Inside the Mind of a Cyber VC: What Founders Get Wrong and How to Pitch to Win

All

>> [applause] >> right. Thank you. >> All right. So, I've got about 30 minutes of material. I totally got about 25 minutes. So, I'm going to move with a a lacery. Uh, but the goal here for you guys is take away how to pitch to win, right? So, let's start with slides. There we go. Who am I and why should you care? >> Uh, so deep background, I've been in the business for 30 plus years. That picture of me is at Defcon I want to say that's defcon four or five, but my first Defcon was Defcon 2. So I've been in the hacker community uh longer than dirt. Uh I've been in venture capital for about 15

years as well. So I've been investing as a professional for quite some time. Um I've taught classes on a career ship at uh NYU. So, uh I think I know what I'm talking about, but you guys have to be the judge of that. I've reviewed about a thousand pitches. Um what my job here for you today is to teach you kind of the process of venture capital, how we as VCs view the process and view the companies that we're pitching or getting hit and then you know how to best prepare yourself for that entire process. All right. So, key takeaways, understand the enemy, right? Not really enemy, you're going to be partnered with the person that you're

you're pitching, but understanding really how they view what's going on and how to best present your company uh is step one. Step two is how to navigate the entire process. Right? So, pitching is one of those things that you only do it most entrepreneurs five or six times in the course of a company. And if you're a multi-time entrepreneur 10 12 times through the process in your lifetime, uh I go through that process, you know, several times a month. So hopefully I can tell you how we view it is we spend a lot more time in. Uh last, you know, how to pitch in a way that makes you one of the companies that someone has to invest in,

right? That's the end of at the end of the day that's the goal is to to uh to drive a process where you are the hot commodity. So what do VCs actually look for in companies? First one, you're going to hear this all the time. It's team over tech, right? Uh techn is great. It's important, but it's it's not the main thing that drives winning, right? There's all sorts of stories, the Betamax, is better than VHS, you name it, where technology isn't really the the winner. It's the team you've put together. So, the first thing you want to do when you start pitching is give an idea of why you're the team to solve the

problems you brought to work. Now, it says cyber VCs at the top of this cyber conference. I am a cyber VC, right? So, my my company, Litical Ventures, we primarily invest in cyber early stage preced series A. So, the earliest stages. Um, but a lot of this stuff goes for all venture capital. And I'll I'll give you the differences. So, the next one is painkiller versus uh again this is a universal concept. You want to solve a real pain point in cyber security. That's generally pretty easy. Most of the problems are real problems. But every once in a while, you find someone trying to solve a problem that is sort of tangential. It's not of

the that you really care about. And so making sure that you really are something that CISOs want or security teams are really looking to buy. Go to market. This is probably the one I see most overlooked at preed and seed investing, right? It's the idea of I've got a great product, it'll sell itself. No, not really. Or um the middle market SMVS don't have all the tools they need. There's plenty for the enterprise. I'm going to go sell the SMB. Great. How? Because getting the first five to 10 customers at $20,000 a piece isn't all that hard. It's the next hundred that matter, right? It takes a lot more to sell the middle market than it does to

sell the enterprises. Why? Because enterprises might write you a $200,000 to million dollar check. You just need a lot less of at bats. And so, how do you get that go to market? Finally, we talk about moat. There's some concept that moes are going away that any business you do that's good enough someone's going to enter u so moes are usually something you look more at the series B series C as you get later in the process but even early on how do you differentiate yourself versus the other startups the hot stakes one thing that characterizes cyber security that's different than many other parts of the market is how quickly any idea hits five or six or seven investors

right So AI for the sock wasn't a thing two years ago and now literally I can't there must be 30 that are going after that. And so how do you win against 30 other competitors that are all smart they're all capable and something maybe better fun than you. So that's kind of where we view your most. Okay. So as I said know your audience. You're trying to partner with this person. So trying to figure out how they think and then how to be on an equal playing field with that person. Right? Your job and I'll say this again later I believe is not to be a supplicant to the VC but to be a partner to them. All

