Dino Boukouris & Sam Bronstein: How AI, identity, and cloud security defined 2025 and what 2026 holds for founders

Welcome to Inside the Network. I'm Sid Trivedi.

I am Ross Halidook.

And I am Mahendra Ramasinghani. We have spent decades building, investing, and researching cybersecurity companies.

On this podcast, we invite you to join us inside the network where we bring the best founders, operators, and investors building the future of cyber.

We will talk about the hard parts of the founder journey, launching companies, getting to product-market fit, raising capital, and scaling to an exit.

And yes, we will also be talking about epic failures.

But Mahendra, we're here to make the founder journey easier.

That is correct, Sid, but we cannot make it too much easier because startups are hard. And of course, you already knew that.

All right, you two, enough. Let's get started with this week's episode.

Welcome to Inside the Network. As we wrap up 2025, we are joined by two of the sharpest minds in the cybersecurity industry, Dino Bucharest and Sam Bronstein. Now, they are the silent dealmakers, the CEO whisperers, pensiglieri, who shape some of the largest cybersecurity mergers and acquisitions. Dino Bocoris is the founder and managing partner of Altitude Cyber, an advisory firm that specializes in corporate strategy, M&A, and long-term exit planning in security. Now, Dino has been in this game for 20 years. Yes, you heard me right, two decades and counting. And the best part is Altitude Cyber's monthly reports. Now, these reports are considered to be the industry bible in tracking Mergers, acquisitions, investments, and categories are receiving funding. These reports are 70, 80, even 100 pages long. They come out every month and they are free. I know I've learned a lot from these reports. I'm a regular reader, and if you are a founder, entrepreneur, builder, head over to altitudescyber.com, look for the resources page, and you'll find a treasure there that could benefit you. Sam Bronstein is a partner at Axon and Sam spent nearly a decade at Catalyst. Now, some of you may know that Frank Cotroni was one of the legendary investment bankers who started Catalyst Partners. At Catalyst, Sam was involved in some of the landmark transactions such as Slack's $28 billion sale to Salesforce, LinkedIn's $26 billion acquisition by Microsoft. And today at Axon Partners, he focuses on cybersecurity, AI infrastructure, and developer software. He's already sold companies to OpenAI, NVIDIA, MongoDB. And so to put it differently, Sam knows how to earn the respect of these giants, how to build trust with some of the most relevant companies in our universe. So founders, as you navigate strategic outcomes in these rapidly evolving markets, Dino and Sam break down the M&A trends of 2025 and what should we expect in 2026. Be it AI security, understanding the insights of CISOs, or planning for an exit, this episode will give you some solid nuggets of how to shape your journey. Let's get started.

Welcome Dino and Sam to Inside the Network. So, you know, we have a whole bunch of things to talk about as we wrap up 2025 and look at 2026. And you are two fantastic advisors to startups and large companies, corporates. We wanted to start with a few questions just around the buyer landscape. Looking back at 2025, what major shifts did you see in the cybersecurity customer priorities? It seems like cyber resilience was taking center stage, particularly after incidents like the Jaguar Land Rover attack., which halted production for weeks. Are boards and customers now investing very differently? And are they focusing on certain categories versus others? Dino, perhaps you could chime in to start?

Yeah, sure. Happy to. Yeah, thanks for having us on the show. Really excited for this. Yeah, I mean, when you look at spending behaviors, I mean, I would say like, you know, if you look at some of the attacks that are out there and how they translated into operational disruption, that really, I mean, that's been top of mind for folks for quite some time now. I don't believe there's there's been a kind of a unique aspect to this that, you know, 2025 like materially shifted behaviors. You know, I would say when you start looking at what folks are doing to augment capabilities internally, like services have always been a large part of the budget and I think they always will be a large part of the budget, whether that's fully outsourcing responsibilities, having some kind of a co-managed model. You know, I would expect that services are probably going to take up half of the budgets, right? Like people and services, like that's typically where we see like the majority of spend. And then obviously there's, you know, entire arsenal of products that folks are investing in. What I will say has, at least from our perspective, what is kind of maybe not changed, but just like the winds are shifting a bit, is just there's an increased focus, and this is not going to be a shocker to anyone on this call, but there's an increased focus to like what is AI doing to kind of the threat landscape. And it's kind of multifaceted, right? It's, you know, how are we leveraging AI capabilities internally and what type of new attack surfaces did we just open up by doing so? Some of which I would argue are not yet understood. I mean, everyone talks about like vibe coding and other methods to leverage AI to be more efficient, but I think we're barely scratching the surface of understanding like, who do we just let into the house, right? Like, what is the risk that we have now kind of entered into the equation that we have not yet kind of placed appropriate mitigations for? So I think that's one aspect. I think AI-driven threats is another big one, right? Like, how are the attackers leveraging AI? And obviously we've seen the first signs of that, like nation-state-backed attacks that are leveraging, I think it was what, 90% of the attack that happened the other week was leveraging AI. So I do believe there's an increased spend for that second aspect for sure. I would say countering AI-driven threats. I think Wiz just released a study a couple days ago that looked at like 300+ CISOs and, you know, the number one area they were kind of focused on and what they wanted to spend, actually greater than cloud security, which obviously Wiz is a cloud security player. So you would assume they would have put cloud first, but they actually put these AI-driven threats are what people are worried about spending money on. And I think we're slowly getting to the point where these kind of the use of AI tools and how to protect against those, I feel like budgets are not quite there yet. Maybe a quarter of the organizations really have set aside budgets for that. Maybe it's up to 50% now. But in the next couple of years, I feel like that's going to be another huge area of spend.

Yeah.

And you mentioned budgets, which kind of leads nicely into the next question, which is we've seen that in 2025, nearly half of the CISOs had flat security budgets, really forcing them to do more with less and sometimes and oftentimes forcing them to do less. In practice, did you see that leading to companies and security teams trying to consolidate their spend to reduce costs, or did they double down on some of the best-of-breed tools in their environment to still make sure that they deliver a clear ROI? And also, which of the previously nice-to-haves or tools that were considered nice to have became must-haves despite the fact that the spending constraints have become much more clear?

