Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / 106: Momentum Cyber’s Cybersecurity Almanac 2022

Transcript

106: Momentum Cyber’s Cybersecurity Almanac 2022 · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:41
  SPEAKER_00: Welcome to episode 106 of the Sales Bluebird podcast, where we know it is hard to get go-to-market fit, scale up revenue, and grow the sales team at B2B startups.
• 0:53
  SPEAKER_00: And Sales Bluebird exists to provide tips, tricks, experiences, examples, ideas, and inspiration from people who've been doing this for a long time.
• 1:02
  SPEAKER_00: All so that your path to go to market fit is less rocky and you can grow sales faster.
• 1:09
  SPEAKER_00: I am your host, Andrew Monahan, and today we're going over some takeaways from the Momentum Group's 2022 Cybersecurity Almanac.
• 1:19
  SPEAKER_00: But before we get into that, I want to hear from you first.
• 1:22
  SPEAKER_00: I want to hear what's top of mind, the questions, the thoughts, the ideas, the struggles you're having that we might be able to address on the podcast, either myself or with one of the guests I have on from time to time.
• 1:35
  SPEAKER_00: You must have something that's burning inside of you right now.
• 1:38
  SPEAKER_00: And if you do, please send it to me directly at andrew at unstoppable.do.
• 1:44
  SPEAKER_00: That's unstoppable.do.
• 1:47
  SPEAKER_00: DO at the end, not com.
• 1:49
  SPEAKER_00: Or if it's easier for you, send me a video or audio message at zipmessage.com forward slash unstoppable.
• 1:57
  SPEAKER_00: In that tool, zipmessage, you can just quickly hit record, record yourself, video or audio, and send it to me immediately.
• 2:03
  SPEAKER_00: And even we can go back and forward if we want to have a quick conversation asynchronously.
• 2:08
  SPEAKER_00: So really powerful tool.
• 2:09
  SPEAKER_00: But yeah, please let me know what's top of mind for you right now that we can address on the podcast.
• 2:13
  SPEAKER_00: Back to the topic for today.
• 2:15
  SPEAKER_00: So Momentum Cyber is an investment bank that deals only with cybersecurity companies, the cybersecurity market.
• 2:23
  SPEAKER_00: It's headed up by Dave DeWalt, and some of you may know or have heard Dave's name over the years.
• 2:29
  SPEAKER_00: He was a CEO at McAfee for a while, and then also at FireEye and Mandiant.
• 2:33
  SPEAKER_00: Long history in cybersecurity.
• 2:35
  SPEAKER_00: He's got his own investment fund called Night Dragon, and he also heads up Momentum Cyber, the investment bank site.
• 2:41
  SPEAKER_00: They released a report recently and they did a call on the call where a few of the team for Moment Cyber, but also Dave DeWalt, Robert Hershevik was on there.
• 2:49
  SPEAKER_00: Many of you may know Robert as the head of Hersheyberg Group in Cando, a systems integrator or VAR for cybersecurity, but also he was on the Shark Tank.
• 2:58
  SPEAKER_00: And then also Gary Fish, you know, longtime innovator, entrepreneur in cyber, founder of Fishnet, Fish Tech, FireMon as well.
• 3:08
  SPEAKER_00: And uh he was on the call.
• 3:10
  SPEAKER_00: And they were talking about with the wider team about what they saw in 2021.
• 3:15
  SPEAKER_00: It was in the Almanac and then their outlook for 2022.
• 3:18
  SPEAKER_00: So you can go to MomentumCyber.com and download the Almanac yourself.
• 3:23
  SPEAKER_00: I think it's about the public version is about 130 pages of slides, but as a PDF, a lot packed in there.
• 3:30
  SPEAKER_00: But if you want to go through it, you know, go to MomentumCyber.com and download it.
• 3:34
  SPEAKER_00: If your CEO or you are already in touch with Momentum Cyber, they have a version that's for clients only that's longer.
• 3:41
  SPEAKER_00: I think it's 200 plus pages with more detail in there.
• 3:45
  SPEAKER_00: But go go get it, download it, and go through it.
• 3:48
  SPEAKER_00: If you want to just get my takeaways, then continue to listen.
• 3:50
  SPEAKER_00: And I've got five main takeaways and then a few and a long tail at the end.
• 3:55
  SPEAKER_00: So let me go through those quickly with you.
• 3:56
  SPEAKER_00: The first one, uh, this should not be a surprise to anyone.
• 3:59
  SPEAKER_00: The the space is more crowded than ever.
