electric, your energy technology partner. Discover more at se.com.

15:00Alex Wilhelm: I mean, just picking up on this thread a little bit, you're what is like you never thought that you would invest in robotics, but what is it about a founder? You kind of want to ask this to every investor, but they all roughly say this similar things. But I'm curious, maybe I'll say something interesting. What is it about a founder that draws you to them that makes you think like, OK, I'm going to invest in you? Like I'm going to not only invest, but I'm going to follow on like before you even close this round. We're going to talk about the next one. Yeah, you know, you used a word that was pretty specific and I wanted to disagree with.

15:33I think just because I know of someone doesn't mean we connect. So actually, the first time I met Jonathan was over Zoom. And I told him, I don't make investment decisions over Zoom. It turned out we had some health stuff in the family. Jonathan has got a really warm heart. And so he jumped on the next flight to see me in New York. And on Saturday, we spent the day together from 6 a.m. to 2 a.m. What happened in that sprint over the weekend? It's a little bit of that je ne sais quoi. You can't put your finger on it. I think often investors label it as intuition. It is a sensation. It's a feeling.

16:14However, we do try to rationalize it, both to ourselves and typically to our partnership, in order to exercise judgment. And I actually think that it's like it's super interesting and dangerous to rationalize because sometimes we're too smart and we talk ourselves out of really deep conviction. And so I think rationalization for me is very useful to pressure test and feel my intuition because I'm not always like in my body. I'm often in my head. But at the source of it, I think it is that it's like a strong sense of intuition.

16:51Alex Wilhelm: Okay. So it's a gut feeling. I think so. The second part of what you said is a really difficult art, right? Which is, I think the question was like, how do you choose when to double down? And so with Wiz, we did lead, co-lead six consecutive rounds of investments. And that was at the time, the largest investment in aggregate that Index had ever made. But we shouldn't confuse the outcome with those individual decisions, right? In the moment, I did feel fear. Like it's really scary every two months to come back to your partnership and say, I actually know more and want to invest more. And your partner's like, what else could you possibly know?

17:31It's only been two months and one month was like December. And so it's actually really challenging to make that judgment call. And we've failed to make that judgment call in many circumstances because we often underestimate the magnitude of the largest companies in the world.

17:51Alex Wilhelm: Yeah. And I'm sure like, you know, there's been plenty of times where, you know, you make that bet and it doesn't work out. And someone, you know, that you thought was a great winner ended up not being one. Yeah. And in venture that happens more often than not. Right. And so there's a degree of either delusion or masochism or confidence. I don't know why. How do you even trust your own intuition? If you get, you know, if the spaghetti falls off the wall more often than not. Yeah. And I think you and I debated this at dinner too, like optimism, skepticism, cynicism, you know, how do you apply a combination of optimism and skepticism to arrive at judgment without falling into the trap of cynicism?

18:30But how do you learn from mistakes you make in order to avoid making the same again? I think another, and this is a bit of a detour, but I think another mistake investors often make is to try to pattern match. I actually think there are no patterns and pattern matching is a fallacy. And so it, again, almost creates a prerequisite to trust one's intuition. I hope that was different from what other investors have told you.

18:55Alex Wilhelm: Yeah, it was definitely interesting. I'm thinking about it through the lens of like, if I'm a founder listening to us, I'm like, am I gonna learn exactly how to get investment from index ventures and it's like well you just yeah I think your intuition is probably telling you I mean you've been in the game long enough right so so that's you are seeing patterns whether you recognize it or not or whether you want to call it that or not but there's clearly something you're seeing that's going to make you um want to invest in someone and so yeah I think just like time in the field will really give you I mean it's the same as news judgment in a way, right?

19:28Alex Wilhelm: It's like, well, how do I know when something's a story and when something's not? I mean, I might be wrong, but sometimes I write something, I think this is definitely a story and no one's going to read it. But I'm not sure. So first, I think most entrepreneurs may not want to work with me and that's okay. Like I'm not a visionary. Often entrepreneurs want to work with someone who has a shared belief on where the world is going to go. And that makes a lot of sense because you don't want to kind of re-litigate your set of beliefs. You don't want to constantly have friction with convincing someone of the future state in the world.

20:01And so you want alignment around shared vision. I'm not a visionary. And so if entrepreneurs want a visionary, and I mean this with great respect, they should go talk to Vinod Khosla, who can see the future, right? I seek belief in people because some of the best companies that I've invested in, they pivot. And for me, it's belief in a person. And I don't fall in love with my own belief of the future state that really matters in the business. That framework is not relevant to every entrepreneur in the world, but I'd be delighted for them to know to disqualify and not spend, you know, spend their precious time trying to convince me of something that doesn't make sense for themselves.

