While these days I don’t really have any time to talk to people in the early days of their startup journey, I did a lot of that. Over the past few years, I have met hundreds (definitely over a hundred) of early-stage and aspiring cybersecurity startup founders. Some were brainstorming what to build and going through an idea maze back then, and are now scaling their fast-growing companies. Others have since ended up winding down their startups, and some even got acquired… I found it really fascinating how people decide what to build and why they picked a certain area.
What’s equally fascinating is listening to the founders we interview on Inside the Network talking about their journey. All this, combined, obviously, with looking at the industry at large, made me realize one thing: that every major cybersecurity company was built on conviction, not consensus. If everyone agrees with your cyber startup idea, you’re either wrong or too late. That is what this piece is about.
This issue is brought to you by... Tines.
Practical guide to AI adoption for IT and security teams
There’s no shortage of advice about AI.
What’s harder to find is practical guidance on how to evaluate AI tools, implement them safely, and make sure they actually improve the way your team works. That’s why Tines recently released the IT and security field guide to AI adoption.
Inside, you’ll learn:
Why many AI initiatives struggle after rollout
How to evaluate AI tools beyond the demo
The questions to ask before making a purchase decision
How to keep humans in the loop without slowing work down
Lessons from teams at Jamf, Vimeo, Canva, and Udemy
Massive opportunities aren’t obvious because they’re about doing what hasn’t been done
We all like to be right, and that’s totally fine
I think that it’s a well-known fact that we all like to be right. Having people agree with us gives us validation, makes us more confident, and ultimately, it lets us feel like we are “winning”.
It also makes sense as a founder to want people - potential buyers, investors, etc. - agree with what you’re doing. Every founder wants to get on the call and see people nod in agreement that yes, the problem is real, the opportunity is real, the market is ready, the solution is exactly what’s needed, and all this sort of stuff.
When you think about it, this craving for approval is pretty logical. Every founder knows that each day brings an endless cycle of ups and downs. Some people (prospects, potential hires, investors, analysts, partners…) say “Hell Yes!” and awesome things happen. But in between all these Hell Yes!”-s there are many “No”-s that feel pretty bad.
Why does all this matter? The reason I think this matters is that really big opportunities are rarely the ones that most of the people agree with.
Many of the biggest successes were bets the majority of the smart people disagreed with
When Kyle Hanslovan was starting Huntress, the idea that you could build a billion-dollar cyber company by focusing on SMB made no sense. Nobody has done that before. Kyle has talked a lot about the early days of the company and how it was hard to deal with rejection after rejection when investors didn’t understand what he was trying to do. The reason Huntress is a big success and it’s valued at over $1.5 billion today is the fact that Kyle pushed through, and despite all the “No”-s, he pursued his conviction. We have recently recorded an Inside the Network episode with Kyle where he talks about his journey of conviction (it is not public yet, so you’ll want to follow the podcast to get notified when Kyle’s episode is out).
When Rob Lee was starting Dragos, the idea that you could build a billion-dollar cyber company by focusing on OT also made no sense. Bay Area VCs didn’t understand nation-states and global threats. For Dragos, fundraising wasn’t easy, and getting started in general wasn’t easy. Despite getting more than 100 rejections from investors, Rob stayed committed to his mission. He saw what nobody else saw at the time, and he knew he had to build what needed to exist, so he stayed true to himself. That conviction got him to grow Dragos into a massive global player. Recently, Accenture acquired the majority stake in Dragos, valuing the industrial cybersecurity giant at $3.25 billion. Rob Lee also shared his story on Inside the Network, which you can listen to here.
Even Jay Chaudhry, a legendary founder who has exited several successful companies before starting Zscaler, didn’t have it easy. Here’s what he explained happened when he was building Zscaler:
“I started to go to CSOs to show them [what they were building at Zscaler]. Most CSOs would tell us early on, “That’s a crazy idea!”. A few would say, “Good idea”, but they’re not ready. I would only need one out of 10 or 12 people to say “Yes”.
If I looked at the numbers and percentages to gauge the market opportunity, I would say 90% of the customers said “No”, so I should stop it. But I looked and said, “This one very smart, large enterprise is so excited about it. And I can only serve so many customers at a young stage of my life. Just that one out of 10 was wonderful”.
Think of the perspective. You could say, “90% of the market doesn’t want it, then let’s stop it”. But you could also say, “No, no, no. These smart customers want it. The ones who don’t want it are a little bit too old school. Over time, they’ll come along”. That’s how these things work.” - Jay Chaudhry: Betting on yourself and building a $40B+ Zero Trust giant in Zscaler on Inside the Network
Okta struggled for a number of years before the market finally evolved, as did many other now successful companies. Yes, there are always a few that explode on day one, but the majority of successes aren’t like that. It takes years before the market matures, before the product is ready, before customers realize the need, or before the changes in technology shift the tide.
Skating where the puck is going to be looks like being contrarian
Wayne Gretzky famously said, “I skate to where the puck is going, not where it has been.” This mindset is especially powerful in the startup world, where being able to bet on the right trend could be the difference between being wiped out or becoming a massive success.
Skating where the puck is going to be requires a degree of conviction. From the outside, it can look like being contrarian, but really what it is is embracing a version of the future that needs to exist, and then making it happen. Steve Vassallo of Foundation Capital wrote a great article titled Great founders don’t search for markets – they manifest them which I highly recommend.
My perspective is that a startup is a bet on a version of the future that needs to exist. Founders need evidence that they are likely to be right, but they cannot outsource their decision-making to the market. For example, if you were to start on customer discovery today and ask people what they need solved, they’d tell you something about agentic identity and AI governance. These are, without any doubt, important problems, but there are many, many more problems that need to be solved outside of these two. This is why it is so important to have a conviction, as that’s the only way to have some focus and clarity in all the noise.
Discovery calls help, but only to a certain degree. If you ask people “What do you want in a car?”, some people will say “A car is a red Tesla, and it has to be electric”. Others will say “It needs to be an SUV”. Others will say, “It should be able to carry 5 tons of weight like a truck”. A police officer will say, “It needs to have flashlights”. To them, the car has many different meanings and many different use cases. The only way to navigate all this is to have some clarity about what it is that you’re trying to solve and for whom; this clarity doesn’t come from asking questions alone.
Closing thoughts
Innovation in security isn’t about spotting the next hot category. It’s about standing where no one else bothers to look, and moving before they realize it’s ground worth fighting for. By the time the market calls something a “trend”, the game is already finished. We have seen that with most new ideas in security. That I think is the meaning of what Wayne Gretzky was talking about, applied to startups. That is also what a lot of the winning companies did. CrowdStrike had to educate the market about the need for EDR. Palo Alto had to educate the market about next-gen firewalls. Okta had to educate the market about SaaS sprawl and identity. Zscaler had to educate the market about changing networks and the cloud. In each of these cases, founders had a strong conviction. Basically, if you wait until everyone agrees on a problem, you’ll end up being too late to solve it.
Great takes. If everyone agrees, you’re likely too late.
Great piece, Ross. The conviction over consensus point is one of the more underrated truths in cyber. Everyone wants validation upfront, but the ideas that actually matter usually sound a little off before the market catches up to them. The rare ‘Hell Yes’ and the long stretch of ‘No’s’ in between is such an honest way to describe the founder experience, most people only see the wins in hindsight. Curious to see the rest of this one play out.