• 4:02
  SPEAKER_00: Uh and any of us that have been doing outreach and trying to break through and rise above the noise out there know that that's true.
• 4:10
  SPEAKER_00: What they have inside the Almanac, though, is a market space slide.
• 4:14
  SPEAKER_00: And it's one of these things that you'll see where it's one slide for the market, cybersecurity market, broken into different boxes, and each each box are all the logos of companies that have solutions in each of these areas.
• 4:27
  SPEAKER_00: And I heard them on the call say they track about 6,500 vendors.
• 4:31
  SPEAKER_00: I don't think quite that many are actually able to fit into the uh the the one slide market scape, but it is crowded, and that's no surprise to anyone on this call.
• 4:41
  SPEAKER_00: What I thought was interesting though is that one of the comments that Robert Hershevec made was you know, imagine being a security leader, looking at that and wondering, what the heck do I do with it all, right?
• 4:51
  SPEAKER_00: Who are all these companies?
• 4:52
  SPEAKER_00: What do they do?
• 4:53
  SPEAKER_00: How are they different?
• 4:54
  SPEAKER_00: The sense making that you have to do as a security leader of that space is really hard.
• 5:01
  SPEAKER_00: And you know, naturally you're just gonna filter out most or if not all of it, and you're gonna default to what you know.
• 5:07
  SPEAKER_00: Or if someone does rise above the noise, you're gonna figure out well, what is it that they do.
• 5:11
  SPEAKER_00: And you're gonna look to your trusted sources as well, your your networks, your your private Slack channels that go on to try and figure out what is everyone hearing and what's what's really breaking through and what should I pay attention to.
• 5:22
  SPEAKER_00: But to try and make sense of it is really tough.
• 5:24
  SPEAKER_00: But it what it does mean though is that certainly these days, and I think it's been this way for quite a while, was if you're running security at a company, it's not a matter if if you can protect yourself, right?
• 5:35
  SPEAKER_00: There's tools to protect yourself against anything.
• 5:38
  SPEAKER_00: If you can afford to buy the tools, you know you'll you'll be able to protect yourself, right?
• 5:42
  SPEAKER_00: The question really is how?
• 5:43
  SPEAKER_00: How do you go about doing it with the budget you have, the skill shortage that's out there in a way that's going to deliver an effective program?
• 5:51
  SPEAKER_00: And that's really, I think, the takeaway if you're thinking through a customer lens behind what's what's there in this market, this credit market space.
• 5:58
  SPEAKER_00: My takeaway number two was there's a huge growth in financing activity right now.
• 6:03
  SPEAKER_00: And you know, I think I'd heard rumblings along the way, oh, things had slowed down and you know it's not what it was a while back, and you know, there's definitely maybe something to evaluations, but I'd heard people saying that you know there wasn't the same run rate.
• 6:16
  SPEAKER_00: And the evidence says the exact opposite.
• 6:18
  SPEAKER_00: So in 2021 over 2020, there was a 43 percent growth in financings.
• 6:24
  SPEAKER_00: So this is rounds of financing, and there was in terms of what momentum cyber is tracking, 1,042 individual financings took place in 2021, which was a 43 percent growth.
• 6:36
  SPEAKER_00: Now, what I thought was interesting was the top segments where the number of financings were taking place, and it was a bit of a surprise to me that risk and compliance was top.
• 6:46
  SPEAKER_00: Risk and compliance with 16 percent.
• 6:49
  SPEAKER_00: Next behind that was data security, uh, identity and access management, network and infrastructure security as well.
• 6:55
  SPEAKER_00: Now, to me, risk risk and compliance necessarily evil, people have to do it.
• 7:01
  SPEAKER_00: Not perhaps the sexiest space right now compared to a few others.
• 7:05
  SPEAKER_00: So I was a little bit surprised to see that uh so many financings were taking place in risk and compliance.
• 7:10
  SPEAKER_00: When you compare that to not the number of financing, but the volume of dollars that are being invested into each of these segments, then some of the hotter names bubble up.
• 7:20
  SPEAKER_00: So immediately what goes to the top is cloud security.
• 7:23
  SPEAKER_00: So cloud security was the top in terms of dollar volume, but it was actually eighth in terms of number of financing.
• 7:29
  SPEAKER_00: So that means that there's more dollars getting concentrated into a small number of rounds.
• 7:34
  SPEAKER_00: And that may be why we're hearing so much about the Wizas, orcas, EQAs of the world as uh you know, hot, hot area, hot companies that are growing very fast.