right. So different types of VCs. First you've got a generalist VC. That's someone that invests across the board. Maybe they do enterprise only or maybe they do all SAS software. Right? So what's the difference between them and someone like myself or the numerous people at other firms that focus only on side, right? So your pitch is going to have to be different. If you're pitching a generalist, you're probably have to explain the problem. You're probably have to explain the space around the problem. Oh, I fit into the world of cyber security at this point, right? I plug into the sim this way. Uh I'm doing identity there. Here's the five or six competitors you need to look at. They're

going to have a less focused network. So, their diligence is going to be harder, right? It's going to be more difficult for them to prove what you're saying. And then they're just have less general market knowledge, right? So, you're going to fill all that in. On the other side, when you go to an investor who's who's cyber focused, and that might be a cyber focused VC firm like mine, but it could just be a cyber person in a generalist fund, right? There are plenty of really smart, savvy, have been in a long time cyber people at General Funds. So, I'm going to lump them all together. They're going to be more skeptical, right? They've already

seen 15 uh AI socket place, I'm going use that or PA, right? They've seen a dozen competitors. They know the history of this space, right? So, you're going to have to uh figure out how to say why now, right? The good news is you don't have to educate. you say, "Oh, I'm in the the U privacy asset manager." Great. They're going to know all that and they're going to quickly delve into how are you doing. The other piece to to think about is they're slightly harder to find. Now, this has changed. You're starting to see more and more cyber focused VC funds where that's all they do. And so, it's getting easier, but it used to be a lot more work to figure out

who they are. Okay. So, I'm going to spend a bit of time here. Because for your diligence on a fund, this is the the thing to think about. Fund size dictates check size. It dictates strategy. If you tell me the size of a fund, in my head, I can do a bunch of math and tell you their strategy, how how big the checks they write are, how they interact with their companies, generally speaking, right? And all I need to know is it's a hundred million dollar fund versus a $500 million fund versus a billion dollar fund. So the most obvious is these big billion dollar funds are unlikely to write 500k tax. It doesn't work for

them, right? The math doesn't matter. I'll get down to that portfolio math section in a second. Um so knowing how big the fund is should give you an idea of what types of checks they want to write and what you should be asking, right? So, you should of course first go in with an idea of, okay, to get 18 months out, I need X. Cool. But going to be somewhat flexible. If someone offered you 2x amount, that amount, you probably take it, right? So, you got to figure out what the ask is here of different funds. One of my partners just came off of fundraising two years ago and he likes to talk about this bullet here of it's

actually easier to raise from a $50 million fund than it is a 20 million. Why? They've got more capital to deploy and so smaller checks are a smaller part of their fund and so it's just easier for them to write that check. Right? If they lose 1% of their fund, not a big deal. Whereas a smaller fund that might be 10% of their fun. it's a bigger deal. So knowing kind of where you fit into their riskreward. So let's do portfolio math, right? If you look at the traditional um bigger funds, $500 million funds, they need to own maths up there. They need 25% of a $2 million outcome to return their fund. And that's the goal

of every investment in a venture capital portfolio. They want to return the entire fund with one investment. if you're that investment where you're the big winner and you pay for the fund and then everybody else gets them to their two or three. But that's the goal of every investment. So if you're going to take money from I'll pick an Andre Andre and they've got a billion dollar fund and they're going to take 20% of your company right they need a big outcome to return a billion dollars and that's essentially what you're signing up for. So there's a founder I know who took money from I should say but Let's just let's just pretend I won't say that's

how I say myself. Uh and he sold his company for $150 million. Pretty good outcome, right? The investors made 3x their money. They should be happy. But wasn't happy because they had bet on him as a billion dollar outcome. So they felt like they had, you know, missed a shot on goal and they would have rather put that money somewhere else. Even though they got 3x, they did they did great. But so knowing where uh your VC is focused should let you understand the why that you're signing up for. Um okay, last but not least, how many deals do they do a year and where are they in their fund cycle? Right? So if you find

