Gili Raanan - Cybersecurity Investment Playbook - [Invest Like the Best, EP416]

24:47Later, you know, Ohad Pressman, who was the CTO of Chegg, and Eyal Navon, who later became the CTO of Hippo Insurance. Two very successful companies and two very smart individuals. But their first real project in a commercial world was to build the first capture. So we built the first capture. And we tried as hard as we can. And we couldn't find a business model for the technology. And that taught me a lesson. And we had to pivot into something else. And luckily, we pivoted into the web application firewall space. We were the first team to build a web application firewall. That was the path that company, Perfecto Technology, that later renamed into Sanctum, managed to build itself.

25:23And that company later merged with WatchFire and got acquired by IBM. But that lesson of CAPTCHA, that you can invent and build a very impactful technology almost every person on the planet uses, and still you're unable to find a business model for the technology, that lesson convinced me that I was completely wrong about the way I approach my startup. Starting with the technology, and then search who has a problem that that technology solves. The process should be reversed, completely reversed. We should first look at what are the important pain points in a market, find the customers, find who's willing to spend money on solving that problem, and then go and build a solution that mere mortals can use.

26:04And that shift in order, as simple as it sounds, I think that's what made CyberStarts as successful as it is, and that's what helped all those amazing founders really feel the full potential of their talents. We continue to evolve the Sunrise methodology because it's not just around product market field. It's actually a program that takes an entrepreneur from day one, from inception, through the first three or four years of running their business. But the early days of the Sunrise is all around focusing on finding the most important pain point in the market. And you do that by going out and speaking with large organizations, making sure you understand their priorities, what gives them the most, and only that.

26:46Can you describe that piece specifically? in some detail, the tactical method for who you're talking to, how many people you talk to, how often you do, like the real details here. I think it's such an interesting process. So keep in mind that our company is B2B SaaS. So all of them sell to large organizations. So obviously large organizations are the customers and they are who you like to ask the questions. And the best person to ask is the chief information security officer that oversees the security operation for that business. The idea behind Sunrise process is that you're going to chase pain and identify pain.

27:18That requires a lot of smartness. Because if you're going to ask, go out and ask the chief information security officer. This week, what's your biggest pain? You'll get one answer. You ask the same person the same question in a week, you get a different answer. And then another week, you'll get another answer. And they're not playing games. They're just being human. There are other ways to identify pain. For instance, one of my most favorite questions is, who's the vendor you hate the most? because if you don't like a vendor, that's a big motivation for you to displace that vendor. Another important observation is words are cheap.

27:52So don't look at what the customer says. Look at what the customer does, which means if you are running security for a large bank, you probably manage budgets of hundreds of millions of dollars. And if you claim that is one thing that's inflicting a lot of pain for you, you worry about that. You think that your bank is at risk and you haven't done anything about it, probably not as important as you claim. So you probably have done something. You have downloaded an open source package to write out. You put two consultants to develop a temporary solution. You had real conversation with Palo Alto Networks or WIS to see if they can solve that issue for you.

28:29You've done something. So we are asking them not about their opinions, but what they actually did to try and deal with that pain point. Eventually, we reverse the power balance in a conversation because we are not asking for favors. We are telling those organizations, hey, this is a new CyberStarts team. That new team would spend about$100 million in the next three years on engineering alone to build one solution. That's the average for a CyberStarts company,$100 million R &D budget for three years. What is the one thing that you care about that you'd like us to solve with our$100 million? You don't need to spend anything on that.

29:05We are giving you essentially$100 million off balance sheet to solve one pain point for your organization. And I found out that when you give people$100 million virtually, they listen and they think. And then you take those answers and you're not having one conversation or two conversations. I think that to have a statistically meaningful outcome, you need to talk to dozens of organizations. You speak with dozens of organizations and you make a choice. This is the one pain point I'm going to go after. And then you do another round of conversations, assuming you go after that pain point and ask them questions, how a solution would look like.

29:37Because you really like the solution to be loved by the users. And only then, and sometimes it takes six months, only then you start to build software. And if you think about the typical startup, when they get money from VCs, they start to get pressure to build software and push forward and hire people. And my approach is almost the opposite. Sit tight. Don't get too excited. This is your last chance to pick the right problem to go after. So let's make sure we pick right. The outcome is that they build software that solves a major pain point. It's verified with dozens of real customers. And they've built a solution that people would love because they talked to those people before they started to build code.

