RSAC 2024 & Optimism for Early-stage Cyber Companies

Classical Economics Case for Cybersecurity’s Soft Landing

A grim picture was painted in 2023 for early-stage cybersecurity companies. On the venture investment side, the number of deals and amount invested fell quarter over quarter as the year progressed. Meanwhile, on the customer side, growth in security spend was flat for the year. We also saw innovation budgets shrink at enterprise companies, hampering the adoption of early-stage, cutting-edge technologies.

The squeeze was on. Some VCs and tech media were predicting a mass extinction event for early-stage tech companies. It looked like cyber wasn’t going to be an exception. But that didn’t happen in 2023. And it likely won’t happen in 2024 either. In fact, Crunchbase reported that total cybersecurity investment in Q1 2024 was up more than $1B from Q4 2023. We may be in for a cyber startup soft landing. How is it possible? Using some classical economics terminology, both the supply side and demand side of the equation are looking up.

Supply-side Argument

Rise of efficiency

Supply of high-quality startups has increased in the last 18 to 24 months. Venture-backed companies have dispensed with bad habits learned while capital was easily available. They’ve adopted efficiency focused KPIs as the capital market cooled in the second half of 2022 and through 2023. The result is they’ve become stronger businesses overall.

Return of the enterprise customer

While cybersecurity spend never significantly fell off, the growth in spend had stagnated for a couple of years. For 2024, however, industry analysts like Gartner are forecasting accelerated growth rates of up to ~40% higher than last year with areas such as cloud security and data privacy seeing the biggest potential gains. It feels like we’re also seeing the Fortune 1000 innovation groups engaging with earlier-stage startups once again.

The talent’s available.

One consequence of the rise of those efficiency KPIs is that more than 260,000 tech jobs were eliminated in 2023 and 42,000 more were cut in Q1 2024, according to The Challenger Report. This is a boon for startups that have historically been unable to go toe-to-toe with the Magnificent Seven-type companies for talent. Top engineering, product, sales, and marketing talent hasn’t been this “getable” to startups in a decade.

Demand-side Argument

Fall of the interest rate

‍The US Fed has signaled that it could cut rates in September if key inflation trends hold. When rates recede, venture becomes a more attractive investment class. Solid teams building real enterprise-grade solutions especially in cloud security, identity access management, and burgeoning categories like non-human identity management, software supply chain security, and generative AI (GenAI) security will find VCs vying to invest.

Make room for IPOs

‍There are several next-gen cybersecurity companies that are poised to go public when the markets become favorable. Public market investors will be on the hunt for companies with potential upside and which may mature into the next major security platforms.

Buy > Build

Enterprise tech giants are getting back into the market for buying innovative startups to “tuck in” to their current security platforms. In the past few quarters, we’ve seen Palo Alto buy Talon and Zscaler acquire both Airgap Networks and Avalor. Privately held unicorns are also getting in on the game, e.g., Wiz acquiring Gem Security. I expect we’ll see more acquisitions from both types of buyers as the year plays out.

GenAI tailwind

‍A significant greenfield has been created in cybersecurity with this once-in-a-generation advance in technology. There are entirely new threat surfaces created by GenAI. Securing and/or anonymizing data that is used for LLM training, fighting prompt injections, and monitoring enterprise usage are just some of the use cases that will need solutions. This category has potential to drive meaningful venture investment over the next six to ten years.

My Case for Optimism

The nature of venture capital is that not every company yields a return on its investment dollars. Some will go to zero, others will be acquihires or distressed sales. And we’ll see some of these happening as the year plays out. But from where I sit, a mass extinction event in the cybersecurity space has almost no chance of happening. As the supply of quality companies goes up alongside the demand for innovation, investment dollars will seek opportunity and there will be significant exits on the horizon. Early-stage companies have weathered the worst of it. A “soft landing” for our space means we can once again focus on innovating and building the future of cybersecurity.