Default Global Podcast: Navigating Global Expansion, Remote Teams, and International Talent

How to Raise Seed Funding for Cybersecurity Startups

Vit Koval / Garret Grajek Season 1 Episode 117

🔊 In this episode of Default Global, I talk with Garret Grajek, CEO of YouAttest and a veteran in identity governance within the cybersecurity space.

With over 30 years of experience and 13 patents, Garret shares actionable tips on securing seed funding, navigating today’s valuations, and finding the right investors.

He also discusses the challenges of scaling a global team and emphasizes that business savvy is just as essential as technical expertise.

Key takeaways:

  1. Raising startup capital in a competitive cybersecurity market.
  2. How a business-savvy spouse can strengthen your investor pitch.
  3. Strategies for managing valuation and attracting investors.
  4. Leveraging a multinational workforce to address security concerns.
  5. Positioning your business strategy for growth and ROI.
  6. Insights from cybersecurity investment trends and investor priorities.

If you're a cybersecurity founder looking to secure funding, attract the right investors, and build a solid business case, this episode is packed with valuable insights.

Garret Grajek on LinkedIn: https://www.linkedin.com/in/theauthguy/
Episode on YouTube: https://youtu.be/QCm6f5zB3m0

Default Global Website: https://gogloby.io/podcast/
Youtube Channel: https://www.youtube.com/channel/UCM9SzxOhqqjOckcVG7XYKFA
Default Global LinkedIn: https://www.linkedin.com/company/default-global/
Vit Koval, Host Linkedin: https://www.linkedin.com/in/vitalykoval/

Vitaly Koval: Here we go. Today I'm thrilled to be joined by Garret Grajek, the CEO and founder of YouAttest. Garret has been a pioneering force in cybersecurity space for nearly like 30 years. 30 years, right? Garret?

Garret Grajek: Sure. Yeah, 20, it sounds better, but yeah, it's 30. Okay.

Vitaly Koval: Holding like 13 patents in critical areas, like multi-factor authentifications, like SSO technologies. Yeah, I mean, his impressive career includes working with major organizations like the US Navy and Ticketmaster. So now he's leading YouAttest, a cloud-based solution that is reshaping the identity governance and administration space, right? So Garret, welcome to the show. It's great to have you here.

Garret Grajek: Fantastic. Thanks for inviting me.

Vitaly Koval: Garret, did I miss anything with that intro?

Garret Grajek: No, that's good. Let's just get into it. Yeah, I've been around the cyberspace for 30 years. I'd like to say 20 now, but it's actually been 30. And I worked with the big companies, the RSAs, the IBMs, the Motorola's, the Cisco's. And then my passion is to take ideas of not being done by the big companies and create, obviously, small companies at first with the goal of making them larger based on what I see are the gaps in the offering in the general community.

Vitaly Koval: Sounds good. And to start us off, Garret, could you maybe give us a quick review of YouAttest? Maybe share some numbers, things like your team size or whatever your company is.

Garret Grajek: In the space of IT, IT is about functionality. That is, someone buys something, I don't care if you're buying Gmail or an SQL database, right? You're buying it for the functionality. Okay. Once you start executing that functionality in the modern world, I don't care if you're in Europe or you're in Asia or if you're in the Americas, you're under governance. You're under governance, especially if you're holding sensitive data. That's, for healthcare, that's called PHI, private healthcare information. Okay. So, once you're under governance, you have to show that there's governance of your IT and your operations and your practices and policies around the data. That is what YouAttest does. It quantifies, identifies, and then creates reports around the access your users, both internal and external, have to privacy data. And it does it in the fastest way known to the market. Those products and services are usually 18 months to get up and running. I can get mine up and running at any site in an hour.

Vitaly Koval: Wow. Wow. That's cool. And I know that YouAttest works with some big names, particularly in the, like you mentioned, highly regulated industries like finance.

Garret Grajek: Really big in PCI DSS, which is the international standard for credit cards. And also in healthcare, big companies, Guardian Health, Fituity, etc., handling healthcare data. Yes.

