Hamza Fodderwala: The future of cybersecurity — 2024 retrospective, 2025 predictions and what founders need to know

Welcome to Inside the Network. I'm Sid Trivedi.

I am Ross Halladuke.

And I am Mahendra Ramasinghani. We have spent decades building, investing, and researching cybersecurity companies.

On this podcast, we invite you to join us inside the network where we bring the best founders, operators, and investors building the future of cyber.

We will talk about the hard parts of the founder journey, launching companies, getting to product market fit, raising capital, and scaling to an exit.

And yes, we will also be talking about epic failures.

But Mahendra, we're here to make the founder journey easier.

That is correct, Sid, but we cannot make it too much easier because startups are hard. And of course, you already knew that.

All right, you two, enough. Let's get started with this week's episode.

Before we dive into the program today, let me share a quick word about equity analysts. They are essentially the deep researchers of Wall Street publicly traded stocks, providing crucial insights that help investors make informed decisions about where to put their money. Their analysis is particularly valuable for founders, especially ones who are just getting started, as it helps you to chart your own trajectory by understanding how public markets value technology companies, business models, and growth strategies. Startup founders can benefit and better position their own companies for success. We're thrilled to have one of the top cybersecurity analysts with us today, Hamza Fattahwala, Executive Director at Morgan Stanley. Where he leads the firm's cybersecurity equity coverage. Hamza brings deep expertise in analyzing companies that are at the forefront of protecting our cyber digital world. Industry leaders like Palo Alto Networks, CrowdStrike, Fortinet, and many more. Since joining Morgan Stanley's software team in 2016, Hamza has established himself as a leading voice in cybersecurity investment research. Following his earlier work in analysis at Susquehanna International Group, Hamza holds a bachelor's degree in economics from NYU. For all the entrepreneurs listening to our program today, Hamza will share some valuable insights into how Wall Street thinks about cybersecurity businesses, what metrics matter most, and how successful companies have continued to scale and create value.

Welcome, Hamza, to Inside the Network.

Thank you, Sid, Mahendra, and Ross for having me.

We're excited to end out 2024 with you and talk a little bit about all the trends, all the things that are happening in the cybersecurity world. Maybe let's start with assessing customer patterns. And as you take a look back at 2024, what were the major customer patterns that you saw in cyber? And how do you think this will change as we go into the new year?

Yeah, it's a great question. I'd say— The major customer buying patterns, there were a few. Two really stood out. One is the trend towards vendor consolidation remained very strong. We saw this start really in late '22, and we saw it really permeate through '23 and '24. So if you look at from the public market, right, which I cover, you look at the public cybersecurity stocks that are the perceived consolidators, the ones that have larger revenue scale, that have multiple products. The Palo Alto Networks, CrowdStrike, Fortinet, um, and others, they're trading at roughly 2x the valuation multiples on EBITDA sales relative to the ones that are the perceived point product vendors in the cybersecurity market. So that trend continues. The average enterprise today has over 50 different cybersecurity tools. The largest enterprises have, you know, sometimes 200, 300. So there's definitely a willingness to bring that down. And the other area that started to really come up more, and I think you're starting to see some buying around this, is around AI, right? And specifically security for AI. How do we secure some of these AI models, as well as AI for security automation, which I think is going to be a bigger theme into next year.

On the topic of AI, it is definitely the case the GenAI craze remained the number one topic for everybody, like every single event, like every single security leader is talking about it. Have you seen customers actually adopting those solutions or are we still at the stage where we are mostly exploring where GenAI security might fit and how do you see that changing in 2025?

Yeah, definitely. And Ross, you've written a lot of great things about this, by the way. Anyone who isn't subscribed to Ross's newsletter should definitely, shameless plug for you, Ross, but definitely should be on it. Look, I think it's early innings. I think Early on, when we started talking about generative AI, we're talking about generative AI for security operations. And a lot of that was tied to, okay, how do we take a lot of this redundancy, a lot of this manual labor outside of the security operations center, outside of your SOC? And a lot of that meant, okay, we need to replace the legacy SIEMs, whether that be an IBM or a, you know, Splunk has had pretty dominant market share in the space. So you're seeing companies like like Palo Alto Networks, like CrowdStrike, like Microsoft go after this next-gen SIEM, next-gen security operations market. I do think that's going to drive more meaningful dollars. You know, Palo Alto Networks talks about Cortex, which is their next-gen SIEM opportunity, their AI for security automation, if you will, that being their next, you know, $5 billion opportunity over time in terms of ARR. And I think that's going to be a major product cycle for them, especially since they're partnership slash acquisition of IBM. Microsoft, you know, talked about Azure Sentinel, which is their next-gen SIEM, being $1.5 billion ARR. So I do think you're going to see a lot more focus on AI for security operations. You know, I should mention CrowdStrike as well with LogScale. But I think what was interesting earlier this year at RSA, we started to hear a lot more about, okay, hold on, AI for security automation sounds great. But how do we actually do security for AI? How do we actually enable this technology within our organization? How do we govern it? How do we classify what's sensitive and what's not? How do we prevent sensitive data leakage? And so you're seeing a lot more investment in that area. We do a CIO survey every quarter and the number one hurdle for adopting, you know, next-gen AI ML capability within an organization is data security, right? How do I prevent an LLM for querying sensitive data? So I think that is going to be, I think, the most immediate opportunity, but But the bigger opportunity, I think, is going to be AI for security automation.

No, thank you, Amza. When you look at the AI and how the security operations are getting shaped up, it's a fascinating trend. And Sid and I have seen a lot of startups coming up with agentification, how agents and sort of this new wave of technologies can be used to improve the SOC. But if you zoom out a little bit, a lot of startups don't necessarily appreciate the role of resellers. And when you look at the world from your vantage point, especially when you look at the large players, they have a very elegant way of partnering with resellers. I mean, this is a business of trust. The resellers play a very important role in the last mile. Give us some insights, help our audience understand how the reseller side of the market is shaping up.

