3 Strategies I Used To Scale SecurityScorecard to $70M ARR, 1,700 Customers, & $200M in Cash

You are listening to Conversations with Nathan Latka, where I sit down and interview the top SaaS founders like Eric Wan from Zoom. If you'd like to subscribe, go to GetLatka.com. We've published thousands of these interviews. And if you want to sort through them quickly by revenue or churn, CAC, valuation, or other metrics, the easiest way to do that is to go to GetLatka.com and use our filtering tool. It's like a big Excel sheet for all of these podcast interviews. Check it out right now at GetLatka.com.

You've seen one of their free reports or use them in a PLG motion. We're going to dive into the full growth story today, potential IPO plans, net dollar retention, revenue growth, and more. Please help me welcome to the stage Alexandra Yopolski from Security Scorecard.

Good to see you, man.

Good to see you.

It's been way too long. It's been way too long. You remember that photo shoot from the last time we were in your office? That was fun.

I remember the photo shoot. It was a lot of fun, and I think we even played football.

You kicked my butt. I know you just set me up. You wanted me to tell you, everyone, you kicked my butt, but it was great. So we interviewed you back in 2022 already. So just the quick sort of soundbite, and then we'll go back into the full story. Growing from 70 million bucks to 130 million bucks of revenue, did it come from adding new customers or was it expanding current accounts more?

Both.

I knew you were going to say pick one. What came, drove more growth?

So a big focus for us today is expanding new customers because what we do is we pioneer the concept of how to quantify cyber risk. We built a platform, just like credit scores. Our security scores are used by over 2,800 customers worldwide. Nine of the top 10 banks, governments in 46 different countries, insurance companies, but the average deal size is about 30 to 40K.

Okay.

A simple math is that if we help 10% of our customer base better operationalize our product and really adopt it to manage their third parties' report to the board, we're going to double our revenue without acquiring a single customer. So, upsell and providing more value to existing customer base is a big focus.

Yep. Well, let's get into the backstory. It's not going to be 20 minutes, it's going to be over the eight minutes. So, we'll talk fast. But talking about your focus on customer success and growth there, your experimentation framework, which is great based off a book, we'll share the book in a second. Then we'll wrap up with what you view as a CEO's job and how you've capitalized the business as well. So, jumping into sort of customer focus, just for people to understand what you do today, help us understand where you're at, how you got there. Then spend a minute on this.

Sure. Well, I was a Chief Security Officer at Guild Group and before that worked at companies like Goldman Sachs, Oracle, Microsoft. And I saw a big, big problem, like a big epidemic that's only getting worse. We're all interconnected to each other. Everything is moving to the cloud, yet you have absolutely no idea how secure your information is. If you upload it to Dropbox, or if you store code on GitHub, or you send your paperwork to a law firm. So, we pioneered a way to measure and quantify risk from outside, and we built a software. The idea appeared in 2014, was in 2014, just a sketch and a napkin, zero customers, two people, zero revenue. And we created a new industry to measure and quantify risk, all the way into today,

where 70% of the Fortune 100 uses us.

As a paying customer?

As a paying customer. About 500 employees, 70% of Fortune 100 are going to probably finish this year between 130 to 140 million ARR.

Did you personally code the original MVP?

I wrote the original MVP, and my development team is still complaining about the code that I wrote and trying to eliminate it for the past 10 years. So, in hindsight, I should not have written the first code.

You won that war, though. It still works, it's still there. Now, this is what the website looks like today, just so you guys can all get your bearings on what they're offering. Again, you maybe have seen their reports floating around in terms of the PLG bottoms-up motion. Revenue growth goes like... And you've gotten to this point using, and you call it sort of your experimentation framework. So let's spend about a minute and a half on this framework. Help us understand what we learned from these two tests.

Look, the big lesson in the past 10 years is that ideas we thought were good ended up being bad. And many ideas we thought were bad ended up being good. Right? So on the right, that's the big flop that I was proud of. But I had this idea that we need to build a new functionality for insurance companies to look at concentrated risk. If you have multiple companies storing your data, how do you look for similarities if everybody is hosted on that? So we took a 10-person team, four months, cost us millions of dollars to build a feature. And then I didn't bother training the sales team, I did not bother marketing, did not add a single dollar of revenue. Even though, when I was starting this, I was so sure it's gonna be differentiator for us.

On the left, one of our developers at the time, that was back in 2016, who's now founder and a CTO of his own company. He said, you know what? I'm gonna code up a widget where somebody can go to your website, put in a URL, and I'm gonna send you a report with your score. Like, literally, nobody asked him to do it, he just did it on a weekend. And that became one of the lead, uh, leading legion mechanisms for us for multiple years, where people wanted to find out the score.