a fund that does 20 deals a year, awesome, right? They they do lots of deals. Other funds only do two or three a year. Are you going to be that that two or three? It's a difference. The other piece is where are they in the deployment cycle? Are they beginning of a new fund? At the beginning, people move pretty quickly. They deploy a lot of capital because they've just got a new fund. They've got zero companies in it. They need to put the money to work. Middle of the fund, they're at their normal pace. The last deal in a fund never happens, right? It's the bar is so high that the last deal never happens. It's unfair, but the last

deal ever happens. So you should as not a supplicant but a partner one of the things to do in an early meeting is ask where they are in the fund. Now again, you can Google a bunch of this data will be okay. Crunch base usually has kind of the fund size. You have an idea. Why not just ask, right? Like what check size are you looking to write? Where are you in your fund size? Um that's a great way to get on the same page and show that you're trying to partner with the fund, partner with the VC to do what they want, right? Because your your goals hopefully are wide. So, it's a bad idea

to take money from a, you know, I think I can do a $200 million exit. Great. Don't go to a billion dollar fund, right? They're not your target man. Because to them, a $200 million exit is is not a win, right? It's it's massive for you. You own 50% of the company. You walk with $100. Great. It's great for a small VC, right? They walk away with 20 $30 million in a $30 million fund. That's awesome. Uh, but it's not good for the big ones. So, you need to know what you're signing up for. All right. So, what do VCs do and not do and how they claim? So, I'm going to use the the claim to help you. Um, and then

I'm going tell you what I've done for my companies in the last month or so. So, you'll get to see what we actually do. So, uh, cyber focused VCs are going to help you with network, right? They'll walk you into a bunch of CESOs. They'll help you with talent and recruiting, right? So, they'll they'll introduce you to sales people that have been in cyber for 20 years. Uh they'll give you go to market advice. Actually, everyone's going to give you go to market advice. So, don't don't worry about that one. Um investor connections, right? So, they're going to help you fund raise the next round. They're going to prep you for that next round. And then there's some

amount of brand that matters, right? So, um, generalists or or industry funds like um doesn't use Google Ventures. Octa Ventures would be a good one. They're pretty cyber focused. Sony Ventures, there's all these other firms that will look to a cyber focus VC as a brand of, okay, yeah, that cyber focused person's in. I'll go in as well as a generalist because I know that at least the cyber part's good. I'll look at other pieces and figured that out for myself, but the tech is good because these guys are here. So, that's what they will do. What they won't do is sell your product for you. Right now, there's been some stuff in industry with some paytoplay and blah

blah blah, but again, that is now over. Let's hope. Um, and so you shouldn't expect those VC intros to be automatic sales. You they'll open a door, but you still need to walk through the door, sell a thing, have something you want. We want to create product market fit. This sounds obvious, but again, you're gonna have to have something people want, right? Um, fixing team dysfunction, right? If you or your co-founder can't get along, there's not much they can do. I actually had a team once get like a fight on a Zoom call in front of me. Probably not going to last, right? And solve narrative issues. So, if you don't have a good story, I'm going to come

back to the story line again. If you don't have a compelling story, your VC can't fix that. That that's something that you need to bake yourself. So, all right, that's what we claim we do and don't do. Uh, just to give you an idea of stuff I've done in the past, I don't know, let's say two weeks for either portfolio companies or companies I'm trying to get invest. [snorts] Um, I've interviewed a couple different CFO candidates for my companies. They want to hire CFO. So, I'm putting them through their paces. I've made introductions to three or four cyber specific vendors, right? A marketer that only does cyber, a head hunting firm that only does cyber. Um, what else have

been up to? I made a bunch of introductions to other VCs. So, one of my companies is raising. I show it to a bunch of VCs I know and say, I love this. Here's why. Um, bunch of board meetings. Those are strategy. Uh, I think we are helpful there because we see broader part of the market than you do as a CEO who's heads down, but that can be a, you know, a questionable one. Um, what else are we up to? See if I hit everything there. Again, I make I make CESO intros. One of the things I'll do as part of my diligence is in introduce a company to a CISO and sometimes that CISO gets really excited.

