Angel investors are arguably the most critical part of the cybersecurity startup ecosystem
Discussing the critical role angels play in the cybersecurity ecosystem, their motivations, and impact
Angel investors: the basics
Although it’s hard to find people in the cybersecurity industry who haven’t heard the words “angel investor” in one context or another, this fact alone doesn’t mean that the role of angels in the security ecosystem is well understood. I am not going to spend time explaining who angel investors are and what they do - there is plenty of material about that online.
Instead, I would like to touch on several areas that, in my view, haven’t been discussed nearly enough: the job and the motivations of angel investors, the value they bring to cybersecurity founders, and why a lot of the successes in security can be credited to their contributions.
This issue is brought to you by… Vanta
Unlocking the ROI of GRC
According to IDC’s recent analysis, Vanta delivers an average of $535,000 in annual benefits and a 526% return on investment by automating compliance, streamlining security tasks, and centralizing visibility across GRC programs.
Join the live event on Feb 27 to discover how Vanta empowers organizations to achieve exceptional results in their Governance, Risk, and Compliance (GRC) programs.
Phil Harris, Research Director for GRC Software and Services at IDC, and Faisal Khan, GRC Solutions Specialist at Vanta will discuss:
The biggest challenges facing GRC programs and professionals today
How Vanta helps teams overcome these obstacles with ease
Key insights from IDC's white paper, The Business Value of Vanta
Welcome to Venture in Security! Before we begin, do me a favor and make sure you hit the “Subscribe” button. Subscriptions let me know that you care and keep me motivated to write more. Thanks folks!
A single most important job of an angel investor
People new to the startup space often assume that angels get to build billion-dollar companies, decide what go-to-market strategies early-stage startups get to pursue, and what market segment they should go after. Although everything about angel investing is highly contextual, in most cases this isn’t at all what angels are expected to focus on.
Angel investors have one job: help the company they back get to the next stage and get growth funding from VCs. After that, support the founder in areas where they require support. Although it may sound simple, in real life it’s easier said than done.
When an angel gets involved with an early-stage company, there is little that can be formally evaluated, quantified, and analyzed: there is no product, no customers, often no employees, and sometimes even no legal entity. The whole startup may very well be a great idea and two or three passionate people who are crazy enough to believe they can make it happen despite having little clue what it will take. For the startup to be able to raise growth capital from VCs and scale its operations, it needs to get to the level that is significantly more advanced: it needs strong, provable signals of customer demand, ideally a product, and a team of people that can convince VCs they will pull it off. Moreover, the company needs to be legally incorporated and present a variety of documents during due diligence, from vesting agreements between founders to balance sheet and cap table.
The only role of angel investors is to help their portfolio companies bridge the gap and get where they need to be for an institutional VC to write them a check with good terms. To accomplish this goal, angel investors should be able, among other things, to:
Help startups to validate their problem space (make introductions, point founders to the right resources, etc.).
Help startups build and test the early version of the solution (help test the product, become an early customer, make introductions to potential design partners, etc.).
Help founders craft a winning fundraising strategy, coach them about pitching to VCs, and make introductions to investors as needed.
Help companies define and test different go-to-market strategies so that they can do more of what works, and less of what doesn’t, and accumulate enough valuable learnings to scale without wasting too many resources.
Help entrepreneurs hit the right milestones and get the right numbers that VCs will need to build conviction and ultimately - write a check.
The single most important job of the angel investor - helping the company get to the next stage - should also be the guiding factor when angels evaluate their potential investments. One of the questions I like to ask myself is - “Can I help this company get to the next stage? What can I bring to the table that can accelerate their growth trajectory? How can I best support founders so that they are where they need to be to become leaders of a growing startup?”.
Motivations of angel investors
Different angels in the cybersecurity industry are motivated by different factors.
For many, angel investing is a way to give back and support the next generation of entrepreneurs. Say, a founder who successfully exited a cybersecurity company decides to allocate some capital to help others build solutions they believe should exist in the industry.
Some CISOs and security practitioners see angel investing as a way to stay on top of new developments in the industry and fund the next generation of path-defining companies. This desire to be “plugged in” into the ecosystem is often a defining factor that keeps angels actively engaged in the community.
I have met several people who started angel investing so that they can build a track record and later transition into the VC space. Sourcing deals, going through the investment memos, and getting familiar with the due diligence process can indeed be a great way to build the investing muscles, and decide if venture capital is something that could be interesting as a full-time career.
