Investing in Cyber: How to Raise Money for a Cyber Startup

Transcript

- [Man One] Test, test. - [Katie] No. You're not gonna sit. Okay, everyone, we are about to get started here.

Thank you so much for joining us bright and early early on the first morning of RSA. So this panel is about Investing in Cyber: How to Raise Money for your Cyber Startup. So hopefully that is a topic of interest to you folks.

I'm gonna kick things off with some introductions of the panel. We're gonna talk about a few things this afternoon or this morning. We're gonna talk a little bit about different sources of funding for cybersecurity startups, a little bit about the macro economic environment and how that's affecting funding, and then lastly, we're gonna talk about some real kind of tactical advice if you are a founder of a

startup looking to raise money. So just to kind of kick things off, this group up here, this is a group of cybersecurity investors. We've known each other for a while. Between us, we've done about 160, we have funded about 160

cybersecurity startups to the tune of definitely over a billion dollars. So definitely a lot of experience up here on the panel. So before I get started, I'd like to know, if you could raise your

hand if you in fact are a founder of a cybersecurity startup or thinking about founding a cybersecurity startup. That's fantastic, and shout out to the women out there. Certainly a little bit of a sea of men, but a few women in there too.

How many of you are investors yourself? Okay, so we've got a good percentage of investors too. That helps us sort of frame the conversation up here. So let me start.

I'll just kind of go down the row here. Rashmi, why don't you start by introducing yourself and B Capital and then we'll go to the rest of the panel. - [Rashmi] Sounds good, thanks, Katie, and it's really nice to be here and great to see an amazing group of folks in this room here. I'm Rashmi Gopinath, I'm a

general partner at B Capital. We're a multi-stage VC fund. I'm part of the growth team mainly focused on investing in enterprise software companies. Cyber is one of the themes

that we actively invest in. Our global fund, and so investments across pretty much all continents at this point. We have a team of investors, as well as a value-added services team that helps our portfolio companies on a variety of different projects all the way from exec recruiting to capital advisory, business development, and

strategic consulting services. It's really exciting to be here and look forward to the conversation. - [Andrew] Great, thanks, well, first of all, thanks, Katie, for having us up here. It's always such a great opportunity to be amongst friends here and see so many familiar

faces out in the audience. My name's Andrew McClure, and I'm with a firm called Forgepoint Capital and Forgepoint Capital, our mission is quite simple. We back founders, entrepreneurs

who are doing one thing and doing it well, and that's defending the digital world. So we are a cybersecurity-only, cybersecurity-focused venture firms. We had our genesis about seven years ago, making us one of the first firms to take this specialist fund approach and we can talk about what that means as far as the team that we have, the companies that we choose to invest in, but more importantly how we choose to build value together. So today, at Forgepoint, we manage over $1 billion.

We have invested across more than four dozen cybersecurity companies, across all the areas that you might expect and some that you might not expect, whether it's cloud, application data, network, endpoint security, but also adjacent areas like FinTechs and SureTech, compliance and anti-fraud as well. And so a big part of our investment philosophy is trying to do one thing and if you look at the team, you can see this because it's built within our diverse DNA where we're comprised of former founders, longtime investors,

operators, technologists. My own background, I spent the early part of my career like a lot of security practitioners and for those of you who were here in the last panel too, I was a military member. So came out of the US

intelligence community, military service where I had really gotten a lot of early technology exposure. But you look across the team and what we're trying to do is really help founders build companies that matter and we do that with the incredible talent and support behind us, whether it's helping you think about marketing, sales, your next hires, or even product strategy. And so in that sense, capital in many cases can be commoditized, but expertise and somebody who can help pave that path for you oftentimes cannot.

- [Sid] Thanks, Andrew, and thank you, Katie, for inviting us all over here and thanks everyone for joining. My name's Sid Trivedi. I'm one of the partners at Foundation Capital.

We're an early stage venture firm. We've been lucky to be in business since 1995. We're currently investing our 10th fund and we invest at the very, very early stages.

That means seed and series A and most of the work we do is seed. In fact, 80% of the investments we make are pre-revenue and we invest in three broad areas, enterprise, FinTech, and crypto. I lead our investing efforts in cybersecurity.