30:16Now, it doesn't work every team, but as I think I've demonstrated, the success rate is quite high. If I back up now and think about the process so far, it's the identification of these people that have this super resilience history and gene. It's the application of the Sunrise program to start identifying and then ultimately pick a problem that's super valuable using these unique set of questions. What's the next phase? Are these things built in a distinctive way relative to the normal startup that you've observed before, or is it at that point a standard software building exercise? It's a standard software building exercise, but perfectly done because you start on the end and walk backwards.

30:50It starts with the end in terms of value, what value the customer would like to produce with that piece of software. The silence process doesn't end at six months. It's a full simulation of everything you're going to face in the next three or four years as a founder, as a company, and how do you deal with it? then how do you architect your company in the best way to run as fast as feasible in the first three or four years? So if you demo the product and then they didn't take you for product evaluation, why is that? If I tell you, the man from the future tells you that they evaluated the product and didn't buy it, why is that?

31:24We use a lot of simulations that assume failure and forces the founders to really analyze the situation, assuming a failure, and build their company to deal with it. So it's not just about product. It's about go-to-market team. It's about pricing. It's about channel strategy. It's about maybe location of headquarters. Those are many, many elements that are being evaluated, examined during the time of the sunrise. One of the things that is incredibly interesting to me is how you must drive low cost of capital for these companies because of your involvement. I would imagine you've got all sorts of other investors with deep pockets that desperately would love to sort of blindly fund companies that are partnered with you at Seed at the Series A or the Series B or beyond.

32:02How do you help the companies manage their future financing? And how do you think about how aggressive to be on valuation and how much capital you raise and dilution? This is a really interesting part of what you've built with such a high hit rate. We think at CyberStats of co-investors as partners. I don't take them lightly, and we are fortunate to have amazing co-investors that have backed repeatedly our portfolio companies and have tons of respect to their contribution and their support of the companies. Because CyberStats can be as great as we like, but there are other smart, capable, knowledgeable people in the world, and we're happy to get their help.

32:38So we are definitely in the early days, we are highly involved in fundraising and helping our companies to finance their growth. My approach is that it is expensive to build important companies. Important companies are typically not cheap. When I hear founders getting advice like, keep down valuations, make sure you don't raise too much money. My approach is your first priority as a CEO is to have enough money that you can build the right product, hire the right sales teams. That's expensive. So in order to raise enough money, the valuation should be high as well, because no founder would sell 50 % of their company in series A, not in series B.

33:13So I'm all for raising a lot of money, assuming you've built the right product and you have the right team so you can scale and take on the opportunity. How do you think about pricing at seed for yourself? What's the right way to think about this? How much variance is there between the valuation at which you've tended to enter companies? Has that changed a lot since 2018? It almost didn't change in seven years. We typically see two type of deals. So if you like the pricing menu of two items, we see one market for first time entrepreneurs, people who that company is the first experience as founders and executives.

33:48And then there's a different price, a different market for repeated entrepreneurs. What are those prices roughly? For first-time entrepreneurs, we've seen deals that anywhere between the$15 to$20 million post money. And for repeat entrepreneurs, I see a broader range starting from the$40,$50 million range. And sometimes it's going up quite crazy. You don't mind paying it because of the extra information you have about the founder on a repeat basis? I do mind to pay. I've passed on deals where the price went crazy enough. And that's what I'm telling entrepreneurs, that their job is to make sure that they are the most important company in each of their investors' portfolio.

34:30Because at the end of the day, they fight for attention and bandwidth and access. And when the investor ownership goes down significantly, it's hard to become the most important company in a portfolio when an investor owns 5 % of their cap table. High prices, in my view, are double-edged swords for entrepreneurs at the early stage. How many other places do you think, in addition to cyber, this method could be applied successfully? Or is there something still in 2025 really distinctive about cyber versus other spaces that make it by far the most fertile ground for applying something like Sunrise?