The ability to generate financial returns can also be a good motivator for some people who choose to invest in cybersecurity startups. Having said that, money is by far the worst reason to angel invest: most early-stage ventures fail, and it’s not a secret that unless one goes deep into it, and builds a diversified portfolio of companies, they are unlikely to make substantial returns. The stories about people striking it big by becoming early investors in Google or Uber suffer from survivorship bias, similar to those about lottery winners. The reality is that the vast majority of those who play the lottery lose, but we only get to read the interviews with winners.
Role of angel investors in the cybersecurity startup ecosystem
Providing high-risk growth capital
Let’s get the obvious out of the way: most people think of angel investors as providers of capital to early-stage startups. Founders need money to get up and running, including:
Incorporate the new legal entity.
Ensure that intellectual property is properly assigned to the company.
Pay for access to the infrastructure (cloud, etc.).
Cover the cost of SaaS subscriptions.
Test different marketing approaches.
Build the product.
Hire employees to get through the initial stage of validating the problem and building the early version of the solution faster.
Few people realize just how much needs to happen before a startup can start thinking about raising capital from venture firms. Angel investors come in when the risks are the highest, and when there is little in terms of traction or product that can be evaluated. By agreeing to support entrepreneurs so early in the journey, angels are betting first and foremost on people - the founding team. Can they move quickly, validate their assumptions, and iterate before they arrive at the problem worth solving with a solution customers are willing to pay for solving? Is this a growing market where they have a chance to succeed? Can they build relationships and trust in the industry? Questions are plenty, yet answers are hard to come by. The risks of investing at the pre-seed stage are the highest they will ever be, and therefore VCs who are bound by the fiduciary duty to their own investors - Limited Partners or LPs, are commonly staying away from making their bets this early.
While there are funds that invest in pre-product, pre-revenue companies, the whole area of pre-seed startups is in many ways at odds with the VC model. There are a few reasons why this is the case. The first and the main one has to do with the math of running a VC fund.
Every fund is a pool of capital VCs raised from their LPs to fund usually anywhere between 20 and 30 companies; 2% of the fund size is typically used to cover the operational expenses of running a fund. At the pre-seed stage, startups don’t really need a lot of capital, so a fund that invests in pre-seed companies would be $10-20 million (~20 investments plus some capital for the follow-ons). A 10-year fund of this size makes little financial sense for experienced VCs because the management fees would not be able to cover the amount of effort needed to find, evaluate, and support early-stage startups. The second reason why VCs are not well aligned with pre-seed companies is that as a fiduciary, a venture firm would need to ensure that it makes a sound investment decision that has the potential to result in outsized returns. At the pre-product, pre-revenue stage, the investment decision cannot easily be de-risked; moreover, a startup would drown in legal paperwork detrimental to its future success if it were to seek VC funding that early, and some firms were open to doing it.
All this is not to say that VCs never invest in pre-seed; they do. Some firms built a thesis (focus) in early-stage companies. The reality, however, is that as a firm grows and raises a new fund which typically happens every four years, it has all the reasons to increase the amount of assets under management (AUM). And, as it does that, its funds become bigger, and it can no longer support small companies. A $50 Million fund still needs to make 20-25 investments, and an average check size is going to be way higher than what a pre-seed- (and often - a seed-stage) company can digest. It’s worth noting that even VC firms that don’t usually invest in early-stage ventures do still make exceptions and from time to time write small checks (mostly to bet on the experienced founder or to build relationships and get access to the next round).
Pre-seed investors in security are pretty uncommon. Most founders in security are better off raising a pre-seed round from angels rather than institutional VCs.
Since angels are investing their own money, they do not need to guarantee returns to anyone else and can make decisions that are much riskier and much more subjective. Since at the pre-product, pre-revenue stage there is nothing of value but the team, angels get to support people they personally believe in. Experienced entrepreneurs and smart first-time founders know that while it’s important to start building relationships with VCs early, it’s equally important to not expect that they will write significant checks before a company is VC-ready.
Advising and mentoring early-stage startups
When an angel investor decides to bet on a startup, the company gets much more than a check. I would even argue that the money itself is not what makes a difference. Angel investors tend to have strong networks in the industry, and while all investors like talking about “value-add”, angels are the ones who are ready & willing to offer valuable advice and mentorship.
Overall, there are two kinds of angels: active and passive. Passive investors will write a check and get out of the way until the founder needs their signature on some legal paperwork. Active investors, on the other hand, are there to help entrepreneurs build the company. I believe that one is not necessarily better than another, and which type is preferred will largely depend on the background of the founders, the stage of the company, and its needs at a particular time. Entrepreneurs and investors must be aligned about their expectations of one another so that there are no bad feelings when an angel starts to reach out to the founder who just wants to be left alone, or vice versa.