That's great for my diligence. I now know it's a real problem. Every once in a while, that CESO will join as an adviser. That's even better for me, better for the company. So those are the types of things you should actually expect that will tell you. Okay. So next we're going to talk about pitching and the fundraising process. Okay. So how VCs run a process, right? It starts with sourcing deals. How do we find the companies that we're going to look at? Just to give you a quick idea, uh most firms look about 100 deals for one day, right? uh as a focused VC

as a focused VC we tend to look at a little less right because I get to toss out all the random marketplace deals that I'm not going to do but still you're going to be in that funnel so how do you get in the funnel to keep you warm intros are much stronger than just emailing a text to someone so I've done a few deals where someone emails me your deck and says, "Hey, I'm doing this thing. I'd like to talk to you about it. I've done 20% of my deals, maybe 10, 20. It's not that many." Um, I'm not hard to get to, right? I know a large swath of the industry. So, you should be able to

find a way in quickly. You know, the stuff I love is when other hackers or founders uh make an intro. That is high quality to me. When my CEOs call me and say, "Hey, I like this company." That's great. CISOs So, Coinbase calls her and says, "I'm gonna use this thing. You should take a look." Awesome. Uh, when other VCs send me a deal, it's a mixed bag. Why are why am I so lucky they're going to give something away? So, if they're a generalist and they say, "Hey, I want to do this deal if you're interested." Cool. Great. I know why I'm involved. If it's a later stage fund, um, you know, one of these billion

dollar funds calls and says, "Hey, this is too early for me. I'd love for you to take a look. Okay, it's not bad, but a lot of those people break their own rules when it comes to going early, right? So, if they really love it, they do it. So, why again, why am I so loud? Um, and then the one you really don't want is this isn't for me, but maybe you don't like it, right? Okay. So, fast filters, things that that obviously get you knocked out of the process. So, this often happens kind of after the first meeting, but it's the reason you're not getting a second meeting. You're not solving a real problem, right? Uh,

that's obvious, but it still happens. Do we think you're coachable? This one will take a little longer. Maybe coachable is not agreeable. That's not what we're looking for. We're looking for someone who hears feedback, processes it, and then, you know, that fork in the road goes one of two ways. I've heard what you said. I think it's a good idea. Here's how I'm going to do it. Or I heard what you said. I don't think it's a good idea. Here's why I'm not believing it. That's cultural, right? You don't have to do what we say, but if you're not going to think about it because you know more than I do, I can't really work. Um, realistic

valuation. So, the age of AI is now. I have people come into my office and say, "I would like to raise $75 million for my seed company, and my entire fund is $50 million, so that's not going to work out." Um, and then this one is more for focused VCs. Is it an interesting solution? I've seen 45 people try email security, right? Why do I want 46, 47, whatever? But every once in a while, you see something, you're like, "Oh, that's smart. I had thought of that. That's novel and that will will get you on the next step. So why do people say no or why don't deals happen to come together? A lack of urgency. There's no reason for

me to move. Right? So VCs like any other business are in the optionality space. We don't need to make a decision today. We'd rather make it tomorrow when we have more information. That's the nature of the beast. So [snorts] part of your job is to create that FOMO that fear missing out so the deal gets done. I'm behind by a minute so I'm going to speed it up and not go through the rest of these and assume that people understand alignments. A messy cap deal just means that I have to go figure out how to cram down your ear investors. Something's wrong. Anyway, last but not least, this one's key enough that I'll pause for it.

