Episode 16 - Investment Banker J.C. Raby

Informing your decisions with intelligence, analysis and insight. Brought to you by the team@ooda loop.com hello JC Robbie, welcome to the Oodacast.

Hey Bob, how are you?

Very well, thanks, JC I appreciate you coming on. There's so many things I want to talk to you about and pull information from you for our readers. JC before we get started, I wanted to tell people that I've had the pleasure of doing business with you guys and Ian Partners and I've got to meet you in person. And it's you and your whole thing.

These days, meeting someone in person.

I know, I know. And I'll cherish that if we never do it again. But I feel like I want to tell folks that you have a great team. Everybody's high energy and focused on this community of business and cybersecurity. Among the things we've done together, we've also done events. You and I have spoken on panels together. We did a joint event prior to rsa and of course you.

I would describe those, Bob, as me being there but listening mostly what you have to say. I always learn something very deep and impactful whenever we get a chance to get together.

Well, thanks, you're too kind. And of course our CEO Matt devoe and you go way back and you helped us with the transaction, so.

That's right. We had the pleasure of helping Matt's penetration testing, you know, red team, I'd say red team even to distinguish it above your typical pen testing Fusion X, which we helped him sell to Accenture and then helped him. Why was Accenture continue to map out the space and otherwise. Yeah.

So jc, my feeling is that almost anybody who is a OODA Loop reader or a listener watcher of the POD will have heard of Boston Meridian Partners, but maybe some haven't. So I hope this whole oodacast will be a way of introducing you and Boston Meridian to a wider swath of the community. So would you start by telling us what is Boston Meridian Partners?

Sure, absolutely. I should note I'm calling you from San Francisco, so it's a or the San Francisco area. So I think the first misnomer is everybody thinks we're just in Boston now we're truly, we're even in Virginia. So I'll start with just the bless you. The high level demographics. We're in Virginia, Boston, San Francisco, but about 35, 40% of our deal flows international. So just close things in Sydney all the way to Netherlands, Europe, the UK and otherwise. What we are is a group of guys who all worked at tech companies but also have the overlay of working at technology based investment banks, banks and we do four principal things, buy side and sell side advisory. Which means so on the sell side you have an innovative company mostly in infrastructure and security where you want to understand how to position that and ultimately transact with a strategic buyer in the space we work with all the strategic buyers the Cisco's Accentures, Amazons, IBM's to help you, you know effective sale to them. On the buy side some of the largest private equity firms or strategics have engaged us to help them when they have a particular area that they believe they want to be transactional in. We have a very deep depth of understanding in the infrastructure and cybersecurity space to be able to triangulate exactly what they're looking for and help them transact. And then we also do capital raising which is to say if you're a interesting company like Secure Code Warrior or reversing Labs or other businesses where you know you might be sub 10 million but growing very quickly in ARR we're able to bring in very sophisticated global investors the likes of the, you know the Goldman Sachs, the JP Morgan Chases, the Forge points as well as some strategics like Cisco's of world and help you effect around to continue your growth. Many times that'll also be a private equity firm buying a majority of your company. We call that majority recap. And then finally we do some proprietary investing. We've had a lot of fun even in cybersecurity, finding kind of the best and the brightest and helping even seed finance some of their stories to get them off the ground. And we've done some other areas investment outside of that in esports and media where likewise we found it sort of comes down to the people I'd say but we found some really fascinating and innovative stories that we can help launch and you know I think we'll be 20, 2020 21. We're really taking all this accumulated knowledge we have of infrastructure and cybersecurity world and really going to spend much more time on these sort of, you know, these, these smaller single investments and helping bring others into share our knowledge in that space. So exciting times and you know, love, love the space. I was a bit of a technocrat growing up. You'd look if you looked over my notebook in the middle of school I'd be probably drawing you know, fighter planes and you know, other other kind of tradecraft, type of, type of vehicles and military vehicles, things like that. And this was as a vocation now having come from Finance where it really doesn't necessarily play into areas where my interests lie from a either historical perspective, you know, perspective where we could have a. Where I could continue to learn around these type of national security issues. This is really kind of the closest thing that I could do.

J.C. would you. So that's Boston Meridian Partners. But would you tell us more about your founding story? You mentioned everybody there has really been operators. And what about you personally? What's your background?

