Snyk, from first check to leader in dev-friendly open source security

We are thrilled to announce our investment in Snyk, which is a developer-first security solution that helps companies use open source code and stay secure. We couldn’t be more excited to be leading this new round of capital again with Canaan Partners and including Heavybit, FundFire, and Peter Mckay (Co-CEO of Veeam) (see Techcrunch for more coverage).

Our initial journey goes way back as we were investors in Guy Podjarny’s previous company, Blaze.io, which sold to Akamai in 2012. For the next few years we collaborated on several co-investments and what ultimately attracted us to Guy’s new company (along with co-founders Danny Grander and Assaf Hefetz), was their bold vision to create a new platform for securing open source components with a dev-first focus. At the time we seeded Snyk in late 2015, open source library usage was growing significantly and solutions were either security first which slowed down dev or dev first but not with enough security built in. With the movement towards continuous integration and deployment, it was clear a new solution was needed.

In a little over two years, Snyk has gone from “founder market fit” to “product market fit” and this new round will allow the company to build out is product offering and expand its Fortune 500 customer base.

With over 120,000 developers using the platform, 100,000 projects protected, 350,000 downloads per month, and notable partnerships with Heroku, JFrog and Microsoft Sonar, Snyk has proven it can get developers to fully adopt a security solution, and the importance of having the strongest database of known vulnerabilities in open source

Funding rounds are always a great opportunity to look back and see how the company’s initial thesis has held up and what has improved or changed. See below for Snyk’s initial vision from late 2015, much of which remains the same today; developer velocity increasing, security isn’t dev-friendly, how do you bridge the gap, esp. in open source world where much of it is third party code.

There have clearly been some tweaks to the model since then, but what is most exciting for us is watching Snyk go from idea and vision in a non-existent market to one where the question of how developers are securing open source components is becoming mainstream. And given some high profile security breaches like Equifax in Sept. 2017 where it was due to unpatched open source vulnerabilities, you can see why the interest in solutions like Snyk’s are gaining rapid adoption.

While the need for dev-friendly open source security may seem obvious today, especially with the stats above, how did we frame our initial investment? Here‘s what got us excited back then, much of which has come to fruition in the 2 years since:

  1. Solving a huge pain point in an emerging but potentially massive market — we were witnessing the move to continuous integration and deployment spreading to the enterprise combined with the growth of open source and third party components; the thinking was that if you could make it dev-friendly then it could be a massive business
  2. Dev first business model with budget from security — we love bottom up, organic models but always question where the bigger budgets are coming from, and what we saw in Snyk was an opportunity to go bottom up with developers and then access the security budget for bigger dollars.
  3. Founder-market fit — GuyPod previously was Chief Architect at Sanctum/Watchfire Security, developers of one of the first web-app firewalls, ultimately sold to IBM. Danny Grander had significant security engineering experience starting in the IDF where he met Guy and into Skybox Security and as CTO of Gita Technologies. Assaf had a Sr Research role at Skycure which Symantec bought last year. This team had the technical and product skills and understanding to go after this opportunity.
  4. Repeat founders — we are always thrilled when founders we backed previously give us thefirst shot to invest in their new company. In this case, we had backed Guy before when he co-founded Blaze.io which was sold to Akamai. He eventually became CTO of the Web Experience Unit at Akamai.
  5. We like to work with founders well before they leave their current roleand start a new company. In Guy’s case we had regular dialogue over a couple year timeframe to both brainstorm and also vet the idea with our Fortune 500 relationships. We also introduced Guy to fellow founders like Tom Preston-Werner from Github (see blog post on Snyk) to help refine the story.
  6. Time to value — incredibly easy to get up and running, authenticate via github, bitbucket and Snyk starts scanning, monitoring, and suggesting fixes
  7. We love being able to help accelerate time from “founder-market fit” to “product-market fit” to which we accomplished by helping Snyk secure some of their early on-prem Fortune 500 customers.
  8. We are purpose built to double and triple-down in our portfolio as they hit milestones and scale their GTM team.

