How Smart Startups Invest in Security

How do you buy groceries? Do you buy based on brand, what you know? Do you consider the price? Or do you have someone else handle it for you?

Making An Investment

While routine, groceries aren’t expensive. When we consider larger investments, however, the calculus changes. Most hesitate a bit when buying a new computer or tablet. We’d want to make sure the system meets our requirements and we’re not paying too much. Since they are a commodity item, you can shop around without difficulty.

Buying a car or a house requires more time to be spent in the due diligence process. At some point it becomes less about “buying” and more about “making an investment”.

Smart entrepreneurs consider their exit. And that means asking one vital question: What due diligence will an investor require before investing in me?

Think Like an Investor

Seasoned investors seek not only profits and revenue, but typically are driven by one of these three reasons.

1. Control the intellectual property (the “secret sauce”) – by owning the process or the patents. (e.g. Google’s acquisition of Motorola Mobility)
2. Obtain the customer base – to offer a more complete solution to a wider audience. (e.g. Facebook’s acquisition of Instagram)
3. Obtain the talent – hire valuable engineers, leaders, and/or a whole team en masse. (e.g. Salesforce.com’s acquisition of Thinkfuse)

Investors are making a calculated risk decision when they make an investment. They consider the likelihood of continued success over failure. Your valuation will depend on both how much investors might make, and how much they might lose. Investors are primarily worried about two things when they think about failure.

1. The Intellectual Property – Is the “secret sauce” still a secret? And are there patents and other protections in place to ensure the IP is truly part of the purchase?
2. The Time Bomb – What is already in place at the company that we don’t know about? What are the risks and liabilities that can end up shutting the business down before we get started? What might end up causing reputation damage that will make it a bad company to have our name attached to?

Invest In Security

So how do you prepare yourself to talk to potential investors? How do you calm their fears so that you can get the highest valuation? The best answer is to invest in security.

A startup with a proper information security and risk management program is well prepared to answer questions about their intellectual property. “Yes, we’re confident our secret sauce is still a secret, because we took the steps necessary to protect it, monitor it, and handle incident response.”

This program also needs to protect intellectual property, including legal considerations. It should also address how you manage vendors – to ensure that your partners don’t end up causing you issues or weaknesses. (Reports show that a third party was at the root of the recent Target breach).

Great investors hire security experts to perform security assessments before acquiring companies. Knowing about a startup’s information security program can put the investors at ease. It can erase concerns over devaluation of the intellectual property. It can also erase ticking time bomb concerns, knowing lax security isn’t going to cause disclosure of customer information or reputation damage. We’ve provided this part of due diligence for corporate acquisitions totaling over $23 billion.

Great customers do this too. We do these assessments for larger companies when they look to buy products or services that will access their confidential information. They want to ensure working with a startup isn’t going to put their company’s information or brand at risk. And they’re often willing to work with the more expensive option if they present better security capabilities.

So make sure that you’re prepared when the truly great investor or great customer comes knocking. Invest in security as early as possible in your startup. It will be one of the few investments you can make with guaranteed positive returns.