35:02I believe that in any field where there's relatively uniformity of buyers, that's applicable. I would assume it's applicable for fintech, it's applicable for gaming, maybe even applicable for medical devices. But you need a fairly active ecosystem, not just from end users perspective, but also from an M &A perspective. That's important as well, because not all your companies would go public. In the past 12 months, we've sold five portfolio companies at cumulative value of$2.5 billion. That's important as well. How would you rate today's environment for prospective returns? Your returns have been crazy high.

35:36Do you think the next five years have the chance for similar returns or have prices made earning those kinds of returns and the market itself much harder? Achieving amazing returns has always been super hard. It would continue to be hard. But I believe that with everything said earlier about the perfect storm in cybersecurity, the introduction of AI and the way it's going to redefine cybersecurity, I believe that the opportunity is there. Obviously, the quality of the talent we see is always getting better. And that's what keeps me so optimistic, just to see the endless stream of smart, eager, hardworking young individuals who are determined to build the next solutions.

36:12Speaking of those individuals, we talked a little bit earlier, I'm just so fascinated by the questions that you ask. As you're identifying these people, and I'm thinking to your time with Mike and Doug at Sequoia, again, famous for asking people about their early lives and whole life stories. Are there any other favorite questions that you have to ask people to understand them as deeply as possible that we haven't talked about? I always speak with founders about their superpowers. What do they perceive as their superpower? What makes them confident that they can win the game? You speak with a founder, speak with an individual.

36:41for a good hour. You've got a fairly good perspective of what you think is their superpower. And it's fascinating to listen to the way they perceive themselves. And I found out that some of the best founders are completely unaware to their superpowers. They're so natural in that. They don't mean to use them. They're just so great at that. And a superpower can be anything. A superpower can be, you're simply the type of person that people are dying to be their friend. You don't notice that. You think that that's a gift everyone has. You don't realize that this is your gift and that's what paved you the way to be successful.

37:14In many cases, the superpower they claim they have is not necessarily the real superpower they have, but it shows you the way they view their weaknesses. Because the superpower they are aware of, they pay attention to, they had to develop it. And they had to develop it in compensation for something else. So that tells you a lot about the person ahead of you. What if you had to answer that question for yourself? First of all, congratulations. You're a fast learner. That's great. A few things, but I would say, let's take self-confidence. It's one answer I would give. I'm sure this is something I've developed over time.

37:45I wasn't natural in that. It took time. And it was as compensation to a very insecure child that grew up in a small town in Israel that didn't feel really appreciated for his talents and didn't feel that he's part of something bigger. And I think only when I was 13 for my bar mitzvah, I got a Commodore 64 computer. That opened up a whole new world for me. I started to get to know people with the same mindset. Speaking about the 80s, I hopped on a bus and went to computer geeks gatherings in Tel Aviv when I was 14 or 15. And I think that only when I joined the Israeli NSA, when I was 18, I really found out that I'm part of something bigger.

38:27I felt that I belonged to that group of people. So we took time to develop that self-confidence. Beforehand, there was always a gap between the way I felt about myself and the type of feedback I got from the people around me. What do you think the hidden superpower is? That's your true number one, but you're not as consciously aware of. My endless hunger. I'm never happy. I'm never satisfied with whatever I achieve. I always look at the next step. I finish climbing on one peak of the mountain. I immediately look beyond that mountain and look for the next peak to climb. It's very daunting because I tell myself it would be nicer if I could just take a rest and enjoy the view from the peak of the mountain I just climbed.

39:05And I find very little satisfaction in that. Where do you find satisfaction? Making impact on people that I really care about. The founders I partner with are people that I really care about. My partners at CyberStars, Leo, Emily, Ilah, Adam, are people that I care about. trying to leverage the past 35 years of being in the different sides of cybersecurity, going through so many different experiences to really make impact on their life. We have the opportunity, given the timing here, to talk about an incredible investment, that of course is the item of the news of the last, I don't know, year in the venture world, an incredible outcome in the acquisition from Google.

39:42We won't talk so much about the outcome as the process and your experience and story of working with the company. We've talked a lot in our interview about why you do what you do, the process by which you found founders, what you look for in them, the process to find product market fit, the Sunrise methodology, et cetera. And here we have the ultimate case study in why these ideas are powerful in combination. So I would love to just hear the story from your perspective. You're right. We is in many ways is the front window type of use case for the cyber starts, the recipe for building an important company.