Yep. And it's great to be on here with you guys. Thanks for having me, Dino. It's great to— it's great to meet you and be on with you as well. Look, there was definitely consolidation, but I would categorize the consolidation as more surgical, not just across the board cutting, right? It's where can we cut commodity layers? Where are there overlapping tools? Where are there places with high licensing and operational burdens? Where can you realize significant cost savings from a cut? So what does that result in? Right. You know, EDR and XDR moving to Microsoft, CrowdStrike, SentinelOne, you know, SASE consolidating to Zscaler, Palo Alto, Cato, Netscope, Cisco. You know, Wiz basically took a bunch of these disparate pieces of the cloud platform and consolidated them into one solution. You also see a bunch of the legacy SIEM and SOAR solutions being replaced by some of the AI-native and autonomous options. So for those areas, there's consolidation, and there's replacing for best of breed in a few critical categories. We don't see people necessarily cutting down on spend, right? So, so where is that? It's, it's identity threat detection and response. It's— there's been such an increase in vendor sprawl and third-party software usage that SSPM is super important. Ransomware defense, backup and recovery, areas like that. So yes, there is definitely a consolidation, but for a select few categories, we don't see people cutting and removing spend.

I want to talk a little bit about the M&A and private equity landscape. And Dino and Sam, both of you spend a lot of time looking at all of these different groups from founders to corporates to private equity firms and advising them on a whole bunch of different types of transactions. The cybersecurity M&A landscape was very lively this year. And not to say that last year wasn't lively. I mean, we had $50 billion of deal volume last year. And this year we've already had $75 billion. We're already up almost 50% year over year. And this has included two blockbuster deals. We had the $32 billion acquisition of Wiz by Google and the $25 billion acquisition of CyberArk by Palo Alto Networks. How has the pace and pricing of cyber M&A evolved and what do you see in terms of deal volume, momentum, and valuation trends as we head into 2026? Let's start with you, Dino.

Yeah, sure. Yeah, look, I mean, it's a overall, I feel like the deal activity, look at historical numbers, for example, obviously we had the sugar high of 2021, right? With post-COVID digital transformation acceleration. If you kind of extract that and pull that out of the data set, I feel like our activity has kind of reached a healthy steady state where it's kind of like pre-COVID levels or kind of a little bit improved from the market correction. But you know, there's no kind of like drastic swings that we're seeing at this point. Valuations have come back up to a healthy range. You know, deals are getting done at a healthy clip. I don't think that there's necessarily like buyer or seller's market per se. I think there's a lot of assets that are on the market that are kind of pushing some of the power to the buyers in my opinion. But Overall, I'd say, you know, we're, we're in a relatively healthy period. The part that is noticeable for me, it's less about necessarily like a multiple conversation, but the business fundamentals have shifted a bit and kind of what is considered a premium asset. And I'm sure you guys have heard this many times before, but like this notion of, you know, growth trumps everything has significantly changed in my opinion at this point in time. So buyers are much more disciplined. And there's outliers, and I'm not talking about like Wiz or the moves, the types of moves that Palo Alto will make that frankly, they're not necessarily multiple pipe decisions. You know, I'm just talking about the vast majority of M&A that's out there. It's really focusing on like the fundamentals of the business. You know, you don't have to have this like hyper, hyper growth so long as you're not burning too much, right? You don't have to have like net retention metrics that are 150%, but you also can't have gross retention that's tracking at 70% and you're going to get attention from folks. So it's like there's different metrics I would say that folks are focused on at this point. But overall, I mean, if you look at private markets, public markets, like multiples for, you know, some of the higher growth companies have actually increased a bit. When you look at the spread of multiples, I think that's what's noticeably different. I would say there's a wider range of outcomes today than there were 12 months ago. I think in the public markets they increased by over 100% as far as like what that upper peak is for the multiple. So I mean, I feel like the, we're, we're in a very healthy environment and kind of absent any like massive like macroeconomic shocks to the system, you know, feeling pretty bullish of what 2026 looks like.

Sam, how do you think about this? I mean, is, do you agree with Dino that things are continuing to look pretty rosy? I mean, we're already seeing some of the signs of stress in the markets and you know, how do you think that may change how buyers behave?

Yeah, I mean, look, right now I think if you, If you condition 2026 as no big macroeconomic shock and no significant reversal on antitrust policy, we would expect M&A to continue to operate at high levels, record levels. You know, I think if you look at 2024, the two mega deals that got done were, were super interesting because you basically had Palo going and doing a $25 billion deal that was really a significant departure from what they've historically done on the M&A front, right? They've historically bought early-stage businesses, great products, great teams, sub-billion-dollar checks, and plugged them into the Palo Alto distribution. And if CyberArk, you know, is a company that was founded in the 20th century and it's thousands of employees, billion-plus of revenue, and you know, what's fascinating too is it doesn't seem like Nikesh is going to stop, right? They just picked up Chronosphere as well and did their second-largest deal. So he, he's clearly putting his, his foot on the accelerator. And I also look at that move as potentially being a bit of a starting gun in the identity wars. And, and what does Zscaler do? What does a Checkpoint do? What does CrowdStrike do? Do they feel like they go and need to own a significant scaled asset in the identity space because now Palo Alto does? So, and then if you look at Google Wiz, right, Google was on the sidelines for a long time because of the antitrust regime. And they had had discussions, you know, rumored with Wiz back in 2024, and they didn't end up consummating it, likely because of their perspective on regulatory. And they came off the sidelines in a, in a big way. And, you know, I remember when you talk about the cloud platforms 5 to 10 years ago, it was like AWS clearly at the top, Azure, you know, second, but not incredibly far off. And then GCP was sort of a distant third. And what they've done, particularly around AI with their TPUs and their Gemini models, but also with security to close the gap between where they're at and Amazon and Microsoft has been incredibly impressive. And then look, I agree with everything that Dino said. I think, you know, if you look at the, Dollar volumes adjusted for Wiz and CyberArk, it's a strong year, but it's not a record level year. And you know, the M&A that's happened below those two, you know, we've had a very active $100 million to billion strategic, strategic acquisition backdrop. And I don't know if I can remember so many deals in one category as we had in this security for AI category. Like Palo Alto picked up Protect, Cisco did Robust last year, F5 did Calypso, CrowdStrike did Pangea, F5 did Lakera, SentinelOne did Prompt, Zscaler did SPLX. So it's been super active in that category. We'll see if they still do more and more of the security for AI as architectures evolve and things change. We've seen some M&A in the AI for security. CrowdStrike bought Onom. SentinelOne bought Observo AI, which was a client of Axoms. And we've also seen non-security buyers remain active in M&A. Mitsubishi bought Nozomi. Twilio bought Stitch, which was also a client of ours. Obviously last year Mastercard bought Recorded Future. So interesting, active market expected to continue so long as there's no big macroeconomic shocks or antitrust reversals.

