Lior Div just raised a $100 million funding round for his security-tech company, Cybereason. A daunting task, to be sure.
“It’s very hard to raise money,” says Div, the company’s CEO and co-founder. “I see it all the time with colleagues of mine, founders. But if you really have a good, unique solution that’s proven, I believe people are more willing to put the money there.”
Div (pictured at center with his co-founders) had another advantage in this case: SoftBank, the Japanese tech giant that previously invested in Cybereason, footed the whole bill for the new deal. The Series D round brings Cybereason’s total raised to $189 million since its founding in 2012. The Boston-based company’s other investors include CRV, Spark Capital, and Lockheed Martin.
Div declined to comment on Cybereason’s valuation in the deal, or its revenue numbers. But he says the company has grown to 300 people worldwide—its other locations include Tel Aviv, London, and Tokyo—and that its annual revenue has increased by a factor of five since SoftBank first invested in Cybereason, back in 2015.
The latest big financing deal in cybersecurity brings to mind three other companies (whose names also start with “C”). Crowdstrike, the Irvine, CA-based firm known for linking the hacking of the Democratic National Committee to Russia, announced a $100 million Series D round in May. Another Irvine company, Cylance, raised a $100 million Series D last June. And Waltham, MA-based Carbon Black, one of the mainstays of the Boston security-tech scene, has raised a similar amount of total funding as Cybereason—roughly $190 million.
All of these companies specialize in endpoint security—detecting and protecting against threats to devices and networks. Cybereason’s approach stands out for its “offensive mindset,” as Div says, and its emphasis on understanding hackers’ intent and trying to “hunt them” inside a computer system. (The underlying technology includes statistical models of organizations and sophisticated efforts to detect and stop anomalous behavior by users or intruders.)
“Our promise is that we know how to… evolve faster than the hackers,” Div says.
A lot has happened in the security world in the past year, from increasing signs of cyberwarfare to large-scale attacks such as WannaCry in ransomware and the Mirai botnet in connected devices. Those trends are driving more demand from companies and organizations, but also a lot of competition from security vendors (for both customers and funding).
According to PitchBook, venture funding deals for U.S. cybersecurity companies peaked in 2015 at $3.46 billion invested, before dropping to $2.31 billion last year. So far, 2017 is on pace for a rebound.
But Div sees “much more consolidation” coming in the industry. Cybereason may contribute to that; Div notes his team is actively looking for companies to acquire. “Startups and groups of companies, if they’re not providing a new way of thinking or approach, they will be consolidated,” he says.
More broadly, he sees “a lot of customers pay a lot of money to the old guard [security companies] that actually disappoint them. They didn’t provide a solution.”
Consequently, older companies are acquiring newer ones in the hopes of boosting their technology, products, and talent. It’s true of all tech sectors these days, but particularly cybersecurity. (See CA Technologies’ acquisition of Veracode, Microsoft buying Hexadite, and Cisco acquiring CloudLock, all in the past year.)
With its new cash, Cybereason is planning to double its employee count in the next year and a half, while it builds a “stable business” and grows “as aggressive as we can,” Div says. That strategy would seem to include fending off its well-funded competitors in the race to land new customers in sectors like finance, healthcare, insurance, and defense.
“We’re not a company that stands still,” Div says.