Vitaly Koval: Awesome. That's cool. So, as we already found out, you've been at the front lines of cybersecurity for decades, right? And you've seen how this industry evolves. So now with the cybersecurity market expected to hit like a, what, 250 billion by 2025, how have you seen like investor interest change over the time in this specific niche? Has there been any kind of noticeable shift in how investors approach?

Garret Grajek: There's been a huge shift in the last, and now it's coming back, in the last four years. Okay. There was a great expansion in cyber investing about 10 years ago, all the way up to about six years ago. It was a really good market to be starting companies and for getting invested. Valuations, that's what you value your company, and then tell the investors, I'll give you a piece of it, were very high. They were in the multiples of 20s. Now in the last two, three years, or four years, however you want to count it, valuations have been two to three times what your income is, which is much, much lower. Okay. So it's been a substantially different market for cyber investments over the last couple of years. And unfortunately, in the negative direction.

Vitaly Koval: Got it. Speaking about your specific fundraising journey, right, was it a kind of straightforward path or did it involve multiple meetings, multiple rejections before securing your first round? I guess it was your first round.

Garret Grajek: My being seasoned in whatever you want to call that, my initial journey was, I want to say simple, but pretty straightforward. First, the market was very good. And secondly, I had come off from previous projects that made people money. Okay. Which, you know, I have recommendations, I will definitely talk about that and why that helps. What, that's how I got the company started. That's how I got it moving. Then what happens is, then you have to go into larger fundings because when you're building your product, you could always assume you're going to be in a funding space for five years because, heck, I mean, big companies, anyone can name this, are still in the red because we spend so much on research and development and production and then marketing. So it's two different worlds. How do you get started? And that's the friends, families, acquaintances, and really the acquaintances is where I got this, which was acquaintances and business acquaintances based on previous ventures. That's how I initiated the funding.

Vitaly Koval: Yeah. Yeah. I mean, I just thought that, yeah, with your extensive background in this field, investors would have been knocking on your door and throwing money at you.

Garret Grajek: Yeah. Once you get into institutional rounds, there's a whole different set of metrics that come at you that I learned in this because I always was on the far right technical side. In the business side, I was less experienced than previous companies. So that's where I had to re-educate myself and re-educate the audience with different and new materials because in the institutional rounds and the ones that the VCs and the funds, et cetera, they're not speaking the language of technology. They are speaking the language of money.

Vitaly Koval: Yeah. Yeah. That's true. And you touched this, but maybe you can give some more detail. One of the key questions that founders usually ask often, like I have, is that when to raise funds. In your case, was there like any specific aha moment when you realized that external funding was essential?

Garret Grajek: And the companies I start, they're starting from scratch. I have to build a product, which usually takes easily a year to get something off the ground before you get your first customer. So you can assume you're in the red from there. And then your revenues to be competitive and to get features, you're going to stay in the red for a while. So you're almost in continuous funding mode.

Vitaly Koval: Mm-hmm. Yeah. And a bunch of well-known founders, entrepreneurs, VC gurus, like, for example, Zack Parrott from Plate, often say that it is crucial to build a great business first, and then the funding will follow. So how important was having that strong conviction in your product when it came to convincing your investors?

Garret Grajek: Yeah, it's both. And I do like to quote, because you can be a tech founder, which I am, and be convincing in the technology, in the market, and the need and differentiator of your product in his space. That's great. That's somewhere about 49 to 40% of fundraising. The other 60% is, as that quote you took, is what is the business model around your technology? And how are you going to be able to execute on that business model and why you will succeed? That's what us tech founders really have to get down. And that's not going to come in your brain. That's going to be coming from outsiders who've been doing business and sales their entire lives. You need help and coaching from them and the materials. And no different than if you're explaining the cybersecurity kill chain to another techie, you need the language of EBITDA and financials to be talking to the investors and to the VCs.

Vitaly Koval: And speaking of that, it is really important to find investors who truly understand your market, especially one as complicated as cybersecurity, right? So were you looking specifically for those with a focus on cybersecurity market or did you aim for a broader group?

