Venture capitalists are on a shopping spree. For budding infosec entrepreneurs in need of cash, this could be the answer. By Richard Willsher.
If you have an innovative information security business and want to raise funding, now is the time to do it. Investors' expectations of making swift and tidy returns haven't been this high since the dotcom days.
On the macro scale, in the first quarter of this year alone venture capitalists in the US invested $7.1 billion (£3.5 billion) in almost 800 separate deals, across all sectors of the economy, according to a PriceWaterhouseCoopers/National Venture Capital Association Money Tree report. Despite a ten per cent drop from last quarter, software still accounted for more individual transactions than any other sector, and although no separate figures are given for sub-sectors, according to industry specialists, infosec is pretty buoyant right now.
"Interest in the security part of technology research and development is increasing significantly," says James Nunn-Price, a director in Deloitte's security and privacy practice. "I would say that it is one of the main priorities for anyone investing in technology because security, business continuity, forensics and fraud have leapt up the corporate agenda."
Consequently, raising money from venture capital (VC) firms has got a lot easier since 2000. That is the experience of Timothy Eades, an expat Briton who is senior vice-president of marketing at Sana Security, a Silicon Valley-based security software business. "But you need to have a clear, differentiated lead in a particular market segment and a strong management team," he points out (see case study, page 33).
"The art of raising money", as Eades calls it, requires an understanding of the VC mentality. You need to know what makes investors tick and what market conditions they operate in. There is currently a vast amount of investors' money looking for a home, whether it is in the hands of private equity or venture capital funds, or in the form of debt funding provided through banks.
Venture capitalists will always be looking to reap the benefits of their investment at some stage in the not-too-distant future. This means selling their stake to other investors in the form of a secondary buy-out, unloading the entire business to a trade buyer or floating it on the stock market in the form of an initial public offering (IPO).
Right now all these exit routes are showing a green light. There is plenty of secondary buy-out activity, in the US, the UK, continental Europe and the Far Eastern markets. Mergers and acquisitions are at an all-time high globally. And IPOs are being brought to the major stock markets at a rapid pace right now.
Against this backdrop, it is not surprising the venture capital firms are confident to invest as long as the fundamentals of the underlying business are sound and its management is capable.
The tax payer lends a hand
State funding is a common theme in many governments' support for research and development and can help technology start-ups. For example, the UK's seven research councils (www.rcuk.ac.uk) assist around 30,000 researchers at any one time.
Another route for funding could be NESTA, the National Endowment for Science Technology and the Arts. The body has recently repositioned itself as an incubator for technological innovation in the UK, sponsoring research and offering financial backing either directly or through third-party funding. Its criteria for investment are as tough as any VC's but the difference is that NESTA is tasked with ensuring that UK plc remains competitive in the global economy.
There are other sources of finance, of which grants, awards, and European Investment Fund loan guarantees and venture capital funds form a part. The US has a number of schemes, such as those supported by the National Science Foundation. Israel's research institutes have long acted as incubators for scientists, especially from the former Soviet Union, enabling those with few cash resources to make a vital jump from innovation to early-stage commercialisation.
Send me an angel
Private individuals, or "business angels", are also significant supporters of start-ups. The jump from grant or business-angel support to first-round VC equity funding is often referred to as an "equity gap" and, for many businesses, it has proved a difficult obstacle to overcome. This gap seems to be narrowing, however.
"I do not believe the equity gap is a reality today," says Laurence Garrett a partner at 3i, a London-based global private equity investor. "There will always be more projects or companies looking for funding than there are funds available. And not all these projects should receive any funding. Today, strong entrepreneurs who can demonstrate a compelling growth story will not experience problems finding funding to grow their businesses."
He gives some examples: "3i has backed several serial entrepreneurs and both early- and late-stage companies, including Garlik, the personal data protection software business run by the former egg banking team. The environment for start-ups is better than at any time since the bubble of 2000."
Deloitte's Nunn-Price says that it not only in the US and UK where infosec businesses are finding funding. And many of those he sees in this country are not necessarily that innovative, he claims.
"Ideas I've seen in the security space that are really revolutionary, new or different are coming from places like Australia, where they also have a very strong entrepreneurial stock market that does encourage people to do start-ups and then IPO in a couple of years." He cites Emue as an example, a company developing identity protection technology that has received investment from Deloitte's Australian corporate finance team.
"You also get a lot of VC-backed business in Ireland, largely for tax reasons," Nunn-Price adds. "We've seen privately funded businesses coming out of South America as well. Another significant development we have noticed is the way large multinationals, some in the security space, are investing in start-ups or joint ventures. There is an increasing amount of partnering with innovative new businesses."