I've been lucky to be in this business for the last 12 years in cyber and I've been at Foundation for the last five years. - [Katie] Great, and just to introduce myself as well, so Katie Gray, I'm a senior partner at In-Q-Tel.

And for those of you not familiar with In-Q-Tel, we are a strategic investor. We'll talk a little bit about in a moment the difference between a financial investor and a strategic investor. But we're a strategic

investor that is investing on behalf of agencies in the US government, primarily in the intelligence community. So we're founded in 1999 or set up as a private independent, actually nonprofit, you don't hear that very often in the venture capital world, but nonprofit organization

that is investing in innovative technology to apply to use cases within, innovative technology in the commercial sector that we can apply to hard problems within the intelligence community. So cybersecurity is one of multiple areas that In-Q-Tel invests in. I lead our cybersecurity

investment practice. We've got a great team of folks here at RSA this week as well. So in terms of cybersecurity companies getting funded, I wanna kind of kick things off with talking about if you're a company just forming, you're looking to get funded or maybe you've already raised your seed and you're looking to get a series A, I wanna talk a little bit about

different ways to get funded and I sort of intentionally here have Sid who's really focused on the seed, Andrew who's seed and series A, Rashmi, who's B and beyond, right? So these are all different stages of a company that you might be looking toward, and really there's three primary ways that I want us to kind of talk about up here. One is obviously you can self-fund a company.

You can have services or contract work, fund the company yourself, build it up such that you have enough revenue to pay the people in your company and kind of grow your company that way. Secondly, you can raise venture capital and obviously the folks that we have up here have a lot of insight into how you can do that, and the third way is to

leverage government grants, loan programs, bank loans, and things like that, and so we'll get to that one at the end. So Sid and Andrew, I'm gonna start with you two. You're both investors in

early stage companies. Can you talk through what it takes to raise a seed round or a series A from VCs? What do you consider to be some of the kind of the key characteristics of companies that should go out and raise venture capital versus some of these other funding mechanisms? - [Sid] Sure, so there's a few things and the way I would describe it is as investors, and I'll let the rest of

the panel chime in here, but as investors we look at four big things. We look at team, market, product, and metrics and I mentioned that when we invest, about 80% of the investments we make are pre-revenue.

So the last bucket is not as relevant when you come and speak to us. On the enterprise side, about 65% of the investments we make are also pre-product. So many cases there isn't really a product that we can look at and spend time with. So really the thing that I'm looking at when you come into the room and you speak to us is really

the background of the team, what makes the team unique and what makes the the market and specifically in cybersecurity, the sub-market that you're going after truly special? And so as you're writing a pitch deck and you're preparing your presentation, make sure that you highlight what makes this team so special? Why do you have the domain expertise? What's so special about the team that you've put together versus others? And then on the market side, really drill down into the market. Provide some perspective on what's going on broadly in the cybersecurity industry, but also very specifically in the sub-segment of the market that you're going after, and talk a little bit about

the competitive landscape and why you believe there is a shift which provides an entry point for you to go and build a new company. - [Andrew] Yeah, thanks, Katie, the nice thing about your question is that as you move down this line, I think the mix of how we all approach team technology and market will somewhat change

between early seed, A and B, and then also growth stage. Now where we sit, we're generally investing in companies that have demonstrated product market fit or beyond a semblance of product market fit. Particularly at the series A, for the series B, you begin to get a bit more metrics-driven and why is that important? Well, I think it should

be apparent to anybody in this audience that as soon as you walk downstairs and you see 1,100 different vendors and you see over 3,500 cybersecurity companies in the market, it should tell you a few things. One, it tells you that this is a very dynamic market. We have not only a lot of great inventors,

innovators, entrepreneurs, but frankly there are in some categories lower barriers to entry than others. So what makes you different? What makes your business defensible? In some cases there's a lot of noise depending on what category you choose to pursue and maybe you're even creating a category, and that can get really exciting as well. And so what we wanna focus on then in that case is who are you selling into? What does that buyer persona look like? Do you have proof points? Do you have references then that we can reach out and touch and see if the product

works, can you scale? Now granted we're focusing primarily on enterprise-grade technology sets here, and one of the things that we built at Forgepoint Capital is a very robust security advisory council and these are the protagonists of the industry if you will. These are CISOs, heads of security at very large companies, small businesses who help

us not only think about where the market is going and help de-risk that component because the other two areas when you think about technology and team, those are areas that you can change, you can affect, you can hire around, you can build around. But market, and I think we'll talk a little bit about this as well, the market's getting a pretty significant vote in this environment, so we'll say a little bit more about that, but why does that matter? It's because as you're going from five, to 10, to 50, to 100 employees, it's a very different mix of capabilities you need on the team.