• 7:44
  SPEAKER_00: And then in terms of dollar volume, the ones you mentioned are already there, IAM, endpoint, risk and compliance, data security, right?
• 7:50
  SPEAKER_00: So the same sort of uh vendor uh segments are there.
• 7:54
  SPEAKER_00: So I was just surprised that that risk and compliance was top in terms of the number of financings, but not surprised to see the cloud security was top in terms of volume.
• 8:03
  SPEAKER_00: Third takeaway, public markets value growth over uh margins and by quite a long way, right?
• 8:10
  SPEAKER_00: So even though they're in the public space, they really want to see that top line grow, and that's where the real big valuations take place.
• 8:18
  SPEAKER_00: And you know, that's a pretty good proxy for what we hear and see and feel in the private market as well.
• 8:23
  SPEAKER_00: You know, those of you leading teams and talking to boards will get the answer all the time that the thing they want the sales team to optimize for is ARR growth.
• 8:32
  SPEAKER_00: Maybe quickly behind that might be diversification of logos, so it's not just all concentrated on two or three, four or five, ten companies, but wouldn't it be good if it's spread out over you know 30 to 50 customers?
• 8:44
  SPEAKER_00: But the top line is what people really care about.
• 8:46
  SPEAKER_00: They want to see ARR growth come through.
• 8:48
  SPEAKER_00: So there is a connection there between private and public in terms of valuations.
• 8:53
  SPEAKER_00: Before we go further, I do want to tell you about cybersalesejobs.com.
• 8:57
  SPEAKER_00: If you're a hiring manager and struggle to find great talent right now, sales talent, or you're looking yourself and are fed up having to check out a whole bunch of sites to see what's out there, check out cybersalesjobs.com.
• 9:11
  SPEAKER_00: It has AEs, SEs, SDRs, channel, ops, enablement, both from an individual contributor, but also at a leadership level as well, all in there.
• 9:20
  SPEAKER_00: Hiring managers can post jobs on there for free, and job seekers can also get alerts as jobs open up for their roles in their areas also for free.
• 9:31
  SPEAKER_00: So head over to cybersalesjobs.com.
• 9:34
  SPEAKER_00: My fourth takeaway from the Almanac were just some interesting facts about the amount of money that's going into companies right now.
• 9:42
  SPEAKER_00: So the top 15 funded companies that are private at the moment have raised a total of$12.9 billion.
• 9:51
  SPEAKER_00: So I'm not good at math, but that tells me that roughly speaking, maybe$900 million,$800 million on average has gone into those top 15 companies.
• 10:00
  SPEAKER_00: That's a lot of money.
• 10:01
  SPEAKER_00: And the names on there were Laceworks, NetScope, Rubrik, OneTrust, Fireblocks, Tanium, Orca, Cyber Reason, Plume, we're all in that top list.
• 10:11
  SPEAKER_00: The next 45 companies have still each all raised over$100 million.
• 10:17
  SPEAKER_00: Right?
• 10:17
  SPEAKER_00: So it goes$145 down, and you're still above$100 million.
• 10:21
  SPEAKER_00: And the big names in there in that trench were Transmit, Arctic Wolf, who'd raised about$535, Cronus had done twenty one, Cato$532.
• 10:31
  SPEAKER_00: So again, big amounts going into these companies.
• 10:34
  SPEAKER_00: And whilst it's really sexy to say, for example, they could say 37 new unicorns in the cybersecurity space were minted last year.
• 10:42
  SPEAKER_00: You know, the the real question for many of us when we're thinking about what our own shares might be worth is you gotta look at that and wonder what multiple valuation has to happen at exit, whether it's IP or acquisition, to have our stock be worth anything of any real value.
• 10:59
  SPEAKER_00: Because each time more money goes in, everything gets diluted done, right?
• 11:02
  SPEAKER_00: So as dilution happens, then your little slice of the pie, and it's probably a very little slice of the pie, gets even smaller.
• 11:09
  SPEAKER_00: And I think if I was looking right now to join a company, I'd want to really dig in to make sure I understand um what my little bit is gonna be worth and where they're at already.
• 11:22
  SPEAKER_00: You know, if they're if they raise 900 million and looking at Series F, for example, you know, your 20,000, 30,000, 40,000 uh options or RSUs are not gonna be worth very much, right?
• 11:33
  SPEAKER_00: But you know, I think we always say that you don't join a company as an individual contributor or even as a sales leader most of the time for the stock, right?
• 11:42
  SPEAKER_00: That's a nice to have.
