Legal and Due Diligence Support In The High Tech Era: Andy Lustig On Startup Success

Informing your decisions with intelligence analysis and insight brought to you by the team@oodaloop.com.

Hello, I'm Bob Gourley, the Chief Technology Officer of OODA LLC. On today's Oodacast, Andy Lustic, a partner at Cooley. We discuss technology and due diligence. Hello Andy. Welcome to the oodacast.

Hello Bob. Thank you for having me.

Andy, let me start with the bio. Andrew Lustig is a partner at Cooley. You focus on private equity investments, mergers and acquisitions and the general corporate representation of high growth technology companies in both the commercial and government marketplace. Your practice includes a wide range of industry sectors including information technology, national security, cybersecurity, data analytics software and telecommunications. You also represent a number of leading venture capital and private equity firms.

That was a great summary. Thank you. You definitely did your homework.

Bob and Andy, I've known you for years and I've known Cooley for several years as well. But what I didn't know was what I learned today. Looking over at the Coolie website, I learned that Cooley is one of the largest tech law firms out there. In fact, 40% of the company on Wall Street Journal's billion dollar startup club list use Cooley. Another stat I learned from your webpage. 300 plus life sciences corporate partnering and licensing deals since 2010, 1300 MA transactions since 2012. So you guys are the M and A experts, you're the tech experts. You're the number one law firm for tech and life sciences IPOs. Takeaway I get from all of that is, you know, we are in a tech world right now and for companies that want to survive and thrive in this tech world, Cooley is well positioned to help them. Is that about right?

Yeah, that's a great summary. In fact we should, we should be paying you. But yeah, so I think we definitely like to say we're sort of at the intersection of innovation and the law and we have a massive early stage startup practice at Cooley on the corporate side. And we work with companies really from inception all the way through their life cycle. And so the M and A and the capital markets, the IPOs, those are what we call liquidity events. You know, sort of the game changers for those companies. But we even stay on after that and we, we stay on with PE platforms. After we sell companies to PE platforms, we continue to work with PE platforms and, and the companies we sold on their next chapter as they grow even bigger and eventually go public, we take companies public probably at that, I think at the, it's been years and years now where we've been the top, you know, tech and life sciences law firm for taking companies public in the US and so, and then we stay on afterwards, you know, as counsel to take them, shepherd them through their life as a public company.

So sorry to interrupt, but you mentioned this. You're at the intersection of tech and law and man, I see it for sure, but isn't that a real conflict? Those two worlds of these tech innovators that are creating things, many of which have never been done before. And, and then we have this very slow human governance process of how governments work and create laws and regulatory environments, which just moves at a snail's pace and innovators going at speed of light, law moving at a snail's pace. Isn't that kind of a conflict?

It is, in fact, and that's really where we kind of earn our keep. So there's no question that the regulatory environment's always behind innovation by design. And so part of our job is to help folks manage through what is often evolving complex regulatory frameworks and assessing risk along the way as to how far they can push it, to make sure they can satisfy the speed of innovation in which they're always running, which is usually incredibly fast. And so our client base over the years, knock on wood, has been, we've been blessed with this terrific, you know, run over the years of being able to really be very business minded and innovation focused. And we've learned a lot from working with these kinds of entrepreneurs over the years to sort of assess risk the way they do and to be able to understand and sort of to translate legal risk into business risk, to figure out what's acceptable and what's not and how they can move at the speed in which they want to move. That's really been part of our secret sauce, is to kind of share their mindset.

Andy, is this the way you imagined it would be as you were graduating from William and Mary Law School and moving into law as a profession?

I'd like to say that I had the foresight to think that way and to think ahead, but I had no clue when I graduated law school, to be candid. So I was hoping it would be fun and exciting, but I had no idea what was in store, to be honest. And had I known, I probably would have worked a lot harder.

You must have had a passion for the law. And then I just wanted to dive a little bit more into your foundational story and what made you decide to pursue the law.