Dino, it's practically impossible to talk about the trends in the cybersecurity market unless we also discuss private equity and how that fits into the broader ecosystem. When we look at the PE, we know that companies like Thoma Bravo, for example, manage over $60 billion portfolio of cybersecurity companies. And some categories in security see that representation at a much higher level than others. In 2025, how did you see the macro environment impact the PE play and the PE activity in cyber? Are we seeing private equity still aggressively pursuing take privates and roll-ups, or have they become more selective in, in our industry?

It's a great question. I don't know if they've become necessarily more selective. You know, I'm not gonna name names. I just think the targets that are out there are just not as plentiful, right? Because when you think about it, some of the companies that have been taken private in the past have a very different profile. It wasn't like were just completely struggling and had no bright future ahead of them and they just needed to be saved by private equity. Like those aren't the types of deals that Thoma chases, for example. I think it's more a function of, you know, are there targets that remain that are not too large? Like obviously they're not going to go out and buy Palo Alto, but that are attractive enough and the business fundamentals warrant their investment. I actually think PE is going to turn their lens more towards like the larger growth scale pre-IPO type targets. And I think you're going to see more aggressive behavior before they actually hit the public markets. And I think some of that is a function of like, it's, it's not as easy to be a public company in my opinion any longer. Like if you look at even the last, you know, 5 years of activity, let's just see, or 4 years, go, let's go back to 2021. Like, you know, KnowBe4 went out, they were taken private subsequently. Darktrace went out, taken private. ForgeRock went out, then taken private. ZeroFox went out, taken private again. I know they were more SPAC. IronNet SPAC, did not end well. Like there's, I mean, those companies were like the $100 to $200 million type ARR range. Now for companies to get comfortable going out public and they're, you know, $700, $800 million, like those, it just kind of tipped the equation a bit as far as like who these big PE firms could actually go after. So long-winded answer, but I would say I expect PE to stay fairly active in the space. I think there'll be fewer take privates just frankly because of a lack of like really bite-sized but attractive targets in the market, and there will be more activity for these like growth pre-IPO candidates being gobbled up by the PE landscape.

Yeah, I mean, I agree with everything you just said, Dino. I mean, it's really interesting to think about where private equity is at today versus where they were at in the last big cyber boom. I mean, I remember when 2021, 2022, Thoma Bravo was outbidding strategics. For high-growth venture-backed assets. And you know, that was before 10 times revenue was a low revenue multiple, right? But they were competing very actively with strategics on deals. That's not the case anymore, right? They're going after businesses that are more traditionally, you know, strong ARR, strong retention rates, you know, profitable, lower growth, mission-critical industries, likely a little older, more on-premise. Um, and the other private equity trend that I have been keeping my eye on, I think that there is the perspective in the zeitgeist that private equity is going to sort of be the, the, the cleanup crew for a lot of the venture-backed companies that raised, uh, back in ZIRP. My anecdotal experience is that there is still a significant disconnect between private equity values those companies and where both the founders and the investors value those companies. So I think we will see more private equity activity as those companies have lower cash balances. You know, their valuation expectations might compress, but you know, with the scale required to go public with strategics focusing on AI and the highest growth assets, the options are limited and I think we will see that valuation gap compress.

Yeah, that's actually a really good point. Completely agree. The ZIRP companies also have a second thing working against them. It's like they raised at much higher valuations and they're slowly coming back to reality for the founders, the investors, the folks that put money into them. But they also tended to be a different profile company where it was like, high growth, focusing on new customers and new ARR, maybe not the greatest gross retention metrics, maybe not the greatest kind of efficiency metrics. And the PEs are quicker to kind of change the criteria and they tend to be able to change that faster than the companies can change the profile of a business because obviously that takes time. So I completely agree kind of with that notion that these ZIRP companies, those that remain that were able to kind of make it until now, I think there's going to need to be a bit of a reckoning between valuation expectations and kind of that, just that bid-ask spread has to get a little bit narrower for some of these to see a PE as a truly viable kind of home for them.

Dino, you're using ZIRP as an acronym, like a Gartner acronym. For the technical founders on our audience, help them understand how zero interest rates impacted PE buying briefly. And before we move on to our next question, just double-click on ZIRP for a minute.

The zero interest rate period is just, I mean, it's going to sound quite obvious when I say it, but it basically just made access to capital very easy and made money effectively free, right? So when money is free, people tend to spend it in ways that is not the most disciplined. And frankly, like that environment is what led to a lot of the investments, the crazy high valuations. Like these, as Sam was saying, when you looked at, 10x being a low multiple for a company. It was kind of crazy, but at the same time, it's just a function of what the market demands. So that period of, you know, we called it like digital transformation, if you will, like post-COVID interest rates dropped and it was just like, go, go, go. Like you can raise capital at crazy valuations. You can have kind of like eye-popping kind of M&A multiples. And it just, it created this feeling of like, you know, the party was never going to end. The music was never going to stop. And people just kept raising, raising, raising. You see a drastic market correction and suddenly, you know, you're on a trajectory where you're, you know, taking off at a very high speed and suddenly the market says that they're not going to reward you for that high speed. And actually you need to be, you know, fuel efficient. And so it's just, it's really hard to redesign the car after you've already, you know, on the racetrack. So I think that that's kind of the dynamic that I would say for, for the less kind of, you know, financial oriented folks, it's less, less about the technicalities about the 0% interest. It's more about kind of the period of time and the behaviors that followed as a result.

