Cracking the Code: How Cybersecurity Startups Secure Funding

Roger Thornton, a partner at an early-stage venture firm that invests only in cybersecurity companies, opens by making the case that startups matter in security. He argues that the field is shaped by a persistent adversary, so many small companies pursuing different approaches tend to produce better results than large firms working through lengthy internal processes. He also shares figures suggesting that most venture-backed security companies never return investors' money, with only a minority succeeding even among top-tier firms.

The middle of the talk covers how venture capital works: how the firm screens companies, the common reasons it passes on deals, and why its strategy is to be the first institutional investor in a round. Thornton then walks through lessons from his own experience. He stresses that founders should have worked at a software company first, should validate demand through customers or a working demo before raising, and should be careful with bootstrapping, incubators, and a crowded cap table that can discourage later investors.

He closes by identifying market risk as the one founders should avoid, and by emphasizing the value of a strong technical co-founder and a team that can recruit others. The session ended with a question-and-answer period covering accelerators, bootstrapping and founder vesting.