Sure, yeah. No, I had left college, went right to Wall street in the corporate analyst programs, jumped over to technology really when the Netscape IPO happened back in 1995 and then joined a very tech focused investment bank called Montgomery securities that was sold. The founder started a firm called Thomas Wiser Partners. I ran their east coast or their northeast business for them. On corporate finance side, it really took 2001 where that opportunity ended rather abruptly. Investment banking was largely cut. I was fired. I was wondering, hey, my world got turned upside down, what do I want to do? And I said, you know what, I'm going to go actually go work for a tech company and actually learn all this advice I've been giving, learn if it actually, if the rubber hit the road. And what I found was I joined Akamai Technologies really at a point where Akamai had just lost its founder in 9 11. It was really trying to figure out its core mission of content delivery. There was so much dark fiber already in the ground. People thought this was commoditized. And Akabi at the time we still saw 40 to 50% of the world's Internet traffic. And really the idea that we could actually have visibility on DDoS type of attacks or any type of high know, broad network sweeping type of attacks which are taking place was really kind of a glimmer. We really didn't focus on that at the time. But you know, I ran the corporate strategy. So I was both responsible for positioning Akamai in the public market, figuring out what network guy was going to go bust on us next because everybody was turning off and sending back all these boxes and then also you know, really helping the current CEO, you know, interact with Wall street through the earnings type of releases and calls and otherwise. But one side note was the would come into Akamai and really the ones that were left in the wake of 2001 would come in and you know, they really, I won't name names but the biggest and brightest you'd expect and they'd come in, they really didn't know what we did. They really truly and they weren't that interested, which was the worst part, you know, because we would. We would have given them the keys to the kingdom to understand really what our technology advantage was and otherwise. And they weren't that interested. It was much more. You call me when there's a transaction or opportunity. So sitting there, I realized that with 3,000 companies in the NASDAQ not being covered and my career as M and a banker, I realized there was really this opportunity, a very entrepreneurial opportunity to start a firm like Boston Meridian. So that's what I did. I joined some of my team back from Montgomery, and we launched Boston Marine Partners 2004. We've done about six and a half billion since then and had success. I could never dreamed at that moment, sitting in Cambridge, Massachusetts.

That's cool. And before we go on, I wanted to tell you my opinion about Akamai to see if this is because of your strategy. For 15 years now, every person I've ever met from Akamai is smart. Whether it's a local account rep, someone for marketing, a salesperson, any technologist. Smart, knows their tech and knows how that tech can be applied to enterprise security. So was that your strategy?

Well, I can tell you I was one of the dumb ones around that. It's sitting in the shadow of darpa. You know, there's enormous crossover between MIT and, you know, given Tom Layton's, you know, still probably. I believe he still is part of the faculty there. But the sophistication of the challenge that they're tackling, which still comes down to that initial algorithm that Danny Lewin helped create, the person that passed in 9 11, it's so fundamental when really the shit hits the fan, for lack of a better phrase, to making sure that that continuity continues. And really now, particularly as we're thinking about remote access, some of these challenges that are in the COVID world presenting themselves, I think Akamai is really well positioned to continue to be successful. But that really underscored, really, why Boston Meridian has a role today. Because really sitting there, the books that would kind of come in through either my group or a gentleman by the name of Robert Wood, his group from corporate development, were these banker books that really had no application of what we did. And so the ideas were very generic. They weren't well thought out. I could not bring them to our cto, who was extremely smart individual, and say, is this strategic for us? Because it was just, you know, they weren't even in the strikes or in the arena. So when I started Boston Meridian with my Partners we really focused on how do we matter in every conversation we have with either a company that is interested in how do I get this next level of finance, financing or sell myself, or particularly with a GM or a business development head inside a major OEM like the Ciscos of the world. How do I really make sure to add value in that conversation through knowledge and action. And that was the genesis of what we really tried to do. So as we grew the team, I firmly believe that you start with people that really love and have that sector knowledge and then you can add the financials, you can have the execution of investment banking behind it. So one of our close associates ran enterprise security for CA, another one for BMC. Did I work inside of proc strategy at BMC. Another one ran corporate development for MRSA, then became an operator who sold his company to a large private equity firm. I love people that love the space, have an interest. They're going to keep themselves up at night reading about the space. They find it extremely fascinating. And then we help them really go out and bring out their best helping clients and other companies. That's really our goal.

Great JC I also want to ask questions your view of the market and then get into some advice for tech firms your view of the market. I'd love you to talk about just any aspect you want to, but one thing that intrigued me was hearing your views about innovators and regulators and how there's a synergistic dynamic between innovators and regulators. What are your views there?

