Fundamentals of angel investing via syndicates for cybersecurity founders and security professionals
Explaining the angel syndicate model, how it works, how it is different from the VC model, and how it looks in the context of cybersecurity
Welcome to Venture in Security! Before we begin, do me a favor and make sure you hit the “Subscribe” button. Subscriptions let me know that you care and keep me motivated to write more. Thanks folks!
After announcing the launch of Venture in Security Angel Syndicate designed to help security professionals decide what tools should exist in the industry, I got many questions about it. After only a week it became clear that the way angel syndicates work is not well understood. There is a lot of noise in the space and so terms like angels, syndicates, VCs, private equity firms, growth equity firms, limited partners, and the like all lump into one big mess.
I have previously written about angel investing in cybersecurity in more general terms. In this piece, I would like to offer a closer look at angel syndicates - what they are, how the model works, and what are some of the advantages & disadvantages for founders and investors thinking about engaging with a syndicate. An important disclaimer: this piece, similar to all of my other writing, is not investment or financial advice. Early-stage investing is a highly risky and very illiquid asset class. Please consult with your financial advisor if a specific investment strategy is appropriate for your case. Similarly, this article is not a solicitation. Another important disclaimer is that as a lead of the Venture in Security Angel Syndicate, I am inherently biased and everything in this article constitutes my personal opinion.
Here is a copy of that using more formal language: This commentary is provided for general informational purposes only and does not constitute financial, investment, tax, legal or accounting advice nor does it constitute an offer or solicitation to buy or sell any securities referred to. Individual circumstances and current events are critical to sound investment planning; anyone wishing to act on this article should consult with his or her advisor.
With that out of the way, let’s dive right in.
A brief overview of angel investing and the model of angel syndicates
Who are angel investors
Angels are investors who put in their own capital to support highly risky early-stage tech startups. They are not necessarily millionaires, but they must make more than a certain amount of money (the exact number and rules for who can be an accredited investor vary by country) to be able to support tech companies they believe in.
How angel syndicates work
Angel syndicates are communities of people who come together to pull money and invest in companies they believe in. Basically, angel syndicates are communities of angel investors making their investments together. Every syndicate conducts business in a slightly different way: some are invite-only while others are open to any accredited investor; some have unique restrictions about who can become a member (such as those that are CISO-only) while others are more flexible.
Members of an angel syndicate receive information about startups looking for funding but are not required to invest in any specific deal proposed by the lead; every person makes their own decisions and chooses if they want to participate. There are no commitments. When people do decide to participate in a deal, there is typically a minimum investment amount they can put in per deal. The amount will vary by the deal and by syndicate: while Venture in Security Angel Syndicate sets its minimum investment amounts to $2000-$2500 per deal, some syndicates can go as high as $50,000 or as low as $1,000.
Every syndicate consists of a lead or a group of leads and syndicate members - individual investors (say, for a cyber-focused syndicate they could be security practitioners, CISOs, etc.). A large syndicate may have formal “committees" - working groups of people responsible for certain aspects of the syndicate’s work such as legal, marketing, operations, due diligence, etc.
A syndicate lead does several things:
Sourcing deals. This involves talking to founders, identifying good ideas, building relationships with communities of startups, incubators, and accelerators, attending events, etc.
Negotiating an allocation. When a startup is looking for capital, it talks to many potential investors, and in many cases, a founder will want to take money from several investors at once. The amount of money a founder is willing to accept from a syndicate is called an allocation. For angel syndicates, allocations tend to be between $50,000 and $300,000 but there is no hard rule: it depends on how much the syndicate thinks it can raise, and how much the founder is looking to get from the angels.
Conducting due diligence. Syndicate leads evaluate startups to ensure that their focus, business model, product, technology, financials, and other factors make them suitable for the investment.
Writing investment memos. If syndicate leads decide to invest in the startup, they will write an investment memo and circulate this to the syndicate members. The investment memo, often accompanied by the company’s pitch deck, typically offers a deep analysis of the startup, its business, the reasons syndicate leads decided to invest, the risks, and other information helpful to the members.
Organizing Q&A calls with founders. Sometimes, syndicate members can make their decision about investing by going through the deck, reading investment memos, and doing some basic googling; at other times, they would like an opportunity to talk to founders, ask questions, and understand their plans, vision, and drivers better. Syndicate leads would typically be the ones organizing calls with founders.
