Behind the scenes of year two at a venture-backed cybersecurity startup
Avertro just turned two. These are some of the real moments from our second year.
If you’re wondering what happened in year one, I wrote about it last year.
5th September 2020
“Oh s***, we’re a year old,” I thought to myself. “It’s a Saturday, so we can’t really have a team meeting to celebrate.”
“Should probably post something on social media. No one will see it because it’s the weekend. But hey, the least we can do is mark the occasion officially.”
Approximately 20% of startups fail within their first year under normal circumstances. We experienced most of year one in the midst of a global pandemic. While I wasn’t able to find any reliable statistics, I suspect that number is much higher if we take 2020 and 2021 as the sample data set.
Despite it all, we’d made it through. There was a cautious sense of optimism as we started year two.
Late 2020
Me: “Team, that was some September. We turned one. But it was also our best month to date in terms of booked revenue. Thank you for all your efforts.”
Team: “How did we do overall?”
Me: “Actually it was a great quarter. We quadrupled our ARR.”
One of our most important metrics is Annual Recurring Revenue (ARR). In business-speak, we’d 4x-ed our ARR in a single quarter.
The startup ecosystem and Venture Capitalists like to talk about traction, which can come in many forms. But there’s nothing like revenue to prove traction and to validate that a company is on to something.
4x in a single quarter is extraordinary by most measures. But we didn’t feel we had time to celebrate.
Recruitment
We’re hiring for a software engineer again. Come to think of it, we never stopped trying to hire engineers in year two because we always needed more.
I spent most of the past few weeks recruiting by sending outreach messages to potential candidates as well as interviewing people. Why? Here’s the secret to building a good team:
You have to proactively look for the right people.
The sequence of events outlined in the following sections have been edited for brevity.
Outreach
This is how one of our current team members joined us.
Me (via LinkedIn): “Hi, would you be open to a discussion? You have a really great background and I’d be interested in your views on what we’re doing.”
New team member (they weren’t in the team at the time, of course): “Sure. Let’s meet for coffee.”
Me (during coffee): “What is it you actually want to do, career wise?”
New team member: “<Tells me their ideal role>.”
Me: “That’s great! We’re not currently trying to fill that kind of role, but let me think if there’s anyone else I can introduce you to.”
Existing team member (a week later from the coffee chat and after having had a few discussions with our potential new team member): “Ian, why aren’t we bringing them into the team?”
Me: “We’re not looking to fill that role right now.”
Existing team member: “Ok, well when we are, we should bring them on board.”
Me: “Depends on whether they’re available.”
Existing team member: “Fingers crossed.”
Me (the next day): “I know I said we aren’t looking to fill that role, but how would you like to join us?”
New team member: “In what capacity? I thought you weren’t hiring?”
Me: “Sometimes when the stars align, we have to make things happen. I’d be silly if I let the fact we aren’t actively hiring for that role get in the way. When the right person shows up, we create a role.”
New team member: “I’m in!”
Inbound
Another team member was someone I’d first met at an event some time ago. So, it wasn’t a cold message they were sending me.
New team member: “Looks like things are going really well. I love what Avertro is doing and would like to help.”
Me: “Sure, let’s chat.”
Me (a few interviews later): “Your final interview is with the CISO of a very large organisation.”
New team member: “Seriously?!”
Me: “If you join us, you’ll be speaking to cybersecurity leaders. I need to know you can have a good, constructive conversation with them.”
New team member: “Oh. That’s fair, albeit a little intimidating. All good. I’ve got this.”
Referral
Another team member was recommended by someone I trust.
Trusted person: “I know a person you need to speak with. They’re one of the most proactive and resourceful people I’ve ever come across. They have a passion for cybersecurity and really go out of their way to get better.”
Me: “Ok, I’ll at least speak with them. Doesn’t mean we have a job we can hire them into.”
New team member (a week later): “I’m a little nervous. It’s great to be speaking with you.”