Yeah, they're inevitably drawn together. You know, the synergies are tougher just insofar as innovation from a high level innovation, everything we fuel from Silicon Valley, where I'm based outside of and on a global basis of innovation really doesn't give much consideration towards regulation. It sort of is, it's first to market. That's a business advantage. Everything from an infrastructure perspective that we've, that you see happening around us, you know, the containerization, the ability to kind of drop a business idea onto a serverless infrastructure and deploy, you know, all of that rushes to the forefront because that's actually how companies accrue business value today is that rapid development, deployment of business applications out to customers and very oftentimes leave things like security, leave things like privacy at the, at the back end. And so they're, they're used to changing the way we do something faster than any regulator, which are usually, I mean, God bless them, you know, more bureaucratic souls based around centers of leadership of government in Europe, in The US and otherwise, who are always constantly playing catch up, either because they see the impact on their constituents who are upset, or there's some lobbyists from some other side that's actually losing out on this whole innovation is pushing them. So you take an area. Now, where are the key areas of innovation? I mean, roughly Obviously cloud computing, IoT, digital health, direct to consumer esports, where we've been active, these autonomous vehicles, cars, alternative power and AI, all of these are really pushing the boundaries. Every single day of innovation and capital is just flying in and everybody wants to ride that charge. But they have very profound, they have very profound effects when you think of it on the populace. If you think about IoT and all this pushing of innovation through 5G and otherwise, leaving aside what people think about if the infrastructure is rewiring our brains or not, from a signal perspective, it really is. What does it mean for the ability to exploit our networks by either a nation state or even something as a simple hack which takes a 5G connected car off the road into a pile of burning flames? There's always this element that lags innovation that is like, oh, wow, we didn't think of that. And there's real ramifications that are happening. That makes sense.

Yeah, it does. It helps. And it seems like society needs regulation sometimes to moderate the impact of this stuff, but we don't want that innovation to be stifled because of regulation. And it seems like it's going to be a constant dynamic.

Well, what's most fascinating about this whole COVID 19 situation is obviously how planned economies have been, or certainly China. Let's just say China, because Russia is still unfolding in terms of its approach to what seems to be blossoming as the time of this podcast. But it's much ballyhooed how China, because of its planned ability and its control of its citizenship, could really lock down the country very quickly and ostensibly do away with the impact of COVID 19. Now, if you apply that into how China can then approach innovation while stifling regulation, you know, such that it can maintain, you know, it can push back these things which are obviously could be harming its population. You know, if you can stifle that and go, go know that there's going to be some impact on its people, but it's going to press ahead anyway, privacy be damned, you know, is really interesting to see. And we're actually at a disadvantage if you think about it, in many ways. I mean, so here we are in the west trying to innovate, running up against these things like privacy and just some of the different social costs. Just Facebook pushing out and what's the social cost for kids on screens or interactions and propaganda directed at us. All these things that a planned economy they don't necessarily have to control because they control the Internet. They keep, they can keep propaganda out, they can keep kind of pressing down on this innovation. It's, you know, something I spent a lot of time trying to think about and understand how we as the west, with all our flourishing ideas can still stay on top.

Yeah, and I appreciate you thinking about that and I know there's a lot more work needs to be done there because there is a lot of tension and we don't want to give up our privacy, but we want the benefits of innovation.

That's right.

And also the pandemic has caused a lot of changes and I want to ask your views about that. But one may be in regulation. When people realize that the Food and Drug Administration seems to exist to say no to everything, they are the anti innovators and they do it out of, I guess, extreme caution. They don't want to contribute to any harm being done. But because of the Food and Drug Administration, you know, telemedicine was just stifled. You had some very narrow stove pipes. You could talk to a particular doctor a particular way. Well, now a pandemic hits and that regulation goes away and we're able to have common sense use of telemedicine. And that's one of a thousand examples. They were also stifling a sensor in the Apple Watch because they didn't want people self diagnosing heart ailments. Well, we had the pandemic and all of us learned Food and Drug Administration's doing this stuff. And I feel like, damn it, that's not what we want you doing.

You know, regulation tends to be impulsive. It tends to follow pathways of years, you know, years prior experience versus cutting edge. You know, it takes a long time to catch up to the benefits of the innovation because it's just Silicon Valley is Mars to downtown D.C. and then you bring in the pressure of lobbyists and others that are representing kind of the old line who are the most to have the deepest pocketbooks in the most established way. And that plays a factor too. You know, it's, it's, you know, for everybody that's innovating, there's someone that's getting cut out that might just have someone sitting on K Street. I agree with you. You know, this is, we've seen, you know, when the, when the social need is Great enough, you know, and the impact is necessary. We've seen the regulation kind of ease up a little bit, for sure.