He points to Juniper as being one company that is part of this trend, as are big names such as EMC, IBM, HP and Cisco. At the same time, these and others are also in the business of acquiring new security technologies for their own use.
Friends on the inside
It is still the case, however, that large corporates are substantial funders of innovation, their R&D budgets effectively acting as internal private equity funds. BT is a good example.
"The majority of our money comes from our internal funding base, but it is aligned to what you'd see externally," explains Bryan Littlefair, who heads BT's Security Research Centre. "We have what we call internal venture leaders, who pretty much follow a VC funding model. We have to convince them that the technology we want to research is worth investing in. There is competition among the research departments to gain this funding for their projects. We discuss deliverables and time frames. There are always more ideas than money available."
While the majority of innovations are internally funded, BT also draws on other sources. The company works with external vendors such as Microsoft, Intel and HP on projects to address a common technology challenge, with each party chipping in an appropriate level of funds. BT has also been receiving funding from the Department of Trade and Industry (now the Department of Business, Enterprise and Regulatory Reform) and from the European Union's framework programmes for research and technological development.
In addition, BT has an agreement with corporate spin-out specialist New Venture Partners LLC. So far, they have collaborated on six spin-outs, including that of Azure, which helps telecoms companies diagnose lost revenues and reduce fraud. Azure is now part of Bangalore-based Subex Azure.
At the same time BT also acquires innovative ideas and companies where appropriate. BT Counterpane is one of these. It provides managed security services and began life as the brainchild of Bruce Schneier in 1999. Counterpane received backing from several VC firms before it was acquired by BT in 2006.
The telecoms giant is certainly not alone among ICT businesses in its approach to research and development and the funding of innovation in information security. What the BT case tells us is that it plays a variety of roles alongside other sources of funding including government support, business angel funding, VC and private equity investment and stock market flotation.
The overall picture at this stage in the business cycle is that there is a vast amount of funds available for investment in the right ideas and right products, but it is worth adding a note of caution. Funding will always go to the investments that offer the greatest scope for making a substantial return while taking the least amount of risk. Those in the infosec sector seeking investors should always bear in mind that they are competing not only with every other contender in their industry, but with all other businesses from every sector, segment and industry. The good news, however, is that with increasing concern among businesses and consumers over new security threats and those yet to be discovered, the ground is fertile for innovation and finding financial support to turn them into profitable businesses.
WHAT DO VCS LOOK FOR?
Venture capital and private equity firms seek to invest their clients' money in a growth story. They will reap their rewards when they exit their investment and sell or float the business. VCs will be attracted by:
- Proven market potential - This means that an innovative, new idea or product needs to be well researched to the point where its market potential can be realistically gauged
- Expanding market - If it can create a market all of its own and establish dominance in it, then all the better
- An experienced management team - The inclusion of people who have already started and run a successful business generally mean chances of success will be more highly rated
- For more advice on gaining funding, visit the British Venture Capital Association's website at www.bvca.co.uk.
CASE STUDY - SANA SECURITY
Founded in 2000 with a little help from venture capitalists, California-based Sana Security is a supplier of SanAPT behavioural analysis and other enterprise threat protection software.
"Raising money in 2000 was not easy by any stretch," recalls Timothy Eades, Sana's senior vice-president of sales and marketing (pictured). "Early-stage investors literally invest in one man and an idea, and El Dorado Ventures, our lead VC, invested in our founder Steven Hofmeyr before there was any product at all. Steven just said: 'here is my philosophy'.
"Today it is not that difficult to find money, but you have to go after the right people and present it correctly; that's the difficult bit," he adds.
El Dorado is a specialist early-stage VC firm that sees software and emerging technology as core sectors. Previous companies it invested in have taken the IPO route or been sold to technology players such as Ciena, Cisco Systems, nVidia and Texas Instruments. Sana has two other investors, Bay Partners and RB Webber & Company.
"By the end of September we will be in 12 countries," explains Eades. "We are expanding rapidly in Europe and across Asia. We are growing in the UK and in the US, and we expect to launch our next generation products early next year."
But will Sana eventually follow the trade sale route or will it IPO? "Over the past three years, people around here have been talking about a nuclear-like IPO winter," says Eades. "IPOs were scarce, investment money was hard to come by. But now IPOs are back."
Given the fact that the company's VC investors have now been onboard for a while, have stuck out the bad times and, moreover, the IPO and trade sale markets are both buoyant, perhaps news of Sana's future may not be far off.