Inside the Mind of a Cyber VC: What Founders Get Wrong and How to Pitch Like a Pro

Inside the Mind of a Cyber VC: What Founders Get Wrong and How to Pitch Like a Pro

Speakers: Lucas Nelson, Venture Capitalist

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=HJsZqwwN1iw

Overview

In a candid and insightful presentation at BSides NYC, seasoned Venture Capitalist (VC) Lucas Nelson provided an unparalleled look into the intricate world of fundraising from the investor's perspective. Drawing on his extensive experience spanning three decades in the business, including 15 years in venture capital and a background rooted in the hacker community since Defcon 2, Nelson demystified the often-opaque process of securing investment. His talk, aimed squarely at cybersecurity founders, meticulously detailed not just what VCs look for, but how they think, operate, and make decisions, ultimately equipping entrepreneurs with the strategies needed to craft winning pitches.

Nelson, who leads Lytical Ventures, a firm primarily investing in early-stage cybersecurity companies, emphasized that understanding the VC mindset is paramount. He reframed the founder-VC relationship not as a supplicant seeking funds, but as a partnership, urging founders to approach the interaction from a position of informed equality. This talk is crucial for any founder, particularly those in the highly competitive cybersecurity space, who aim to navigate the fundraising landscape with confidence, avoid common pitfalls, and ultimately secure the capital necessary to scale their innovations.

The core message revolved around a strategic shift: instead of merely presenting a product, founders must understand the underlying mechanics of venture capital, the specific drivers of investor behavior, and how to position their company as an indispensable, fund-returning opportunity. Nelson’s deep dive into fund size, portfolio math, and the nuances of diligence provided a rare glimpse behind the curtain, offering actionable intelligence for anyone aspiring to turn a groundbreaking security idea into a venture-backed enterprise.

Background

▶ Watch: Introduction and speaker's venture capital background (0:00)

The journey from a groundbreaking cybersecurity idea to a successful, scalable company often requires significant capital, a resource typically sourced from venture capitalists. However, the fundraising process is notoriously challenging, complex, and often fraught with misunderstandings between founders and investors. Many entrepreneurs, particularly those with deep technical expertise, struggle to articulate their vision in a way that resonates with VCs, often focusing too heavily on product features rather than market opportunity and team strength.

The cybersecurity market itself presents unique challenges. It is characterized by rapid innovation, a constant arms race against evolving threats, and a crowded landscape of startups all vying for attention and investment. Ideas can quickly become commoditized, with "AI for the SOC" or "PAM" solutions emerging in droves, making differentiation incredibly difficult. This competitive environment necessitates a sophisticated approach to fundraising, where founders must not only possess a compelling product but also a profound understanding of the investment ecosystem.

Lucas Nelson’s background provides a unique lens through which to examine these challenges. His presence at Defcon 2 underscores a foundational understanding of the hacker ethos and the technical underpinnings of cybersecurity. This deep domain expertise, combined with 15 years as a professional investor, positions him to bridge the gap between technical innovation and investment viability. He has reviewed over a thousand pitches, giving him unparalleled insight into what works, what doesn’t, and why. His talk effectively addresses the perennial question: how can technically brilliant founders translate their vision into a language and framework that VCs not only understand but are eager to invest in? By dissecting the VC decision-making process, Nelson aims to empower founders to navigate this critical phase of their company's lifecycle more effectively.

Key Findings

▶ Watch: What VCs look for: Team, Painkiller, Go-to-Market, Moat (2:09)

Lucas Nelson's presentation distilled the essence of successful fundraising into several core principles, emphasizing that the VC's perspective often differs significantly from a founder's. His key findings provide a roadmap for understanding investor priorities and crafting a pitch that aligns with those expectations.

First and foremost, Nelson stressed the universal VC mantra: "Team over Tech." While technological innovation is important, the caliber, experience, and cohesion of the founding team are ultimately the primary drivers of success. VCs invest in people who can execute, adapt, and lead through inevitable challenges, regardless of how superior their initial technology might seem. Founders must articulate why they are the unique team to solve the problem they've identified.

Secondly, a product must be a "painkiller versus a vitamin." In cybersecurity, this is often easier, as most problems are acute and critical. However, founders must ensure their solution addresses a genuine, urgent pain point that CISOs and security teams are actively seeking to alleviate, rather than a tangential or "nice-to-have" feature.