Well, it's interesting. I actually think again, I almost wish I had a sexier story to tell when it comes to my path to law school. And the reality is that while I come from, you know, actually, you know, I have some. My grandfather was, was an attorney in Indiana and his, in fact, they were the first husband, wife, team of lawyers in Indiana, believe it or not. And so I like to think that I had this rich tradition of legal scholars in my family and that's what pushed me into the law. But the reality is I looked at it as an opportunity to sort of head down a path that intuitively I felt was where my strengths were, but that I didn't really know what it would entail. I just felt like it would open some doors. And thankfully I was right. More by happenstance.

Well, I tell you, you, you graduated right at the time when the Internet was taking off, the PC revolution was well underway and maybe there was 400 million computers around the world at the time. Now billions of computers, billions of smartphones, everyone is connected to the Internet. So I think you graduated right at the right time to be a pioneer in this area.

It's interesting. I did. And I happened to go to a law firm out in Texas, right out of law school. And I worked there for just under two years. And you know, it was more of a traditional white shoe firm, oil and gas, typical Texas kind of, you know, corporate practice. And when Cooley, when I heard about Cooley and what they were up to, I felt like I was, you know, had my face pressed up against the window and was watching this firm do everything I always wanted to do in terms of working with these, you know, you know, really amazing, innovative companies that were all going through these massive growth spurts and, you know, just really on the cutting edge of everything, technology and all these IPOs. It was just so exciting to hear about. And I was on the outside looking in and thankfully one of my good friends from the area mentioned that, hey, you know, Cooley's about to open up its first east coast office. He knew some of the guys who were opening it up said, if you're thinking about coming back to the area, now's the time. And I jumped at it. And after it's been fast forward 20 years later and I've been at Cooley for over 20 years now. And that was started with the rest in office and now we are. Before we weren't even. That was our first east coast office. Now we're international. And so from that time, I think we've probably easily tripled in size. It's been an amazing journey. It's been a fantastic place to work best people on the planet and afforded me incredible opportunities to pursue all of my passion projects, which is how we got to meet.

So speaking of passion, I know another passion of yours that I've observed is helping out the startups. And a lot of these startups, they don't have any budget whatsoever, but they need help. And I have seen you and others at Coolie really lean forward and help out the startups as they getting started and get them all moving in the right direction so they can get their funding and become a growing concern. And I wanted to mention that because I wanted to ask you when should a startup start a conversation with a company like Cooley to get advice or formal legal counsel to really get things in order?

Well, it's for one, I would say they have to ask themselves if they're the right kind of startup to work with a firm like Cooley. We do our best work and we can be most helpful for companies that are on high growth trajectories or that want to be on high growth trajectories. And usually that means that they are. This is not the lifestyle kind of company where, you know, you, and there's nothing wrong with that, where you start up a company to, you know, to you know, be your main source of income and it's something that you want to really, you know, ride all the way into Sunset and maybe pass along to your family and sort of be a generational kind of a business. We do work with some businesses like that, but the norm is more the companies that are going to go access capital, venture capital, you know, angel money, venture capital, growth equity, private equity, and really to make their business plans, go to work and then pursue liquidity events and exits and, and high growth in a short amount of time. And those tend to be historically have been technology companies, which is really where is foundational to Cooley life sciences companies or biotech companies that we have probably over, I think 20 or 30 companies now that are all working on Covid vaccines right now. It's amazing. I think We've done over 25 IPOs this year alone, a majority of which have been life sciences companies on the basis of, of everything that's happening in the world right now. So life sciences companies, tech companies, those are the kind of companies that we tend to really work well with that are on those kind of trajectories. And that extends to all ends of when we say technology or life sciences, it's really high growth companies, environmental companies, it could be space companies, satellite companies, you name it. It's anything that's innovative and fast and requires capital to grow. And so as far as entrepreneurs go, I would say the sooner the better. We talk to folks all the time who before they really need legal services. And part of our passion is really just getting the ecosystem that whether it's local out here in the D.C. metro area or whether it's national or international, but leveraging everything we can to help that ecosystem. And that means often we have to lean forward and help companies before they have any work to give us. And a lot of times they need help, but they just don't have the resources to pay for it. But we are just like the venture capitalists in the sense that we take risks and we make bets on companies and we make bets on people and that's where it's fun and fulfilling and exciting and much the same way you guys have done in your careers, just surrounding yourself with some fantastic people that are innovators and good things come, you know, when you're patient and you lean forward and just offer a helping hand. So that's definitely our approach.

