3 Strategies I Used To Scale SecurityScorecard to $70M ARR, 1,700 Customers, & $200M in Cash
15:20 Share

You are listening to Conversations with Nathan Latka, where I sit down and interview the top SaaS founders, like Eric Wan from Zoom.

If you'd like to subscribe, go to getlatka.com. We've published thousands of these interviews. And if you want to sort through them quickly by revenue or churn, CAC, valuation, or other metrics, the easiest way to do that is to go to getlatka.com and use our filtering tool. It's like a big Excel sheet for all of these podcast interviews. Check it out right now at getlatka.com.

You've seen one of their free reports or use them in a PLG motion. We're going to dive into the full growth story today, potential IPO plans, net dollar retention, revenue growth, and more. Please help me welcome to the stage, Alexander Yapolsky from Security Scorecard. It's been way too long. It's been way too long. You remember that photo shoot from the last time we were in your office? That was fun. I

I remember the photo shoot. It was a lot of fun, and I think we even played football. You kicked my butt. I know you just set me up. You wanted me to tell everyone you kicked my butt, but it was great. So we interviewed you back in 2022 already, so just the quick sort of soundbite, and then we'll go back into the full story. Growing from $70 million to $130 million of revenue, did it come from adding new customers, or was it expanding current accounts more? Both. Pick one. What drove more growth?

So a big focus for us today is expanding new customers because what we do is we pioneer the concept of how to quantify cyber risk. We built a platform just like credit scores. Our security scores are used by over 2,800 customers worldwide, nine of the top 10 banks, governments in 46 different countries, insurance companies, but the average deal size is about 30 to 40K. Okay. Right? So...

A simple math is that if we help 10% of our customer base better operationalize a product and really adopt it to manage their third parties report to the board, we're going to double our revenue without acquiring a single customer. So upsell

and providing more value to existing customer base is a big focus. Well, let's get into the backstory. It's not going to be 20 minutes. It's going to be over the eight minutes. So we'll talk fast. But talking about your focus on customer success and growth there, your experimentation framework, which is great based off a book. We'll share the book in a second. Then we'll wrap up with what you view as a CEO's job and how you've capitalized the business as well. So jumping into sort of customer focus, just for people to understand what you do today, help us understand where you're at, how you got there. Spend a minute on this. Sure.

Sure, well, I was a chief security officer at Guild Group and before that worked at companies like Goldman Sachs, Oracle, Microsoft, and I saw a big, big problem, like a big epidemic that's only getting worse. We're all interconnected to each other, everything is moving to the cloud, yet you have absolutely no idea how secure your information is if you upload it to Dropbox or if you store

code on GitHub or you send your paperwork to a law firm. So we pioneered a way to measure and quantify risk from outside and we built a software. The idea appeared in 2014. It was in 2014 just a sketch and a napkin, zero customers, two people, zero revenue.

And we created a new industry to measure and quantify risk all the way into today where 70% of the Fortune 100 uses us. As a paying customer. As a paying customer. About 500 employees, 70% of Fortune 100 users.

I'm going to probably finish this year between $130 million to $140 million ARR. Did you personally code the original MVP? I wrote the original MVP, and my development team is still complaining about the code that I wrote and trying to eliminate it for the past 10 years.

So in hindsight, they should not have written the first code. You won that war, though. It still works. It's still there. Now, this is what website looks like today. Just so you guys can all get your bearings on what they're offering. Again, you maybe have seen their reports floating around in terms of the PLG bottoms-up motion. Revenue growth goes like this. And you've gotten to this point using, you call it sort of your experimentation framework. So let's spend about a minute and a half on this framework. Help us understand what we learned from these two tests.

Look, the big lesson in the past 10 years is that ideas we thought were good ended up being bad, and many ideas we thought were bad ended up being good. So on the right, that's the big flop that I was proud of, but I had this idea that we need to build a new functionality for insurance companies to look at concentrated risk. If you have multiple companies storing your data, how do you look for similarities if everybody is hosted on that? So we took...

A 10-person team, four months, cost us millions of dollars to build the feature. And then I didn't bother training the sales team. I did not bother marketing. Did not add a single dollar of revenue, even though when I was starting this, I was so sure it's going to be differentiated for us. On the left, one of our developers at the time, that was back in 2016, who's now a founder and a CTO of his own company. He said, you know what?

I'm going to code up a widget where somebody can go to your website, put in a URL, and I'm going to send you a report with your score. Like literally nobody asked him to do it. He just did it on a weekend. And that became one of the leading lead gen mechanisms for us for multiple years where people wanted to find out the score. How many people have downloaded that report? Oh, I mean, there's over 80,000 companies who downloaded this report. And so the point is most companies overvalue great ideas.