Third, the "go-to-market" strategy is frequently overlooked, especially at pre-seed and seed stages. Nelson cautioned against the belief that a great product will sell itself or that targeting SMBs is inherently easier. While acquiring the first few customers might be manageable, scaling to hundreds requires a robust and well-defined strategy. Enterprises, despite requiring fewer "at-bats," often offer larger checks, making them an attractive, albeit challenging, target.

Finally, the concept of a "moat"—a sustainable competitive advantage—is crucial. While often considered more at later stages (Series B/C), early-stage founders must articulate how they differentiate themselves in a crowded market. The cybersecurity industry is notorious for rapid imitation; an idea like "AI for the SOC" can attract 30 competitors in two years. Founders must demonstrate how they will win against smart, capable rivals, perhaps even those with better funding.

Nelson also highlighted the critical distinction between different types of VCs:

• Generalist VCs invest across various sectors. When pitching them, founders must educate them on the cybersecurity problem, the market landscape, and the competitive environment. Their networks are less focused, and their diligence processes may be more arduous due to less domain-specific knowledge.
• Cyber-focused VCs, like Lytical Ventures, are inherently more skeptical. They've seen numerous iterations of similar ideas and are deeply familiar with the history and nuances of the space. Founders don't need to educate them on the problem but must explain "why now" and how their solution offers a novel approach. While harder to find historically, their growing numbers make them more accessible now. They also offer a more focused network and deeper market insights.

A profound insight shared by Nelson is that fund size dictates check size and strategy. A large, billion-dollar fund is unlikely to write a small $500k check because the math doesn't align with their portfolio construction goals. Understanding a fund's size allows founders to infer its investment strategy, typical check sizes, and how it interacts with portfolio companies. For instance, it can sometimes be easier to raise from a $50 million fund than a $20 million fund, as smaller checks represent a lower percentage of the former's capital, reducing their perceived risk.

Technical Deep Dive

▶ Watch: Why go-to-market strategy is often overlooked (3:40)

The "technical deep dive" in the context of venture capital isn't about code or protocols in the traditional cybersecurity sense, but rather the intricate mechanics, strategic architectures, and operational "protocols" that govern VC firms and the fundraising process. Lucas Nelson meticulously broke down these internal workings, providing founders with the insights needed to navigate the system effectively.

The Mechanics of Fund Strategy and Portfolio Math

Nelson emphasized that a fund size is the single most important indicator of a VC's strategy and check size. He illustrated this with portfolio math:

• A traditional $500 million fund, aiming to return the entire fund with a single investment, needs to own approximately 25% of a $2 billion outcome. This means every investment is made with the hope that it will be that "fund returner."
• For a billion-dollar fund, taking 20% of a company, the required outcome is even larger. Founders accepting capital from such funds are implicitly signing up for the pursuit of a multi-billion dollar exit. Nelson recounted a story of a founder whose company sold for $150 million—a fantastic personal outcome—but whose investors were "unhappy" because they had bet on a billion-dollar outcome. This highlights a critical misalignment if founders don't understand their VC's internal goals.
• Conversely, a $30 million fund would consider a $200 million exit a massive win, potentially returning a significant portion of their fund. This underscores the importance of aligning your company's projected exit potential with the fund's strategic objectives.

Founders should also understand a fund's deployment cycle:

• Beginning of a new fund: VCs move quickly, deploying capital aggressively as they have zero portfolio companies.
• Middle of the fund: They operate at their normal pace.
• End of the fund: The bar for investment becomes exceptionally high. Nelson noted that "the last deal in a fund never happens" due to the immense scrutiny and risk aversion. Founders should directly ask VCs where they are in their fund cycle and what check size they are looking to write to gauge alignment.

What VCs Do (and Don't Do)

Nelson clarified the realistic expectations founders should have of their VC partners:

• What VCs claim to do: Provide network access (introductions to CISOs, industry experts), assist with talent and recruiting (connecting to experienced sales or technical talent), offer go-to-market (GTM) advice, facilitate investor connections for subsequent rounds, and provide a "brand" halo that can attract other investors.
• What VCs actually do (based on Nelson's recent activities): Interview CFO candidates, introduce companies to cyber-specific vendors (e.g., marketers, headhunters), make introductions to other VCs for follow-on rounds, participate in board meetings to offer broader market strategy, and facilitate CISO intros for diligence that can sometimes lead to advisory roles.
• What VCs won't do: Sell your product for you (introductions open doors, but founders must close deals), create product-market fit (the product must inherently be wanted), fix team dysfunction (internal conflicts are a deal-breaker), or solve narrative issues (a compelling story must come from the founders).