Yeah, it's a great point, Mahendra. So the average cybersecurity vendor will generate somewhere between 70 to 90% of their sales from the channel community. Now, some of that is, you know, resellers or value-added resellers. Some of that increasingly now is MSSPs, the managed security service partners, which will oftentimes help operationalize a lot of these technologies, which is really important. And so, you know, these partners are really the last mile when it comes to cybersecurity, because it's not just about selling you, you know, a bunch of software and then telling the customer, okay, you figure it out. You know, you do need to have a partner to help enable this technology and also give you leverage from a go-to-market perspective. So I think, you know, as far as the startup community is concerned, really try to engage these partners early on. A lot of these, you know, channel partners, particularly within the MSSP community, you'll find these folks are very forward-thinking. These are folks who worked in industry themselves. You know, they want to partner with the cutting-edge technologies. And the earlier you can build those relationships, you know, the better it is. And I think, the industry, the reseller industry, if you will, is going through a bit of consolidation. So that's why it's really important to have, you know, these MSSP capabilities, you know, be able to add value on top of just reselling. That becomes more and more important. So their margins are under pressure. Certainly they are looking to offer more services on top of just reselling. So if you're a startup company and you've reached a certain scale and you feel like you have a product that's, you know, very much in demand, you know, partner with these folks early on, have those discussions early on. I think it'll pay dividends down the line.

You know, you make a great point, Hamza, about building these relationships early on. If I put myself in the shoes of a founder, you know, they are young, they don't have necessarily the size and the scale. What's your advice? What kind of thresholds do you see in, let's say revenues before the partners get excited? You know, obviously there's the side of innovation, they want the cool new products, but they also wanna say, hey, are you stable? Are you able to serve our community and our geography well? Do you have the infrastructure to help our teams to sell better? So what kind of trade-offs do you see in that dynamic?

Yeah, I mean, I'd say generally speaking, you start to really catch on with the channel reseller community once you approach that $100 million of ARR or more. But you'd be surprised, I think there are a lot of smaller companies, I'm thinking of companies within the data security and posture management space, for example, or the application security space right now. There's a lot of interest among the channel community in those areas because that's what their customers are asking for. So it really depends, right? There's some companies where, okay, if it's an established market within cybersecurity that you feel like you have a better mousetrap in, then certainly, you know, you want to curate some demand. You want to get to the, you know, 9 figures in ARR before you really start to engage the reseller community in a big way. But I think if you have a product that is very much missing in the market, And I think there's a lot of white space again in application security and data security. I think engaging with the partner community early on, even at 10, 20, 30 million of ARR, which we have started to see, I think can pay dividends down the line as well, because these are technologies that oftentimes are tied to broader initiatives, right? So data security, for example, may be aligned with the broader AI transformation initiative, right? And so the partner is coming in, the system integrators coming into the customer and trying to help the customer deploy these technologies, but they don't really know how to do this securely. That's why we're bringing in a data security vendor might be helpful, even if it is a subscale vendor. If they have good backing, good investors, then they can be viewed as a strategic partner longer term.

Hamza, when you're talking about the need to engage with the resellers and MSSPs and so on and so forth, How is it related to the need to engage with industry analysts? Like which come first? Should startups at first start approaching Gartner and the likes, or should they be working on the reseller side? Or is this something that happens in parallel where one side feeds into the other? Like, how are you seeing that?

Yeah, I think ultimately if you have a product that has good demand, good backing, ultimately all that will come. You know, and I just think it's a matter of inertia, right? So once you start to gain that momentum in terms of your product go-to-market, which again, the channel community is a big part of, right? Whether that's resellers, MSSPs, marketplaces, which are becoming more and more important, getting that momentum, right? I think should be the primary focus. And then adjacent to that, right? And over time you'll start to see the analyst community start to take notice. And start to, you know, mention your company in their various reports as well.

I want to move things a little bit further and talk about the public equity markets that you cover so acutely. Between 2022 and today, we've had just 4 software IPOs. We just had a new software IPO in ServiceTitan, which just went public. Looks like the stock has really popped. So hopefully it's a sign of more positive kind of tailwinds. But what factors could help open up the public markets for new issuances at a much larger scale? And when you look at the different cybersecurity, private cybersecurity companies that are out there, who do you think is the most likely to go public next?

Yeah, it's a great question. Um, I'll try to keep it high level rather than mentioning any specific company, but I would say it does feel like the public markets are open again. If you look at, you know, the average software stock over last year, is up almost 30%. The average cybersecurity company over the last year has been up 40 to 50%. So, you know, we're certainly seeing more appetite to invest in software as well as cybersecurity. Cybersecurity has been an area of more defensible growth, right? So not only are you participating in a lot of the secular tailwinds around AI, cloud, the expansion of the attack surface area, but these are also very resilient companies in terms of this is the last area of your IT budget to get cut. So I think we are seeing appetite for new public issuances. Again, looks like there's a general growth scarcity in the market. I think right now, you know, if we look at 2025, I can't think of one company that is going to grow 30%, at least, you know, guide to 30% initially. So I think having, you know, new companies within the IPO market that are growing faster, that are aligned to a lot of secular tailwinds in the market, whether it's AI or cyber, I do think there is a growing appetite for that. And you know, we've had some IPOs recently which have done quite well in the last 6 months. So as far as going forward, I think, you know, in general, I think if you're a company with $250 to $500 million in ARR and you're growing, I think, you know, north of 30%, especially within that cohort. Now if you get to $500 million to a billion in ARR, right, the growth rates become different. I'd say you want to be growing north of 20 in that cohort. I do think that there's going to be demand, you know, for those types of assets. Again, it's going to be harder to bring public those $100 million plus ARR companies, right? That are more subscale that don't really have a near-term path to profitability. I don't think we're quite there yet, but the $250 to $500, 30% plus type growers with a path to profitability in 12 to 18 months timeframe, I do think that there's an appetite to invest in those companies again, because there's so much growth scarcity in the public market again. Like, I can't think of one company that's going to guide to 30% revenue growth in 2025. You and me both.