And look guys, you know, we are almost 20 minutes into this podcast and I'm really, really disappointed that nobody, you know, I mean, Dino and Sam, you guys are smart people. My co-hosts may be smart, not as smart, but at least, and nobody's brought up the race car acquisition that had happened. You know, George Kirkland buying Mercedes F1. Do you want to touch on that before we go into some of the other fun stuff?

If he's as good at racing or owning a race car as he is at building a company, I think he'll do quite well.

So I'm just, I'm jealous because that just sounds amazing to actually own part of a racing team. But yeah, so hopefully one day.

Yeah, no, this is sort of, I think my co-host Sid mentioned this in one of his LinkedIn posts that there are these fascinating trends that are occurring in our landscape. Let's go from the private equity and the mega to what we might describe as the medians. Your Altitude Cyber Reports often cover these very well. Talk to us about what would 2025 look like in the median acquisitions? What is top of mind in the tech sector? You talked about AI and how should our founders more importantly use that knowledge to steer their ship in the right direction in 2026?

Yeah, it's a great question. I mean, I think Sam touched on this a bit. There's, there's the number 1 and 2 and 3 sector that we've seen this year has been really kind of protecting the use of AI, right? So securing AI, whether that is looking at the protect acquisitions, looking at the— Checkpoint made a bet in this play, uh, Zscaler made a bet in this play in the space, Palo Alto made a bet in the space, F5 made a bet in the space. I mean, you've seen most of the activity, uh, and some people are like, oh, okay, the big bets were made. No, actually, I, I don't think it's over. I would expect to see a number of those players buy a second and third company in that market. There's still quite a few strategics that have yet to make their bet in that space. Some of them, you know, tried to build it themselves. Some have been going after assets. Obviously I won't name names, but you know, maybe they came up short in terms of what they were able to bid for some of these that were taken out at really high prices. But the interesting part is, you know, if you look at the ARR that those firms have generated, it wasn't a large amount, right? It wasn't like they bought because the budgets were there and, you know, they saw the commercial traction to justify it. It really is people that are kind of gearing up and it's an arms race for the technology and frankly, the talent to be able to do it. So I do believe that the security for AI market will continue to have pretty strong tailwinds, like through 2026. I do think there's a lot of snake oil when it comes to the, the reverse of that, the kind of AI for security out there, but there are capabilities and effectively it's taking automation and efficiency to the next level.. And I do believe as a founder, if you're able to successfully do that and, you know, whether you, you use AIs or agents or, you know, MCPs, like it's almost irrelevant at this point. I think if you're able to succeed and truly drive efficient operations, I think you'll be rewarded for that in the market. Because we're continuing to enter in this period where it's like the attack surface continues to expand. Budgets are finite. They're not infinite, even if they're increasing, you know, these coming years. So I do believe that efficiency, consolidation, those, those trends are never going to disappear. And so, you know, from my perspective, like those two key, you know, kind of factors as it relates to AI will drive a lot of the activity in the coming years. And even if you're not in the space, I think it's important to note that when the acquirers are prioritizing these sectors at the top of their M&A list, you might say, oh, well, I'm a perfect strategic fit. For this, you know, XYZ company, why aren't they buying me? Unfortunately, there's also finite resources on the acquirer side. So you might have to wait 1, 2, 3, 4 quarters for them to place their bets in the most kind of highest priority markets. And as a founder, like you need to be prepared to weather the storm. If you're not in one of the top priority areas for these acquirers, even if there is a strong strategic fit for your company, unless they see it as opportunistic, which is just a fancy way of saying they can buy you for a cheap price. Unless they see it as an opportunistic kind of acquisition, you might just have to wait. So timing is everything. And I'd say that's the one aspect that founders don't really appreciate is it's not just about strategic fit. It's actually about timing as well.

And Sam, you came from a background, you know, like Catalyst, where you were, you know, involved in large transactions like Splunk. What's from your vantage point, what are some trends that you're seeing and how should founders sort of play into that thoughtfully?

Yeah, I mean, look, these strategic deals are really driven by personal relationships, right? Even the deals that are the largest in the industry, the, you know, the Splunks and the CyberArks, and they're a founder CEO connecting with the CEO of the acquirer, you know, maybe it's a GM of a business line, someone with P&L, and it takes It takes a long time to develop those relationships. And, you know, obviously I'm a little biased in that my business is M&A, so I'm predisposed to encourage people to think a little bit more proactively about M&A. But when you're getting acquired by a company, you're really looking for someone on the other side of the table to pound their fist down and say, look, I'm going to expend a lot of political capital to go and bring Mahendra over here or Sid over here. And those relationships, that's not, you know, a Zoom call and a couple texts. That's dinners. That's getting to know someone on a personal level. And once you have product market fit as a company, like I think before you have product market fit, it's premature to go and build those relationships. But once you have product market fit, unless you're just, maybe you're like a whiz and you're just like, we're only going to show up on people's radar by just kicking ass and scaling our revenue at unprecedented rates. So maybe this advice wouldn't apply as much to a Wiz, but yeah, go and figure out which strategics have investment arms. Go figure out where there's an opportunity to go build a commercial partnership, to go sell together. Even if there isn't a clear opportunity to work together, but you have a warm intro with a senior executive, potential acquirer, go get dinner with them. Just go get to know them. And what that will do, it will open up the chance that, you know, they want to come and acquire you, but it will also create some optionality if someone else decides that they want to acquire you. Because then when you make the call to the other buyers, you're not bringing them up to speed from day one from a slow start, right? They know you well. And then you have an opportunity to get multiple people that are interested in acquiring you. And that's when you get some of the more interesting outcomes.