How you think about approaching your sales organization, when to hire not just your first rep but your first product manager, and so on down the line. And so what we wanna do is really focus on backing businesses that have semblance of product market fit that we can help create or move to become category leaders in their respective fields. - [Katie] And Rashmi, you focus more on the growth stage, so series B and beyond.

A little bit Sid and Andrew both touched on the importance of the market and I think that's really important. Not just that you have a great technology and there is a market for it, but the total addressable market and the scale of the market. Can you talk more a little bit about the metrics that you're looking for at

the series B and beyond? And also maybe talk a little bit about the importance of the market size and validation points around that size. - [Rashmi] Absolutely, so everything that Sid and Andrew said still holds at the growth stage and so the four things that Sid talked about, those four continue to be equally important at the growth stage as well.

Team by far is the most important metric and that's regardless of stage. We don't want to make sure that we're backing teams that have the ability to execute against the big bold visions that companies usually start off with. On the metric side, that becomes incredibly important in growth stages and so I'll break down growth

into kind of the early growth and the late growth side. Early growth typically would be in that series B through D stages and then you've got the late growth which is the D and beyond. Across both stages, metrics matter and one of the things that we encourage companies to think about is when you are looking to raise capital in those late growth stages or even the Cs or the Ds, the qualifiers that we look for is is this an IPO candidate or is this a company that

becomes a billion plus in scale because again, the valuations tend to grow higher as you're coming down on the growth side and so from a return standpoint, we need to ensure that the market is huge, the opportunity is huge, the exit's going to be huge. And so if we see the category more as a tuck-in category which kind of is well suited to become part of a bigger company and then most of cyber acquisitions typically happen in that 200 to 500 range, then coming in at a valuation of three to 500 for that sector or that theme probably would be less interesting.

And so for companies that we look at, one of the key aspects that we assess is how big is this team? And does this company have what it takes to kind of become that public company or a billion plus in exit if they were to get acquired by somebody else? Now if they were to get acquired at somebody else at a billion plus, that universe is really small and that is a set of folks that we work with pretty closely, the Microsofts and the Salesforces, all of the big tech acquirers in the ecosystem to kind of understand what are the pain points, where would they be placing

acquisition bets in? Is this a space where they would, their corp dev teams would come in and push an acquisition at this scale and at that size? And if they already have bets in that space, how likely would it be for them to acquire in that space? And then finally I would say all of the typical enterprise metrics that we look at on the SaaS side still continue to hold on the cyber side given that most business models mimic what we see on the enterprise SaaS side where it's either a seed-based,

a consumption based-pricing or a subscription license based-pricing. And so metrics on LTV to CAC which helps us assess what is the sales and the go-to-market efficiency of the team. - [Katie] What is LTV to CAC? Just to make sure that the acronyms are being...

- [Rashmi] So we look at the lifetime value of each of the accounts and then how much does it cost to acquire a customer? And typically what we look for is a metric that's at least a 3x or has the ability to kind of improve and get close to that 3x on that scale. Net dollar retention is another metric that we pay a lot of attention to and that really shows how much expansions and upsells have you had within your existing customer base.

From a growth standpoint, as companies get at, I would say a 50 or an 80 million plus in ARR scale, it becomes more and more difficult to double and triple your revenue at that base. And the higher your upsells and expansions can be, that becomes a really high, I would say or a more consistent way to drive growth going forward. And so if you're sitting

at a net dollar retention of 120 or 130%, then that 20 to 30% growth just comes from your existing customer base. And so in terms of the new sales or the new growth that you need to go after, that I would say as you're getting to scale, it's gonna be more and more difficult.