I agree with this point around, you know, the lack of companies that are 30% plus growers on an annual basis. Just more broadly on that topic though, I mean, the number of very, very highly valued large-scale unicorn or decacorn companies that are over $100 million of ARR that haven't yet gone public. Has now really, really gotten to a large enough scale. And I'm just curious on your opinion, do you think that these numbers that we have figured out in the public markets of 250 million plus ARR growers and anything below that, it's very hard to go public. Do you think that's fair for the public markets? I mean, the average person, the average, you know, just investor can't invest in a whole bunch of high-growth companies until they become really, really scaled. I mean, this is very different to what things were like 10 years ago, certainly what things were like 20 years ago.

And there's no shortage of capital in the private market these days, it seems. You know, I think it's, if it's a company that is, I think $250 million in ARR is at the low end. That would be harder, if you will. But if it's a company that is disruptive, that is aligned to a secular theme that isn't available right now in the public markets. So if you had a, AI security company or a pure play vendor in the cloud security space, for example, where maybe there isn't an avenue to invest in the public market, that would be interesting, right? But there'd have to be some scarcity value if you're at $250 million plus. I think once you get to $500 to a billion of ARR and you're still growing 20, 30% plus, that's where the need to have that scarcity value perhaps diminishes, right? You can be the second or third player in your category, if you're a disruptor and you're gaining market share, most likely you will get a multiple that is comparable or maybe a slight premium to the peer group that's already public. So I think $250 to $500, scarcity value would really matter, right? If it's something that's really unique that isn't being addressed by public vendors, I think you can see some appetite for those types of assets. But I think outside of that, it will be tougher. That's where you do have to get to a bigger scale, $500 to a billion of ARR.

I guess my question is more, do you think that's fair for the average stockholder to not have access to those high-growth players who are very much focused on the private markets? They're raising capital from the private markets.

Yeah, I mean, I think if you are a company that's in an existing category, let's just say, for example, in, in SASE, Secure Access Service Edge, which is part of the network security market, you know, there are companies you can invest in, right? You can invest in a Zscaler or a Palo Alto Networks or what have you. Cloudflare comes to mind as well. Now there are a lot of great next-gen SaaS players in the private market too that I think some of them, you know, eventually will reach that scale. But I think, uh, you know, there are options in the public market, if you will, to invest behind those themes that, you know, are also available in the private market. I think, again, it really depends on the category. I think the question of fairness is a good one, right? We want investors to have more access to the growth that we're seeing in America, whether it be within cybersecurity or elsewhere. But I do think there are many companies in the public markets today that are investing and really align with a lot of these themes.

Hamza, this year we saw the creation of the first $100 billion-plus market cap cybersecurity company in the industry, that being Palo Alto Networks. And it looks like CrowdStrike is not far behind. A lot has been said during this year about the trend of platformization or industry consolidation or whichever language you choose to use. How much do you think that holds as you evaluate public companies' earnings results this year and also looking into the 2025 estimates and forecasts?

Yeah, and it's pretty amazing that, you know, CrowdStrike still is not very far behind from that goal, despite obviously the incident that they had in mid-July. So kudos to them and that team for doing a great job in their response. Yeah, I think it's going to matter a lot. I think the fact is it's You have Palo Alto Networks, which announced their platformization initiative earlier this year. And then keep in mind, CrowdStrike, after this outage, also announced, you know, an effort, uh, which they call Falcon Flex. And now that's being broadened out into these customer commitment packages. Effectively, both these companies, you know, have been given a hall pass, if you will, for the next 12 to 18 months to discount, some might say price bomb the market. So if you're competing with in Palo Alto Networks or CrowdStrike, it has gotten much more difficult. The Street, analysts like myself have cut their numbers on both these companies quite a bit to allow them to do this stuff. And so I think if you're competing against one of these larger scale companies that are able to discount more aggressively now that had the scale to do so, I think it's going to become harder. So what that means is if you're a smaller company, you know, really making sure that, you know, one, not only you have a great product, but you're solving a need that these big platforms are not, right? They're not going to be able to solve everything for everybody, right? So a great example I can think of is within email security, right? These platform players for the most part have not focused on that area because the view was, well, Microsoft is just going to dominate this space. And we've seen great companies like Abnormal, even Proofpoint, who's out there as well, come out with some great products here. Checkpoint even, which recently invested in a company called Avanan a few years ago, talked about getting to $100 million of ARR in their email security products. So I think, you know, making sure you have products and are solving problems that these companies aren't is first and foremost. And I think also once you get to a certain scale, having that multi-product vision of your own, right? It may not be there necessarily today, but Engaging with your customers, with your strategic partners, and aligning them on a future roadmap saying, hey, look, you know, we do these two things really well, or we do this one thing really well. And we're going to focus on doing that one thing really well, but we have a broader vision here, right? We want to, we want you to partner with us and see where this vision goes and, you know, see how we can deliver this innovation to you. So I think it's about one, solving problems and having a product. That, you know, these other big sort of platform vendors are not going to be able to focus on as much. And then two, also engaging with your customers, engaging with your strategic partners early on, having that roadmap, that vision in that they can see, okay, you know what, this company is going to be an even better version of the existing platform players that I might be using today.