I think, I honestly, I think this point is worth reinforcing 2, 3, and 4 times. There's a mistaken belief for many founders and frankly, like very sophisticated boards and investors that we talk to and there's this belief of like, oh, well, we're just not looking for an exit. And so it's like the analogy that I always use, it's like you don't start dating when you're ready to get married. Like you need to start the dating process well in advance. You don't know what the future is going to hold and leaving your exits to chance, like many boards advise, like, nope, we're heads down. And to Sam's point, like, sure, if you're a whiz and you struck gold, and to be clear, striking gold doesn't equal it's in the founder's mind that I've built the best technology on the planet. Frankly, no one cares. Do your business metrics, do your commercial, like, does your commercial traction show that you struck gold? If so, you can use a different playbook. But for the rest of us mere mortals and the other 99.9% of the companies out there, if you leave your exits to chance, like the odds are not stacked in your favor that you're going to have a great outcome. And the value of the relationships that Sam was describing, like I just think it's the most important thing you can do aside from building your company. Your number 2 priority needs to be building the relationships because you never know when you might need them. You never know, like to Sam's point, you can actually have an LOI come in and somebody wants to buy your company. If it's an amazing offer, obvious decision. If it's a terrible offer, obvious decision. What if it's mediocre and you're like, man, like if I knew this is the only offer out there, I would take it. But if it's not, I don't want to take it. And you've never built up a relationship. And that's where, you know, I won't say the B word on this call, but that's where people are like, oh, well we're going to call a firm and they're going to make a teaser for us and they're going to blast it out to 247 corp dev people. That's not how you're going to get the maximum multiple. So I think I could not agree more with what Sam was saying.

Yeah, I keep reminding all my CEOs that, you know, they have a couple of jobs. One, speak to investors. Two, speak to corporates and partners who may end up becoming acquirers. Three, hire the best people. And four, speak to customers. I mean, it's just those, those four things are so, so important as a CEO. And many times you just think that you can kind of ignore a few of those things and candidly you cannot. You have to be out there all the time. From, you know, the M&A markets, let's talk a little bit about the public markets and the IPO landscape. After a 2-year drought, the cyber IPO window finally cracked open in 2025. And, you know, we most recently saw Netscope debut on the NASDAQ at a $7.3 billion valuation, which priced above the targets, and it also popped on day one. How have the public market investors receive this 2025 cybersecurity IPO in Netscope as well as the one from SailPoint? And more broadly, what do you think is going to determine whether we see a bigger wave of cyber IPOs in 2026? And Sam, let's start with you here.

Yeah, look, I would characterize the IPO window as opening, not wide open, right? There have been across not just cybersecurity, but software. 11 IPOs in 2025. That's compared to 42 IPOs of software companies in 2021, but only a small handful from 2022 to 2024. So we're trending in the right direction. I think it's really a tale of two cities, right? If you look at some of the IPOs that have traded up significantly, not in cybersecurity, but in broader software, the Figmas, the Circles, the CoreWeaves, the companies that have been able to capture the imagination of both retail and institutional investors, gives them exposure to an industry that they didn't have much exposure to, or maybe had limited options to invest in, like crypto or AI. Those are the businesses that are performing the strongest once they go public. CoreWeave and Circle still trading above their IPO price. Figma came down, but they both had They all had big pops. The other side of the street are businesses like Navin, great business, built a real scaled business with strong growth over time, but didn't really capture the imagination the same way the others did. And I think that that's what we've seen a little bit in the security landscape, right? Netskope popped nicely on the first day of trading, but now it's hovering right around the IPO price, still trading at a nice multiple, but they didn't have that kind of zoom up into the right trajectory after IPO and SailPoint traded down a bit on the IPO and it still has gone a bit further down post-IPO. And why is that the case? I think there has been in the public markets a real focus on scale. And if you look at where the majority of the price appreciation has occurred over the past 2 years in the public markets, over 50% of that's from the Mag 7. So there's a real view that you have to be doing something super unique and special to get us to rotate out of Nvidia, Microsoft, Google, and into your company. And with Netscope, right, they are obviously a pure play SASE vendor, the only one that's on the market. But investors might look and they say, okay, well, I could also buy Zscaler or Palo Alto. They're significantly less risky in all likelihood, and I still get exposure to that same product and category that I want. So look, I think the IPO window is opening and it's good to see companies go public, but I think it is challenging to go public if you aren't one of those super shiny objects. And I think you get into a situation where it might be preferable to get acquired. And that doesn't even start to factor in the cost of going public and how expensive it is to do an IPO. You know, 7% of proceeds, $10 to $20 million of fees. It's very, very expensive. So yes, IPO window is cracking open, but not wide open.

And talking about the shiny objects and talking about the fact that some companies, that very few companies are on track or would have been on track to go public. We have to talk about Wiz, right? Like earlier this year, Wiz surprised the market by deciding to get acquired by Google for $32 billion instead of going public. Obviously, many in the industry assumed that Wiz's successful IPO would open the room and become that first big success that would then demonstrate an opportunity for other companies to follow. And yet, given the outcome and given the fact that the sale has raised questions about the IPO pipeline, What does a mega deal like this say about late-stage cybersecurity firms' preferences and their decision to choose the M&A over IPO? And do you think that there will be more cyber unicorns that will decide to take a similar path instead of facing the public markets? Dino, I think this one will be, will be to you.

So a couple thoughts here. We're talking 4 years ago or 3 years ago. You know, you, you go public, you can have, you know, call it $175, $150, $200, $250 million of ARR. Those types of targets were truly having a decision of, you know, do we IPO or do we consider some kind of M&A outcome? When you get to the scale of your revenue, kind of you're, you're, you're measuring it with a B, right? And you're saying, okay, well, you know, we're going to hit a billion of revenue this year. As much as you'd like to think there is, like, there's not that many buyers that are out there for companies that reach that scale. So most of the time it's not, it's not really in your control. Right? If you don't take the off-ramp when you're bite-sized and you actually have a pretty wide pool of buyers, like you're left with like a handful of folks as a security company that you might get snapped up by. So I don't think like as you scale, it's like your options dwindle when it comes to M&A. So that, that's the first, I think, challenge when it comes in. Obviously none of us can read the minds of Wiz, but I think that's one of the challenges is Wiz was growing so fast, like their, their pool of buyers was getting smaller and smaller., you know, by the quarter, not by the year. Second thing is people don't often appreciate an IPO isn't an exit, right? Like an IPO is just the next chapter. Like it's the next kind of challenge and the next, you know, part of your journey. Getting acquired for $32 billion, that is an exit. Everybody is getting cashed out. Investors are making money. The founders are making money. Employees are making money. That is truly an exit. So it wasn't like, you know, what exit do you want? It was either exit at a very healthy price or keep going and, you know, see how big you can go. Go compete with Palo Alto, go compete with all the big players that are out there and see what the public markets do. And then over time, yes, you can sell shares and you can find liquidity for your investment, but it's kind of a misconceived notion where an IPO is necessarily an exit. And last, last comment I'll make on Wiz is, I mean, they raised at what it was like a $12 billion valuation in May of 2023. 24. So to look at selling at 3 times, effectively almost 3 times that valuation less than a year later, it's really hard. Like if you're valued at $12 million, being valued at $36 million a year later, yeah, no big deal. It's really hard to turn $12 billion into $32 billion in a year. Like when you get to that scale of numbers, being able to triple that type of an investment and, you know, call it like less than 12 months, It's not easy to do. It's really hard to say no to that type of a return. Yeah.