Handling all the paperwork. There is a lot of paperwork that goes into an investment, and while syndicate leads might not be the ones putting it together, it is their responsibility to make sure it gets done.
Talking to prospective members. Whenever somebody is interested in joining a syndicate, syndicate leads would typically be the ones arranging a call, learning about the person’s motivations, and explaining how the syndicate works.
These are some of the responsibilities, and there are a lot more. Notably, angel syndicates do all of this work for free. Well, almost “free” - they get paid in interest if the startup succeeds. To understand how it all works, it’s important to understand the flow of money.
A sample angel syndicate math
Let’s use a hypothetical scenario: a Syndicate “Cyber Future” has 75 members.
Cyber Future’s lead through his network found an amazing startup looking for Seed funding, and negotiated a $260,000 allocation. When he brought this startup to the membership, 55 people decided to invest. The minimum amount the syndicate lead set for this deal is $3,000.
Let’s say that the syndicate lead put in $10,000 and the first 30 people invested $5,000 totaling $160,000. The other 3 people put in $20,000 each bringing the total to $220,000. One other member who is a high-net-worth individual invested $40,000. At that point, the allocation amount of $260,000 has been reached. When the other 20 people finally send their money, it will be returned back to them as the allocation (the maximum amount a startup is willing to accept from the syndicate) has been hit.
Now let’s run three scenarios to see how syndicates make money: a failure (most likely), a medium return (second most likely), and a homerun (least likely).
Failure Scenario
Let’s say that after 2 years, the startup goes out of business. Nobody makes any money and everything that was invested ($260,000) is entirely gone. This is why there is a saying that people should only ever invest the money they are willing to lose.
Medium Return Scenario
Let’s say that after 3 years, the startup is acquired and the return is 3X turning $260,000 into $780,000. In this case, the returns will be distributed proportionally to the initial individual investment minus the percentage of carried interest (think-profits) allocated to the syndicate leads, which is typically 20%. For example, given the 3X return, a member who invested $10,000 would get $26,000 of which
$10,000 is the initial amount they invested
$16,000 is the carried interest (profit) minus the syndicate’s share of 20%
Homerun Scenario
Let’s say that after 5 years, the startup is acquired and the return is 10X turning $260,000 into $2,600,000. In this case, the returns will once again be disbursed proportionally to the initial individual investment minus the percentage of carried interest (think-profits) allocated to the syndicate leads (20%). Given the 10X return, a member who invested $10,000 would get $92,000 of which
$10,000 is the initial amount they invested
$82,000 is the carried interest (profit) minus the syndicate’s share of 20%
The syndicate’s share of 20% is a compensation the syndicate receives for all the work it did at no cost at the beginning (setting everything up, getting people on board, finding startups, building relationships, doing marketing, negotiating with founders) and throughout (staying in contact with founders to provide help and support, making introductions, sharing resources, helping raise the next round, etc) the life of the investment. Although it might seem a lot, if you consider the amount of work it takes to run a syndicate, and how few of the companies end up leading to significant returns, it’s not much.
Another item I’ve omitted for simplicity is the setup fee charged by lawyers when the investment is being set up. Depending on the platform used, it can be anywhere between $4,500 and $10,000 of the total investment; this amount is prorated across all individual angels (members and syndicate leads). For example, if an angel syndicate raises $150,000 and a setup fee is $4,500, this means that 3% of everyone’s contributions won’t go to the startup, but instead will be used to pay for a lawyer. Effectively, a person investing $3,000 would only be investing $2,910 and $90 would be used to pay the legal expenses.
Some syndicates such as Venture in Security design incentives for the syndicate members to make connections to great founders. The goal is to encourage people to stay active and keep their eyes on new up-and-coming ideas. This is especially relevant in security where almost every practitioner knows someone working on a potentially impactful side project, and many great companies started while their founders were employed by Google, Microsoft, AirBnb, Amazon, Palo Alto, CrowdStrike, and the like.
Lastly, please do note that there is much more to the syndicate math with concepts like dilution, liquidation preferences, and others that can make a big impact on the final outcome. This post doesn’t capture the whole picture; the intent is to provide an easy-to-digest summary of the topic.