Speaking of platforms and platformization, I think that's sort of the buzzword going back to the earlier comment you made about consolidation. I think that's clearly one industry trend, Hamza. Let's zoom out a little bit. In a few weeks, a new president will step in. That changes sort of the geopolitical dynamics. On one side, you have China, you have Russia. In fact, one of our earlier guests on the podcast, Dmitry Alperovitch, has written a fascinating book about it, which by the way, in 2024 has been named one of the best books on this topic. So you have this whole geopolitical dynamic that is going to shift.

Okay.

And of course you also have Israel. What challenges do you see in our sector play out as a result of that?

Yeah, unfortunately the world is going to become more challenging from a geopolitical standpoint. Whoever is president, right? And whoever is president, you know, obviously, you know, President-elect Trump, we wish them, you know, all the best in solving these challenges. But, you know, certainly the world's going to get— the world has become more dangerous from a cyber perspective and otherwise. You know, I think, you know, for us, you're looking at a lot of the enterprise security companies. I don't think this necessarily changes anything, right? I mean, the fact is, you know, we're going to continue to see growth in ransomware attacks. Some might say that that may even be peaking right now, if you look at some of the more recent data. But I think, you know, nation states are going to continue to be a big driver. You also have cyber criminals that are going to continue to be big drivers of cyber demand. But I think You know, more domestically, you know, this, um, these new initiatives around the Department of Government Efficiency or DOJ and the willingness to reduce the size of the federal government, you know, whatever you think about that, it's probably going to have some headwinds short-term for a lot of enterprise software and cybersecurity vendors. And we actually recently wrote about this in our 2025 Cybersecurity Outlook, but, you know, you look at the, typical cybersecurity company that's public today, right? And I think it probably holds true for a lot of private vendors, but they're generating anywhere from 7 to 8% of their revenue from the US public sector, right? And some of the larger vendors like Palo Alto Networks or Tenable, Zscaler, and others, you know, in some instances they generate 10% plus of their revenue from the US public sector. And federal government alone spends over $25 billion a year on cybersecurity? So I think the fact that you want to reduce the size of the federal government, and in some instances there have been reports around, you know, should we downsize or eliminate CISA entirely, or should we, you know, take out a trillion dollars from the federal budget over time? You know, that's going to have some impact on IT and cyber budgets, and I think is going to be a headwind in 2025. Longer term, right, if the government can become more efficient, use more technology, perhaps it could be a tailwind, but short-term, I think it's a headwind. And then also a big driver of cybersecurity demand has been a favorable regulatory backdrop, right? When you think about all the recent rulings around from the SEC around disclosing cyber breaches, around having better cyber practices, the question's going to be with this new administration, with the new SEC head, are we going to see the same types of regulations and the enforcement around these regulations going forward that we did in recent years. So I think the fiscal backdrop, the regulatory backdrop, there's some uncertainty there. And I think the general, the view is right now perhaps those backdrops are not gonna be as accommodative for cybersecurity spend as they have been in recent years.

No, you make great points there, Hamza, both on the fiscal and the regulatory standpoint. And also from the fact that, you know, the ransomware angle or call it attacking, this continuous sort of escalate in some ways on how the relationships evolve. If you just take a counterpoint, this is of course rumored now, but Trey Stevens, who is a partner at Founders Fund, has been active investor in cybersecurity companies like Expans that got acquired by Palo Alto Networks. He is, I think, on the board of Anduril, which is a security from a different angle, if you will. He's rumored to be the second highest ranking position at the Pentagon, Undersecretary of Defense. And if this happens, this could be the first time that somebody who wears a VC hat and has been a cybersecurity investor is squarely in the center of a very important role in national security and the Department of Defense. Do you see new opportunities open up as a result of some of these dimensions playing out?

Yeah, I think the fact that you're seeing more folks from Silicon Valley and the technology community get involved in public policy and Washington certainly is favorable for tech longer term. And so to the extent that, you know, you do have some folks from the cyber VC community advising the DOD and the president, I think those are, those are good things. I would say if we look at the, the cyber budget today, right, in the federal government, it's about $25 billion annually, products and services. Half of that is DOD. You know, half of that is civilian based on the numbers that we have. I'd say DOD is probably safe, right? I think, um, this incoming administration is known for wanting a strong military. It's the civilian portion that you worry about. So, you know, to the extent that you're looking at eliminating thousands of seats at the IRS or the DHS or what have you, that means, you know, less endpoint security, for example, right? Because each of those seats might be a, you know, an endpoint or a PC workstation or what have you. Or, you know, you might not need to buy as many firewalls or SASE seats or what have you. So I think, yes, longer term, those are all good things. And the federal government certainly has a lot of room to modernize. I think those modernization initiatives take a long time. In the short term, though, if you're eliminating a lot of these people and you're reducing the size of your organizations, ultimately they're not just not going to need as much IT, which means they're not going to need as much cyber.

Yeah, there could be a consolidation, obviously, just following the same trend of if you wear a business hat, which says, hey, multiple organizations are buying these products. How can we bring efficiencies, buying power, the role of services to just bring a lot more cleaner, faster, better way of conducting security across both the DoD as well as the civilian? So you make a good point there, Hansa.

I want to move the conversation over to M&A, and you've touched a little bit around consolidation, but we've seen a relatively active M&A market this year with over $50 billion of deal volume to date in cyber., and we've seen companies like Juniper, Darktrace, Recorded Future, Synopsys, Venafi, and a whole bunch more that have been acquired. And the year hasn't even ended, you know, the time of this recording, the year's— there's still a few more weeks to go, but it's already— that $50 billion of deal volume is already up from last year's numbers. So what are the valuation expectations looking like today and what are buyers looking for in general?