And the other dynamic in the IPO markets that are interesting, if you look at the top echelon of companies, and I think right now the companies in cybersecurity are maybe a little bit too early to be considering going public, like the Sierra and the Islands, the sort of shiniest objects. But if you just zoom out to broader Technology, Databricks, Stripe, SpaceX, right? They're just sitting there and they're like, why would we ever go public? You know, we get, we have a good secondary market. We get our employees liquidity that way. We don't have to pay a bunch of money to go public. We don't have to get asked questions on a quarterly basis. So you've really had the illiquidity discount for these companies turn into sort of an access premium because people want to get their money into those companies, but they can't. So it's sort of a fascinating inversion. Of what we used to traditionally think of these late-stage private companies and what they wanted to do.

I think both of you make excellent points here, Dino and Sam. IPO being the next stage of the journey. One of the thoughts that comes to mind is our guest Tomer from Sentinel One. If you look at the company, I mean, here's a company that has crossed a billion dollars in revenues. I didn't look at the markets today, but it's probably some $10 billion in terms of market cap. And when you look at that as an example of how the public markets operate versus a $32 billion outcome to a company like Google, I mean, clearly, you know, the halo of an IPO is not necessarily as attractive anymore, right? I mean, here's Stromer still working his ass off and our friend at Wiz have, you know, going to move on to the next journey. So creates a very interesting dynamic in the IPO market. I mean, talk to us about what are some things that you're seeing in the public markets as shift to like growth with profitability. Growth was valued. Now growth with profitability becomes important. What are some other metrics that you're seeing at the public market level that are becoming more important?

I can take that. Look, it's, it's no longer an optional thing to be profitable, right? You know, interest rates have reset the valuation frameworks. Market learned a bunch of painful lessons from the IPOs of 2020 to 2021. So it's no longer optional to be profitable. So look, market's punishing high burn. Low gross margin, inefficient go-to-market, growth that's super dependent on sales and marketing spend. When you think about the metrics that are required to trade well in the public markets, right? You think about Rule of 40, should be at least 40%, ideally 50% plus. Free cash flow margins, at least breakeven, ideally 10% plus. Gross margin, 75% and above, ideally in the 80s. NRR of 15%, if not higher, gross retention of 90%, if not higher. So the bar, and this is all for companies that are at significant scale. So right when you're a $200 million revenue company, it's generally easier to grow at a high rate. When you're a $600 million revenue company, to sustain a 20% growth rate or above is very challenging. So it's a tough time to be a public company. It's a tough time to try to be going public. Because the market has become significantly more punishing of companies than it has been in the past.

Yeah. And to translate what Sam's saying, you know, kind of down into the private markets, because I do think, I think it's a fair question for both public and private companies. You know, as Sam mentioned, right? Like the growth that you're talking about, people talk about like Rule of 40 and growth at the public levels. If you're able to sustain 50% growth at the public levels, I hear founders do this all the time. They're like, Well, what do you mean I can't trade like Zscaler? Like they only have like X percent growth. I have the same amount. It's like, yeah, but they're doing it on a base that's, you know, 100x bigger than you, right? So when you think about growth, like at private markets, like you should be well north of 50% growth, ideally well north of 100% if you want to be considered kind of best in class. I think gross margins are the one thing that translates nicely, getting north of 75%, 80%. And I realize there's times where you're just not optimizing for margin when you're at the earlier stages, and I get that. But if you don't have a clear path to get into those healthy margin territory, you'll get penalized even as a private company. And then maybe Rule of 40 is a little less relevant for the earlier companies. Like some type of, some people talk about Rule of X where you kind of weight the growth stronger than profitability, but there are other metrics that you can use, right? You can look at like burn multiples to see how much you're burning relative to how much you're growing. You can look at magic numbers to see how efficient your sales and marketing organization are. I mean, I know We used to always talk about kind of LTV to customer acquisition cost ratio. So there's, there's like efficiency metrics in your business that you, you can, you can and should be measuring, monitoring, and improving as a private company. And then there's the other ones that are kind of true for public and private. And I think retention is probably the biggest point that I want to emphasize. Gross retention has somehow become the new king and not retention. Net retention is important and you absolutely need to have it., but if you have a weak gross retention number, even if you have best-in-class net retention rates, you're going to struggle to attract attention because people are fundamentally wondering like, okay, like, you know, you have some customers that love it, but do you have true product market fit? Are you maybe not dialed into your, the right ICP? And I mean, there's some PE firms that if you're not north of 90%, like, no thank you. Like, it doesn't matter what the rest of your metrics are. Like, 90 is a hard line now. And I would say 5 years ago, we were actually not seeing that. So there, there are some metrics that I would keep in mind. Beyond growth that matter for the private markets as well.

Yes or no, Dino, is the market ready for outcome-based pricing? You know, if you look at the AI world, it's gone into the whole outcome-based pricing, is moving there fast. Is cybersecurity market ready for outcome-based pricing?

Not for product. I don't think that's the case. For services, perhaps, but the product companies will probably argue that there's too much that comes down to how you implement the solution, how you manage it, how you integrate it. Like, I don't see product companies in my jumping in, signing up to that anytime soon, or at least most of them. You know, you do see things where product companies, when properly installed, will give some kind of, you know, a guarantee of their service, or, you know, they're backed by a cyber insurance provider that'll underwrite some kind of a guarantee. I've seen that before, but I would say service companies, people are probably going to push more towards outcome-based service. But again, there's just, there's so many variables where it's really hard to guarantee an outcome these days. So I know that's not a yes or no answer, but I think for product, my answer is no.

