Builder | Best Selling Author of "Cyber for Builders" 👉🏻 cyberforbuilders.com | Writing about cybersecurity 👉🏻 ventureinsecurity.net | Startup Advisor | Angel Investor
In security, startups are faced with the inverted crossing the chasm problem (I first heard this term from Joel de la Garza of a16z). To put it simply, while in other industries SMBs are the first and large enterprises are the last to adopt new solutions, when it comes to security, the opposite is true. Selling security products is harder than selling other solutions: security teams at large enterprises are notoriously risk-averse, and yet they are innovators and early adopters. This dichotomy creates a barrier to adoption many startups find themselves unable to bridge. To make matters worse, because most security problems are fairly niche, there is often no path to mass market adoption (and therefore, no opportunity for a startup to cross the chasm). #cybersecurity
Nailed it. That is such a key issue, and is also why much "product management" approaches and out of the box "app development" focused frameworks fail.
Nikoloz K.
2w
I'd add from another angle influential organizations like Gartner tend to focus on large vendors that can generate significant revenue and long-term partnerships. This dynamic puts startups at a disadvantage compared to large cybersecurity vendors. As a result, innovation from startups may struggle to gain traction until bigger players catch up and potentially acquire them. The most innovative solutions can't reach mass adoption, stifling the very progress needed to address evolving requirements and threats. Breaking this cycle will require a concerted effort to support and elevate promising startups.
You can either build for SMB in cybersecurity or fail to go down market with a product not built for them.
I believe this is more reflective of market failure to build products that scale across market segments. Organizations tend to choose toward optimizing for large enterprises and big deal sizes. Hence the security poverty line that’s been created due to these dynamics. SMB/MSP represents a huge untapped market. Bottoms up or top down can work depending on if you build the right product and have the right dna.
Peter Ho
2w
There is a "security poverty" line. Most SMB cannot afford or understand the cost of cybersecurity. In addition, the value of security is hard to quantify as it doesn't matter until it does. Being the case, security products need to start with large businesses first rather than scaling over time. Enterprise have the hardest environments since they are so diverse internally with complex needs and size.
Agreed, but I will argue that when it comes to XDR the enterprise-first approach is going to fail. Not because of the business reasons you mention, which are super-valid in XDR, but because of the feasibility of tech and product. Take the basic XDR functionality of correlating network and endpoint logs, for just one firewall vendor and one EDR vendor: the compute required to do that grows exponentially with the size of the environment. That means that while for an SMB it could be a reasonable task, for a large enterprise it would be very very hard and overwhelmingly expensive. Now multiply (or power) by the number of permutations of products and versions that an enterprise uses and you have a practically non-practical problem to solve, especially since enterprises tend to go for a best-of-breed approach. That's why I believe that startups that attempt to build a closed XDR ecosystem for SMBs have a significantly better chances to succeed than startups or well established vendors trying to do the same for enterprises.
Ross Haleliuk in the first paragraph: 1. To what “other industries” are you referring? 2. To what “security” solutions are you referring? In the 2nd paragraph, same: 1. “Other solutions” can be even harder to sell than cyber, which is why cyber has been so attractive to investors. 2. “Large enterprises” sounds like all verticals are the same. Honestly, without defining your terms these two paragraphs and the accompanying graphics are simplistic gobbledygook. If you’re wondering why it’s increasingly difficult to sell cyber solutions you need to look elsewhere. (Hint: there are 3700+ vendors, several very large and growing ones, many, many cyber service providers, a whole lot of noise, … And I haven’t even touched on the buy-side). The market for cyber has taken a turn, and has forced companies large and small to rethink their sales strategies. (Hint2: replacing your salespeople is not the answer. As Sangram Vajre might say, “you don’t have a sales problem, you have a GTM problem”). Lastly, as you said, if you’re a startup you have to get to the chasm first. Only then do you have the problem of crossing it.
Bryan O'Neil
6d
Enterprises will often start small for a new technology to prove it out internally and expand more broadly with validation. When driving a new security category or disrupting an existing market, this land and expand motion is critical. SMB and MM can adopt early across a whole org while still keeping the implementation and rollout to a simple scope vs complex Enterprise environments. Its unique (but not impossible) to have an offering that’s a fit for this wide spectrum of markets ..
Co-Founder & CEO at ContraForce
2wRoss, do you think this inverse model is represented in the past, present, or future?