But you can still achieve pretty high growth rates if you have that strong net dollar retention base. And then finally I would say we're in a market environment where we're back to basics.

Profitability matters, growth at all cost is not as great as what it used to be two years back. And so rule of 40, the ability to get to cash flow breakeven, ability to get to profitability are things that we look for as well. And so building a durable, efficient, scalable business that has the ability to then sustain that value in public markets, demonstrate consistent

growth in public markets, those are some of the factors that we look for at the growth stage. - [Katie] Yeah, so Sid and Andrew, turning it back to you in terms of I think that's a great explanation of some of the things you're looking for when you're funding early and later stage growth companies. How important is size of the market when you're funding a seed stage company or a series A stage company? Are you looking for companies that are ultimately going to IPO or is a tuck-in or an acquisition in the two to $500 million range also provide your funds with a good enough return? - [Andrew] Yeah, I'll

take a first stab at that. It's an interesting dynamic I think that we see across cybersecurity. Nine out of 10 companies as they successfully exit are tuck-ins, right? They're M&A below 500 million, 80% below 100 million, right? And when you think about that, this is a market that still has less than two dozen public cybersecurity companies.

We have over 90, nine-zero, private unicorns. So can the market really support that? We can talk about why I believe the answer is no, but more importantly is what happens with the other 3,400 cybersecurity companies that are out there that have perhaps taken

funding, aren't growing, and really need to think about how they build a business. And it's okay to be a point solution. It's okay to be a platform solution. Not every company we invest in, do we have an expectation that

this company will go public. In fact, nine times out of 10, we construct our portfolio to have a mix across those by duration, by stage. And so we're very deliberate around where we come in either with early As and late Bs and at what time in the fund, and all that's fun dynamics and I don't wanna bore you with all that.

But just to give a sense too of where the market is at, I took a look at just last week a 12-month reverse scan on 950 cybersecurity companies that we know and track and I compared this against the website that many of you all know that tracks tech layoffs, so layoffs.fyi. My belief based on the data that I have seen and the proprietary data that we use is that that underestimates layoffs in the cybersecurity industry by about 2/3, why is that? Because out of 950 cybersecurity companies that I have high fidelity data on, 32% of those were reducing

headcount last year. So think about that. Why is that the case? And another 1/3 of those companies had some sort of a hiring freeze through 2022 and into mid-April, this month. So really only 1/3 of

companies have we seen are growing in any way and there's a funding dynamic that I think is closely coupled with that. So when we bring this back to the market, if you're investing in a point solution and coming in at an entry that really the only way is to have an IPO type exit, you're gonna find that your investors become quite disengaged once the company reaches the first sign of trouble, right? And so bringing this back to our philosophy as investors, why does that matter? It's because when you look at the market dynamics and by being very focused in this market, we believe we can also be disciplined.

And so we throttled forward during the shutdown period in mid-2020 and there was this four to six month window where we saw a lot of investors sitting on the sideline. We're seeing that again. We're seeing that again

for the last 12 months from about Q2 up until this year and we're throttling forward again, investing out of our new fund when a lot of late stage growth investors have really seen the market reverse and are pulling back. So there is a full 50% less capital deployed in the market in Q1 of this year than in Q1 of last year. So what does that mean? That means that capital

is harder to come by. It means that the fundamentals of a business are much, much more important, all the core metrics that Rashmi had described. And it means that the dynamics

that Sid had focused on which is how important is the team and the market you're focusing on so that you can drive toward a successful outcome given the size and scale of your business? And I'll give you one example where we invested in a company frankly that we knew and we called as a point solution. They had a very specific capability that they developed in the runtime application security space.

Great technologists, great teams, but if you ask Gartner anything about the market, they would've given you the two year rear view mirror look on this space, but they didn't even cover it. And why is that? Because they have to focus on big categories and so for us, that's not a negative

signal in due diligence. That's a positive signal because here you had a category creating business that turned out to be a 600% plus IRR investment for us. And so there are ways to really focus on these core technologies

and core businesses and then why are there outcomes like that? It's because companies, large strategics who are the ultimate acquirers here in many cases, realize that they can plug in that solution into their entire sales force and sell that across a global network. And instead of paying 10 or 15 times revenue, they pay one or two times forward revenue because of the synergies

that they can realize across their entire business, and that's why you continue to see that segment of the market so prolific and so active. - [Katie] All right, Andrew's answered a bunch of my questions there in that one talk there, but anyway, Sid, did you have more to add to that? - [Sid] Yeah, maybe let me just add one more thing to Andrew's point.