Sam, yes or no?

Yeah, I don't think that they're ready for that. I think what Dino said is right. And look, you know, the whole technology world is experimenting with the right way to price and deliver AI services. They're trying to figure out what the terminal state gross margin for these businesses is. So it's just a rapid it's a period of significant change and it feels like we're in the primordial soup phase of AI as people figure out the right way to go to market, deliver the services, price them. So it's quite fascinating.

As we approach the last part of the episode, we would like to talk about the advice for founders. You know, 2026 is coming very, very soon. The market is changing. The market is evolving. Both of you guys have a fantastic view and a fantastic vantage point to see where things are headed. Sam, let's start with you. As we turn the page to 2026, which emerging problem areas or gaps in cybersecurity do you believe are especially ripe for new startups and startup founders to tackle?

Yeah, look, I'll break it into two zones, right? The first zone is AI and the second zone is non-AI. So within AI, There's a bunch of interesting new companies that have been funded around using agents to pen test. Still early there. Still think the customer traction is limited, but a lot of really strong teams raising capital. Uh, Agentic Security, right? Is that sort of tier? Is that phase 2 of where security for AI goes? If the first wave was security posture management for models, is that now evolving to, uh, SPM for agents? How does the SIEM evolve, right? How does the SOC evolve? What, what do tools look like in, in 2028, not just 2026? As far as more broadly speaking, look, I think identity is, is potentially the next battleground in security, right? Every company now has EDR on their endpoint, CSPM for cloud, SASE, regular pen tests. It's become significantly harder to breach the network in the traditional ways. And a lot of the, a lot of the things that people were bullish on in identity haven't really panned out. Like MFA hasn't been the silver bullet. LLMs have made phishing attacks a lot easier. The third party and contractor access has, has exploded. So the software supply chain is significantly more, more at risk. And I think that's why you see Palo Alto going and buying CyberArk to, to unify networking, cloud, data, identity., and I expect that to be an area where the other players in security make moves. I look at what the private equity firms own. You know, what does Thoma do with Ping? What does Francisco do with BeyondTrust? What does TPG do with Delinea? And then, you know, what happens to Agentic Identity and Auth? Is that an independent? Is that a large enough category to create a massive independent player, or does it get rolled up into a broader platform? So I have my eyes very closely on the identity segment over the next year or two.

Yeah, and I think that last point I think is worth re-emphasizing. We are living in a world where organizations are writing code they don't really understand to take actions they didn't anticipate with resources that are not monitoring, leveraging identities and permissions they don't actually manage and monitor on a regular basis. Like the, and I'm not saying identity is a silver bullet for that, but truly understanding what does it take to understand identities, permissions, like all of the aspects that, you know, it, it was challenging enough with humans happening at kind of machine scale and with AI kind of, you know, pulling the strings and being the puppeteer of all things. I just, I don't think we are prepared for the challenge ahead. So I do believe there's going to be an opportunity for startups and companies that will help us solve that problem because it's like we are running way faster than the security tools can catch up at this point in time.

I would highly recommend our audience to also listen to or read this report by Anthropic, which talks about the first AI orchestrated cyber espionage. It just came out. It's a 14-page report about how cloud code was used to build a campaign. 17 organizations were successfully penetrated in a record time. So, you know, we live in very interesting times. Now, if I'm a founder trying to raise capital, or if I'm a founder trying to exit, you know, here I'm looking at 2026, I'm listening to all the data and statistics that you're sharing. What are 2 or 3 things I should keep in mind as I plan my next step, you know, raising capital or exiting? You know, what would you advise me?

Yeah, I mean, look, I can, I can give my thoughts and, and Sounds like Sam and I will be pretty aligned on this. I mean, we already talked about business fundamentals, so I don't want to kind of belabor the point, but do not underestimate the value of strong fundamentals. Like the days of just selling a great idea on a napkin, like unless you've built and sold, you know, 6 companies yourself, do not underestimate the notion that you need to focus on your business fundamentals, operational metrics, et cetera. To the relationship point that we were previously making, do not underestimate kind of of how early you need to start building relationships. And I don't mean you should be thinking about, oh, I'm going to sell my company. And oh, absolutely not. But you should be building relationships across the industry, like the GMs, the strategy folks, product folks. Sure, corporate people, talk to them too. You know, it's good to have those relationships because you just can never predict when you're going to need to leverage them. And I think the last point I would make for founders is, you know, this obviously you get most of you who are investors yourselves, but they really need to think carefully each time they raise capital, right? Like, it's not just about valuation. It's not just about key terms, but like, you need to think about composition of your board. Like, what are the investment objectives of the investors that you're bringing to the table? Are you bringing investors that have these massive funds that are swinging for the fences and won't even be interested in, you know, some offer of, you know, you get a $200-300 million offer where you as a founder, as a first-time founder, never exited before. You're like, this is amazing. And your investors are like, that's a rounding error for us. Like, you know, we, we don't want to take this. We want to, we want to go for the whiz or bust, right? So think about who you're actually bringing around the table because just because you can raise some, you know, massive round of capital at a crazy valuation from a massive fund doesn't mean you should. Like, you need to align with what your goals and objectives are for the company, what the rest of your investors' goals and objectives are for the company, and you need to just kind of look at that holistically.

Yeah, look, I agree with everything that Dino said, right? Once you raise a round of capital, you've reset your shot clock. You've reset what success means and you should think about it very carefully. The, I guess the one thing that I would add, I think that first-time founders particularly underthink marketing a little bit and doing their best to show up in these Gartner Magic Quadrants and you sponsor conferences and We've seen companies in security, Wiz, great example. Thayera, great example. Island, great example. And they've really captured the attention of people around one specific market. And that requires not just great product, not just great distribution, but making sure that you're branding and marketing your product and company effectively and actively.