I've seen, because I'm in the cybersecurity domain and I've done a lot of cybersecurity assessments. I've seen so many things that are not coming to light yet. And for example, the regulations of Food and Drug Administration on how these major drug and pharmaceutical companies have to configure their servers. It's so ridiculous and constraining. These drug companies have a hard time leveraging the cloud like everybody else is. It's cheaper for them to own their own piece of hardware and stick it in a closet somewhere, which will be.

The last holdout for the rest of the world. So we're active in that space. Is that more infrastructure? We work with clients that are doing a lot of the migrations of EDR systems to the cloud for on behalf of working as close partners with Google, Microsoft and certainly Amazon to be the back end of that cloud hosting. They're doing it too. So hospitals can also administer their own infrastructure there, but also on the Novartis of the world and others that are doing this discovery. So hopefully there's, you know, hopefully there's some innovation at work there too that we're certainly covering and active in. Great.

Hey, J.C. a few minutes ago you talked about many of these areas of innovation places where hot stuff is occurring. And I'm wondering if you have views on those areas of innovation in regards to the pandemic. Have things changed? There are things accelerating or decelerating in any way in any of these innovation areas?

Yeah, I mean, I named a bunch of them. So I mean, I'll focus on a couple, you know, certainly. Look, esports is a fascinating one. Before, you know, the perception was that, oh, esports, that's not really sport. And these kids are kind of sitting around, you know, getting unhealthy. You know, you dial that in today where the audience is multiple times larger than pick your sporting event, you know, F1, the Super bowl, you're, you're, you know, a single title. So an Activision title or Ubisoft title like a Call of Duty will have magnitude of people watching it on a global basis. And really that what COVID 19 did was actually gave authenticity to the actual platform because the NFL F1, you know, all these people are now, the only way they can actually stay engaged with their audience is to actually having their stars sit there and compete driving a car on, you know, in esports and building, playing with Fans and otherwise. That's one bizarre little wrinkle that really blew up a space certainly keeping it back to infrastructure. For example, you know the acceleration for cloud but particularly focus around remote access. Really VPANs were sort of like a backwater as we know of kind of commoditized offerings. Well now it's much, it's more important than anything. When your employee base is now distributed, where does the spending go? It's going to really go around securing that type of, securing that type of access versus the traditional physical infrastructure internally. The insider threat, it's really the distributed threat now everything around that and then the ability to accelerate if you're going to bring these new applications online much more accelerating the demand that's going to be around shaping new cloud infrastructure around that really those are where. And you mentioned already healthcare. I wanted to cover that. But even on IoT we continue to have most of our communications being done through I'm using a laptop, talking to you through an iPad. My home is, I can't leave my home. So now I'm trying to bring in all this functionality into my home and that presents its own IoT side. We sold a company called Cujo for example which literally secured the home gateway from and did behavioral analytics across every device connected to that gateway. Very important. Now if you think about security kind of coming to that gateway as a means of exploitation. Fascinating.

And JC I'd love any other views you have on the cybersecurity market. And one way I thought it'd be a huge benefit to our community is if you could give advice to the CEO of a company that wants to make sure he's poised for a good transaction in the future. You know what CEOs do to make sure their company is ready for that transaction and is as valuable as possible.