I think Andrew mentioned kind of the view of a specialist investor. In the case of Forgepoint, what they invest in is cyber. That is their core focus. For Foundation, as I mentioned, we do a whole bunch of different things. So when I sit down with my partners, the big decision that I need to make is is this going to be a

category defining company period? And if that cybersecurity company is not in my opinion gonna be a category defining company, then I'd much rather have that capital go to an amazing FinTech company, or an amazing crypto company, or an amazing generative AI company 'cause that's the craze these days. But to just further highlight and give some perspective on when we say big markets, what does that mean, right? Typically to be able to go public in the cybersecurity market today and Andrew mentioned there's about less than two dozen public cybersecurity companies, you have to get to about

300 million of revenue. That's where you got to be, and you have to be growing over 50% right now in this market. So our assumption has to be that at 300 million of revenue, you probably have about 10% of the market. So that's $3 billion.

You have to assume that the market is a $3 billion market at the get-go. That's a really, really important stat. Now that doesn't mean, there are many cases where we, probably before SIM existed, no one thought about the SIM market as a multi-billion dollar market. So we do have to recognize that there will be new markets formed, but we have to believe that hey, is there an opportunity to go and see this becoming a

multi-billion dollar total market before we go and invest? - [Katie] Yeah, those are really great points and I think just to summarize what I'm hearing is that you need to have a very large market that you're going after. For some firms, I think

probably for everyone, but in particular firms that are not just focused on cybersecurity, you need to be able to convince an investor that this is a huge market and that you are going to be the category defining company in that market. For specialty investors, maybe there's a little bit more, there's kind of more

of a portfolio approach where an exit that is an acquisition by a strategic acquirer might also be a good option. And I will tell entrepreneurs that are out there don't be discouraged if you go to Sid and he doesn't invest in your company or Andrew or Rashmi. You might need to talk to dozens and dozens of investors.

You really only need that first one to say yes and you've got to have a lot of resilience if you're a founder out there looking for funding. I wanna talk a a little bit about a couple of other ways.

So obviously venture capital is one way to fund your company. There are examples of companies that have not raised venture capital funding and are still very highly successful companies. I'm gonna talk a little bit

about one, strategic investors and two, government grants and so sort of options there that also could provide funding for your company. So In-Q-Tel is very much a strategic investor and by that, I'm distinguishing it from financial investor in that the reason we invest in companies is to help bring capabilities

to the government agencies that we're working with. While we don't have financial metrics that we're trying to meet, obviously we wanna invest in companies that are going to be successful. Maybe gonna be category defining, but certainly going to have the staying power kind of longevity to bring great capabilities and products to the government market. So strategic investors. In-Q-Tel is one of those.

There's a lot of big corporates. Microsoft and others have strategic investment groups as well. They tend to not lead rounds, so you're usually having to also find a venture investor and they tend to also be looking at a lot of the same metrics, but also can potentially bring to you some strategic value in terms of commercial opportunities, partnership opportunities

with the big companies. In In-Q-Tel's case, when we work with companies, we are typically helping them adapt their commercial product to something that will meet specific use cases or bring new capabilities, innovative capabilities

into the government market. And on the government side, let me just touch on a couple of things there as well. So some of you may be familiar with DIU, the Defense Innovation Unit. The DOD, across DOD there's a

lot of innovation activities and funds and things like that. We've got Johnson Wu I see here sitting at the front who is with DIU. So DIU and some of the other, there's AppWorks, Army Futures. NavalX, there's a number of

different DOD-focused funds or not funds, but activities that are kind of leveraging things like other transaction authority, OTA, within government procurement to be able to rapidly procure technology. Some of the other innovation groups are leveraging the Small Business Innovation grants or let's see, SBIR research grants, so the SBIRs.