• 11:44
  SPEAKER_00: The chance of it of it A being worth anything and B then being worth something is pretty small.
• 11:49
  SPEAKER_00: So you want to optimize for OTE and your opportunity and your career growth and all the rest of it, your learning growth.
• 11:55
  SPEAKER_00: Um but you do want to understand, eyes wide open, going into these companies, truly what your your opportunity is to make sure that you understand that.
• 12:02
  SPEAKER_00: And even though they're saying they might be offering you all this stock, really what it's worth, and uh really ask those questions, understand where they're at in their process.
• 12:11
  SPEAKER_00: Takeaway number five, product-led growth is really growing and getting established.
• 12:16
  SPEAKER_00: Now, this is the idea that you know for many of us, we grew up in an enterprise sales-led world, sales and marketing-led world.
• 12:23
  SPEAKER_00: And in the product-led world, essentially what's happening is the product is driving a lot of inbound for the company.
• 12:30
  SPEAKER_00: And what that means is you don't have to invest quite so much in sales and marketing to be able to grow the company.
• 12:37
  SPEAKER_00: Now, I think in reality, what most companies realize is it's actually pretty hard to optimize for product-led growth, right?
• 12:43
  SPEAKER_00: The product has to be a certain way, the way it's marketed has to be a certain way, things like that.
• 12:48
  SPEAKER_00: But still, to get into enterprises, there's the role for sales.
• 12:51
  SPEAKER_00: And you know, there's sales teams out there are doing very nicely right now on handling inbound from companies who have got the small teams using for free or next to free and now want to grow from there.
• 13:00
  SPEAKER_00: So but the point in the almanac was it's growing, it's getting established.
• 13:05
  SPEAKER_00: They use the example of Sneak.
• 13:07
  SPEAKER_00: It's a company that the the spelling is S-N-Y-K.
• 13:10
  SPEAKER_00: I often wondered how do you pronounce that, but it's Sneak.
• 13:14
  SPEAKER_00: And they're doing a great business right now.
• 13:16
  SPEAKER_00: They got high valuation, and they're primarily a product-led growth company.
• 13:20
  SPEAKER_00: I talked to Jay Wallace, the VP of sales at Rumble last week on the podcast, and he's seeing tremendous inbound coming and essentially from the use of the product, right?
• 13:30
  SPEAKER_00: As people go and test it and use it from a download, they're realizing you know we need to use this much wider.
• 13:36
  SPEAKER_00: And they're taking that whole inbound and creating decent size to big deals on the back of that.
• 13:42
  SPEAKER_00: And then back in, I think it was December, I talked to MT Robertson, who's a CRO at BlueScape, and they're making the transition from being an enterprise sales-led company to a product-led growth company.
• 13:54
  SPEAKER_00: So the point in the Almanac is it's happening, it's happening again.
• 13:57
  SPEAKER_00: And it's obviously very attractive for founders, for CEOs, and for investors, where they don't have to invest so much ahead of revenue as they do in traditional sales-led world if they can figure out how to get the flywheel going in a product-led world.
• 14:11
  SPEAKER_00: My sixth takeaway is really a bucket with small little items.
• 14:15
  SPEAKER_00: One was that ransomware is not going away if anything is increasing.
• 14:19
  SPEAKER_00: And there's investment vehicles, uh, private equity firms, for example, who are building up or acquiring companies to build out ransomware type platforms.
• 14:28
  SPEAKER_00: The skill shortage that we know about continues to be a problem.
• 14:31
  SPEAKER_00: It does mean, and I think uh Gary Fish maybe made this point, was it really puts a premium and a real necessity on MSSPs.
• 14:40
  SPEAKER_00: Right?
• 14:41
  SPEAKER_00: So, you know, the growing number of and capability of the managed security service providers is going to be more and more valuable going forward, back to the point about the market scape.
• 14:51
  SPEAKER_00: How does a security leader figure out how to knit all this together?
• 14:54
  SPEAKER_00: Often they don't, and they they like the idea of turning for at least part of their portfolio to companies and say, you know, can we offload some of the operational capability, some of the liability as well, the risk to someone else, to a very capable MSSP?
• 15:09
  SPEAKER_00: And Gary, on the call that I was on, maybe a little bit tongue-in-cheek or maybe not, one of his predictions for 2022 was the death of the VAR.
• 15:18
  SPEAKER_00: Given where he's come from, I thought that was kind of interesting.
• 15:21
  SPEAKER_00: But it was just this point, right?