20:43Alex Wilhelm: Yeah. Whether or not you believe in, you know, or think that you have like a strong vision of what you think the future is going to be, you know, you're placing bets every day. and we're in a world... No, hopefully not. That would be too fast. Not every day. Even in today's environment, that would be too fast. That would be too fast. Well, you're placing bets on a regular basis. And, you know, we're living in a world where the future is increasingly uncertain, right? And I think that's why you're seeing a lot of funding gravitate towards, you know, these cyber companies, right? That are trying to, I guess, give enterprises or individuals a little bit of hope that something will be okay, that like they're protected for the oncoming wave, right?

21:25Alex Wilhelm: We saw, you know, recently 100 plus companies warned that AI-enabled attacks will soon become more widespread and more sophisticated. And, you know, we saw GBT Astra crossing this critical cyber capability threshold so it can autonomously find and exploit previously known vulnerabilities. So I think it's pretty clear, everyone's pretty clear on the fact that AI is changing cyber and it's making it like a game of whack-a-mole. But what existing security categories do you think might be getting destroyed by AI? You know, I think we need to very quickly evolve to a world of continuous security. And so there have been categories that are periodic.

22:15An example of this is security testing. Today, it's regulated for public companies to get periodically tested against security controls. And how it works is usually you get like an agency, you get a team from that agency, they give you a report, and you may or may not take action on that report. But a board of directors will look at that report and ask you, why are you A, B, C, or D, or a number one through 10, and ask if you want more resources to improve your score, right? But that world of discontinuous security does not exist going forward. So will external pen testing evolve? Absolutely. And there's a field of emerging companies that are oriented.

22:59That's like one idea that comes to mind. Second, I think that to your point, the adversary landscape has evolved. So adversaries can consist of like nation states, of criminal syndicates, of individual hackers. And they have access to different technologies and different resources and infrastructure in order to launch attacks. Those attacks might be politically motivated. They might be economically motivated. So there's different people with different incentives that are part of this adversary landscape. What has happened because of the advancement of AI is more adversaries can launch more sophisticated attacks with less money.

23:45imagine a single individual in a rogue state that launches an agent swarm of 10 ,000 to conduct ransomware attacks across the globe. That's pretty scary. So on the other side, the world needs to evolve to a machine-to-machine cyber war state. If a human is in the loop on the defense side, compute or cost will drive an overwhelming force. Therefore, any human-in-the-loop-oriented security business needs to evolve. And I think that's the core of the thesis behind 7AI, as well as, again, an emerging set of companies. There's a new stack that will form. There might be security foundation models. There might be security defensive swarms.

24:35There may be new services or organizations that can collect data in different ways or leave behind information in different ways in order to make the economics of an attack more costly for adversaries. And so I do think it's a super interesting question because there will be massive shifts in how defense operates.

24:53Alex Wilhelm: Yeah, definitely. So new categories appearing for sure. What do you think will make an AI security startup defensible when the underlying models keep improving? Well, it starts with the people. Again, not to be cliche and simplistic, but it's a true belief. It starts with an ambition, the ability to identify a team and motivate that team to go on this irrational journey to start a company. Most companies will not succeed. So it's completely irrational to start a business. It's actually irrational to join a company. And it's probably even more irrational to invest in it. But we're all in it together.

25:28Yeah, we're all mad here. So it starts with the people. I get attracted if I try to use my rational brain and not just give you the je ne sais quoi. I think I'm attracted to individuals that can hold contradiction, right? And so how do you create a service that's easy to use but is extraordinarily sophisticated? Because ultimately, I think the best companies will build platforms.

25:53Alex Wilhelm: Yeah. Okay, so what does the next Wiz look like? I try not to compare companies to Wiz. I actually learned this lesson from Datadog. Datadog is a wonderful business. I still serve on the board, but it made me a bit of a snob. And I'm worried on the back of the incredible journey that we experienced at Wiz that I become a snob again. Like snob, because you're like, I picked a winner. Well, no, it's not. I mean, I happen to be in the right place at the right time with an incredible group of people. It's not about myself. But confusing that with myself exactly would be problematic. I also wanted to switch gears a little bit and ask you, what really makes a good AI investment anymore, right?