That raises a couple other points. I wanted to ask you about these young companies, the startup that's on a high growth trajectory. Before there's some event in their future, there's going to be an examination of all their finances and their technology, a due diligence assessment by either an investor or an acquirer. So starting things on the right track early is important. I know that, but I wanted to ask your views on due diligence. First of all, what is due diligence in your mind?

So if I had to boil it down, I would say it's kind of a three step process in which you identify risk as the first step, you quantify risk as a second step and then you mitigate that risk as the third step. And, and so if you think about what that really means, it's just, it's identifying whether or not there are issues in your company that are tolerable and that somebody can get past before they invest in you or before they buy you. And every company has issues, so there's no secret there. Lots of them are in your control and lots of them are not. And so diligence is really about just getting down to what risk can you live with when you partner with another company.

And do you have advice for the high growth CEO on how to prepare his company for a due diligence?

Well, it's interesting. I think one of the prevailing pieces of advice that we give is always to surround yourself as soon as possible with people that have been there and done that. And one of the things that's really very fulfilling, exciting about the entrepreneur ecosystem is that they're very good about giving back to other entrepreneurs. They're excited to do it, they're happy to do it. It's one of those ecosystems that loves to do that. It's very reciprocal in nature. And so I could not emphasize more that the best thing you can do is go find other CEOs that have started companies or other founders have started companies and raise money, sold them. Companies that have had problems that haven't worked out and had to be liquidated. Surround yourself with as many people as you can that have been there, done that, and ask a lot of questions on the front end. And there's a lot of mistakes that you can head off and avoid if you just surround yourself with the right people on the front end.

Andy, that's great advice and it brings to mind a couple other things I want to ask you about. But first I want to test you out. I want to give you a thesis and have you tell me that this is wrong or right. The last 20 years there's been an IT revolution underway. We went from just standalone computers to networks computers to the global grid of the Internet, the IT revolution and the Internet of things revolution. It's all been about it. The next 20 years is going to be the biosciences revolution. It will be the biotech decades where all the innovation will be driven by, by biotech. What do you think of that thesis?

I think it's an interesting thesis. I agree with most of it. I think that's a, I think it's a really accurate assessment. I think when you look at what's happening with the speed of computing and data analytics and AI and what that translates into in terms of the ability to solve what used to be almost impossible, very tough medical and life sciences based problem sets, DNA sequencing and creation of vaccines, rapid innovation of medicine. Those are all highly formula in science and math driven, which lends itself very, very well to take advantage of all the innovation that these tools now that are becoming more accessible to folks are actually becoming really interesting in the hands of scientists, a lot of these life scientists and biotech firms. So I think there's no question we are on the very, very front edge of a massive sort of biotech surge in innovation. I also think there's some other areas that are equally poised for growth.

Like what?

A big one? Well, I think space Remote communications. I think the amount, every time there's a new satellite that goes up, there's an unbelievable amount of data that now becomes accessible that wasn't there before. So the sheer volume of data that's going to become accessible over the years as the, as IoT environments continue to expand and as all these remote sensors begin beaming back data from every corner of the globe and eventually the universe, it's gonna be really interesting to see what happens and what that means with all the compute capabilities trailing behind. Right.

It is a fascinating tech enabled world that we're in, that's for sure.