The Fundraising Process: Sourcing, Filters, and Urgency

VCs typically source deals through various channels, with "warm intros" being significantly more effective than cold emails. Nelson noted that only 10-20% of his deals come from cold outreach. High-quality intros come from other hackers, founders, trusted CEOs, or CISOs. Introductions from other VCs are a "mixed bag," with generalists being more credible than later-stage funds that might be passing on a deal they "really love."

Fast filters can quickly disqualify a company:

• Not solving a real problem.
• Founders being uncoachable (not disagreeable, but unwilling to process and thoughtfully respond to feedback).
• Unrealistic valuation (e.g., asking for $75 million for a seed company when the entire fund is $50 million).
• Not offering an interesting solution (e.g., being the 46th email security company without a novel approach).

Reasons deals don't come together often boil down to:

• Lack of urgency: VCs prefer optionality and will delay decisions if there's no FOMO (Fear Of Missing Out). Founders must create urgency.
• Misalignment on vision, values, or strategy.
• A messy cap table that complicates ownership and future investment.

Nelson also clarified the role of a term sheet: for early-stage investors, it's often the final step before closing, with only minor diligence remaining. For later-stage investors, however, a term sheet can be "the opening to dig," meaning significant diligence still lies ahead. Founders need to understand which scenario they are in.

Tactical Advice for Founders

• Aim your raise based on company stage:
• Pre-seed: A bet on the team, minimal traction.
• Seed: Some traction, a prototype, a few users, possibly a design partner, maybe a little revenue.
• Series A: Some revenue (often founder-led sales), aimed at transitioning from founder sales to a dedicated sales team (the first $1-3 million in revenue is typically founder-driven).
• Series B and beyond: "Pouring gas on a fire"—scaling sales and marketing after proving the sales model.
• Deck structure: Aim for 8-12 slides, covering essential points without overwhelming detail.
• Engage VCs early (before you need money): Ask for advice when you don't need money. This builds a relationship, demonstrates execution and follow-through, and allows VCs to see progress over time. These relationships are long-term, often lasting 7-10 years, potentially longer than many marriages.
• Know when VC is not the right answer: For services companies, venture capital is often inappropriate. A services business generating $2-3 million in profit annually is a great business, but it doesn't fit the VC model of "putting gasoline in a rocket ship" for a massive, fund-returning outcome. Founders must understand the "bet" they are making and if it aligns with their personal and business goals.

Top Mistakes Founders Make

Nelson summarized common mistakes that lead to VCs saying "no":

• Focusing too much on the product, not enough on the market or GTM: Founders often describe the "cool drill" instead of the "five-six inch hole" the customer wants.
• Pitching VCs like engineers: While technical details matter, initial meetings should focus on what the company will do and how it will achieve market success, not the intricate how-it-works.
• Not knowing their Ideal Customer Profile (ICP).
• Playing "buzzword bingo" without substance.
• Dismissing competition, which suggests a lack of market research or an unrealistic view of the landscape.

Ultimately, the single greatest mistake is not having a compelling vision and story. A strong narrative—like an "AI-enabled SOC where humans oversee but don't get involved day-to-day"—can overcome many other minor deficiencies and create an unforgettable pitch.

Demo / Proof of Concept

▶ Watch: Know your audience: Generalist vs. cyber-focused VCs (5:23)

This technical article is based on a conference talk that provides strategic and tactical advice for founders pitching to Venture Capitalists. As such, the presentation did not include a live demonstration or proof of concept of a technical product or security exploit. The content focused entirely on the conceptual framework and practical guidance for navigating the fundraising process.

Strategic Implications for Founders

▶ Watch: How fund size dictates VC strategy and check size (7:24)

Lucas Nelson's deep dive into the VC mindset offers critical strategic implications for cybersecurity founders, transforming the often-daunting fundraising process into a more predictable and navigable journey. Instead of viewing VCs as gatekeepers, founders can leverage this knowledge to become strategic partners, "defending" against common pitfalls and "attacking" the market with a well-aligned vision.