Cheap, quick experimentation always beats great ideas. And that's the culture you want to build. And a simple framework that we use that was actually, it's a really boring, horrible book. But I'm going to summarize for you the whole idea over here. Hold on. Should they buy the book and just read? No, just Google it. Google it. Mike Schrag is actually our advisor. We've been working with him for a long time. But here's the idea. Five by five by five. Take five people.

Five days, $5,000. If somebody tells you it's going to take me two months to build a feature, I'm like, okay, how do you do it in five days? They're going to give you a blank stare and say it's impossible. I'm like, okay, maybe you can mock it up. Maybe you can send it to 10 people, see how many people download the report and either prove or disprove hypothesis. But we really adopted this experimentation framework in every team. Technology, product, marketing, sales, because it really starts driving agility and innovation.

you know, failure should be exciting if it's done in small increments. And so this experimentation was quite crucial for us over the 10 years. Let's jump into part two, CEO job and capitalization of the business. So let's talk first on capitalization. Obviously, you have quite a funding story. Again, we had the privilege of getting up and I actually took a snippet here of the magazine. It was great putting on the cover. This magazine sold very well, by the way. So you have a second career if you ever want to go do it. That's my good looks. We'll flip to your story here. And what you'll see when we get to the feature story here on...

security scorecard at a point, 71 million bucks, a billion valuation. And you told me you had 200 million cash in the bank. That was the foosball table where you kicked my butt. We built your everything graph up there on the upper right, talking about specific product launches. And on the next page in the bottom right, you were kind enough to talk to us a little bit about how you had the equity structured, which again, we always publish those in the magazine, a lot of good data in there. I want to talk about that cap table, right? That pie chart a little bit.

because the theme, right? Folks are thinking about how do they capitalize the business. You did your first round in 2014, 2 million on 6.2 post. Let me just ask you this. Looking back at the seed all the way through the series, D, any regrets about how you structured any of these deals or the timing?

So the one thing that I really was careful and the previous speaker spoke about it, make sure to go like the valuation matters a lot less than all the other things you negotiate. The one X liquidation preference, the control on the structure of the board. Very, very important. You know, if you start negotiating,

agreeing to higher valuation because of some bells and whistles, participating preferences and coupon mechanisms, you're kind of screwed, especially in this environment. So what I'm very proud of is that we never really took a crazy valuation. We always made sure that we have good composition and control of the board to this day. Very, very important. So with the board, how many today? Five people, seven, three? Yeah.

There should be more. There are about seven, eight people on the board, and it's an event split. Common and preferred is an event split along with independence. But make sure you retain board control. That's very important. Otherwise, you'll get fired as a founder, regardless of whether you're doing a good job or a bad job, by the way. If it's your baby, you want to control the company. Make sure you don't agree to any crazy rules.

kind of coupon participate in preferred structures and be careful who you partner with. The best investors are not going to bother you. They're not going to help you. Nobody's going to help you. You're in by yourself, no matter who promises what to you. But the worst investors will actually give you better advice on

and really create more headache for you. So I'm quite proud that we did a good job. When you launched, did you and your co-founder, did you split equity 50-50 at the start, or were you majority? I was a majority shareholder. Okay, because your idea... Yeah. Okay, got it. Like, 60-70%, and he was 30... 80-20. 80-20. Okay, fair enough. Well, then all this is going to be wrong, right? Because you didn't own 50% at the start, you owned 80. But people can just increase this by...

What is that, 25%? Multiply by 1.25, the green column, you'll get to sort of Alex's take. I mean, when you look at these, I just-- ALEXANDER BUZGALIN: That's an embarrassing situation to start showing my net worth in front of random people. ALEXANDER BUZGALIN: Well, it's OK. But it's all public. It's all public. It's important. This is how you have to learn, right? That's SaaS. I mean, it's actually more than that. Because look, as a founder, if you stay for a company for a long time, a lot of the time the founders feel that they need to be kind of like slaves to the idea. The simple argument you need to make with your board if you're fully vested

is, look, if you had to go recruit an outside CEO, you would have to pay, what, 4%, 5%, 7%. So if you're doing a good job and you're fully vested as a founder, regardless of what you have, you should have skin in the game and you should have additional vesting stuff. Otherwise, you can just leave and go start the next stuff. So yes. That little italic text you see below my chart I put together is exactly what Alex is talking about, which is we assumed no new ESOP pool being created at each round, and we assumed the start was 55%.