And also on the early side, you've got things like DARPA and the intelligence community also has their own ARPA which is called IARPA. But all of those activities tend to be focused on specific types of technologies that are in demand and sort of on the DARPA side of things are sort of a research, kind

of future looking on the DIU and the various services innovation groups. They're really looking for things that are in the market right now that they can kind of rapidly procure and bring to bear within those organizations. Does anyone here have an example? So one of the things we

haven't really touched on is when is it appropriate or when does it make more sense for a company not to raise money from venture capital? I think if you can think of the inverse maybe in some ways of the things that we've talked about here which is you're not going out, you're going after maybe a more niche market. There's also already a ton of players in the category and you know you can get up

to 10 million in revenue, but you don't necessarily see a pathway to 300 million in revenue. Are there some examples that you guys have of companies that have sort of successfully started with more of a services or taking contract work kind of beginning and have gone on to be successful companies? - [Sid] I think the two that I'll just mention, one, Thinkst Canary,

Haroon Meer is here today and I think he's speaking later today or tomorrow, and they're also a sponsor. And certainly in the early days, the concept of having just a simple canary just felt very small, and Haroon was building the company out of South Africa and I think it was a realization that going after cybersecurity investors would be particularly difficult to do. The other person I'll mention is Ron Gula who's one of the founders of Tenable.

Tenable actually was founded in 2002 and it only raised its first round of funding in 2012. 10 years later it raised a $50 million what's called series A, but it was effectively a growth round as Rashmi would confirm. Those are just two examples of companies that have done particularly well, the second having gone public and being one of those dozen, two dozens, sorry, cybersecurity public companies that have actually done

as good as possible and have different approaches to not going and raising venture capital funding from initiation. - [Andrew] Let me just a give couple quick examples on productizing services business which we've done three times now. The first was a service or

offensive testing company that was really one of the largest standalone pen testing companies in the market. Pure consulting services business like that really would not focus on taking venture dollars.

Now what we realized was that there was an opportunity to then productize a lot of that and that's when really it made a lot of sense to build this business. First, create a tech-enabled platform and then ultimately a product. So that's one example and then another one where we invested in a female founder who had

started a VAR services business and for a decade had been focused on building this business, and then ultimately wanted to build a product out of that. And so we've done that again and then another company out of Oregon, very similar story.

Focused on services and then we come in, funded the series A in each one of those three examples to really productize that. And that's very hard to do and it's why when you focus on late stage, a lot of the sponsors may do, you'll see a category of sponsors that will do tech enabled services business. It's a very healthy market.

You see that less so in venture because venture is usually funding say product oriented business and it's a muscle memory that we've been trying to really exercise quite lately. - [Katie] Do you have anything to add on that, Rashmi? - [Rashmi] I mean, at the growth stage once they come to us typically for funding, they've raised funding

from the earlier stages. So I would say it's more rare for us to see a company that has never raised funding before. We do sometimes approach companies that have built a profitable model by never having raised capital before. But again, the likelihood of them now wanting to take venture funding is low just given that

they've figured out a model on how to build a scalable business without investing. - [Katie] Great, so I think I'm gonna put the market dynamics to the side for a moment 'cause I think what I'd like to do is focus a little bit on sort of brass tack.

How do you actually go about okay, you've got this great idea, you've got a team, you've got some industry knowledge, product knowledge. How do you actually go about approaching investors, raising money? And maybe as part of that we can talk also, you can touch on 2022 versus 2023, right? To Andrew's point, there

has been a 50% reduction in the funding that has gone into cybersecurity startups. For those of you who are at the previous session, there was some conversation around are we still investing? Have we shifted, are we investing kind of earlier stage and later stage? And so if you're at the series B or C, people are not giving

that as much attention. But maybe I will start with you, Sid. Can you talk about what advice would you give a founder who wanted to talk to you, for example, about a startup that they were developing? What's a good way to get connected to you? What's worked, not worked in the past? Do you have to have already had a successful startup and an exit or maybe talk a little bit about how you would go about interacting with founders right now. - [Sid] It's a great

question and very important. Firstly, let's start with what you shouldn't do. Don't send a generic email to 500 of us. I mean, Andrew, Rashmi, Katie, and I will all have seen

those kind of group emails where we're all included and it just says, "Hello Investor, I am building blah, blah, blah." It's a two-page-long email and it's not helpful. we're gonna delete it immediately. That's one thing you should not do. Do not send an email where you get confused on which fund

you're kind of pinging. The number of times I've gotten a note which says, "Hello, Andrew," for example. I haven't gotten that note specifically for Andrew, but, "Hello. Andrew, I'm blah blah, blah.