Firstly, understanding your audience is paramount. Founders must tailor their pitch based on whether they are addressing a generalist VC or a cyber-focused VC. For generalists, the emphasis must be on educating them about the problem and market. For cyber-focused investors, the pitch needs to quickly demonstrate novelty and explain "why now," as they are already familiar with the landscape and likely more skeptical. This strategic adaptation ensures the message resonates and avoids wasting valuable time on redundant explanations or failing to address specific investor concerns.

Secondly, strategic alignment with fund mechanics is crucial. Founders must research a VC firm's fund size and deployment cycle before pitching. Approaching a billion-dollar fund with a projected $200 million exit is a strategic misstep, as their portfolio math demands multi-billion dollar outcomes. Conversely, a smaller fund might be a perfect fit for a more modest, yet highly profitable, venture. Asking VCs about their target check size and fund stage early in the conversation not only shows diligence but also frames the founder as an informed partner, not a supplicant.

Thirdly, the power of a compelling narrative cannot be overstated. Nelson explicitly stated that the "real mistake founders make... is not having a compelling vision and story." While technical details are important, the overarching narrative of what problem is being solved, why now, and how the specific team is uniquely positioned to achieve a transformative future (e.g., an AI-enabled SOC) is what truly captures investor imagination. Founders should spend significant effort crafting this story, as it can compensate for deficiencies in other areas and create an "unforgettable pitch."

Fourth, proactive relationship building is a significant strategic advantage. Engaging VCs when you don't need money, seeking advice rather than capital, allows founders to build rapport, demonstrate execution, and receive valuable feedback. This "pre-diligence" process transforms a cold pitch into a warm, established relationship, significantly increasing the likelihood of investment when the time comes. This long-term view of the founder-VC relationship, akin to a marriage, encourages thoughtful engagement and alignment from the outset.

Finally, founders must honestly assess if venture capital is the right path for their company. For many successful services-based cybersecurity businesses, the VC model of rapid, explosive growth is not appropriate. Understanding this distinction prevents founders from pursuing a path that fundamentally misaligns with their business model or personal goals, potentially leading to investor dissatisfaction or a forced pivot. This strategic self-awareness is critical for sustainable success and founder well-being.

By internalizing these strategic implications, cybersecurity founders can move beyond simply having a great product to mastering the art and science of fundraising, positioning themselves for successful partnerships and accelerated growth.

Key Takeaways

• Team Over Tech: The strength, experience, and coachability of the founding team are the most critical factors for VCs, outweighing even superior technology.
• Painkiller, Not Vitamin: Solutions must address a real, urgent, and significant pain point in cybersecurity that CISOs actively seek to solve.
• Go-to-Market is Crucial: A well-defined strategy for acquiring and scaling customers is essential from the outset, especially beyond the initial founder-led sales.
• Know Your VC Audience: Differentiate pitches for generalist VCs (educate on market) versus cyber-focused VCs (explain "why now" and novelty), and understand how fund size dictates investment strategy and check size.
• Create Urgency and Build Relationships: Proactively engage VCs for advice before needing money to build rapport, demonstrate execution, and create FOMO (Fear Of Missing Out) when ready to raise.
• Compelling Vision and Story: The ultimate differentiator is a clear, inspiring vision for the future and a captivating story of how the company will achieve it, which can overcome other pitching deficiencies.

About the Speaker(s)

Lucas Nelson is a highly experienced Venture Capitalist with an extensive background in both the technology and investment sectors. His career spans over 30 years in business, demonstrating a profound understanding of industry dynamics. Nelson's roots are deeply embedded in the hacker community, having attended Defcon 2, which speaks to his foundational technical acumen and appreciation for cybersecurity innovation. For the past 15 years, he has specialized in venture capital, focusing on early-stage investments. He is a key figure at Lytical Ventures, a firm dedicated primarily to early-stage (pre-seed to Series A) cybersecurity investments. Beyond his investment activities, Nelson has also shared his expertise by teaching entrepreneurship classes at NYU, further cementing his commitment to fostering new ventures. His professional journey has involved reviewing an impressive volume of over a thousand pitches, providing him with a unique and comprehensive perspective on what makes a successful startup and a winning pitch.