Garret Grajek: Well, that's the deal. I mean, if you can get, and I'm not saying I perfected this, but if you can get your message down to value and profit and income and growth, if you can get whatever you're built and you can get your message there, then you can go pitch to the general audiences. And I'm not saying I perfected that, but that's really where the winners get it, that they take something that could be very wonky, but then they translate it to the world of just business dollars and cents and profit and growth. That's what the audience really wants to hear.

Vitaly Koval: Yeah. And one challenge that many cybersecurity companies face is justifying their return on investment to investors, because it's more about risk mitigation from my point of view than immediate profit for them. So can you give us some specifics? How did you navigate these during your fundraising routes?

Garret Grajek: I had a lot of coaching from different resources that do this for a living, okay? And where basically they take, to start with the deck, which is almost something that's a bad word in my brain, the deck of how you're pitching your company, usually you're somewhere to eight to 10 minute, the PowerPoint should be limited under 10. Unfortunately, mine usually aren't. Anyways, and then what should be in there and what should be covered for your audience? Yeah, the solution and your differentiator is there, but that's almost like two slides. The rest should be your business model, your execution plan, probably bullet points from your pro forma in how you're going to make it to growth and if relevant profitability.

Vitaly Koval: Got it. And I know that your company has team members across the US, Pakistan, Egypt, right? So three countries.

Garret Grajek: Yeah. Well, you mentioned some of where my resources and workers are coming from. The customers are coming from Latin America, US, North America, and Europe.

Vitaly Koval: Yeah, I'm speaking about your team, right?

Garret Grajek: Yeah.

Vitaly Koval: And I've been working with startups and companies from probably every single vertical in the tech space, including FinTech, healthcare, and so on, but I've never worked with cybersecurity companies.

Garret Grajek: Really?

Vitaly Koval: Yeah. I mean, one of the reasons for that, I guess, is that the majority of them are very strict in terms of their own security and having this distributed team raises those risks for them. That's how I understand this. But that's not maybe the case with you. You don't see this as a threat, right? But more like a competitive advantage.

Garret Grajek: No, it is a threat. And in fact, working with outsources that you don't know and thus shouldn't trust is a threat. I mean, I've been in previous companies where the enterprise has taken the technology and created their side product. That's a true, that's straight out true. We know what happened, et cetera, which is that the laws are then governed. Now, the group that I'm working with, I've worked with for over 20 years in three different companies. Okay? So there's a level of trust and there's a level of governance and management that is unparalleled to what I see than just some random guy says, yeah, I'll build this API for you.

Vitaly Koval: Yeah, that's true. Okay. But from the fundraising perspective, does it present any significant blockers in terms of raising investment, specifically in your niche?

Garret Grajek: Yes, in my niche, I have it covered. I have it covered because of the relationships I've had in the past and that I crafted the individuals and whatever to be reporting straight to the structure of UHS, et cetera. But like I said, I mean, you mentioned good skills.

Vitaly Koval: Okay, cool. So probably my last question, what are the three key pieces of advice would you give to cybersecurity founders who are raising their seed round in 2024?

Garret Grajek: First of all, and this is coming from a guy who's known as a maverick and a loner and all that, don't do it alone. If you're an SME in a technology, find the best business guy that you know and partner with him. Explain the business model. Why? Because even if you learn the language, right, given your strong technology background, people will see you as technologists. The investors really do like to see a coupling. They like to see a coupling of an investor with a business guy. And then they are, a lot of them are almost, I mean, I would almost say they don't even, to say they don't try to understand that technology is wrong, to say that it's not the number one in their list is absolutely right. What they're looking for is first the business model, the business plan, and then the believability in the person telling them that. If you're a technology and you're reading a script, you're reading someone else's words on how you're going to execute the business plan, you don't think an investor who's very successful and probably self-made doesn't see that. Of course he does. That's why having a business guy that can articulate it and if interrupted goes, give the bullet points in his own brain, not on the slide, of why he's going to win. That's what needs to come through, right? And that coupling, that coupling of talents is usually what makes a successful investor presentation.

Vitaly Koval: That's great. Thank you. Thank you very much for sharing your journey with us today, from fundraising in the discomplex world of cybersecurity to managing a global team. We have covered a lot of ground. Thank you so much for your time.

Garret Grajek: Good stuff. Stay safe out there.

People on this episode