How angel syndicates exit their investments
There is one more point about the angel model that is well worth calling out because of the number of misconceptions and incorrect assumptions. It applies to both individual angels investing on their own, and angel syndicates, and has to do with the way angels exit.
While traditional VCs typically exit their investments and get their initial investments and returns back when a startup IPOs or gets acquired, the same is not true for most angels who get bought out by other investors.
Here is how it works. Every startup has a document called a capitalization table or cap table for short, which lists all investors the company received money from and their ownership stake. At a certain point of a startup's journey, typically Series A, B, and later, the number of investors with small ownership becomes too high, and VCs leading subsequent rounds are looking to consolidate the ownership and “clean up” the cap table. It is then that they typically offer angel investors (or syndicates) to sell their stake at a discount of the latest valuation, providing the ability for angels to exit their investment and get compensated for taking the risk earlier.
Obviously, angels can only get their money back and think about profits if the investment is successful.
What makes angel syndicates different from VCs and other types of investors
The venture capital model works as follows: VCs raise a lot of money (a fund) once, and then the leaders of the firm (partners) allocate the fund without having to actively consult with their own investors. The compensation model of VCs is what is called “2 and 20”: a firm gets to use 2% of the fund size to cover its operational expenses (salaries, travel, events, etc), and at the end of the fund life which is typically 10 years, it gets to keep 20% of the profits it generates. The math works as follows: if a VC raises a $100M fund, it gets to use $2M per year to cover its business (after a few years the amount decreases, but we’ll simplify it for ease of calculation). Then, after 10 years, if the fund is worth $250M, the VC will first return $100M to its own investors (LPs or limited partners), and then it gets to keep 20% of the profits (20% of the $150M). The actual math is a bit more complex with things like hurdle rate and others coming into play, but this is good enough for now.
Another notable difference is that VCs invest somebody else’s money while angels invest their own. For clarity, it’s worth noting that VCs are required to contribute a small percentage of the fund to show the “skin in the game”; the actual contribution can typically be anywhere between 1% and 5% of the fund size. Angel investors put in 100% of their own capital, hence their incentives are in perfect alignment with this of the founder. Angel syndicates are similar to VCs in this regard: a syndicate lead has to contribute a certain amount of their own money to show that they believe in the company, with the rest coming from individual angels.
To summarize: VCs get paid a salary and get to take a percentage of the profits. Syndicate leads do not get paid a salary, and therefore cannot hire employees, invest in marketing, etc. Unlike VCs which raise a fund every 10 years, syndicate leads raise money from their investors (angels) every time they want to invest in a new startup. Raising money is hectic and labor-intensive, and so is evaluating startups. Doing all of this while not getting paid unless the bet is successful is probably why people who do it are called “angels”.
Private equity and growth equity funds are different in their own way, but importantly - people doing the work also get paid a salary, and fundraising for them doesn’t happen multiple times per year.
Cybersecurity-focused angel syndicates
There are several cyber-focused angel syndicates worth mentioning.
Venture in Security Angel Syndicate (ViS Angels) is a practitioner-focused cybersecurity angel syndicate. As cybersecurity is becoming more technical, traditional investors are struggling to evaluate ideas and solutions of the future, often funding tools that make big promises but don’t solve real problems. On the other hand, while security practitioners spend an incredible amount of time staying on top of new innovations, they still have little impact on what gets funded. ViS is changing this. Venture in Security Angel Syndicate believes that security engineers, SOC architects, detection engineers, penetration testers, threat researchers, and other hands-on security professionals are best positioned to shape the future of cybersecurity.
Silicon Valley CISO Investments (SVCI) is another angel syndicate based in and focused on North America. They are an established angel group, and its membership rules dictate that one must be a CISO to join. Security professionals - engineers, architects, SOC analysts, and the like cannot join SVCI as of the time of writing this article.
Cyber Club London (CCL) is a London-based angel syndicate that invests in European and Israeli startups. CCL was established after SVCI but before Venture in Security Angel Syndicate so as of the time of writing this article, they’ve made 8 investments.
Although there are a few smaller syndicates, they are either not as active or operate as a small, closed, friends-only group, hence why I’ve decided to omit them. Many generic syndicates invest in a broad range of B2B SaaS and enterprise tools, some of which happen to be in cybersecurity. However, because they do not have expertise in security, I decided to not include them here.