40:11And for me, the We story really holds many of the key ingredients for building an important cybersecurity company. I'll talk about a few elements. I hope that I'll do that in the right order. But most importantly, I think it's picking a really important pain point and getting to perfect product market fit. If you look at Wiz, the four founders, Asaf, Ami, Roy, Non, I think that the Wiz journey started eight years before founding Wizz in 2012. There was just a bunch of young guys, 27, 28 years old, straight out of the army. Asaf had spent maybe a year with McKinsey, but really inexperienced team.

40:53And they started Adelon, a cloud security company. And that journey was quite short. In three years, they sold the business to Microsoft, joined Microsoft in 2015 and spent five years at Microsoft building the Microsoft cloud security business, brought it to a decent size of a billion dollars in revenue. And then they left Microsoft in 2020. And at that point in time, they were the most experienced team, in my view, worldwide in running a cloud security business. And they started a company which wasn't called Wiz, it was called Beyond Networks. And they had a very, very different idea. They thought to go and secure satellite offices with secure one access, et cetera, you know, some sort of a business that never took off.

41:37And at Beyond Networks, we looked at the customer feedback and it was an important problem for customers, but it didn't have a very important ingredient, which is it was important. It wasn't urgent. And at the early stage, as much as you like to go after large market size and important pain point. The most important thing in my mind is to go after an urgent pain point that generates sense of urgency. And the sense of urgency is almost everything you need as a small venture, because that means that things would happen fast for you. You get to more customer engagements, you learn faster, you improve faster, you'll be able to build your revenue faster.

42:17And we didn't have that with the secure one access idea. And the Wizz team was smart enough to really pivot into a space the new very well, which is cloud security and renamed the company Weez. And we ran our Sunrise program, which is all focused on getting feedback, making sure that we understand the pain point, building the right solution that mere mortals can use. And three months later, they had a product, which would generate a sense of urgency. They spoke with customers and those potential customers, prospects, who wanted to bring them in. And then I learned a very important lesson about the four customer profiles.

42:54When you sell a product, you are going to face four personas. The person that has the pain point, that has the problem, the person who has the budget to pay for a solution to solve that, the person that has the authority to decide on the product or solution, and the fourth person is the person that would actually use the product. Now, as a startup, if those four personas map into a single person in real life, that's a mega hit. And that was the case of Wiz. If those four personas are mapped into four real people, there's one real person that has the problem, one real person that has the budget, one real person that has the authority, and a fourth person that actually used the product, don't do that.

43:37Go and pivot. And if you map into two people, that would be a very nice company. If you're mapped into three people, that's a borderline. You may or may not like to pursue that. So for Wizz, it was a single person. It was the CISO. The CISO has the problem. The CISO, the chief information security officer, had the authority to decide on a cloud security solution. They obviously had the budget. And most importantly, they had the AWS credentials that enabled them to really deploy the product. So Wiz was able to do something very unique just because all those four personas mapped into one real-life person.

44:10And Wiz built a really cool technology. They managed to build a product that during the first call with a prospect, they could ask for the AWS credentials. and within the call show them real value for their own organization, not in a demo environment. And that really accelerated things for Wizz. And in three months, we faced one major dilemma. We could go for a low entry point price product to get a lot of logos and build Wizz from the ground up, bottom up, or what people in Silicon Valley call PLG, product-led growth, or go after very large deals, enterprise deals to begin with, and grow the ARR top line.

44:52Unlike the common wisdom within Silicon Valley, we decided to go for the large deals, scrap PLG, and go for real enterprise deals to begin with. We thought that by growing our top line ARR, we would be better off. We would have real commitment by highly sophisticated customers. we would attract attention from outside investors. We would attract attention from top go-to-market talent, and that would enable us to build a significant business. And while we spent the first 12 months building a product, the next four quarters were quite unusual. The company closed a million dollars in ARR in the first quarter of selling the software,$2 million, I think$8 million, and then$25 million in the fourth quarters.