Yep. What do you think in terms of the, you know, with that thesis, what scares you about it?

You know what scares me about it is the fact that after two decades of working IT security, we didn't fix IT security for the old architectures. There's still challenges. So why should anybody think IT security will be fixed for the new world of quantum computing and space based communications and space based remote sensing and the biotech revolution? It's not going to be fixed. There will always be issues of trust and risk and risk mitigation and optimizing in a world where the adversary can be observing all of your actions. So that's what worries me. I'm still an optimist. This is going to be a great and wonderful tech enabled future. But there will always be a need for professionals to assess risk and mitigate risk when it comes to cybersecurity, I think.

Yeah, I couldn't agree more. And I still feel, you know, from an M and A standpoint, you know, from a diligence standpoint, from financing standpoint, that, you know, what if you'd asked me five years ago what my prediction would be in terms of technology diligence and cyber diligence, I would have said that they would become absolute hand in hand partners in terms of legal diligence and transaction diligence and company diligence would, you know, that cyber diligence would be the star of the show. Right. Because everything was so reliant on, you know, security and technology that whether it's life sciences company protecting its, you know, its secret sauce for its vaccine, you know, or whether it's a technology company that relies on, that does, you know, you know, launches satellites into orbit, you know, and has to protect everything about that process that there's going to be so much more at stake that it was going to be just a given that cybersecurity would be top of the list. While it's definitely grown and it's recognized. It's definitely on the checklist now. I still feel like it hasn't quite played out the way I thought it would in terms of prominence. Right.

I have to agree with you. And I think part of the reason why is cybersecurity requires you to think about an invisible domain of cyberspace that we don't really operate in. It's some magical, mystical place where all the technology interconnects. So it's easy to be out of sight, out of mind. You fix one problem and then you're off to, you know, you ignore that and go about your business. And I think that is always going to be an issue. But in this new world of the biosciences and the bio revolution, it's just going to be so important that we get this, that we do better because we don't want screwed up delays in the bio revolution. We don't want people screwing with our vaccines is one way to put it. We don't want people messing with our genetic data and publishing stuff. The ultimate privacy violation would be stealing someone's genetic sequence. Yes, we need to get this cyber stuff, right?

Yeah. And I'm concerned that the stakes are getting higher and higher as we go. I mean, if you look at just with the, with COVID in terms of what the monitoring now from a privacy standpoint, everyone's being monitored. People are asking for a lot more data, health data, in the interest of trying to track the spread of viruses and things like that. This won't be the last, as we both know. So the stakes are getting higher and higher and the boundaries are getting broader and broader in terms of who is picked up by those issues. And so my hope is that folks are starting to really think about the right questions to ask in terms of resiliency. And that when people start asking the right questions, like what matters to your business, what can set off this business, what can damage this business at its core, inevitably you're going to get to security and I think people are going to start looking at it differently.

Hopefully, I hope. Andy, you mentioned several times the importance of CEOs having a network and thinking through issues. And it brings to mind another thing I want to talk about is Mission Link. What is Mission Link and what's it there for and what are you doing with Mission Link now?