Why there are so few cybersecurity-focused angel syndicates
While there are tens of cybersecurity-focused venture capital firms, there are only a handful of angel syndicates focused on the space. There are several reasons why that is the case, the most important being the stage, the model itself, and the domain.
First and foremost, early-stage investing is incredibly hard. Unlike later stages, where a startup has already proven its business model and received customer and therefore market validation, at pre-seed and seed there is typically little to no revenue, and the number of customers is fairly small (if there are any at all). Investors cannot rely on metrics alone, and therefore they are finding it hard to separate the signal from the noise. The failure rate for early-stage startups is higher than for those at later stages.
Because angel syndicates are entirely outcome-driven, nobody gets paid until (and unless) the company the syndicate invested in succeeds. While as I’ve mentioned, VC firms use the 2% of the fund size to pay salaries and cover operational expenses, leads of angel syndicates do their work for free, hoping to be rewarded in the future. And, it is a lot of work: they need to meet founders, evaluate potential startups, take calls with potential members, build relationships with VCs, help the companies they’ve invested in, and much more. Few people are passionate (or crazy) enough to spend so much time doing work they are unlikely to ever be compensated for.
Lastly, cybersecurity is a complex domain. Few people have the necessary knowledge of the technology and the market to evaluate security startups. Those in the industry know that saying “I work in cybersecurity” at a party is one of the best ways to make sure that the conversation will either end or move to a different topic. It’s no different with investing: while many are interested in the market, few have enough understanding of the space to bet on early-stage companies shaping its future. The amount of expertise required to separate the signal from the noise, make sense of complex marketing, and not drown in buzzwords is similar to that in biotech where investors have to get a PhD before they can truly understand what they are looking at.
Pros and cons of working with angel syndicates for cybersecurity startup founders
Everything has pros and cons, and angel syndicates aren’t an exception. Although I am bullish on the role of syndicates in the cybersecurity ecosystem (hence why I choose to run the ViS Angel Syndicate), I don’t believe it is the end-all-be-all method of funding.
For cybersecurity startup founders, the advantages of working with syndicates include:
A chance to work with investors who can actually understand what the startup is trying to do, what problem it is tackling, and whether the proposed solution makes sense.
Ability to get funding from potential customers and security practitioners with deep connections in the industry and a strong passion for supporting the products they believe in.
Building a relationship with security professionals who are very active in the ecosystem and can spread the word about the startup’s mission. Angel investors are often leaders in their communities, speakers at events and conferences, advisors to early-stage ventures, organizers of CTF competitions, and the like.
An opportunity to get different forms of support - advice from experienced practitioners, product feedback, help with the go-to-market strategy, and the like - something traditional investors may not be as well positioned to provide.
Because angels invest their own money, they do not have a limited time horizon such as VCs who need to exit all of their investments within 10 years. Angels are long-term players, and this long-term focus makes them very unlikely to push startups into the growth patterns that founders are not interested in pursuing.
By working with syndicates, founders can tap into a broad network of people and get money from a large collective of investors. At the same time, they benefit from only having one line on the cap table - a very important factor for them to raise the subsequent rounds of funding. This is why whenever founders are approached by friends and relatives looking to put in some cash in their companies, those thinking long-term encourage investors to do it via syndicates.
Most importantly, angels are in this industry not for the money, but because they love what they do. Security professionals are in for the long term, and as we explain to founders on the ViS website, “when security professionals invest in your company, they truly want you to succeed, and unlike traditional investors, they will always go the extra mile to help make it happen.
While angel syndicates can be great partners for cybersecurity startups, they are not always the best solution. This is the case for several reasons:
While angel syndicates that bring together security practitioners and leaders are great for early-stage ventures, they are typically not a good fit for companies at later stages. The average check size of angel syndicates is $50,000-500,000, well below what an established later-stage company would need to supercharge its growth. Having said that, angel syndicates are typically well-connected and have established relationships with VCs, so they can be of great help when their portfolio companies are looking to raise the next rounds of funding.
The biggest potential downside of working with a syndicate is the fact that the number of people who will see the pitch deck is higher than in a regular VC. This is not surprising: a typical syndicate would have 50+ members, compared to a VC firm where the number of associates and partners who will go through the deck is typically below ten. It is critical to emphasize that angel syndicates vet their members, and any serious angel will never disclose any information to any third party because they know that it will cost them the membership and their reputation as an investor. Additionally, platforms like AngelList have strong measures in place to prevent the leakage of data. While there are no reasons to worry, the fact remains that syndicates involve more people. Although it is one of the key assets that enable syndicates to evangelize the startup’s mission and make potential connections to customers, it can also have downsides for those in deep stealth mode. The best way to lower the risks is to openly discuss the concerns with the syndicate lead and see what they say.