Yeah, you know, I think of the M&A market very similar to the housing market, right? So the sellers have expectations, the buyers have expectations, and obviously there's the cost of financing and everything else. And so, you know, I think a big active buyer within cybersecurity historically has been private equity, the financial sponsors. I'd say they've been less active in recent years, just given how interest rates have really increased in the last couple of years. So they've certainly have valuation expectations that I think if anything, you know, they're not willing to pay the multiples that they were in 2020 and 2021. The strategics have been less active. I mean, certainly we've seen some, we've seen Cisco, Splunk, we saw CyberArk, Medify, and those, you know, buyers tend to pay higher multiples. So, you know, based on our analysis, looking at cybersecurity transactions over the last 10 years, strategics have on average paid about 9, 9.5 times NTM revenue for cybersecurity companies, whereas private equity is paid between 6 to 7 times. So I do think we are seeing more interest from both areas within the cybersecurity market. I think what's, what changed over last year was perhaps seller expectations. So if you were a cybersecurity company or enterprise software company and you realized, okay, whether you're public or private, the market is not necessarily going to value me at the multiple that I want them to, right? If I go public or remain public, there are a lot of investments that are a lot of transformation that has to be done that probably isn't great to be done in the public market view, right? If you're going through a major product transformation or you're going through some sort of M&A spree, doing that in the public market where you have to report quarterly earnings is somewhat difficult. So I do think seller expectations have come down. But at the same time, when you see stock markets tend to decline and, you know, even for larger companies, if their share price is worth 30, 40% less, well, a lot of times they, you know, they use their stock as a currency to buy these companies. So what we've seen, I think, is very much a buyer's market in security and software. The big are getting bigger, right? If you are a large-cap company, $20 billion-plus market cap, you're still trading at a double-digit sales multiple. If you are below that, you know, the average multiple comes down to about 6 times sales. So the larger-cap companies are the main driver of outperformance in enterprise software and security. So you still have a favorable— you still have a high stock, you know, in favorable currency to buy these assets. And then if you are a smaller mid-cap company, you know, there's some that are still trying to break the sound barrier., right, but are having a difficult time. So I do think we start to see some of these companies that are $5, $7, $8, $9 billion in enterprise value look at saying, okay, are we ever going to break that sound barrier to get to $20, $30, $40, $50 billion? I think most of them will realize it's much tougher than realized. And I think, you know, we'll eventually make that, you know, move to perhaps get acquired by a larger vendor or look at a private equity route. So I do think we start to see a little bit more of that. From those bigger companies, right? So far the transactions predominantly have been, you know, companies with less than $5 billion enterprise value, a lot of private companies that are selling for less than a billion even, but not as much of those big companies like the Splunks that we saw last year.

And just as a follow-up on that topic, you speak to a lot of these CEOs of these public companies. Are you hearing from them that there is some kind of, they are in some ways holding off and waiting for the new administration to come in and then launching more active M&A strategies? Has that been a topic of conversation or, you know, is the current move the move that they are playing?

I think they all have strategies. They all have, you know, M&A targets that they've looked at. Certainly this, the last administration, I don't think is any secret, was perhaps, you know, less accommodative in terms of those transactions happening. And I think there is an expectation. I mean, we'll have to see. Obviously, we just had a new FTC appointed. We'll have to see what, what those policies are. But I do think there's a general view that, you know, this new administration may be more favorable towards, you know, that outcome.

How is private equity shaping the M&A landscape in cybersecurity today? With certain market segments seeing a significant percentage of companies owned by PE firms, what are some of the trends or shifts that you anticipate as we move into 2025?

Yeah, I think private equity has been shaping the cyber M&A landscape in a lot of ways in the last few years. I mean, if you look at the identity market, You know, Tomo Bravo has been very active there. Endpoint security, email security. There's certainly been a lot of interest in cybersecurity. If you think about cybersecurity, these are very durable companies, right? They tend to be, you know, high retention rate, very sticky, high margin at scale. They tend to be very good businesses. And so I think, I think from the PE standpoint, they do have a lot of assets that, that they acquired in the last 5 years, particularly during that last wave during 2019 to 2022 that I think they're looking to monetize from, right? Whether it's exiting vis-à-vis a IPO or looking to sell them to a larger company. So I think that there's a bit of a monetization wave that's going to happen, assuming the public markets remain open. And then I think eventually there's going to be some interest in looking at, you know, some cyber assets, whether public or late-stage private, that, you know, are ripe for consolidation. So I think what we're going to see more from the private equity players going forward is similar to what we, you know, did see with Thoma Bravo acquiring in the identity space, right? They acquired 3 great companies. Some of those companies they'll look to merge, others they'll look to keep standalone. And I think there's a lot of opportunity to do that in the late-stage private and public space, right? I mean, you know, finding maybe a public company and a private company that have overlap, maybe neither of those are going to be viable on a standalone basis longer term. Maybe you acquire those 2 companies, combine them, and in 3 to 5 years look to spin off, spin a a bigger public company, right? That could be more palatable for the public markets. And I think we'll see a lot more of that. And there's a lot of opportunity for that. As you know, there's, you know, something what, like 7,000 cybersecurity vendors out there and, you know, less than 100 of them are public. And so I think there's certainly opportunities for consolidation.

You know, Hamza, when we look at how these consolidation trends are occurring, there's a very interesting pattern that we are starting to see. And we'd love to get your views on how the universe of acquirers is expanding. And let's take the most recent example of Recorded Future, a company that was acquired by Mastercard. Now, Mastercard and cybersecurity not necessarily go in the same sentence, but it was interesting to, as I read and researched this acquisition, that Mastercard was losing something in the range of $5 billion a year on fraud. And they paid about $2.65 billion for Recorded Future. So, you know, if you just do the math in 2 years, that's— that could be a reasonably good recovery if it just follows that simple logic. But the fact that a financial entity is losing so much on fraud and then is stepping into saying we need to do something about cybersecurity, there's a very interesting shift in our acquisitions marketplace. Give us a little bit more from your vantage point on how you see this shifting.