Well, this marks our 20th episode of Inside the Network. It's pretty amazing that for, you know, after all those hours and hours of recording, Mahendra, Ross, and I are still doing these episodes. So I'm glad that we've stuck together. And, you know, Dino and Sam, you've both been fans of this show from the early days. So thank you so much for, you know, believing in us, tuning in, and then agreeing to join us for this end of year. 2025 episode. And with that, as we kind of wrap 2025, most of the folks who are listening to this, hopefully they'll be on a beach somewhere, or maybe they'll be taking a walk in some, you know, nice forest landscape, or unfortunately they'll be sitting at their desk thinking about 2026 and all the things they need to achieve in the new year. But hopefully they'll have a little bit of time on their hands to listen to this episode, but perhaps some of the others. And with that in mind, I'd love to go around the room and I'll ask my co-hosts to also chime in here and just share one interesting thing you learned from listening to any of the past few episodes. So just one thing. And Sam, let's start with you.

Yeah, I thought the interview you guys did with Shlomo was super interesting. I love the story about him on the patio trying to figure out, he kind of had realized that his original idea Perkata wasn't going to work, right? It was just putting it in the data center, looking at east-west traffic. He ended up pivoting to a much larger vision that really became SASE. And I thought it was a great lesson in just going back to first principles. If you realize something doesn't work, just scrap it and start from the beginning. And obviously that's gone, that has gone pretty well for him.

Dino?

Yeah, look, I mean, it's recent episode, obviously you guys had Tomer, CEO, founder of SentinelOne on. I mean, I, I think I think it might sound simple, but like the points are so spot on. Like you really need to focus on having truly differentiated product that is solving a major need for folks and not just slapping like AI powered everywhere and thinking that that's going to cut it. You need to find like a sustainable product market fit. And sometimes people think, oh, you hit a few million of ARR and you're all set. Like, let's call it a win. Like, no, that is, that is nowhere near the point where you can be confident you have product market fit, especially if, you know, some of the metrics we talked about earlier, right? Like retention metrics and others are not that great. So I think from a lessons perspective, I really just like the simplicity of what he was focusing on. But I will say a second learning for me as far as, you know, the episodes you guys have had, you know, between the three of you, the real thing I learned is you guys are some of the best connected individuals in cyber based on the caliber of people you brought up on the show. Well, until it's I, today at least. So even being mentioned in the same sentence as some of the legends you've brought on, like that's, that's the real honor for me. So I really appreciate it.

Ross?

For me, I think it was the episode with Jay, the founder of Zscaler. And the story that I found absolutely fascinating is that, look, if you're building something disruptive, customers oftentimes are not going to get it. And obviously it is not always easy to tell if you're just being wrong or if you're just being dumb or if you're truly onto something big. But I did find it rather fascinating that when Jay was talking to security leaders at the time when he started Zscaler, 9 out of 10 people were looking at him saying like, look, what the hell is this? Like, who cares? Like, this is not a real thing. And I think it almost goes contrary to this advice these days and the way the founders approach picking the problem area or picking, you know, the problem to solve where everybody goes to interview CISOs to ask them what's important to you. And what Jay did is is he did all of that and he's seen 9 out of 10 people saying, you know what, we don't care about this. But he flipped it and said, you know what, that means the 10% are saying yes. And he went on and he built a company which ended up becoming one of the most successful companies in our industry. So to me, it's stories like that that are truly different and that are rather fascinating.

Mahendra?

No, Sid, actually I want you to go. In fact, I want your, our audience to know that that 3 of us do these things behind the scenes, but really Sid works the hardest amongst all 3. I mean, Ross, he's got a big smile, he shows up. I get dragged into these. I'm like, guys, you don't need a dinosaur at the table. I'm like Charlie Munger now. I don't have anything to add, but these guys will call me, text me, and here I am. So no, Sid, you should go first. You know, I'll go last.

You know, I think the interesting thing for me, there are lots of amazing ones, but Joe Levy, the CEO of Sophos, he made this comment that fewer than 1 in 10,000 businesses today have access to a CISO. That's truly amazing when you think about it, fewer than 1 in 10,000 businesses. And he described this, he had his team pull this up for an internal kind of offsite where he said, that they've pulled it up and there are 360 businesses globally and only 32,000 CISOs. So it's just a reminder of just, you know, how much, how hard it is to kind of, you know, have the level of talent that we, that we need to go and be successful enough and have, you know, high quality, you know, cybersecurity capability. And it's a good reminder for, you know, all the founders who are trying to go and build amazing businesses that at the end of the day, we're trying to protect not just the 10,000 businesses that have access to a CISO, but the 360 million other companies that need to protect against digital risk. Mahendra.

Sid, you make a very good point. I think the reason all of us are here together and why we've done 20 episodes and better part of the past decade is we look at our role as a small way to try and protect the society and help the good guys win. And when I think about all the episodes we've done, Gee, the tough part was trying to pick one because I can think of the two Dougs, Doug Merritt and Doug Song, as some of the top episodes or top kind of insights that we gathered. Clearly Doug Merritt, building flunk and more importantly, building culture. He is sort of really at the top there in terms of how he engages with everyone, how he cares about people and how his people love him. I mean, he's clearly one of the Rare leaders in cybersecurity. And then Doug Song, you know, he came from this absolutely gritty background. I mean, if you hear that episode, it still gives me the chills, like growing up in Jersey right next to this casino. You know, I'm sure there are more stories that he has not even shared about. And then he builds this company, which is filled with outsiders. Like he did not hire people from inside the cybersecurity domain as such, and has one of the epic exit, most capital-efficient company built in our business. So the two does stand out. And my favorite was the fun episode the three of us did live at RSA with Andy Kao. You know, that was so much fun. So yeah.

Well, with that, thank you everybody for tuning in for 2025. And thank you, Dino and Sam, for ending out with a fantastic overview.

Thank you guys for sharing.

Thank you so much.

Thank you so much for having us.

Thank you for joining us Inside the Network.

If you like this episode, please leave us a review and share it with others.

If you really, really liked it and you have some feedback for us, wrap it on a bottle of Yamazaki and send it to me first.

No, don't do that. Mahendra gets too many gifts already. Reach out by email or LinkedIn.