Now what you're saying is obviously you had more than 50-50 at start, and it sounds like you got a new ESOP pool established at each round. Correct. Every round we establish and we re-up...

of the top performing executives and the people who don't perform or do an average job we get rid of them very quickly and then I do think it's actually a huge mistake to have a 50/50 split with your founder when you start a company because even if it's 51 49 somebody needs to be in charge and control the board I'm an investor I'm an angel investor into about 23 24 different startups at different stages and

Number one reason why many companies fall apart is founder conflict. So make sure you really... Founder confidence? Founder conflict. Conflict, yeah. Yeah, so make sure you really love kind of your co-founders. And the same for your exec team. You need to be on good terms. You need to enjoy presence of your exec team. So my conservative modeling puts you at current ownership around 10%, but true or false, you've figured out a way to get above that by being smart as you've negotiated. Yeah. Round of applause for being transparent. Yeah, that's good. Thank you.

We have to encourage good behavior. This is very helpful, but I thank you for being open. You're really going to hit the next slide. And look, on the job of a CEO, there was a good article that came out about founder mode that some people read by Paul Graham. It resonated a lot, I think, with all of us. Look, I think like many articles, I think there's a lot of truth to it, but one big advice, do not listen for advice from people who have not done your job. That's my number one advice. It doesn't matter if you have a...

investor from Sequoia, Andreessen, we've taken money from top investors including Sequoia. It doesn't matter if you're

board member is a billionaire or this or that or have been on a board of Oracle, Google, etc. If the person has not done the job, take any advice with a grain of salt. Any generalization has lots of limitations. For example, I hired just like in that article, my worst hires were polished executives with Amazon, Google. They would come in, I start micromanaging, they would tell me I'm a terrible CEO.

And then I leave them alone for three months and they fuck everything up. And then I have to fire them and I get more bad Glassdoor reviews.

And then reality is it actually matters. It's called situational leadership. It's not micromanagement. The situations where you trust but verify and you dig in and you give very specific tasks. But the best thing for us that worked really well is hiring up-and-comers with a chip on a shoulder. And we really got very sophisticated about how to screen for talent. We actually have a psychologist.

who interviews, he used to be a coach to Steve Jobs actually and Larry Ellison, but he interviews every VP higher and above and I get a 40 page report on what is a person like, not like, culture, curiosity. And so the job I think of a CEO is to be the main provocateur. Like you don't want to go solve the problem for all the people, which is your superpower as a founder, but you want to make sure people are curious. And if they're not curious, they're probably wrong people. And so I

I mean, the average tenure of my team is... People stayed for a while. There are people who've been with me for five years, people who came back, but...

Screening for culture fit upfront has been one of the most important things I'm proud of that we've done in the past couple of years and it really changed the trajectory by being very sophisticated how you screen the talent. - Guys, in summary, the past 10 minutes we touched on customer focus driving that growth from 70 million of AR to 130, which is impressive. We talked about the experimentation framework. - And cashflow positive, by the way. - And cashflow positive. - Growing on a cashflow positive way. - I do have one quick, I remember when I was in your office you said, it was kind of off the record,

I can make it on the record because it's old now. You're like, you know, we're looking at maybe IPO-ing right now. I kept watching the news, no IPO. What happened? Well, you're not going to go away. Well, right now, if you look at threshold for IPO, you have like $300 million, $400 million. So the bar just moved. So the bar just moved. So, I mean, look, we're actively looking at token acquisitions. We're going to do this year $130 million, $140 million. Next year, we're probably going to grow at $100 million.

25-30%. When you say tuck-in, you're buying other companies. Yeah, so we're going to grow organically at 25-30% and we're going to look actively at tuck-ins as well at 20-40 million era range. So I think there's lots of interesting opportunities ahead. Well, guys, heck of a story. Super transparent. He'll be around more for lunch. Again, got going. Launched the MVP to the detriment of his

other engineering team, but it got the job done. Quick experiments like the job reports or the report, the security report ended up bringing in 85,000 leads. The company has turned those leads via multi-products we've sent to an average customer value of 23, 24, 25,000 bucks per year. Now sitting at 130 million bucks of AR with plans to grow to another 140, 150 million bucks in the next, call it six to eight months. We're certainly rooting for you. - 140 in the next few months. - Even the shorter period, always faster growth for this guy. Guys, give it up for Alex at Security Scorecard.

Hey, thanks. That was awesome. You're always great. Thank you so much.