Me: “Don’t worry. Let’s just have a normal conversation. Not an interview. What are those things on the shelf behind you? They don’t look like books.”
New team member: “Oh, I collect board games. I have lots of them.”
Me (15 minutes later): “Do you follow the NFL? American Football?”
New team member: “Not really.”
Me: “Alright, this might not make as much sense but I’ll tell you anyway. Back in the 90s and 2000s, there was an NFL player, Kordell Stewart who played for the Pittsburgh Steelers. His nickname was ‘slash’ because he could play a few positions. And he played them all really well. He broke the mould of a normal NFL player. His biggest strength was his versatility. His abilities allowed him to be valuable to the team in so many ways. I see that in you. I think you can be good at many things, and really great at whatever you need to focus on.”
Me: “I’m going to create a role for you. But first, you have to speak with a few other team members. Culture is really important to us and I want to make sure they feel the same way about you as I do.”
Job ads
The three examples mentioned above did not come via the traditional job ad. But it doesn’t mean we should stop putting job ads up. We still use them, and have found some of our best team members that way.
Disruption
Like every other company, not everyone sticks around for the long haul. Some people are only able to be part of the story for a short amount of time.
It doesn’t always feel the same when people leave. Some need to happen. Other departures sting on a personal level. And some are just downright disruptive.
Roman (via Slack): “I need to talk to you about something important. Let me know when you have time.”
I didn’t think anything of it. There’d been many important things we had to speak about since the founding of the company.
Roman, our CTO, had moved to Europe (temporarily, I thought) early in 2021 for personal and family reasons. Not a huge problem in the scheme of things, given many international businesses have timezone alignment challenges to work around.
The following is not verbatim, but you’ll get the gist of it:
Me: “What’s up?”
Roman: “…”
Roman: “Ummm…”
Roman: “…”
Roman: “As you know, there’s been some things that have been a challenge for me.”
Me: “Yeah, I know the whole time zone thing isn’t easy. But we’re still managing aren’t we?”
Roman: “That’s not what I mean.”
Roman: “I’ve thought long and hard about it.”
Me (thinking to myself): “Oh s***.”
Roman: “With everything going on and my shifting priorities.”
Me (thinking to myself): “F***.”
Roman: “ I need to step aside from day-to-day operations.”
Me: “…”
Me: “So, you’re saying you want to reduce your hours?”
Roman: “Initially, I guess.”
Me: “…”
Me: “Initially?”
Roman: “If that’s what will help to make it easier.”
Me: “Easier for what?”
Roman: “For me to no longer be an employee.”
Me: “…”
Me: “…”
Me: “…”
Me: “…”
Me: “…”
Me: “Alright, make this absolutely clear for me to ensure I’m not misreading the situation.”
Roman: “I’m stepping down as CTO.”
Me: “Is there anything the rest of us can do to help?”
Roman: “Not really. Everything is ok. I just think it’s best for everyone involved.”
Me: “…”
Me: “Alright.”
Me: “…”
Me: “I suppose all I can say right now is that I understand this must have been a difficult decision.”
Me: “…”
Me: “We don’t need to make this any more difficult than it needs to be.”
Roman: “I’ll do whatever is needed to transition out and reduce the impact. Just let me know how best to handle this. I’ll stay for as long as the team needs me to before leaving.”
As much of a shock as it was, I knew we’d be ok. We’d built a team resilient enough to get through tough situations. But first, I had to figure out how to tell them.
The announcement was the toughest part. Everyone was shocked. But to their credit, they remained philosophical and pragmatic.
To us, this was a speed bump in a long journey. Not a wall.
We knew we’d get through it together. The team sensed I needed their support. And I got it. I will always be grateful for that.
I called our investors as well to inform them. Thankfully, we have great investors and they simply asked if there was anything I needed them to do.
Roman’s last day as an Avertro employee was the 31st of May 2021. He remains incentivised and aligned with our success, but is no longer part of our day-to-day.