• 15:22
  SPEAKER_00: There's going to be less of a need for just the people doing the value-added reselling, getting you the deal that costs plus one or two as a security buyer from vendors, and much more need for organizations that can deliver capability and not just uh licenses.
• 15:38
  SPEAKER_00: Dave DeWall talked about the ship left shift left.
• 15:40
  SPEAKER_00: So this is the idea that you know it makes a whole ton of sense to bake in security properly into projects, products built internally, but also from the vendor standpoint.
• 15:50
  SPEAKER_00: It's been hard in the past because it slows things down too much when you have to bake in the security.
• 15:56
  SPEAKER_00: But these days, with the tools right there and the processes, it's becoming much easier to enable people early on in the development of products and projects to do security properly.
• 16:06
  SPEAKER_00: So this whole idea of shift left is happening in the DevSecOps world, but also in the traditional product building world as well.
• 16:12
  SPEAKER_00: Distributed workforce, we've talked about on the podcast, happening right now, obviously.
• 16:16
  SPEAKER_00: We're all feeling it, different guises, but that's going to continue.
• 16:20
  SPEAKER_00: And also the idea that we're living in a world where there's more and more interconnected companies.
• 16:25
  SPEAKER_00: People are doing business with partners more often than not, and therefore third-party risk continues to be something that's top of mind for people.
• 16:31
  SPEAKER_00: I know one of my clients, they talk about you know, 63% of breaches that have happened in the last few years have actually come through third parties in some shape or form.
• 16:40
  SPEAKER_00: You know, this is a significant vector, something that we that everyone should be concerned about.
• 16:44
  SPEAKER_00: And in a world where things are more interconnected and we're perhaps not hiring FTEs quite as much, but uh looking to third parties to provide capability for companies, not just in security, but you know, business models are dependent on third parties, therefore third party risk is a big thing.
• 16:59
  SPEAKER_00: So there we have it, the five takeaways I had.
• 17:01
  SPEAKER_00: First one was around the space is more crowded than ever, and what does that mean for a security leader?
• 17:07
  SPEAKER_00: Secondly, huge growth in financing activities in different submarkets.
• 17:11
  SPEAKER_00: Thirdly, that the valuations are all about growth.
• 17:14
  SPEAKER_00: They continue to be all about growth in ARR rather than anything else.
• 17:19
  SPEAKER_00: Fourth one is just some interesting facts of what the concentration of funding in big companies are taking a lot of funding in and what that might mean for us as sellers and how we view what we get in our packages.
• 17:31
  SPEAKER_00: Product-led growth, PLG, not so easy for me to say.
• 17:34
  SPEAKER_00: Uh PLG is growing, continues to grow and be attractive.
• 17:37
  SPEAKER_00: And then we've got some smaller takeaways around ransomware, skills shortage, shift left, the workforce being distributed, and third-party risk.
• 17:45
  SPEAKER_00: So with that, I'd remind you if you want to dig deeper, go to momentumcyber.com.
• 17:51
  SPEAKER_00: If you like these episodes, the single best thing you can do is to help spread the word.
• 17:56
  SPEAKER_00: Go out there, share with your friends, pick just one friend and send on a share with this episode to them.
• 18:02
  SPEAKER_00: Make sure you subscribe in your favorite podcast player.
• 18:05
  SPEAKER_00: But then also, if you can, go to Apple Podcasts and do a like and review.
• 18:10
  SPEAKER_00: The number one driver for people when they find a podcast, but whether they actually go and listen to it, is whether it's got likes and reviews.
• 18:17
  SPEAKER_00: So please go to Apple Podcasts if you can and do that.
• 18:20
  SPEAKER_00: Also, the hub for all content is at salesbluebird.com.
• 18:24
  SPEAKER_00: In addition to the podcast, there's blog posts, videos, and also you can subscribe to the Sales Bluebird weekly email.
• 18:31
  SPEAKER_00: And that's packed full of more tips and thoughts, and sometimes not just from me, but from others too.
• 18:36
  SPEAKER_00: Thank you to Haida Jansen for making all that we do at Sales Bluebird just happen.
• 18:40
  SPEAKER_00: And also thanks to our friends at Sherein Chan and team who make it look like I know what I'm doing with the production and promotion of the podcast.
• 18:49
  SPEAKER_00: I really don't, but they do, which is the important thing, and they're at shrainchan.com.
• 18:54
  SPEAKER_00: The dad joke of the week, I gave all my dead batteries away today, all for free of charge.
• 19:01
  SPEAKER_00: With that, don't forget to subscribe and hit play the next time.
• 19:05
  SPEAKER_00: Talk with you then.