How many people have downloaded that report?

Oh, I mean, there's over 80,000 companies who downloaded this report. And so, the point is, most companies overvalue great ideas. Cheap, quick experimentation always beats great ideas, and that's the culture you wanna build. And a simple framework that we use, that was actually, it's a really boring, horrible book. But I'm gonna summarize for you the whole idea over here.

Should they buy the book and just read?

No, just Google it, and Mike Schreik is actually our advisor, we've been working with him for a long time. But here's the idea: five by five by five, take five people. Five days, $5,000. If somebody tells you it's gonna take me two months to build a feature, I'm like, "Okay, how do you do it in five days?" They're gonna give you a blank stare and say it's impossible. I'm like, "Okay, maybe you can mock it up. Maybe you can send it to 10 people, see how many people download the report and either prove or disprove hypothesis." But we really adopted this experimentation framework in every team: technology, product, marketing, sales, because it really starts driving agility and, you know, failure should be exciting if it's done at small increments. And so this experimentation was quite crucial for us over the 10 years.

Let's jump into part two, CEO job and capitalization of the business. So let's talk first on capitalization. Obviously, you have quite a funding story. Again, we had the privilege of getting up and I actually took a snippet here of the magazine. It was great putting it on the cover. This magazine sold very well, by the way, so you have a second career if you ever want to go through it.

It's my good looks.

We'll flip to your story here and what you'll see when we'll get to the feature story here on Security Scorecard at a point, $71 million, a billion valuation. And you told me you had $200 million cash in the bank. That was the foosball table where you kicked my butt. We built your everything graph up there on the upper right, talking about specific product launches. And on the next page in the bottom right, you were kind enough to talk to us a little bit about how you had the equity structured, which again, we always publish this in the magazine, a lot of good data in there. I want to talk about that cap table, right, that pie chart, a little bit, because it's the theme, right? Folks are thinking about how do they capitalize the business. You did your first round in 2014, $2 million on 6.2 post. Let me just ask you this. Looking back at the seed all the way through the Series D, any regrets about how you structured any of these deals or the timing?

So the one thing that I really was careful, and the previous speaker spoke about it, make sure to negotiate. Like, the valuation matters a lot less than all the other things you negotiate. The one X liquidation preference, the control and the structure of the board, very, very important. You know, if you start agreeing to higher valuation because of some bells and whistles, participating preferences and coupon mechanisms, you kind of screwed, especially in this environment. So what I'm very proud of is that we never really took a crazy valuation. We always made sure that we have Good composition and control of the board to this day, very, very important.

So what's the board, how many today, five people, seven, three?

There should be more, there are about seven, seven, eight people on the board and it's an even split. Common and preferred is an even split along with independents. But make sure you retain board control, that's very important, otherwise you'll get fired as a founder. Regardless of whether you're doing a good job or a bad job, by the way. If it's your baby, you want to control the company, right? Make sure you don't agree to any crazy kind of coupon, participate in preferred structures and be careful who you partner with. The best investors are not going to bother you, they're not going to help you, nobody's going to help you. You're in by yourself, no matter who promises what to you. But the worst investors will actually give you better advice and really create more headache for you. So I'm quite proud that we did a good job.

When you launched, did you and your co-founder, did you split equity 50/50 at the start or were you majority?

I was a majority shareholder.

Okay, because your idea, okay, got it, like significantly like 60, 70% and he was 30.

Eighty, twenty.

Eighty, twenty, okay, fair enough. Well, then all this is going to be wrong, right? Because you didn't own 50% at the start, you owned 80. But people can just increase this by, what is that, 25%? Multiply by 1.25, the green column, you'll get to sort of Alex's stick. I mean, when you look at these, I just.

That's an embarrassing situation to start showing my net worth in front of.

Well, it's okay, but it's all public, it's all public, it's important. This is how you have to learn, right?

I mean, it's actually more than that because, look, as a founder, if you stay for a company for a long time, a lot of the time the founders feel that they need to be kind of like, you know, slaves to the idea. The simple argument you need to make with your board, if you're fully vested, is, look, if you had to go recruit an outside CEO, you would have to pay what, 4, 5, 7%? So if you're doing a good job and you're fully vested as a founder, regardless of what you have, you should have skin on a game and you should have additional vesting stuff. Otherwise, you can just leave and go start the next stuff, so yes.