Visibility
We’d been relatively visible in our first year, getting our fair share of press as well as presenting on stage and at virtual events. In year two, we had to keep the momentum and find new ways to stand out.
Media
We maintained a steady stream of press appearances, but ramped it up in year two. Avertro continued to appear in multiple top tier media outlets. Here is one example.
“Hi, this is the ABC. We’re doing a news story on the federal budget and saw some comments from your CEO in another publication. We’d like to arrange an interview with Ian the day after the budget announcement if he’s available.”
The Australian Federal Budget was released on the 11th of May. I found myself watching the Treasurer’s speech in full, and subsequently read the transcript.
The rest of the evening was spent digging through all the budget documentation in my attempt to craft the most informed opinion of the federal budget I’d ever put together in my life.
The ABC wanted to film the segment in our offices, which was still at Tank Stream Labs in the Sydney Startup Hub at Wynyard.
Stephanie Chalmers (ABC reporter) and I had conversations on quite a number of things off camera. I answered many more questions on camera. The filming took an hour, which included a lot of B-roll. Note: I don’t actually spend time walking up and down the corridor that way. The shots of me working on my laptop were real though. Don’t know what I mean? Watch the segment.
I went straight to the airport after filming as I had a flight to catch to the Gold Coast for AusCERT. I didn’t get a chance to watch the segment live because I was attending a dinner event organised by AustCyber.
During that evening, my phone kept vibrating with text messages.
“You’re on my TV!”
“Hey, I saw you on the news!”
“Loved your comments.”
“Who’s this bloke on my tele?”
“Way to represent the startup and cyber community on national TV!”
Some simply sent photos without comments.
The next morning at AusCERT, others walked up to say they’d seen the ABC segment. A week later, another cyber startup founder sent me a message with a photo of the TV at their gym commenting that they can’t get away from me even when they’re trying to exercise.
Our first real conference
May 2021 marked the first time we’d exhibited at an actual conference. The fact it was at the iconic AusCERT Conference on the Gold Coast made it all the more special.
Thanks to our supporters and friends at AustCyber, we were highly visible alongside many other “AustCybers” and helped showcase how vibrant and innovative the Australian cyber ecosystem really is.
Of course, we couldn’t show up to a conference without branded items (a.k.a. merch), so we took the liberty of ordering some. As superficial as this sounds, there’s nothing quite like merch to make a company feel even more real.
CyberWest keynote
Thanks to some fantastic work from Farrell (our Business Solutions Director), the organisers at the CyberWest Summit offered Sophia and Priyal a keynote speaking slot alongside other luminaries.
Farrell: “Should we do it?”
Sophia: “I think it’s a great opportunity.”
Priyal: “Yeah, I agree.”
Farrell: “I’m going to point out the obvious. It’s in Perth and you’re all in Sydney. Should we do this virtually?”
Me: “I know it’s going to cost us a few return flights, ground travel, meals, and accommodation. But we should do this in-person. It’ll be more impactful. Best of all, Sophia, Priyal, this is the type of experience you will remember. Let’s lock it in.”
Unfortunately, the pandemic had other plans for us. The weekend leading into the event happened to be the start of the latest outbreak that we remain locked down for.
Most of Monday, June 21st was spent monitoring the situation.
Farrell: “So, are you all flying across?”
Me: “Our flights are still booked. So, let’s be optimistic and keep our fingers crossed. As of now, we’re still flying to Perth.”
Farrell: “FYI, the CyberWest organisers just announced that they are advising all interstate speakers to not travel here.”
Me: “Ok. Noted.”
Later that day.
Sophia: “What decision are we making? You remember our flight’s tomorrow morning right?”
Me: “McGowan (the WA Premier) likes to make snap lockdown and quarantine announcements. As of now, we’re still ok as long as we pass a COVID test upon arrival into Perth.”
Priyal (who had a flight on the Wednesday): “Should I move my flight so we’re all in the same boat if the situation changes while we’re in mid-air?”