Although not all angels are active, I believe that at the pre-product, pre-revenue stage when the uncertainty is high, founders can tremendously benefit from the expertise they bring to the table. Angel investors are most commonly operators - successful entrepreneurs, ecosystem builders, experienced startup leaders, and others who have been there and done that. While not everyone has built and exited a company, most angels bring some skills to the table that are highly relevant to early-stage ventures, be it software development, operations, sales, marketing, go-to-market, finance, law, or anything else. For instance,
Product leaders with experience taking cybersecurity companies zero to one can help startups accelerate their customer discovery, understand how to segment their market and whom to go after first, and how to build a roadmap that remains focused despite hundreds of different requests and bug reports in the pipeline.
Experienced founders and sales leaders can help new entrepreneurs build and execute the plan to transition away from founder-led sales. Startups looking to scale will need to solve this problem, and there are plenty of stories of what can happen if it’s not done well.
Lawyers who have worked with many startups and participated in their due diligence know best where people make the most impactful mistakes. This may include ensuring that all employment contracts assign intellectual property produced by the employees to the company, that everyone who has invested in the startup will be properly reflected on the cap table, etc.
Having seen how much difference angel investors can make, I truly believe that one can judge the chances of a new venture to succeed by looking at who are the angels that back the company. Savvy founders know that quite well, and to be able to tap into the wisdom of experienced mentors and advisors, they look for ways to attract the best players as their angels.
Making introductions to VCs and others in their network
Not only do angel investors come to bring hands-on experience building companies, taking products to market, crafting and testing go-to-market strategies, executing these strategies, scaling a startup, and the like, but all of them have their own networks.
First and foremost, as experienced operators, they have had the opportunity to work with many others in their field. The compound effect of staying active in the industry and building relationships is enormous: many angels can reach senior decision-makers from almost any company; if not directly, then through a friend of a friend.
People who spend their free time supporting startups, tend to have a strong community of practitioners, operators, investors, and ecosystem partners around them. Who is a good journalist who can help get some press coverage? Who could be a good design or integration partner? What law firm is open to providing some pro-bono services? Experienced angels can not only answer these questions but also make introductions to people in their network.
Another area where angels add enormous value is making introductions to VCs.
To find good cybersecurity startups, VCs cast their nets far and wide, building relationships with advisors, community leaders, security practitioners, CISOs, and, of course, angel investors.
Angels are super connectors who, by the nature of their role in the ecosystem, get to hear about the new ideas, meet new people, and connect to potentially promising opportunities as early as at their inception point.
Since angels live and breathe the industry, they talk to hundreds of founders and have a fairly good idea of who is working on the problem worth solving, and who is likely to start raising in the coming months. The partnership between angels and VCs is a true win-win: VCs need to build a deal flow pipeline, while angel investors are looking to help their companies grow. And, because their interest in the industry is largely driven by their passion and the desire to make a difference, they are happy to make connections to promising founders even if they themselves didn’t end up investing.
For early-stage cybersecurity startup founders, getting backing from respected people in the industry can be a great path to the right introductions and connections they would not be able to access as easily elsewhere. As with anything else, it’s always better when one can secure an introduction from a trusted source, compared to sending cold email outreach or submitting “pitch us” forms on VC websites.
VCs are not the only type of investors founders can reach through their angel supporters. Angels themselves tend to work closely together with one another - sharing deals, helping with due diligence, and asking for introductions for their portfolio companies. I refer to people who are especially active in the industry as “super angels”. While some of them have well-established personal networks, others are active via angel groups and syndicates. By building relationships with the super angels, founders can expand their reach and connect with ecosystem players who can greatly accelerate their growth trajectory.
Illustrating the critical role angels play in the cybersecurity ecosystem
Case one: Israeli cybersecurity startups and the success of the angel network
Arguably the best example of how strong angel networks can impact the cybersecurity ecosystem is Israel.
First of all, an important disclaimer: no part of the startup landscape can function on its own, and the context matters a lot. There are most certainly many factors that all played a role in enabling Israel to become a leader in cybersecurity:
Entrepreneurial culture of the people.
The military pressures and the resulting investments in offensive and defensive technologies.
IDF and especially the Unit 8200 role as a co-founder matching service and entrepreneurial bootcamp.
Continued support from the government.
While all that is true, I would argue that the main reason for Israel’s leadership in security is the culture of mutual help and the angel ecosystem enabled by this trait.
The Israeli cybersecurity ecosystem as we know it was born after the success of Check Point. It is then that those who exited Check Point (founders & early employees) kicked off the cycle where successful entrepreneurs reinvest a portion of their money in those from their network who are just starting out. Thanks to this investment which comes with mentorship, advice, and a row of introductions, the generations of security founders in Israel one after another are able to execute the same playbook to success:
Find a problem and validate that CISOs are willing to pay to solve it.