And that little italic text you see below my chart I put together is exactly what Alex is talking about, which is we assumed no new ESOP pool being created at each round and we assumed the start was 50/50. Now, what you're saying is obviously you had more than 50/50 at start and it sounds like you got a new ESOP pool established at each round.

Correct, every round we establish and we re-up all of the top performing executives and the people who don't perform or do an average job, we get rid of them very quickly. And then I do think it's actually a huge mistake to have a 50/50 split with your founder when you start a company, because even if it's 51/49, somebody needs to be in charge and control the board. I'm an investor, I'm an angel investor into about 23, 24 different startups at different stages. And number one reason why many companies fall apart is founder conflict. So make sure.

Founder confidence?

Founder conflict.

Conflict.

Yeah, so make sure you really love kind of your co-founders. And the same for your exec team, you need to be on good terms, you need to enjoy presence of your exec team.

So my conservative modeling puts you at current ownership around 10%, but true or false, you've figured out a way to get above that by being smart as you've negotiated?

Yeah.

Round of applause for being transparent. Yeah, that's good. We have to encourage good behavior, you know, this is very helpful, but I thank you for being open. You're really gonna hit the next slide.

And look, on the CEO, on the job of a CEO, there was a good article that came out about founder mode that some people read by Paul Graham, resonated a lot, I think, with all of us. Look, I think like many articles, I think there's a lot of true to it, but one big advice, do not listen for advice from people who've not done your job. That's my number one advice. It doesn't matter if you have a investor from Sequoia or Andreessen, we've taken money from top investors, including Sequoia. It doesn't matter if you're a board member, is a billionaire, or this or that, or have been on a board of Oracle, Google, etc. If the person has not done the job, take any advice with a grain of salt. Any generalization has lots of limitations.

For example, I hired, just like in that article, my worst hires were polished executives with Amazon, Google. They would come in, I start micromanaging, they would tell me, "I'm a terrible CEO", and then I leave them alone for three months and they fuck everything up. And then I have to fire them and I get more bad Glassdoor reviews. And then, reality is it actually matters. It's called situational leadership, it's not micromanagement. The situations where you trust but verify, and you dig in, and you give very specific tasks. But the best thing for us that worked really well is hiring up-and-comers with a chip on a shoulder, and we really got. Very sophisticated about how to screen for talent. We actually have a psychologist who interviews.

He used to be a coach to Steve Jobs, actually, and Larry Ellison. But he interviews every VP higher and above, and I get a 40-page report on what is a person like, not like culture, curiosity. And so the job, I think, of a CEO is to be the main provocateur. Like, you don't want to go solve the problem for all the people, which is your superpower as a founder, but you want to make sure people are curious. And if they're not curious, they're probably wrong people. And so I, I mean, the average tenure of my team is... People stayed for a while. There are people who've been with me for five years, people who came back. But screening for culture fit up front has been one of the most important things I'm proud of that we've done in the past couple of years.

And it really changed the trajectory by being very sophisticated, how you screen the talent.

Guys, in summary, the past 10 minutes, we touched on customer focus, driving that growth from 70 million of AR to 130, which is impressive. We talked about the experimentation framework.

And cash flow positive, by the way.

On cash flow positive.

Growing on a cash flow positive way.

Well, I do have one quick... I remember when I was in your office, you said, it was kind of off the record, but I can make it on the record because it's old now. You were like, you know, we're looking at, you know, maybe IPO-ing right now. You ended up not... I kept watching the news, no IPO. What happened?

Well, you're not going to go... Well, right now, if you look at threshold for IPO, you're at like 300, 400 million.

So the bar just moved.

So the bar just moved. So, I mean, look, we're actively looking at tuck-in acquisitions. We're going to do this year 130, 140. Next year, we're probably going to grow at 25, 30%.

You buying, when you say tuck-in, you buying other companies?

Yeah, so we're going to grow organically at 25, 30%. And we're going to look actively at tuck-ins as well, at 20, 40 million AR range. So I think there's lots of interesting opportunities ahead.

Yep. Well, guys, heck of a story. Super transparent. He'll be around more for lunch. Again, got going, launched the MVP to the detriment of his other engineering team, but it got the job done. Quick experiments, like the job report or the report and security report, ended up bringing in 85,000 leads. The company's turned those leads via multi-product suite set into an average customer value of 23, 24, 25,000 bucks per year, now sitting at 130 million bucks of AR, with plans to grow to another 140, 150 million bucks in the next, call it, six to eight months. We're suit and rooting for you.

No, 140 in the next few months.

Even a shorter period, always faster growth for this guy. Guys, give it up for Alex at Security Scorecard.

Hey, thanks, man.

That was awesome. You're always great. Thank you so much.