Every funding method has its pros and cons; angel syndicates are not an exception. However, I believe that the simplicity, the human connection, and the long-term focus of angels are great options for most cybersecurity startups.
Pros & cons of working with angel syndicates for investors, security leaders, and security practitioners
For investors, security leaders, and security practitioners, syndicates provide:
The ability to invest in early-stage cybersecurity startups with low effort. Syndicates do the work of building the community, finding promising companies, negotiating allocations, and handling the paperwork - a syndicate member gets all the hard parts of investing taken care of. Since there are no commitments, and members get to choose if they want to take a part in any deal, it makes becoming a part of the syndicate appealing to many people.
Low starting amounts. Over the past decade, the nature of angel investing has changed. If in the past, it was only accessible to millionaires, today any accredited investor can put in as little as $1500-$5000 to support companies they believe in via syndicates. Angel syndicates have democratized and greatly lowered the bar for early-stage investing.
The ability to get involved even if they are not accredited investors and are not in a place to invest. Because angel syndicates rely on the community for sourcing deals, and making their presence in the ecosystem known, there are many ways to be involved beyond investing. Even those who are not accredited investors can find a way to help shape the future of the ecosystem - by sourcing startups, helping to organize events, making introductions, and the like.
There are, however, also reasons not to get involved with angel syndicates:
Early-stage investing is incredibly risky, and the chances that people will lose money greatly outweigh the chances that they will make money. This is why one should never invest anything he or she is not prepared to lose. Those considering angel investing should consult with their financial counsel (remember that this piece attempts to explain the concept of angel syndicates and the basics of how they work; it is not all you need to know and most definitely not investment or financial advice).
Some people who are incredibly sophisticated and experienced investors might prefer to do it on their own, instead of being a part of the angel syndicate. By going on their own, angels get a greater degree of freedom about what they invest in, how and when they do it, and the like. The downside, however, is that they have to do everything themselves - deal sourcing, paperwork, etc, and the minimum investment amounts are typically much higher (most startups will never list an angel who invests $5,000-$10,000 on their cap table).
Those considering angel investing should do their own research, and consult with trusted advisors.
Closing thoughts
Angel syndicates are an important part of the tech ecosystem. For several reasons, this is especially the case in cybersecurity:
Cybersecurity is deep tech, and therefore it can take longer for companies to commercialize their innovation
Traditional investors are finding it hard to evaluate cybersecurity startups
The industry needs long-term thinking that can only happen when companies are not forced to exit quickly
At a later stage, founders may just need money so that they can focus on execution and growth as they know exactly what to do. At an early stage, they also need help - help with proving or disproving hypotheses and understanding the complexity of problems, help with building and validating solutions, help with positioning, and help with building a community of champions, early adopters, and evangelists. At an early stage, founders need engaged investors - those who will go an extra mile to help them achieve their vision. This is where having support of industry leaders and security practitioners can be a deciding factor in who succeeds and who doesn’t (or who will need much more time).
Although with the emergence of syndicates and platforms such as AngelList angel investing has become much more accessible than before, it is as risky as ever. With the number of startups in the industry, it is clear that the vast majority won’t IPO or get acquired and will instead end up costing the founders and investors money. Such is the nature of innovation, and that is why most people should not be looking to become angels. Those interested in the topic, should do their own research and consult with their financial advisors.
Lastly, I want to encourage anyone exploring angel investing to read “Angel: How to Invest in Technology Startups - Timeless Advice from an Angel Investor Who Turned $100,000 into $100,000,000” by Jason Calacanis. This essential read provides a deep-level practical overview of how the whole process works, and what a person new to the space needs to know as they are getting started and building their investment portfolio.
Disclaimer: This commentary is provided for general informational purposes only and does not constitute financial, investment, tax, legal or accounting advice nor does it constitute an offer or solicitation to buy or sell any securities referred to. Individual circumstances and current events are critical to sound investment planning; anyone wishing to act on this article should consult with his or her advisor.