Once again, we couldn’t be more excited about leading this new round of funding and look forward to continued success for the team.

Also on Medium

 

The 4 Kinds of Series A Rounds in Enterprise roadmap for understanding how to go from seed to Series A

A wise VC once told me when dinner is served, you eat. When it comes to fundraising, I’ve learned that if someone is trying to invest now, you should strike while the iron is hot. Given that the headwinds are getting stronger, we at boldstart have been advising all of our portfolio companies to raise as much as they can as soon as they can and to make sure that every dollar spent has a real ROI.

Related to this, the question I am often asked is “what metrics do I need to hit” to get that next round. While super important, I always like to understand where the business is in its lifecycle before answering. Having spent the last week in several meetings with startups going from seed to A, I thought I would break down the various types of A rounds and the major ??? to success:

The 4 kinds of A rounds:

  1. No A round. Sucks. — self explanatory
  2. Vision A round, super hard — raise on the promise and pre-launch, on the vision, huge market with the killer team that can build and scale. sometimes easier to raise on the promise and the expectations of amazing success than after the launch
  3. Metrics A round, easier — killer metrics, repeatable growth and predictable sales model, used to be $80–$100k MRR/$1mm ARR, the bar is raising…
  4. Hybrid A, toughest — this is where you are between 2 and 3 and the hardest to get done.

Read More

What founders can learn from Jeff Spicoli you don't have to have all of the answers

I know I may be dating myself here, but over the past few weeks I couldn’t help but think about the movie Fast Times at Ridgemont High and one of the standout characters, Jeff Spicoli.  When asked by Mr. Hand, his teacher, why he keeps coming late and wasting his time, Spicoli answers, “I don’t know.”

In several meetings with founders during the past few weeks, they would have been better off answering like Spicoli rather than giving me some hollow answer.  I want to make it very clear that I don’t expect founders to have all of the answers questions, especially in the early days as startups are a series of hypotheses that need to be tested.  In fact, many questions I have may not have an answer today so “I don’t know” will be the best answer. My one caveat is that the “I don’t know” is followed by a how might you figure out the answer or a when might you figure it out.  This line of questioning is really just another way to test how you think and determine how our working relationship might be were I to invest.  I would rather have the honest “I don’t know but I’ll figure it out” then a made-up answer that will never allow you or your investors to really understand what is driving your business.

Never give up but move on quickly startups are tough, you always have to keep fighting

As a young kid, I was always taught the valuable lesson of never giving up or quitting.  No matter how many times you get knocked down, you have to stand up and keep moving.  That is the same trait that I also admire in many of the entrepreneurs that I have funded over the years.  This mentality is what carries many great entrepreneurs from near death experiences to ultimate success.  However, I do caution that entrepreneurs should temper this “never give up” attitude with a “move on quickly” one as well.

Let me explain.  Many entrepreneurs will take this same “never give up” attitude with the sales process or raising financing.  On the one hand this attitude is what is absolutely necessary to get things done but on the other hand it can be quite detrimental.  What entrepreneurs need to do is learn how to qualify their leads and to do it quickly.  The worst outcome for an entrepreneur i to spend countless cycles on trying to close a deal that is not closable or spending way to much time on a lead only to end up giving away the farm to make it happen.  Never giving up may actually prevent you from finding the next great customer or funder.  I have seen this time and time again from many companies and what is problematic is that time is precious for a startup.  You only have so much time to hit your milestones so use it wisely.  When you are meeting with potential prospects make sure to qualify them in  the first meeting and understand if they really do have a need for what you are selling, the decision making process, the timeframe in which a decision is made, and ultimately the potential budget.  If the information does not meet your needs, move on quickly.  You can take your “never give up” attitude by trying to qualify as many prospects as possible rather than “never giving up” on one or two.