Yeah, and that was a very interesting and unique acquisition for sure. And I think it's, I think it really comes down to, you know, two things. Is cybersecurity going to be a source of growth for, you know, companies going forward? I think the answer to that is yes. But then the second point is, is this going to be synergistic to my core business? And so, you know, in Mastercard's case, right, it sort of checked both boxes. I think other companies we've seen, outside of cybersecurity make investments in the past. You know, yes, it's a growth driver, right? It adds some diversification to their revenue stream, but perhaps it's not as synergistic, right? So we've seen defense companies, for example, acquire in the cybersecurity space recently and in the past. Sometimes it works, sometimes it doesn't, right? We've seen enterprise software companies invest in cybersecurity companies, and those can be hit or miss as well. So I do think there's going to be that interest, right? But I think the key question is not just that, hey, this is another business segment within my broader organization that can maybe be accretive to growth in the short term perhaps, but it's really around how do I integrate this and make this synergistic to what my core offering is? I think Mastercard answered that question with Recorder Future again. And looking within cyber, companies like Palo Alto Networks have done a great job of this as well, making almost 20 different acquisitions. In the last 5 years, you know, some of those were very successful, maybe a few of those weren't, but the ones that really were successful were synergistic, were easy to sort of sell into the distribution engine and ultimately became much bigger businesses under Palo Alto or, you know, CrowdStrike than they would have been on a standalone basis. So I think that those, you know, two questions are really important to ask to the extent that you are looking to invest in the cybersecurity market.

You know, you make a great point there, Hamza, about when you look at how Palo Alto has done what, almost 20+ acquisitions over its time and done a very good job of integrating them very well. On the flip side, you know, the telcos have somewhat of a mixed bag in terms of, you know, playing this game. I mean, Singapore Telecom bought Trustwave for $800 million. This was almost a decade ago. And then recently they divested Trustwave for like about $130 million. So are telcos not well suited to play this game at all? Or are there some examples that jump out at you where they've done a very good job?

I can't think of any examples, but I think I might be wrong on that front. But I think, I think it goes back to that earlier point, right? I think initially the telcos, and I could understand why it was intuitive, right? I mean, Hey, you know, a lot of times telcos are involved in really being a channel partner for cybersecurity companies, right? Being an enabler for cybersecurity adoption and just thinking, you know what, you know, why can't we just do this ourselves and get 100% of the economics? And I think the logic makes sense, right? But again, it's, is this just going to be another business segment within your broader organization, right? Or is this actually going to be a core pillar of what you're offering, right? Is this going to be your core business, right? Is this going to be synergistic with your core business? And that question I think is more important to answer than just, you know, saying, okay, you know what, we're going to make this another business segment. We're going to throw a bunch of money at it and hopefully it sells. No, no, it really has to be, you know, core to your offering for it to be successful because cybersecurity is hard, right? I mean, a lot of enterprise software companies, you know, Microsoft comes to mind, which is the biggest one, and they built a great cybersecurity business, $25 billion plus in revenue. But even they've had their challenges in certain market segments. And so I think just given how hard security is, you really have to make sure that this is something that you think about every single day, because I can guarantee you, folks like George Kursk from CrowdStrike or Nikesh Arora from Palo Alto Networks or Jay Chaudhry from Zscaler, they're thinking about this 24/7. They're thinking about how can they win in the market, you know, every single day. And if this is an afterthought for you, it's going to be tough to compete.

That's a great way to put it, that, you know, cyber can't be an afterthought, whether you're running a business or whether you're using those cybersecurity solutions. I want to move to the last segment of our conversation and really talk about lessons for founders. And you spend a lot of time analyzing and speaking to the executives of every major cyber incumbent vendor, and you, you spoke about a few of those names just now. What insights do you have for founders on which areas are ripe for disruption and where they should focus their time?

Yeah, it's a, it's a great question because I mean, there's some areas that have been ripe for disruption that you wouldn't really think are areas that people have been focused on. So I think it kind of breaks down to two categories. One is Solving new problems. And then I think the other one is solving existing problems that, you know, people haven't addressed for a long time. So I think the new problems would be areas like we talked about earlier, AI security, right? Coming up with more modern data security, application security products that are going to be able to solve this new world of securing AI and large language models. Because I think there are some bigger companies that are going to certainly try to address this market, but I think this is going to be a greenfield area that every Fortune 500 company or small and large is trying to figure out right now. Every company right now is establishing AI governance boards and trying to figure out how to securely enable this technology. And then the second is solving existing problems that a lot of people have sort of abandoned. So the one that comes to mind clearly is email security. I mean, I covered Proofpoint when it was a public company, and the number one question you get from investors was, okay, well, when is Microsoft going to crush them? And that hasn't happened, right? But what we've seen, if anything, in recent years is we're seeing new email security companies come up. Abnormal comes to mind, which obviously recently had a big raised an evaluation round and is now over $200 million of ARR and has done really well in that email security market. Obviously we still have, you know, Proofpoint out there. In the private space, we've had other email security companies that have raised, you know, money at pretty decent valuations recently as well. We saw Checkpoint, Fortinet recently acquired in the email security space. So again, this is an existing area that people just thought was not going to be innovated on and Microsoft is going to take that space over. But I think with AI now, with the increase in phishing attacks, we're seeing more innovation in this market. I think another area that's been coming up more and more has been this market for cyber resilience, right? Whether that's backup and recovery, we've seen some companies go public around that front, like a Rubrik, which has done quite well recently, or others, right? So I think cyber resilience, backup and recovery, data management, those are going to be areas that I think are going to get more attention, more funding as well. So again, newer problems, newer attack surface areas that you have to secure, whether it's AI or elsewhere, and then existing problems that have been sort of left for dead, like cyber resilience, like email security. I didn't mention GRC, governance, risk, and compliance, which we're seeing a lot more investment in. I think AI has the potential to disrupt existing categories and create new categories. So that's where I would I would focus on. Those would be sort of the broad umbrellas, if you will, that I would really try to focus on if I was a founder.