Get a few local design partners.
Raise pre-seed capital from experienced operators turned angels.
Build an MVP.
Start selling to customers in the US,
Raise seed from local VCs (ideally - YL, Cyberstarts, Team8, Glilot, or Picture what I have seen).
Build the product.
Raise a big round of growth capital from US-based VCs.
Come out of stealth, enter the American market as a powerful force, and start aggressively fighting for market share.
For those interested in learning more about the role of Check Point in the cybersecurity ecosystem, here is a dedicated deep dive into this topic: The power of Check Point mafia, the impact of Foundstone, Juniper Networks & Cisco on the industry, and the origins of cyber ecosystems.
Case two: European cybersecurity startups and the absence of the angel network
An opposite example to that of Israel is Europe which has been struggling to get early-stage cybersecurity companies off the ground that would be capable of outcompeting their US and Israeli counterparts. The biggest reason why that is the case, in my opinion, is the absence of a strong angel network in Europe.
When we look at the European market, it’s clear that it lacks early-stage funding. However, when we zoom in closer, we see cyber-focused funds such as TIIN Capital (Netherlands), 33N Ventures (Portugal), Axeleo Capital (France), and others, many of which are focused on or would be open to funding a Seed and an A-stage company. What Europe is lacking is the angel ecosystem - people who can come in earlier, and help European startups to get to the stage when institutional investors can actually look at them. Sadly, because Europe hasn’t had a series of solid exits in cybersecurity, it hasn’t been able to form a strong angel network willing and able to help local companies get where they need to get. The UK is an exception (think of Draktrace and Recorded Future, to name some), but the EU sadly doesn’t have that. What is equally unfortunate is that founders of the European companies that do exit, often choose to back US-based startups instead of paying it forward in their local networks.
We have seen the governments all over Europe trying to solve the lack of funding by designing grants and other arrangements where startups can apply to get “free” money. I strongly believe this is a wrong way to go, and countries would be better off encouraging angel investing, rather than giving away grants.
For those interested in learning more about the European cybersecurity ecosystem, its challenges and opportunities, check out a dedicated deep dive into this topic: Getting Europe to become an active player in the global cybersecurity market: challenges, opportunities, and the way forward.
Looking at data: scientific research about the role of angels in the tech ecosystem
It’s not just the anecdotal evidence but also scientific research that suggests that angels are critical to startup success.
Researchers from Harvard Business School and MIT looked at the impact that angel investors make on the companies they fund. They recognized that the magnitude of the role angels play in the ecosystem has been greatly underestimated, and that in reality, they are often even more critical to startup success than VCs.
The research paper documents the role of angel funding in the growth, survival, and access to follow-on funding of high-growth startups. Some of the findings include the following:
“Angel-funded firms are significantly more likely to survive at least four years (or until 2010) and to raise additional financing outside the angel group.
Angel-funded firms are also more likely to show improved venture performance and growth as measured through growth in Web site traffic and Web site rankings. The improvement gains typically range between 30 and 50 percent.
Investment success is highly predicated by the interest level of angels during the entrepreneur's initial presentation and by the angels' subsequent due diligence.
Access to capital per se may not be the most important value-added that angel groups bring. Some of the "softer" features, such as angels' mentoring or business contacts, may help new ventures the most”. Source: The Consequences of Entrepreneurial Finance: A Regression Discontinuity Analysis by William R. Kerr, Josh Lerner and Antoinette Schoar
Closing thoughts
Over the past several years, I got to see and experience firsthand the degree to which angel investors get to influence the direction of the industry. I am now convinced that by looking at who the early investors in the company are, one can say with a medium-to-high degree of certainty how likely it is that the company in question can succeed on the market.
This is especially the case in cybersecurity - an industry that is so heavily reliant on trust. Because trust and pre-existing relationships play such a critical role, startups that can get backing from angels with strong networks in the industry (especially “super angels”), get a strong competitive advantage. No angel can be credited for the company's success, but good active investors can greatly amplify the efforts of founders and help the startup gain initial momentum.
Building a successful cybersecurity market is not easy, and many components need to be in place for any effort to come to fruition. The presence of supportive government regulation, top-tier and industry-focused VCs, formal or informal venture studios and accelerators, strong mentors and advisors, and many other ingredients are all necessary for the ecosystem to function and show good results. However, all the opportunities start with good founders and angel investors willing to back them - without these two components, nothing else matters. VCs will always go where the money is; angels, however, have to support founders when there is little they can expect in return.