Startups getting caught in No Man’s Land stuck between seed and series a funding

“No Man’s Land” is traditionally known as the area between two trenches.  This is a reference to World War I and the vicious trench warfare and hand-to-hand combat that characterized that war. In “No Man’s Land” lay a wasteland of dead bodies and other debris and shrapnel.  Increasingly I am seeing many startups who were ably seed funded get caught in “No Man’s Land” between the seed round and a true Series A round led by a venture capitalist.

This is happening because there are way too many companies raising seed capital but not enough executing their way to a Series A.  This can happen for many reasons including not raising enough capital in the seed round to begin with and of course not getting your product out the door.  So what does an entrepreneur do when caught in this predicament?  Many try to do an additional seed round or add-on to the prior round.  While not a bad idea, this is rarely successful because many seed funded startups have way too many investors who are more apt to write off the investment then to bridge more seed money.  Secondly many angel investors would rather invest in that shiny new car or first seed round then add more capital to a used car or startup that did not “get there” on its first seed financing.  Smarter entrepreneurs are increasingly doing two things to make sure they don’t caught in “No Man’s Land.”  First, rather than getting 20 great names as seed investors, they are making sure to get at least 3/4 or more of the round invested by a couple institutional seed folks that may have deeper pockets and more ownership in the startup to really care about what happens in the future.  Secondly, the smarter entrepreneurs are really thinking carefully about what milestones need to be hit to raise that first Series A round and work backwards to determine how much financing they need to get there.  While not an exact science, it is imperative to think like this as you don’t want to be one of the many seed-funded companies that will linger in “No Man’s Land.”

Standard investor update for startups great starting point on how to communicate with your investors

I remember when we hired a new CEO for one of our portfolio companies and my tip to him was to overcommunicate.  We had a few large VCs on the board and a number of high-profile angels that could also help in various ways.  His job was to keep everyone up-to-date but also to know how to get help when he needed it and from whom.  Given today’s excitement over seed investing it is not uncommon for many of today’s entrepreneurs to have 5-15 investors in any given round.  How you effectively communicate with your investors is an important priority that if done right will give you major value add while also not taking too much of your time.

In order to help our new CEO, I reached out to all of the other investors, and we all agreed that if we all spoke to him a few days a week about the same information that he would not have time to run his business.  In addition, this would be redundant for the CEO since most investors were asking for the same basic information.  In the spirit of streamlining information flow, we worked with the CEO to put together a weekly email to provide us with the key metrics the company tracked along with departmental updates on key high priority projects.  We weren’t asking the company to create something they shouldn’t already have (key metrics, departmental priorities, cash balance) but rather we just wanted the data shared on a timely basis.  Over time, we all found that when we did speak with the management team that we did not have to spend a half hour gathering information but rather we could get right to the point and actually discuss the whys or hows on certain sales numbers, metrics, or prospects.  In the end, we were all much happier and more productive since we had the same baseline of information and could focus our energy on productive and deeper conversation on the business stategy rather than gathering basic data.

Over the last 6 months I have made a number of seed investments and have shared the following company update with them. Each CEO has had their own minor tweak but this should give you a sense of what investors may be looking for and how it can help you streamline your communication and focus on how to extract value from your many investors.  If you choose to update weekly then obviously it will most likely be a shorter piece with maybe only the cash burned and current cash on hand as the financials.  If you choose to send out a report monthly then it may be more like the form I have uploaded on docstoc.

One other important note I forgot to highlight is that since many companies I invest in are web-based and therefore many of them have real-time metrics I can track.  Michael Robertson who started Mp3.com and Gizmo5 (sold to Google Voice) had one of the best real-time dashboards for tracking his business.  I could see number of downloads, minutes used, new paying customers, etc. whenever i wanted to by logging into the system.  Other companies have created an investor wiki or use status.net (full disclosure-a BOLDstart seed investment) or other communication platforms for investors to share ideas and information.  I only imagine this will even get only better in the future.

Anyway, enjoy and I hope to hear some feedback on what is missing or what may be too much information.