Sign up for my newsletter to see interviews with the biggest names in cybersecurity.

For this issue I went through all of Ted Schlein’s articles on the KPCB blog in the past year and highlighted the main themes. ​Schlein was an early employee at Symantec and has been investing in cyber security at KPCB since 1996. I’ve pulled out samples from Schlein’s posts that directly relate to how VCs should approach the cybersecurity space at the top of the email, and I’ve included more comprehensive notes at the bottom.

I’d love to hear any feedback you have on the email and thanks for being a part of it!

(Drop me a note if you no longer want to receive these emails).​

How to Make Money as a VC in Cybersecurity (the brief):

Strategy:

Rollup: Companies looking for security solutions don’t want to deal with five companies who each tackle individual aspects of security and there are few large players who can address all of the security needs of today’s corporations (Symantec and McAfee are still too reliant on the anti-virus/firewall). The space is fragmented and ripe for consolidation.

Where to invest:

Data Security: Network security is dead. Invest in companies that are protecting the endpoints via encryption (think Ionic Security) or containerization (think Invincea).

Problem to Solve:

Threat quantification. “How secure are we” is a difficult question to answer but it’s one that boards are constantly demanding from CEOs. There’s demand for a company who can answer it credibly and in real-time.

News and Reports:

Banks Changing Apple Pay Procedures after Fraud

• “Some issuers have found as much as 8% of ApplePay transactions to be fraudulent, compared with .1% on traditional cards.”
• Also see how Apple Pay facilitates online fraud.

February 2015 Hack Statistics

• E-commerce was the most hacked industry in February.

Cybersecurity Companies Booming in wake of Major Attacks

• HACK, the cyber security ETF, gained 17% in February (compared to 5.5% for the S&P), buoyed by CyberArk, FireEye, Qualys and Juniper Networks.

Paypal Purchases Security Firm CyActive

• Paypal purchased the Israeli-based malware detection firm for a reported $60mm. CyActive attempts to be a “proactive antidote” that predicts malware threats before they enter a network.

Shortage of Security Pros Worsens

• Cisco estimates there are a million unfilled cyber security jobs worldwide.

• Only 38% of polled organizations believe that they are ready for a sophisticated cyberattack.

 

FireEye:M-Trends 2015

• 205 days was the median time it took for companies to realize they’d been breached in 2014 (down from 229 in 2013).

• Breached companies are facing increased pressure from the public to disclose intimate details of the attacks.

• Professional services, retail and financial services were the three industries in which Mandiant investigated the most attacks.

 

Featured: I go through each of Ted Schlein’s cybersecurity posts and interviews on the KPCB blog in the past year and give you the highlights

 

Significant statistics:

• Attacks rose 48% in 2014 and there are now over 100,000/day.

• The median financial institution spends $2500/year on security.

• The median breach took companies 229 days to discover in 2013 (in 2014 that dropped to 205)

• 60% of data loss in an organization comes from non-malicious human error

 

Themes and Trends

• Network security doesn’t work very well: the antivirus is necessary but insufficient

  • “There are only two kinds of companies: those that have been breached and know about it, and those that have been breached and don’t know about it.”

  • Attackers are going to breach the network–the goal should be protecting the endpoints (the data) with encryption or related technologies so that even if attackers are able to steal the sensitive files, they are unable to access the data.

  • Bromium and Invincea are two good examples.

• Boards are taking cybersecurity seriously

  • The seminal event occurred when Target’s CEO was fired because of the breach.

  • Boards are asking CEOs “How secure are we” which is a very difficult question to answer. There’s a need for a company who can credibly quantify that in real time.

• There’s significant room for consolidation in cybersecurity

  • Companies don’t want to deal with 5 security companies that each address a specific need–they want one company who handles everything.

 

Schlein’s tips for cybersecurity startups

• Target financial services firms first

  • They have the biggest budgets and the biggest need and often act as early adopters.

• Get industry influencers on your board

  • Security is serious business and if you can get a vote of confidence from a trusted name (big security CEO, ex-FBI official, Ted Schlein), that can act as “social proof” for companies looking for a security solution.

• Develop a memorable message to rise above the noise

  • Area1 Security says, “We will never allow a phishing email to enter your company.”

 

Another interesting tidbit:

• The Target breach was actually an IoT breach–the attackers first gained access to the air conditioning system which was on the same wifi network as the PoS system.