45:35It was an incredible company from the moment we actually launched our go-to-market for those three reasons. Focus on the urgent, not the important. Build a product that has a terrific product market fit for one person, one real person that owns the budget, the authority, and the ability to use the product. And we went and sold that to large organizations at a high price point. Can you say a little bit about how you won such early involvement with a team that was obviously so strong, the ongoing lesson from the stories that have come out since the acquisition news is some of the very high multiples, nominal revenue multiples that were paid by subsequent round investors who nonetheless earned an incredible return, even though they paid high multiples.

46:18And I'm curious what you learned from watching that dynamic unfold, having been the earliest investor in the business. That actually was an old lesson. I learned at Sequoia many years ago that the expensive deals, the pricey companies are pricier from day one. They are always expensive. They are expensive at the seed round, they are expensive at the A round, they're expensive at the B round. The worst reason for a venture capitalist to pass on an opportunity is for price, because it's part of those companies' DNA. Pick a company. All of those companies were expensive. Airbnb was expensive. Instagram was expensive.

46:48So if you're going to pass on an opportunity just because of price, you're going to pass on all the good companies. Yes, Wheeze was super expensive to begin with and attracted a lot of attention and became the fastest unicorn, the fastest company to go to$100 million, the fastest company to get to$500 million dollars. And this year, when we get to a billion dollar ARR, it's probably going to be the fastest SaaS company to get to a billion dollar ARR. But that's part of the DNA. It's a fast company. Watching that just convinced me that as an investor, a high-priced company is actually a good thing, not a bad thing, if justified.

47:21Is there any other novel lesson? I love the three points that drove the success that you outlined. And I love the idea that the high-priced thing is an old lesson. Are there any other new lessons that Wiz taught you that are unique to your experience with that specific company? The productivity at Wizz, if you look, was second to none. And when I looked at the number of engineers relative to the number of products and the number of capabilities we delivered annually, it was amazing. And when I look at the way Wizz stores engineers, there's always a debate. How do you pick the best engineers? And who are the best engineers for your business?

47:55And I discussed that with Roy Resnick, the VP of and dear for years, one of the co-founders, one of the four co-founders. And he had a super special way to source engineers. He would not just source smart engineers who has been in good companies beforehand, terrific education, et cetera. He would source people that their hobby is writing code. He would source people that on a weekend, assuming they are married and have kids, if they have a couple of hours of quiet time, they would not go reading or watching a Netflix series or listen to music. they would go and write code. Those are the people you like to hire.

48:30When you have a hundred of these guys, it's like having three or four hundred terrific engineers. Because you know the rule that a great software developer is probably 10 times better than a good software developer. But having great software developers that their hobby, their sole hobby is writing code, that's a force multiplier. And I think we realized that and capitalized on that. Is the outcome satisfying? I think I told you as part of the interview that I'm never satisfied. Just testing it. The answer is no. And I know that you're going to laugh and say, okay, I really feel that. But again, it's hard to live life twice.

49:07I wish I could. I would A, B test that decision again. But I think it's setting the bar super high to get from zero to$32 billion valuation within five years. I didn't check history books, but I guess that's pretty good. But I can think about a few other companies that has the potential, at least, to break that record. I dare to predict, again, assuming this transaction go through and get approved, etc., that's the real final outcome. My guess is that within 10 years, somebody would break that record. Do you think it can be broken in cybersecurity specifically? Yes. Why? Why do you think that's possible?

49:42Just because it's changing and so big? Because you have all the ingredients. You've got the market size. You've got the evolving pain point, fast moving landscape, and a lot of talent, a lot of experienced talent, not just on the engineering side, but also on the business side. And I think that you have some experienced investors as well. So I think that you've got the ingredients. Now, luck should be in the mix as well. And therefore, I think that within the next decade, we would see that record getting achieved and broken by a new player. I think it's very, very feasible. If it happens, I wouldn't be surprised if you're involved from the very earliest stages and if the Sunrise methodology and your approach works again.