Yeah, you know, it's, it's. What's most interesting is you know, if you looked historically speaking a, you know the perfect type of company would have very strong, a very strong kind of enterprise sales process in tuned to it. It would be proven to be able to sell licenses to large Fortune 500 companies and have the sales force that would take them out to golf and take their counterpart out to golf and want them and don them for 12 months and then land this big contract. And we've really crossed on, we obviously on a SaaS type of base revenue platform because you think about a crisis like Covid, the ability to have at least some Runway where the customers have already bought and deployed this maybe on one to three year type of Recurring revenue platforms. It really softens the impact of a technology company when a situational spike arrives, which cuts off kind of demand and flow. So that SaaS model for one. But most importantly what we've seen is, you know, the enterprise sales model has really moved into the value in cybersecurity. About my channel, right, because what we're seeing at the same time of the sales model changing is the fact that I cannot, unless even if I'm one of the biggest financial services firms in the world, I cannot manage my own security posture because the nature of the threats are becoming much more complicated. They're usually backed by state actors with unlimited budgets. And they also there's a consumerization going on at the same time where I, not knowing anything about security, can become a script kitty and go try to hack a third world bank. It's literally that type of kind of growth that's going on there. And so what that means is that we're pushing the problem out to the partners again pushing it out to the channel. We're going down market SMB through taking what traditionally would have sold me my storage and some of my compute. And now we're turning them into security professionals who technologies. We're really kind of expanding the nature of the, you know, the nature of the ecosystem out to push security out to the biggest clients all the way down to the bottom. And so what that means is your product has to really be able to fit a channel distribution strategy of either turning MSPs into MSSPs and taking, I presume your users, your viewers would know what that is, but these service providers and then enabling them to go be the first, manage multiple customers, do the incident response, take that on. So that's kind of that pushing out of the sales effort to democratizing it, meaning your platform, your product has to be able to quickly land in someone's toolkit and be brought to market there certainly for example. And other than that, just really the ones we've seen most win are ones that are enabled to be kind of apply their value in a toolkit that a developer can quickly wrap on and deploy. Getting back to this whole idea that business value is really coming about speed to deployment of that value. So we're seeing great companies like the Hashicorp of the world and other ones really be able to take your business fundamental application, wrap all this infrastructure around it, put it into a container and fire that container off to the world, but then be able to secure it as different vulnerabilities arrive, different people figure out how to Exploit that application or the infrastructure around it, being able to change and keep that dynamic and then take all that and push it back into the code base at the point you're writing the next iteration of the product. So you're always taking those vulnerabilities and you're pushing them back into the DevOps cycle. So that's a really fascinating thing to see and be a part of, but that if you're going to position your company for sale, you need to really be able to link rapid deployment of value back to the developer community. Awesome.

So to summarize a couple big thoughts there, guys like you used to tell me it's important to think about product market fit. Now you're saying product channel market fit.

That's right.

And when it comes to the code base, it needs to be like a platform that's continually securely improved both security and functionality of that program.

That's right. Because the vulnerabilities will continue created by humans, exploited by humans, humans now with a lot of powerful technology to find those exploits. So you need to constantly inure yourself in the DevOps cycle going back into that. You need to learn and protect.

All right, let me ask another advice kind of question. This time for the private equity firm or the big strategic that wants to acquire someone and needs to do due diligence. What kind of thing do you think they should be looking for when it comes to technology? Due diligence before an acquisition?

Well, you know, I'll tell you what has emerged obviously in the, and you know, you see these companies like black ducks of the world. You know, I think for the last several years it's been, is what's the sanctity of the code base? These open source, you know, code repositories now are, you know, just what's the value of my company? Did it just kind of cobble together open source components, put a UI on it and declare that a company that's valuable, right? Like where's the, where's the true intellectual property and the logic that they're bringing to bear in the algorithms on top of an open source product? So being able to go through and just see what that open source code base is, are they maintaining it, that type of thing. But more importantly, a lot of these open source libraries now are actually being managed, infiltrated, bought by bad actors who are able to inject malicious code into them, for example. More importantly, given now when you can see a company gets breached and the massive effect it has on its market capitalization or its value, particularly if you're a security company, securing other people. It's really when you're buying and evaluating buying a company on due diligence, you have to absolutely make sure to run the requisite check of its entire security infrastructure. And to with professionals, obviously people like UDA and others that really would be able to quickly assess what the real risk of this company's business value or its employees or brand and recognition. Think about someone that's a password manager, we've seen them before getting breached. It's pretty much out of business. If you went and spent 250 million acquiring a position or something like that, it's a difficult check to write down. So we're seeing that much more coming to the forefront. We're always interested in technologies. We've even seen in investments of companies that are going to be able to do that in the 30 day window between when you sign a term sheet, when you close. So if as a private equity investor you can look at that and say, hey, even if I don't know all the risks, I can actually indemnify myself for them later on because I've done an initial assessment that says I know these holes are there and they need to be fixed. Does that make sense?

Yep, it does. JC, I really appreciate this and I think, you know, our goals were to introduce Boston Meridian and you to more people and I think this conversation really highlighted why I personally like doing business with you so much and I really appreciate the time and context.

Yeah, we're fascinated by the space. We love it, we live it every single day. We'll talk to any company with an interesting idea, share our knowledge of it and we believe in the community aspect of this that the better we can get technologies to market which can keep us on the front end against the adversaries we're really interested in helping out on. Cool. Well, thanks J.C. great. Give my best to Matt as well.

Thanks for listening to this OODA Loop production For the latest analysis on cybersecurity technology and global risks, please visit www.oodaloop.com.