Well, I appreciate you mentioning it. It's one of my passion projects over the years that I've been very fortunate to be involved with. So MissionLink is a nonprofit group that we started maybe about a little over eight Years ago and the thesis was could we. And the we is a group and I consider you part of this founding group too Bob, because you got, you were so gracious in getting involved early with Mission Link and that you were, no question you were part of the secret sauce. But you know, the we was a group of folks that were there's executive recruiter Jeremy King, Kevin DeSant over at Kipps Investment Banker and us as in a law firm. They were all working with national security focused companies whether it was through M and A or working with startups, sitting in boardrooms, attending board meetings. I started to hear a lot of common threats and common enemies and folks operating in silos in terms of how they approached some of these threats and common enemies. And I thought given the stakes, you know, in this Post kind of 911 environment, it was crazy to me that there wasn't more communication within the private sector for a lot of folks that were going after solutions targeting the same adversaries. And so I started to ask around and as did you know, my other co founders in terms of companies and founders and some of the thought leaders in the national security space saying, hey, what if we were to get more of a formal group together to share data and insight on how to better target adversaries and how to better problem solve and could we bridge the private sector with the intelligence community on the federal side a bit better by having this kind of a dialogue at the very edge of innovation with some of the true startup activity and some of the innovation that was happening right in our backyard. And the thesis, you know, there's a lot of folks and thought leaders like you that were thought, you know, were all over it. And we quickly formed a group and over the years we would invite, you know, 40 to 60 founders of companies that were had national security capabilities, whether they were selling federal or commercial Cyber data analytics, IoT, you know, road sensor technologies, you know, any capability that could lend itself to national equation and gather them into a kind of a cohort or class. And we would meet over several, you know, once a month, over six months and then we quote, graduate that class and then the next year we would start a new class, 40 to 60 and then start that process all over again. And we had a group of advisors and thought leaders that would help open doors, facilitate communication, share ideas, guide conversation. And that group happened to be what we view to this day as some of the best minds in the business when it comes to national security cyber cutting edge innovation. So guys like you, Bob Gourley, Matt Devoe, Alan Wade and we just had this. We were blessed and fortunate to have a bunch of just rock star thought leaders in the area that wanted to roll up their sleeves and get involved. The thesis behind it was really just to help companies accelerate their growth without really asking for much in return. And it was really about having the industry help itself and find people access to capital, to partners, to buyers, to sellers, to customers in the federal and commercial sectors and leverage all of the insight that comes with it. And that group, as it grew, just became kind of its own sustainable ecosystem that to this day we've had over, I think 500 companies have gone through it. And what's really interesting is to look at all of the companies that went public or that were acquired for a billion dollars. And it's amazing that we got to say that we knew them when they were little and you've been along for that ride and have been an absolute part of the secret success. I mean, you guys have been phenomenal coaches and all these companies and it wouldn't be where it was without you guys and folks and many folks like you.

Well, I sure have enjoyed it and I think the other advisors I worked with also all enjoyed it because you're helping out these CEOs that are really mission driven and want to create and build and innovate and create jobs and create value and support the economy by creating some big transaction in the future and so supporting national security at the same time.

Yeah, that's where it got fun, Bob, is you realize you can do both. You could be a successful company that competes with people in the room, that competes out in the market, but you can also work on the mission at the same time and help each other as frenemies and not just competitors going up against each other. And that's where it just, it gets really fun when you can do that. That's what a lot of people are passionate about, moving the needle on national security and at the same time being successful aren't mutually exclusive.

So what's next for Mission Link?

It's a great question. And so we have actually been in the process of updating Mission Link. In fact, we're actually calling it Mission Link next. And the idea is to sort of address the evolving landscape, you know, the threatscape, the nations, the nation states, which used to be the sort of the primary adversaries you concerned about from a national security perspective and going after more federal kind of systems and government has all evolved now where you have a much, much broader set of threat actors and the national Security landscape has completely converged into the commercial landscape. And so I think what we're trying to do is to address that sort of the blending of commercial federal in a much more precise way now and focus on some of the areas that some of the technology sectors that we're most concerned about being sort of at the center of that convergence. And so on the remote sensor IoT side, on the AI sort of machine learning side of the equation, and then still on the security side, but with a bit more of a precise group of industry verticals that we see being really impacted. And Life sciences is a perfect example. So the idea is where historically we'd say, would a life sciences company want to be in Mission Link? People would probably say, maybe other than Gus Hunt, who was always interested in that intersection and a couple others, but we'd say, no, it's not really a good fit. But now the interest of companies have never sold anything or thought to sell anything to the federal government, but are absolutely aware and concerned about national security. Threats are perfect candidates, you know, and thinking about how companies like that can benefit from that kind of mind share is part of what mission like next is going to be focused on.