You know, Hamza, I'm seeing a very interesting dichotomy from my vantage point. I mean, you make absolutely spot-on observations about how AI security for AI and AI for security is going to play a very big role. And of course, the proof point, Microsoft example, in a parallel world, people joke about Google can solve this problem, but either they don't have the time or the interest, it's not a big enough problem for them. And you have the likes of Enormal continue to sort of take on the email security problem. The dichotomy I'm seeing is the SMB side of the world. You know, we have interviewed Governor Snyder. He's the former governor of Michigan, is now CEO of one of my portfolio companies called Sensai. And it's squarely focused on SMB market, which is employees or sizes that are a certain threshold below. I mean, these are too small for the Palo Alto Networks of the world, but they often become the vector, the attack. Like if you look at the Home Depot story of how this HVAC vendor, a 40-person company, was used as an entry point into some of their point-of-sale systems. Besides the economic rationale that this is not a big enough market, there is too much churn, what do you think can be done to make that side of the economic landscape more resilient?

Yeah, it's a great question. You know, I think obviously there needs to be an education and an investment in sort of the channels to sell to these market segments. So I think this is where partnering, going back to our earlier question, partnering with the MSSPs, the managed security service partners, is going to be really important. And, you know, having sort of managed services offerings yourselves, I think can also be important, right? Really like deploying that technology is one thing, but operationalizing it is the other thing. And I think a lot of issues with perhaps that market, the SMB market, when you get below 1,000 employees, is they don't have the resources to buy and deploy a bunch of these security technologies, right? Even if they had the budget to spend $100,000 or $200,000 on a security product, you know, them being able to use it is a whole nother different story. So how do you reduce that cost to serve, which I think certainly a lot of MSSPs have been able to do, but also the cost to operationalize is a big thing. And, you know, most large organizations will have a CISO nowadays. They might have a head of endpoint security, a head of identity, a head of vulnerability. You know, a lot of these organizations don't have a CISO. They have one, you know, one guy or gal who's the head of IT, maybe the head of networking they might have. And then, you know, one of those people gets stuck with the security job and it's obviously a big task. So I think partnering with MSSPs, having managed services offerings of your own is going to be vital if you're trying to address that market. But I think finding a way to scale that profitably is another challenge. And hopefully that's where AI can come in, right? If you can use the power of generative AI to, you know, offer and solve security problems, I think that could also be a big thing too. I'm thinking for the MDR vendors in particular, that could be an area where you could see an AI SOC as a service, if you will, markets start to come up more and more as we figure these, how to operationalize these technologies.

Very topical because we had Kumar Saurabh right before you on the episode right before you. So very topical for our listeners.

I might've gotten that idea from him. So thank you, Kumar. Yeah.

You know, one other thing is that kind of the number one cyber analyst on the street, you spend most of your time with these legendary founders like George Kurtz, like Todd McKinnon, like Jay Chaudhry, is there a single trait that you see amongst them? I mean, you've probably spent hundreds of hours with each of these individuals debating what they're doing from a strategy perspective. Is there something that you see that you're going to say like, this is what makes an amazing cyber founder?

Yeah, I do have to give a shout out to Nikesh Arora. He may not be a founder of Palo Alto Networks, but he's definitely founder mode. I can tell you that. I would say they're all very much locked in and they're obsessed with solving these problems. So, you know, I think of George Kurtz, right? And kind of what he's been through in the last 6 months with this incident that they had in mid-July. You know, he was at the forefront. He was on television the next day, took full responsibility, didn't hide from anybody. He was at Black Hat. He was at his conference. He was at your event at Black Hat as well, Sid. You know, this is a person that took on this challenge with a lot of integrity and was, you know, at the forefront and, you know, is living and breathing this stuff, you know, every day, right? One of the things that I always find, right, whether it's, you know, George or Nikesh or whoever, whenever you reach out to them, you send them something, right? They get back to you right away. So they're always on and they're very passionate about solving these problems for their customers and ultimately winning in the marketplace, right? It's a competitive space. So if you're a founder and you believe you have the next $100 billion cybersecurity company, you want to have that self-belief almost to like a delusional level, because certainly these folks not only believe they have the next $100 billion cyber companies, which some of them have been able to achieve, but they think they can get to $200, $300, maybe a trillion dollars over time. So I think it really just comes down to passion. And I have to mention, obviously, Jay Chaudhry as well, you know, who is working 24/7, right? And you just think of the, you know, where he's come from and what he's been able to achieve. This is a person who's, you know, sold and started companies several times. So he's not in it to, you know, make a quick dollar, right? He's really in it to win and build Zscaler into a much larger company and a company that can endure over time. And so I think that's really the one trait that I'll mention from the CEOs and founders that I'm particularly close to is All of them, you know, are very passionate, very hardworking, and are always thinking around the corner, almost to a paranoid, you know, level, if you will, on how they can be disrupted, right? So if you're a small cybersecurity company and you're a founder and you think that you can stay under the radar, maybe you can for a little while, but I guarantee you, you know, they will take notice at some point. Yep.

