Greylock Sarah Guo, an investor with Greylock, said she gravitates toward early stage security startups.
With global malware attacks like WannaCry garnering widespread attention and press coverage, and companies and consumers growing increasingly worried about how security threats are rapidly evolving and diversifying, investors and entrepreneurs alike are seeing big opportunities.
"Security is a space where you see a lot of startups," said Sarah Guo, an investor at Greylock Partners. "Everything is increasingly internet connected and if it's internet connected, it's vulnerable. There's a lot of new opportunity, and I personally believe the market will grow for a long time."
Last year, investors put $3.5 billion into cybersecurity companies via more than 400 deals, according to CB Insights. And those numbers may well go up this year - the first quarter of 2017 set a five-year record for deals in the private security space.
What they're seeing is a market that's already huge, but is growing steadily. Companies will spend some $81.7 billion globally on security hardware, software and services, up 8.2% from last year, IDC projects. The tech research firm expects the market to continue to grow at a nearly 9% annual clip through 2020.
Protecting fish tanks - and against phishing
Among the new generation of cybersecurity companies is PhishMe, a startup that focuses on combatting phishing attacks. The startup has developed a threat management platform that makes it easier for employees to report suspicious email. It expects to see $70 million in revenues this year, said Rohyt Belani, the company's CEO.
"Recently, we've had some chief security officers come to us saying, 'My board of directors are asking me what are we doing to protect against phishing attacks.' It's turned into a board issue at Fortune 500 companies," Belani said. "Every high profile breach that you see these days has started with a phishing email. From our standpoint that's been great tailwinds."
There's no doubt that phishing - sending fraudulent emails in order to get information like passwords and credit card numbers - is a major concern. But it's only one among many being targeted by cybersecurity startups.
The increasingly connected Internet of Things has created a market for companies that focus on more obscure concerns. Take Darktrace, for example. It uses artificial intelligence to detect unusual behavior on a network. In one case, its software detected a security breach on a high-tech fish tank that sat on the floor of a casino.
Once Darktrace's software was in place, it quickly raised a red flag. The fish tank's network connections - normally used to send data on the tank's temperature and monitor feedings - were exporting 10 GB of audio and video weekly to a far away location.
Reuters
Men play poker at the Paradise Walker-hill casino in Seoul September 17, 2007.
On July 11, Darktrace announced $75 million in series D funding led by Insight Venture Partners. It's raised a total of $179.5 million since March 2015.
Following the money
Greylock has taken a particular interest in cybersecurity of late. It tends to specialize in making small, Series A funding deals with high-potential security startups.
In June, the firm led a $9.5 million Series A investment in Obsidian Security, which focuses on protecting user accounts on hybrid clouds in the
Greylock also invested $8.7 million in Series A funding in Awake, which focuses on big data and machine learning for corporate network security. Awake raised $22.5 million in Series B funding from Bain Capital Ventures at the end of 2016.
I think of it as an opportunity
While the details of such investments can run together, they are indications that Greylock and other investors are increasingly focusing on security and recognizing how the threats are changing. As malware becomes more diverse and complex, the market is opening up for more tailored and specific cybersecurity solutions.
It also helps the new startups that most networks use multiple layers of security, or as Belani said, "We're all trying to add depth in defense here." There is room in the market for multiple, highly-specific cybersecurity technologies because they work in conjunction with one another, rather than in competition.
"The trend we see now is companies focusing on specific problems," said Matthieu Suiche, founder of Comae Technologies, a United Arab Emirates-based security company that helps organizations who have experienced breaches diagnose and recover from them.
Suiche said he sees a future for start ups that focus on responding to incidents after they happen, since many breaches these days are too sophisticated to anticipate. He also sees a big market for startups that automate their processes so they can be better integrated into companies' workflows.
"I think of it as an opportunity," Guo said of the sophistication of recent breaches. "When the attacker landscape changes, smaller companies should be more nimble in adapting to that change."
Consolidation
Though less active this year than the VCs, the giant security companies are also responding to the changing market. They're diversitfying their own product offerings - often by acquiring much smaller rivals.
On July 13, for example, Cisco announced its intent to acquire Observable Networks, which makes network security software for the cloud. Since June, Symantec has acquired three smaller security companies: Skycure, Fireglass, and Watchful Software.
Security has never been more challenging as attacks have become more advanced and targeted
Meanwhile, Microsoft reportedly paid $100 million in June to acquire the security startup Hexadite, which focuses on using AI to detect attacks.
"Security has never been more challenging as attacks have become more advanced and targeted," Microsoft said in a statement. "To help businesses take advantage of the modern workplace while protecting their greatest assets, Microsoft continues to invest in enabling the digital transformation of business and optimizing operations with enhanced productivity in secure environments."