Awesome. Great.

And what are your thoughts, Bob, in terms of the evolving landscape and where mission like can and should be going?

Well, I think it's clear now that one element of our national power is the technology infrastructure that is being created by our innovators. It really is a driver of the economy. And that driver, the economy, as we mentioned, is going to shift more from now, not just being it, but biotech and nanotech space tech. Quantum computing is extremely hot. And the quantum computing is important because that's modeling the physics of reality. And there's so many use cases. The easy ones are things like, oh, better sales and marketing. Well, but that's not the transformative use cases of quantum computing, although that's going to definitely be a use case. It's things like modeling chemical reactions to allow you to make chemicals more efficiently and with lower cost and lower energy and, and faster and lower price. So quantum computing is going to be a real revolution. They need to keep reducing the error rates of these quantum computers to where they can do that. And as I know you know, we are tracking quantum security also because one day a quantum computer will be able to run this algorithm called Shor's algorithm, which will allow it to break asymmetric encryption, which is a lot of the encryption we use today. And when that occurs, our adversaries will be able to read our Mail. In fact, bad guys right now are sucking up as much of our communications as possible in the belief that 10 years from now they'll be able to read what we're writing about today. So quantum security is an issue for today. And I think Mission Link next should be aware of that and should help highlight innovation in that field so more people know who to turn to for solutions.

For example, you know, Bob, and that's it's a great use case in terms of mission like and we already have actually, believe it or not, a small handful of quantum computing companies that are going to be in this next Mission Link class. And one of the things that I love about the comments you just made is that actually is one of the values that are value adds that a group like Michelin can bring to the table. For folks like private equity investors and venture capitalists us is sometimes hearing the industry and thought leaders within the industry that aren't being paid by a quantum computing company to be able to translate what those kind of capabilities can do and what they mean in sort of a plain English sort of speak in terms of the industry and the implications of what could happen in terms of risks and risk profile if those solutions don't get to market. Can be a difference maker for investors or buyers or teaming partners in terms of who and how they see some of these solutions. And so part of the idea is to get the thought leaders who really understand sort of this macro level of where things how the dominoes could fall, to be able to communicate that to that kind of an audience, because that's what can then open the doors to get somebody funded or a private equity fund or venture capital firm to kind of confirm its thesis that it's been developing and actually actualize it by finding companies that are doing what their thesis suggests.

Right, Cool. So Andy, I think one thing I'm going to do, we'll put in the comments of this video and in our podcast ways that people can get in touch to talk about Mission Link. And I'll just tell everybody, get in touch with me and I'll connect them to you. If they are a candidate for Mission Link, terrific.

We would welcome it because it really is about eyes and ears out there and if anyone knows innovative solutions or companies and by the way, MissionLink, the members were all over the country and eventually all over the world where people would fly into the area to participate. So we'd welcome any ideas and thoughts, suggestions on thought leaders and innovators that like to join.

Right, Andy, before I let you go, I have a couple other questions. I would love to know what you're reading right now.

That's a great question. Well, you know what I've been reading has been a lot of OODA Loop.

That's good. Thanks.

My time is. My time is short and I've been. I'm gonna say reading in air quotes because I've actually been doing more. More audible than anything else. But, you know, it's actually been a lot more of light reading these days. So I've been following some of Matt's recommendations on Mr. Singer's books, which I've got some of my kids into as well. And then beyond that, it's just kind of keeping up with my legal work. But thank you so much, Bob. Definitely love what you guys are doing. I've known you and Matt for years. It's really. You guys have created a lot of magic with OODA Loop and you guys are top of the list when I have clients that are looking for true technology thought leaders on the security side and really appreciate everything you've been doing for the local ecosystem as well as technology and innovation in general.

Well, thanks, Andy. It's great having you in the OODA network.

Thank you so much. Thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.