Security investments - Any hope for VCs?

This week Tali and I had a conversation with a US investment bank to discuss the investment environment surrounding information security startups.

I have to admit that I came out of it quite depressed!

The underlying statement was - No big exit potential for security startups (in other words - acquisitions will be sub $50m). This is also the sentiment of many VCs (VC investment fell 20% in 2005)

This is very bad news for VCs. Its even worst for startups.

(I guess that puts information security in the same predicament as enterprise software - as mentioned by Danny and Tali).

The reasons for this are many, including -

• A maturing industry (that's consolidating)
• No IPO activity in security (only 3 IPOs in NASDAQ the last 5(!) years)
• The fact that the startups end up as "point" solutions which large companies like to view as "off balance sheet R&D" acquisitions
• And the fact that many segments are considered overfunded...

So is there a future for information security startups (and related VCs investments)?

I think (or hope to think) yes... Moreover, I think that this is one area where being Israeli could make a big difference . The (information) security space is a real Israeli core competency (with knowledge coming from the military, and world class experts coming from the likes of Checkpoint, Aladdin, Cyota, etc.)

So where are there still opportunities - and what should entrepreneurs think about:

• There are still some "Hot" segments for investment - These include data/database security, wireless, data leakage/extrusion prevention, and next-generation authentication. Nonetheless, startups in these areas still face the risk of becoming "point" solutions...
• Given the low exit valuations, entrepreneurs need to find out ways to create companies that have highly capital efficient models (i.e. will need less than $5m or $10m investment over their lifetime). Such companies could still make great returns for their investors (although they still might not fit into the VC model)
• In the past, security companies that became huge (i.e. checkpoint) achieved this because they bet on fundamental industry shifts. Its unclear when this will happen again for security players (and if the large players won't also get into this game). Its a good area to think about, and I'll be glad to speak to anyone who has some thoughts on it...

I still need to do some investigative work to prove my argument. But I guess it boils down to the fact that we don't know what the next big security threat will be. As long as there are hackers and criminals thinking up ways to cause havoc, there will be entrepreneurs looking to find ways to solve it and better prevent the next attack. (A great classic on this topic is secrets and lies)

I'll be glad to hear any thoughts or comments that could help figure it out - Is the security industry on hold? Or, now that VCs are shying away , is this actually the right time to invest, and if so in what areas?