Farrell: “I don’t know if it helps, but as long as you make it in, McGowan’s never retroactively applied the quarantine rules for people who are already in the state. So, if you get in and pass the COVID test, you should be ok.”
Me: “…”
Me: “You know what, it’s past 5pm. Let’s not. There’s too much uncertainty. Cancel all our flights and accommodation. I don’t want to risk all three of us being stuck in a Perth hotel quarantined for 14 days.”
As it turns out, we made the right decision. Mark McGowan did retroactively apply the quarantine rules shortly thereafter. Had we decided to travel, we’d be stuck in Perth hotel quarantine for 14 days and would have had to do the presentation virtually from hotel rooms.
Attending the CyberWest summit in-person was never going to be on the cards for the three of us based in Sydney. Priyal and Sophia did end up delivering their keynote virtually. And they were fantastic.
Cyber leadership
In building the CyberWest presentation, we wanted strong independent research to support our points.
Me: “Let’s conduct a study. We know what we need answers to. Let’s put a set of independent questions together and see what results we get back.
Priyal: “We need answers from CISOs. We don’t have months to do this, and we need a good sample set of responses.”
Me: “I’ll email every security leader I know. We’ll get some responses. Here’s hoping they see value in what we’re trying to achieve and want to see the results.”
For anyone who’s ever conducted an industry study, you know that a response rate of anything over 5% is good. Anything more than 10% is great.
We had a 50% response rate. To all the security leaders I asked who responded, I know that you were doing me a favour. Thank you.
The initial insights from the study were used in the CyberWest summit presentation. We subsequently did more in-depth analysis to author our first market research document: the Cyber Leadership Effectiveness Report.
We also recently launched our Reboot Cyber series, and are extremely proud of the first episode as well as the subsequent ones to come.
Growth
Being only two years in means we are still very early in our journey. But we’ve been able to achieve things in our second year that we could only dream about in our first.
Going global
Earlier in 2021, we were accepted to the NSW Government’s Going Global Export Program. It provided us with government support and additional credibility for our expansion outside of Australia. In this particular instance, it was into Singapore.
More recently, we were accepted as one of the companies participating in the London Tech Week ANZ Virtual Trade mission, organised by the UK Government’s Department for International Trade.
We’ve always known that the problems we solve apply globally. It’s extremely fulfilling to see independent acknowledgement from state and federal governments affirming what we’ve believed since day zero.
14x
We hit 14-times ARR growth in July/August 2021 when compared to the exact same time last year. This is extraordinary traction by almost anyone’s measure.
For context, most are happy with 3x YoY ARR growth. The reality of it is that we don’t expect to maintain this growth rate. There were a lot of factors from year one that contributed to achieving this number, the largest one being the fact that the pandemic caused most organisational spend to be delayed from 2020 into 2021.
Horizon
We begin year three in lockdown again. It’s been this way for months, which is not ideal for business. It is important for us as a B2B company to be able to get out there. To build relationships, both new and existing.
It has also been tough for our team to cultivate our internal relationships. I recently wrote about founder mental health; the mental health of our team is just as important. No matter what anyone says about the benefits of remote working, nothing beats in-person interactions when we need it.
A startup wants to move fast. The pandemic has had the exact opposite effect. Everything slows down, particularly when it comes to business. Conversations with potential customers take longer. Sometimes, they just stop because they’ve “paused everything we’re (they’re) doing until after the lockdown”.
It’s been the most frustrating thing this year, and it does not look like it will change anytime soon despite the optimism we had entering 2021.
But we are thankful.
To our customers, supporters, and partners.
We remain committed.
To delivering the things we’ve promised.
We will continue.
To adapt to disruptive change, one day at a time.
We persist.
Because our team truly cares about what we do.
Ian Yip is the CEO of Avertro, a venture-backed cybersecurity software company. Avertro CyberHQ is a Cyber Management Decision System that helps leaders manage the business of cyber using defensible insights to determine what is essential.