Uh once you get a term sheet for most early stage investors [snorts] their plan is to go through turn sheet is the okay I've got a couple things left to diligence but I want to do this for later stage investors often times the turnkey is the opening to dig okay I've given you term sheet agree terms now I'm going to do all the work to see if I want to do the deal so you need to know which of those two worlds you're in the later you go the more like bankers they are the more term sheet is an opening rather than a a kind of final process piece. All right, tactical advice. So, aim your raise based on where you

are in the company. Each round has a purpose, right? So, for preede, I'm making a bet on you and your team. You might have some traction, but not much. At seed, I want to see a P. I want to see a couple users. Maybe you've got a uh design partner going. maybe a little revenue. Uh by series A, you've got some revenue, but it's probably founder le, right? That means the founders made the sales. First one to $3 million probably needs to be founder, right? It's where you can bring a salesperson in before that work. U so your series A is to figure out how to transition it from founder sales to a salesperson. Series B

and beyond is pouring gas in a fire, right? You know, you can hire salespeople. You know how to get them to be productive and therefore I'm a hire a salesman marketing. I'm not going to read the deck piece to you. There are plenty of great talks that are just on how to build your deck, but 8 to 12 slides. Hit those things. Um, yep. I'm because of time, go Google one of those. All right. How to engage in early VCs. Uh there's a a phrase I like. Uh if you want uh if you want advice, ask for money. If you want money, ask for advice. So you want to get involved early when you don't actually need the

money. All right? You come in, you say, "I'm not going to be raising for another two to three months. When I'm raising, I'm going to have these things in place to make you excited. Ask what things I want to see." So on so forth, then come back two, three months later with those things. And I've learned a ton. I've learned that you can execute. I've learned that you can follow up. I now feel much better about our relationship. It's still early, right? It's hard to call three phone calls a relationship. But that's what you're trying to lay the groundwork for because again, these are marriages. You're going to be with your VC for 7 to

10 years. I hate to say it, but I think most veteran relationships last longer than than most marriages in the US. So, like you you want to make get off the right. Um, and then we hear from a VC, but I'll say it. Sometimes venture capital is not the right answer for your company, especially if you're a services company. Cyber has a lot of great services, a lot of great services companies where you can walk away with two or three million dollars in your pocket every year. That's a great business. It's not a great venture capital business, right? The idea behind venture capital is we're going to put gasoline in a rocket ship and either you

blow up the launch pad or you make it to Mars, wherever you go, right? That's our model because we can take 20 bets. It's probably not your model in that you're making one bet. So know that that's the bet you're making and whether it's appropriate for what you're trying to do. Okay? So these are real mistakes, but I'll give the butt in a second. Top mistakes founders make according to these things. These are the reasons we say we're not interested. um you're focusing too much on your product, not enough on how to get to the market or who the market is. So, no one wants a five, six inch drill bit. What they want is a five six inch hole. And

too many people focus on how cool the drill is, right? I don't know. I'm a nerd. I've been a hacker for years. I love playing with technology, but that's not what I want to hear [snorts] when I get pitched. So, next one. Pitching VCs like that engineers. I'm susceptible to this because I was an engineer, but honestly, I don't really care, especially the first couple meetings. Um, oh, 25, right? I got I'm good. Uh, I don't care how you're going to do it. I care what you're going to do and how you're going to get to meeting. Know your ICP. Don't play buzz word bingo. I have great examples of buzz word bingo and skip them. Um, last but not least,

don't dismiss your competition. It shows you haven't done your homework or there's no mark. So, the real estate founders make and great engineer is not having a compelling vision and story. All those other things can be overlooked if you have a compelling vision and a story how you're going to get there. I see the future. It's an AI enabled sock where humans look over the process but don't have to get involved dayto day and here's how I'm going to get there and here's the way I need that makes unforgettable story and a pitch that you can't see that. Thank you very much. [applause]