I want to really talk to Forgepoint Capital," and I'm looking and saying hold on. I'm at Foundation Capital, my name's Sid. This is odd, I'm gonna click delete. Mostly it's not because I feel unhappy or something that

you didn't recognize me. It's just that it shows lack of purpose and focus. If you're not gonna spend the time, then candidly why should we spend the time to read the email? So really spend the time first understanding who you are reaching out to.

Secondly, understanding what investments they have and thirdly, understanding well, what would make for an interesting conversation with them? Why are you reaching out to them? What specifically would you like to talk about? Make these emails relatively short. Don't do the two-pager 'cause what ends up happening even if you've made it very

customized, it's a two-pager, I'm gonna click flag on it and I'll get to it two weeks from now because there's too many things happening in the world. So try to keep it short, keep it brief. I make two commitments. One, I read every single

email that comes in. Whether I respond to it or not is the big debate. Two, I read every single LinkedIn mail that comes into me.

So if you wanna reach out to me, you can ping me on LinkedIn, you can send me an email, and I'm happy to reach back out as long as the first two points are not met. - [Andrew] Yeah, and I would say this. At Forgepoint, we might invest in 10 to 12 companies any given year. We might want to invest in 100, right? So for every 100 companies that we see, we might make one investment.

That's just the ratio and so oftentimes when we do invest in companies, it's because we've built a very much of a longstanding relationship. We've known the company for several years. Perhaps these are repeat founders either inside or outside of our portfolio.

Maybe we backed them before, maybe we didn't. Maybe we learned about the company first from a customer of those. Those are always high quality introductions for us, or maybe we even did a lot of

diligence in the A in past. We saw the company grow, and build, and mature, and really become a category leader and then we had a lot higher conviction. So there's a lot of different ways where we can develop conviction. I see Neil in the back there and one example of high

quality introductions comes from people like Katie to say you know what? Here's a great company that's doing awesome in Europe. We need to duplicate this success in the US.

And so it's other co-investors like Sid and Rashmi as well where we say you know what? This is incredible validation, what they're doing in this market because we were able to talk about that and we've had the privilege of co-investing with In-Q-Tel more than we have anybody else. So if your board is not working for you, then what are they doing? Are they coming in every quarter? Are they not providing value? Building a company is hard and not everything goes in a straight line.

And so when you hear 99 nos to get to one yes, it can be frustrating oftentimes. But that's the level of grit, and determination, and dedication that we love to see at Forgepoint and what really gets us excited.

- [Katie] All right, I know we're running short on time. I'm gonna just open it up to Q&A in just a moment. How about you, Rashmi? Do you get just unsolicited

emails from investors or when you're at the later stage, is it more you're finding them and you're working with their investors? - [Rashmi] Unsolicited emails and LinkedIn posts all the time. But like Sid said, I read every email and every LinkedIn post that comes to me. In terms of the number of investments that we make again, at the growth stage because the check sizes are higher, it's fewer number of investments and so I look to make somewhere between three to

five investments every year. Our check sizes are usually between 30 to 80 million that we write on the growth side. We tend to be very thematic, and so we have our sectors and sub-sectors where we're spending a lot of time and where we're researching this space, we're researching companies.

We usually have a target list of companies that we're looking to go after and we reach out to investors like we have here to get introductions, to get to know companies. We're usually tracking companies for several quarters, in some cases several

years, before we come in and make that investment. That being said, if one of the investors in our network sends us a company that we may have missed in our analysis and says this is one of the best companies in our portfolio, you should take a look.

Absolutely, yes, we will take a look at those. What we also like is when the founders have done some research on us and we see a number of founders reaching out saying that we see you've invested in these companies, in these spaces. Your thesis aligns with

what we're trying to build and that's always a great validation to see the research that and the time that founders are taking to get to know us as well. - [Katie] All right, I have a bunch more questions here, but we are running short on time and I do wanna open it up to folks in the audience if you wanna ask questions please. There's two microphones here.