There are over 80 cybersecurity companies that have reached unicorn status and about 5 have 100 of them have raised over $50 million in venture funding. And despite this, exits are still quite limited. What advice do you have for founders who are raising venture capital in 2025?

Probably a better question for you, but so maybe you can answer it as well. I mean, it really depends like what stage. I'd say, you know, if you're an early stage company and you're solving a problem that will be bigger down the line, but you might not have the distribution, I would just be thoughtful about valuation. Just remember Palo Alto Networks, CrowdStrike, some of these larger cybersecurity companies that you may want to eventually sell to, these companies have not made acquisitions that are above a billion dollars in purchase price yet. And, you know, if they eventually will, you know, it might be something of scale, right? That they can perhaps, you know, could be accretive to their growth. So just be mindful that, you know, you might have You know, the best AI security product in the market, but at a certain price point, it's more economical for these larger cyber companies to perhaps build a product on their own and compete with the talent that you're trying to compete with, as opposed to going out and paying $1 billion for your company that might be great, but it's only $10 million of ARR. And so folks like myself will probably start to question the prudence of that deal. So I just think be thoughtful about valuation, right? If you want to be the next $100 billion cybersecurity company, right? Then perhaps that's a different calculus that you have to make early on. But I just think, you know, it really depends on the stage and what your exit is, but just don't take that big valuation increase without thinking about, you know, what your ultimate exit strategy is.

I couldn't have said it better myself. I think the factor around really be thoughtful on what is your goal, why are you raising this capital, what's the value of that that capital, what are you going to do with it, and is it a fair valuation? Just so, so important.

And then you have, of course, people like Asaf at Wizz who have, you know what, the last rumored valuation was $12 or $20 billion. Is that correct, Sid?

Yeah, we don't know what the— yeah, there's a round going on right now, but yes, it's potentially over $20 billion.

It's rumored, right? It's rumored.

That's right.

So, you know, I think that when you fall into that category, obviously, Obviously there is this, now you have only one path forward, which is you have to go public because you essentially price yourself out of the market that the 3 or 4 public acquirers could have paid. And if you zoom out a little bit, Hamza, what are some things, take a look at a crystal ball, what are some things we should prepare for in 2025? And we already touched on some of these in earlier parts of our conversation about regulatory changes that are coming. But, you know, if you had to end on an optimistic or a positive note, what are some soundbites that come to mind?

Soundbites that come to mind of optimism. I think, you know, in that case, just to address, you know, Wiz, I mean, these are folks, whether it's Asaf or Yunon and that whole team, this is a team that really believes they're going to be the $100 billion cybersecurity company. Right. So the fact that they, you know, reportedly had an offer from Google at $23 billion and were able to walk away from that, I think really shows that. So I think for them, you know, they've been able to obviously raise bigger rounds and, you know, may grow into those valuation rounds. Certainly the trajectory seems to suggest that. And so more power to them, right? And we'll see when they decide to make that leap into the public markets. I think signs of optimism is, look, you know, technology today is about a little over 40% of the S&P 500. And there's no signs of that slowing down. Every organization in the world is trying to deploy more technology within the organization when it comes to AI, cloud, you know, what have you. And so I think it's a great time to be in cybersecurity because ultimately the more technology you deploy in your organization, the more AI you use, you have to secure that. And I think that's going to open up new threat vectors, which is going to open up new opportunities. And, you know, ultimately that's going to mean more innovation in the market. And so I think it's exciting times. I think if you look at the public markets right now, the macro backdrop is certainly favorable. There's a lot of growth scarcity. I mentioned the public markets. That means that, you know, if you're a company that is $500 million of ARR, $250 million of ARR, and you're growing fast and you have a great product, I think this is the time to really go out. And I'd also say, you know, You know, great companies throughout the history of, you know, tech and software usually are born during difficult times or tested during difficult times. If I think about the cybersecurity companies that have come up in the last, you know, 15 or 20 years, whether that's Okta or Zscaler or whoever, right? These all came up in and around the financial crisis. And so I think, you know, there's going to be a cohort of cybersecurity and tech companies that, you know, could potentially be the next $100 billion, $200 billion companies of our generation. And we've got this massive compute cycle in AI, which is really driving every organization, large or small, to really rethink their technology architecture and modernize their technology architecture. Because a lot of these folks, you know, still haven't really fully embraced the cloud, you know. And so I think this AI is really going to be the catalyst for them to put technology more at the forefront, which means more dollars for these companies.

On that note, Hamza, first of all, I wanted to thank you not just for coming today and sharing your insights, but I think you're one of the few analysts that is always accessible. You have this fantastic blend of humility with very deep research and good work that you do. Obviously, your team has been named number one now for what, 6 years consistently at Morgan Stanley. So your work speaks for itself. But most importantly, Sid, Ross, and I are serving founders. These are people that are just getting started. They are sort of in a classic state where very few people care for them. And the work that you do, the insights that you share are extremely valuable for them to plan their journey. So I wanted to say a big thank you. And of course, as we end our year in 2024, Sid Ross and I also want to take this opportunity to thank all our listeners for helping our podcast to become number one in 2024 in cybersecurity.

That's self-proclaimed.

Is that correct, Sid?

It's self-proclaimed? It's definitely self-proclaimed.

Well, at least we are one of the few that is focused on cybersecurity and we're bringing some of the best best brains, the best minds in the industry to our founders. So on that note, thank you, Hamza. Thank you, Sid. We'll see you in 2025.

Thank you, Hamza. And thank you to our listeners. Thank you for joining us Inside the Network.

If you like this episode, please leave us a review and share it with others.

If you really, really liked it and you have some feedback for for us. Wrap it on a bottle of Yamazaki and send it to me first.

No, don't do that. Mahendra gets too many gifts already. Please reach out by email or LinkedIn.