26:42Alex Wilhelm: So Index invested in Instinct, which that was a$250 million Series B, I think. I'm just going to rattle some stuff off. That was at a$2.5 billion valuation for a very young company, a very young consumer AI agent company. Then there's Similees,$200 million Series B, Similees doing AI simulations of people for markets and societies. Enigma, you mentioned earlier, they had a$71 million seed round. That's an AI robotics company, seven AIs,$130 million Series A for cyber agents. So these are monster checks early in company formation. And that's just the ones that Index has invested in. We're very early in the whole AI race.

27:21Alex Wilhelm: You guys are putting crazy checks into companies at stages where investors used to need a lot more proof. What do you know that makes those prices rational? Yeah, well, let's take one as an example. And you know June at Simile, so maybe we can start there because you'll be able to ask more pointed questions. The first investment in June was like pretty classic. We had deep conviction in a team that had the moral authority to build in a category that we thought would be important. And then we learned, because we're really close to the business and we had more context than I think anyone else, that there was incredible market demand across geographies, across verticals from some of the largest companies in the world.

28:09And I hadn't seen that amount of market demand since the beginnings of Wiz. So that triggered our next investment. And then the market demand translated into business model traction, where they were able to close, not only close large contracts, but also renew, expand multiple contracts, and close even bigger contracts with larger companies in an incredibly short period of time. I was on stage earlier today, so yes, last week, based on the timing of this pod. But I was on stage with Parag at the primary event in New York. And I asked Parag this question of how does he think about the financing environment?

28:54Because he's raised from us multiple times, but also other terrific investors, including First Round Capital, Coastal Ventures, Kleiner Perkins, Sequoia. And he's got an incredible set of investors. And what he shared was he wants to have every customer in the world, but he doesn't want to have every investor in the world. And he believes, he actually agrees with me, that it's irrational to start a company. And what he looks for in investors is an irrational amount of belief.

29:27Alex Wilhelm: Sure. And it turns out when you have an irrational amount of belief. You put forward irrationally sized checks. Exactly. And so that made me feel really good on stage. Okay. So basically, we are just all swept up in this low-key irrational hype. And that's just what it is. It is what it is. Well, I mean, University of Chicago is where I studied. Economics 101, it's perfectly rational for there to be irrational participants in a market. Yeah. Okay. That's fair. Okay. Last question for you. I'm sure we're all still talking about Dario's Pacing the Frontier essay. I'm curious, not that any investor that I have spoken to actually believes that the frontier will be paced, but let's say it is.

30:09Alex Wilhelm: Let's say it does get paced. Could that actually interrupt the assumption that everyone's basing pricing on, that models will just keep getting more capable, compute will keep scaling, and the demand will keep exploding? I think that the technological advancement in the last two years has definitely surprised me. However, the diffusion of that technology into industry, into the hands of consumers, is lagging. As a consequence, if your hypothesis is correct, and we are paced at the frontier, I still think there's a significant lag in the world actually having diffusion and acceptance of existing technologies and capabilities, which are pretty significant.

30:51Alex Wilhelm: Right. So you're saying that even if, you know, we paced, we slowed it down, we stopped development, The existing technology that is out there today, it's so underutilized and there's so much demand that we're not going to see. There will still be money flowing, buildouts happening, people buying. Yeah, I think so. I think the outstanding question then would be, is there irrationality that leads to a set of people who whisper to another set of people that kicks off a bank run, right? And again, this is a topic we talked about at dinner. Yes. Well, you know, before we dig into that extremely anxiety-inducing topic, I will say thank you for joining us on the show.

31:35Alex Wilhelm: It has been, as usual, a very interesting chat. Where can our listeners connect with you and find your work online if they want to get to know you a little bit better? Oh, thank you. It's a pleasure. Next time we won't start on anxiety. And I hope we don't end on it either. I think we probably will. But that's just that's more of a me thing than a you thing. But if folks want to find me, LinkedIn is the best location. I do check it really frequently. And I'm pretty religious about accepting folks that are specific with questions and ideas. That's OK. Specific with questions and ideas, people. All right.

32:08Alex Wilhelm: Don't just say let's talk. Well, Shardul, thank you so much for joining us on the show. To our listeners, you can find me also on LinkedIn and on Twitter. And you can find Equity on Twitter and threads at Equity Pod. Talk to you next time. Equity is hosted by TechCrunch Senior Reporters and produced by Teresa Locansolo with editing by Kel. Subscribe on YouTube or wherever you get your podcasts and find out what's next at techcrunch.com slash events. Thanks so much for listening and we'll talk to you next time.