Please just come up to one of the microphones and ask a question. - [Kujong] Hi, I'm Kujong from Microsoft. I have a question about business model. So firm business model could be better or open business model? Which business model is kind of flexible? So what we're doing for cybersecurity is we make your CPU speaking billions machine

language at the same time while the language gonna be switching at the time. So we have a double lender. (indistinct) - [Katie] So I just wanna make sure. If you have a pitch,

come up to us afterward. So did you have a question? - [Kujong] Our business model. - [Katie] Pardon? - [Kujong] Our business model vision... However any partner or investment, it could be different. So I will know by the end.

- [Katie] Okay, yeah, we'll talk afterward. - [Man Two] Thank you for your insights. I have kind of just a question on how do VC funds typically view, let's say you're a startup, you're moving along, you've invested in them, how do you typically view the prospect of let's say a strategic

merger with another startup? And what kind of impact does that have? - [Rashmi] So it's something that we have seen a few different times where we will see synergies between two companies. It could be in the same space or it could be an adjacent space where the boards and the companies agree it kind of make sense to put the two assets together.

If it creates a creative value down the line, provides a faster path to an exit or an IPO, gives the ability to sell to an even bigger TAM, an even bigger opportunity, I think it's great.

There are complexities in the execution and the tactical aspects of how do you make it work? Is it a merger of equals? Is it one company that's bigger, another that's smaller? Who is the management team of this combined entity going to be? How do the investors get comped for the ones that are looking to exit their position? So the tactical aspects are challenging. But in terms of the accretive value that has a potential to create something bigger, it's very exciting, so very positive.

- [Katie] And probably at the earlier stage if you're talking about super early stage, there's probably a lot less complexity to it. It's really just about the cap tables and making sure that your investors are happy and that you're not together a valuation that sort of is outside the range of what an investor would

be willing to support. - [Man Two] Cool, thank you. - [Katie] Thank you. - [Man Three] Okay, I wanted to ask about how do founders choose between strategic versus financial investors? And even between financial

investors like venture companies what the founder should look when they want to choose one, right? I understand in today's market, it's different if you want money. But for longer term relationships with, as you said, we need to build big businesses. One way from, Katie, when do you choose strategic versus financials? Are there type of companies

where strategic works best or does financial works always best? And between financials, are there companies which you should say hey, you should work with me versus this? How do VCs differentiate. - [Katie] That's a great question. I think in part it's sort of how do you diligence the investor? They're gonna do their diligence on you. Quickly I would say for

In-Q-Tel specifically and maybe this applies to other strategic investors, we don't always have to have that promise of an IPO at the end. So if you have a technology in our case that you think is really relevant and bringing sort of a breakthrough innovation to the commercial sector that you think also has government applicability, it's great to approach us.

Does anyone else have another comment on sort of how to choose your financial investor as well? - [Rashmi] Maybe just adding on the strategic one. So prior to B Capital, I was at Microsoft Ventures and Intel Capital before that. The key question really is

what is the joint synergy between you and the corporate that you're trying to work with? So in Microsoft's case, many of the founders that we invested in saw a path to a joint partnership with Microsoft on Azure or some other business, same with Intel, some synergy with a product line within Intel and that always works great. On the financial side, I would say there's a whole variety of things that you would look for. If you're looking for someone that has a very specific experience in a specific domain like Forgepoint and CyberInvest, AI-specific funds, then you would look for, I

mean, funds with that experience and maybe partners that have experience in a certain domain who you really want on your board for the value that they can bring to you or it could be that there are other of your peers that are funded by this fund that you've heard great feedback on. There is definitely a lot of matchmaking that happens in this process. - [Katie] Do we have time

for one more question? No, we don't, okay, I'm so sorry. We've got a successful founder here though who many of you could probably go talk to to get good tips. We are at the end of this session. I wanna thank everyone for coming out.

We're happy to stick around I think for a few minutes if folks have additional questions that they wanna ask, but thanks for coming and have a great RSA. (audience applauding) All right, for sure, yeah, hi.