50:20I appreciate that. If you think about the stories of resilience that you look for in your founders, it's a nice thing to say. Can you tell me the story of the hardest episode of resilience that you've had to personally go through? Yeah. Before starting Cytostars, I lost my daughter, my 19-year-old daughter, in a terrible tragedy. And the war just closed for me. And it was very easy to stop everything and focus on the endless pain I felt. I managed to found the power and the strength to keep on going, build Cypress Starts and focus on building that organization and legacy. And that really helped me to continue to live with the pain, but continue to live.

51:00How is that possible? Everyone listening, myself included, with children knows that's the single worst thing one could imagine. How is it possible to get beyond something like that? I think it's very, very difficult to give advice to hopefully nobody has to deal with that tragedy. It's really the most painful thing that you can go through. For myself, I did that instinctively. I didn't spend time to think about it. I didn't make a decision. I just did it. in a way, I managed to live with terrible emotions that previously I wouldn't imagine I can contain them and live with them. And over time, I taught myself to live with the pain, not fight the pain, just wait for the pain to ease.

51:41And I think that working with younger people on innovation, on solving real world problems, on building solutions, that's what kept me younger and healthier. I love the message of focusing on young people and building things for others. It seems like your orientation and your satisfaction and your strategy and your search and your work is very other oriented. Anything you would say to other investors out there that hear that part of your story and that's the piece that appeals to them most, helping other people and what they build and how they do their work? I really think that there's many ways to become a terrific investor.

52:15I don't think there's one canonical way together. And by the way, it's not enough just to be first. You also need to be right. That's the difference between an investor and a terrific investor, being right. But again, there are many ways to hell, but there's also more than one way to heaven. My recommendation is to really find your passion and do something that's not just profit generation or work. Do something that's a life project for you. When I look at cybersecurity, cybersecurity is not an investment area. It's not an area of interest for me. It's a life project. It's really important for me.

52:48And I think that's the best thing you can feel about anything you do, that it's super, super important for you. You really care about it. If you think about the future of cyber, what challenges, evolutions, things that might happen excites you most or worries you most? I guess both. It's not the way I think about cybersecurity future. I don't keep a category of domains, et cetera. It's a common misconception to think about cybersecurity as a market. Stand alone, there is no cybersecurity market. Cybersecurity is always a derivative of something else, of a new technology or a new business. So if cloud is new, you need cloud security.

53:20And if autonomous vehicles are new, you need autonomous vehicle security. Take, for instance, our conversation about AI. AI for sure would redefine cybersecurity. It already does it, but you couldn't predict it. So an investor that focuses on cybersecurity early stage investment, I'm not concerned about figuring out the best, the most important things, opportunities or domain in cybersecurity. I'm confident they will introduce themselves. The same as cloud introduced itself, IoT security introduced itself, mobile security introduced itself, AI security introduced itself. I'm focused on picking the right talent, picking the right athletes, partnering with them and making sure that you use the right system, see our conversation on Sunrise to really build solutions that real customers, real users would love.

54:08If we do that, everything else would fix itself. It's totally remarkable what you built in a short period of time. I'm sure the CyberStart story is in its infancy and that we'll be able to do this in five years and a whole new set of challenges will have arisen, like you said, probably unpredictable. Thank you for doing this with me. When I do these, I always ask the same traditional closing question. What is the kindest thing that anyone's ever done for you? The kindest thing that someone has done for me is a couple of years ago, my son told me that he spent a lot of time thinking about it and he realized that I'm his best friend.

54:36For me, that was probably the best thing anyone could tell you. It's not just about being a dad. It's the ability to create this level of trust and emotional connection that makes someone feel that you are his best friend. And when it comes from your son, that's the kindest thing you can hear from anyone. Close to 500 times. I've never heard that answer. These answers tend to cluster in a couple of key themes, variants of key themes, three or four. I've never heard that one. With a son of my own, it hits you right in the face. All that must have gone into that thing he told you, really a beautiful, amazing place to close.

55:08Gilly, thanks so much for your time. Thank you, Patrick. Really enjoyed it. If you enjoyed this episode, visit joincolossus.com where you'll find every episode of this podcast complete with hand-edited transcripts. You can also subscribe to Colossus Review, our quarterly print, digital, and private audio publication featuring in-depth profiles of the founders, investors, and companies that we admire most. Learn more at joincolossus.com slash subscribe.

55:51Thank you.