Source: Maskot/Stock Photos/Business/via Getty images.
A key part of the RSA Conference is the RSAC Innovation Sandbox contest. The ISB contest allows finalists to give a two-minute pitch to judges, who then consider the product and company’s viability and select winners that seem best poised for market success. Past judges have included Asheem Chandna of Greylock Ventures; Niloofar Razi Howe of Capitol Meridian Partners; and Dorit Dor, chief technology officer of Check Point Software Technologies Ltd.
Starting in 2025, the top 10 finalists will each receive a $5 million uncapped Simple Agreement for Future Equity investment provided by Crosspoint Capital Partners. The ISB has been emceed by Hugh Thompson, a managing partner of Crosspoint Capital.
The Take
While finalists in the ISB have displayed product innovations, go-to-market innovations have lagged. The ways buyers buy have changed; the ways sellers sell need more innovation. As a result, money from the investors’ is frequently wasted because “go-to-market fit” (GTMF) growth phases are difficult to achieve. For vendors, the large investment rounds are both market signals and obligations; vendors spend enormous sums to match the obligation that a given funding round signals. Vendors frequently confuse their sales and marketing activity with actual customer progress and repeatable customer journeys.
Commentary
Given large funding rounds, the investors’ closest positive exit might have been behind them. Founder and investor expectations also require reality checks. For most investors, entrepreneurs and strategic acquirers, the path ahead remains to be seen.
Of the 110 finalists from 2014–2024, the vast majority have been geared toward large organization customers. While initial product market fit (PMF) or idea market fit (IMF) might have occurred among the finalists, successful GTMF phases are more difficult to achieve. GTMF success occurs when the customer buying journey fits the finalist’s go-to-market efforts. The repeatability of customer deals and the cadence of co-sellers are based on organization customer readiness.
The landscape among organization customers is changing with the growing diversity of economic buyers and technical influencers. While the chief information security officer persona is important, there are other parts of the organization required to operationalize or act upon a new control. Many disciplines of security like application security, identity & access management, cloud security, security for generative AI and data security require buy-in from others beyond information security teams. As indicated at RSAC 2024, the democratization of PAM highlights wider ranges of use cases with very different stakeholders. AppSec responsibility applies to everyone: developer, operator and security teams alike, which frequently ensures that no one is really responsible. In addition, information security teams are not increasing their personnel to operate or implement new tools. According to a survey conducted by 451 Research, a part of S&P Global Market Intelligence, just 18% of security teams are adding staff. These teams said that managed services to augment both staffing and tooling were the biggest way their teams were changing.
Large organizations are changing; many of them have become or are becoming technology companies in their own right, with technology decentralizing toward different business lines. The largest financial institutions have thousands of technical development staff, and their business lines heavily invest in technologies with greater autonomy. For finalists selling into these organizations, they must not only understand how their technology will work with their customers’ environments, but they must also better uncover and understand the business value. They must navigate these organizations, understand their business goals and only then understand how their solutions help the right personas achieve the right goals.
Given the limited number of tools that organization customers can operationalize, finalists must be pragmatic. If existing budget categories can be leveraged, so be it. For example, for finalists in endpoint detection and response like Cylance, SentinelOne Inc. or Cybereason, it might have been perfectly suitable to pursue expiring legacy endpoint contracts to land quicker wins. While each finalist would like to truly be a disruptor everywhere, not every organization customer wants to be disrupted.
Solid PMF phases are foundational to GTMF phase success. Three fundamental questions must be answered in PMF phases: Why do organizations need to make a change? Why do they need to do it now? Why is their product the solution for the need for this immediate change? Answering these questions helps finalists graduate from the typical founder-led-sales or friends-and-family sales mechanisms. While startups need scrappy tactics, scale-ups need GTMF to sustainably grow. It is essential for finalists to document and institutionalize PMF and ideal customer profile in objective, customer-oriented terms.
GTMF phases are the most expensive for finalists, with industry-wide selling efficiency projected to worsen even for publicly traded companies. Within information security, the valuations of price/sales remain significantly higher than other industries. These large funding rounds signal both ambition and obligation to finalists. In turn, finalists must always be mindful that their GTMF phases will likely succeed based only on a solid PMF success. Ideal customer profile includes understanding the customer journey, not just the organization’s demographic attributes. Finalists need to understand how their organization customers realize that they need to make immediate changes. The sequence and pattern to navigate multiple stakeholders, to build internal organization champions and to anticipate the path organization customers take to buy a startup’s security offering are critical.
Too often, the large funding rounds drive finalists to focus on the growth of their GTM activity rather than understand customer activity. GTMF phases are the most expensive for finalists in terms of both financial resources and time. Generous partner programs, marketing events and sales staff on non-recoverable draw compensation and staff on-boarding do not become worth it if the organization deals are not forthcoming.
GTMF success also deepens and widens competitive moats. Network effects from product telemetry or user data make solutions inherently stickier and revenues more recurring. While direct or indirect incorporation of generative AI lowers barriers to product entry, better harnessing of this data could increase the K-shape of market traction. Better distribution can also have outsized impacts; any solution that accelerates or enhances the offering of a larger co-traveling vendor will be far more likely to penetrate key organization accounts. In turn, the accretive value to strategic acquirers is more attractive.
The IPO remains an important, albeit very high, milestone. In addition to the large volumes of venture funding raised, the diversity of investors is also striking, with 526 distinct venture funds or investors participating in various funding rounds.
For investors, strategic acquirers and entrepreneurs alike, the road ahead is uncertain. 451 Research, a part of S&P Global Market Intelligence has provided individual and sector coverage for the vast majority of ISB finalists from 2014–2024 to better understand and contextualize industry trends. The slowdown in information security M&A may continue to test venture investors’ liquidity needs; multiple investors in each round complicate consensus for M&A.
The Security Talent Gap is More Complicated Than You Think
Want insights on Infosec trends delivered to your inbox? Join the 451 Alliance.
This content may be AI-assisted and is composed, reviewed, edited and approved by S&P Global in accordance with our Terms of Service.
