Investor Stories 30: Why I Invested in Cybrary (Moran, Label, Corey)

*Please excuse any errors in the below transcript

Nick: Today we’re doing a special installment of, “Why I invested”. I’ve asked #Justin Label of #Inner loop capital and #Ryan Corey of startup #Cybrary to join me today. We had new stack ventures recently invested in Cybrary alongside Justin and I thought it would be fun to talk through our thought process in thesis on investment. So to start out here, Justin, can tell us about your background and involvement in venture capital in startup of investing?

Justin: Yes, sure. Thank you for hosting us and putting this together Nick.

Nick: Yeah, no problem.

Justin: Ryan, it’s great to be with you as always. So, this is Justin Label. I’m the lead investor for Inner Loop Capital. Inner Loop is small seed stage firm that I started in 2014 when I moved to the east coast after seventeen years in Silicon Valley. 2014 I moved with my family to the Baltimore Washington area and since then have been making seed stage investments primarily in cybersecurity companies in what we call the cyber corridor region between Northern Virginia and Baltimore. Prior to Inner Loop, I spent ten years at t #Bessemer Venture Partners in Menlo Park in Silicon Valley. Started early in my career at Bessemer as an Associate; stayed on for let’s just say ten years as a partner for the last several years and for the bulk of that time, focused on cybersecurity and related infrastructure software and services field. So at Bessemer one way or another I was involved with twelve of our cybersecurity investments over those ten years there and as I say, cybersecurity is now my primary focus here at Inner Loop Capital.

Nick: And Ryan, can you tell us your story and how that led you to the launch of Cybrary?

Ryan: Sure. Thanks Nick. Well I’ve always been entrepreneurial from the start. I was selling lemonade as a kid and that just escalated other things including starting up a website on the side during my professional career than having that get acquired. I’ve always been a big fan and just really loved marketing. So for the majority of my career, I’ve been in the I.T. and cybersecurity training industry and to be quite frank, I was part of the root of what is now this big problem. So for years I had been selling and marketing Cybersecurity training to people and the problem is right now that cybersecurity training is accessible to far too few people. It’s very expensive. It’s extremely impractical especially given that basically the technologies and techniques that you would learn in a class right now that you just paid five thousand dollars for could turn over as much as one hundred percent in short is one year and then the courses are very inaccessible in general. So if you think about it, there are a ton of people out there who are Malware Analysis, Engineers or Reverse Engineers and having one company run a class for a handful of them is difficult to do so the industry sees very frequently cancellations and classes. So the outcome is obviously this burgeoning skills gap of over one million unfilled cybersecurity jobs.;three hundred thousand of them in the United States. I mean, twenty thousand alone are here where we are in Maryland and so I was a part of that problem for a long time. I had many conversations where I was sitting down you know, across the table from somebody and I would have a conversation with them about how they wanted to take the next level course, whatever it was that was in their career path but they didn’t have five thousand dollars to pay us as a company; and if their organization or their company or government agency wasn’t going to pay for it, then they simply weren’t going to acquire that skill set in that year. So that was the genesis of cyber. It was having several hundred conversations like that, that led us to realize that something had to change in the field. In terms of timing, eventually online training became a highly accepted form of learning in the field. You’d take for example Plural sites, Meteoric Rise mixed with the growth of free moocs or massive open online courses providers like Coursera and so on. Then the cybersecurity markets inherent love for free open source and equality. I realize that it was only a matter of time until someone did but we are now doing and I don’t believe that there is any team out there more qualified to do it than we are. Our team has unique capabilities of cyber security training experience, strong industry network, growth marketing capabilities and a deep understanding of the market in general.

Nick: Can you give me sort of the one line elevator pitch on Cybrary?

Ryan: Sure. Cybrary is the world’s largest cyber security professional network with free online cyber security training as our foundation. We are helping to advance the industry by building a thriving community that provides anyone, anywhere the resources needed to learn, grow and showcase their career.

Nick: Tell me more about the problem here. You’ve talked about education, you talked about training… You’re building this online community. What is the problem being addressed and is it one; of just training or is it bigger than that?

Ryan: It is bigger than that. So it’s not really just training. Training is the foundation, is the reason that an individual would want to come to Cybrary in the first place but then when they get there they realise that there is this entire professional network to Like I said, grow, learn and connect with other people in their field. So the obvious problem is that there’s one million unfilled cybersecurity jobs out there so you could think about that. There’s negative unemployment in cybersecurity. It’s just amazing to imagine in this hyper growth industry but then ultimately putting together all of the resources that an individual needs to further their career in one place online is the bigger picture here. So, is it is a job placement going to be the end of the funnel for your users? Are they going to select out of the community at that point or is this more of an ongoing place where they can sort of build their profile on their network of other professionals in their field?

Ryan: Sure. So, absolutely job placement is part of the picture that we’re building here. We see that as a no brainer that we have to invest in that and we need to get companies paying attention to Cybrary and the professionals that are developing their careers there but no, this is a lifelong commitment you know. We are working hard to establish a user generated content model to where we can be a repository for one’s knowledge so cyber area is building that capability to where these users can share their discoveries and their findings but then over the long term we want to keep building a reason for these users to come back. throughout an entire career lifecycle. So, we are very aggressive at keeping our ear to the ground and trying to discover the latest trends, techniques, technologies and so on that are emerging in the cybersecurity field and obviously we have a terrific amount of data flowing via our community to tell us more about the trends but as we see those trends and we realize that they’re going to become critical to a cybersecurity career, we then build a course around that. So, in some cases those are very, very advanced or even some cases, high leadership classes but we’re good at that and so we want to be able to provide content for everybody across the entire spectrum of a cybersecurity career.

Nick: Yeah. Tell us more about what the market looks like. What’s the total number of professionals in cybersecurity as well as nascent professional? So people that will be added to this growing market of cybersecurity individuals and professionals.

Ryan: Sure. So it’s hypergrowth as you know right now. There are approximately four million people working in cyber security right now and that number within the next year, year and a half is supposed to expand into about six million. So, let’s talk a little bit about the statistics behind our user base because I can show you a little bit about…

Nick: Yeah.

Ryan: … where this kind of… this potential reaches. So with the classes that we offer on Cybrary, there are topics in there and there are cybersecurity careers and skill sets and so on for people across a wide spectrum. We are about twenty percent coders. People in a computer science program, they’re looking to get a software development job or something like that after college. A lot of times cybersecurity and secure coding principles are overlooked in those types of degree programs. Well, there are courses on Cybrary that a person who is just a pure coder could benefit from but then little people know this; cybersecurity actually has a wide subset of jobs that are for non technical folks. So, people that would be more… their careers are more centered around Business, Accounting. Leadership Project Management and so on, there is a large sector of jobs that require people like that. Governance risk and compliance is a big term in the field and typically you’ll find people like that around those topics. So, we have about fifteen percent of our users fall into that category and then of course there are your highly technical folks: the people that are learning Penetration Testing, Malware Analysis, Social engineering, those types of things.

Nick: Can you talk a little bit about traction in community development both at the time that we invested as well as currently?

Ryan: Sure. So, at the time that you guys decided to present us with a term sheet we had about one hundred thousand registered users, we were approximately a top forty thousand most highly trafficked website globally and we were growing by a few hundred new users per day. We were also at the time, working really hard to acquire those new users so we were focused on building our learning content out and then establishing some new sustainable growth channels. So that was a few months ago. Now, just a few months later we are the largest cyber security training company in the world; we are a top thirty thousand Web site globally; we have three hundred thirty five thousand registered users; we spend almost no time or money on marketing right now and yet we still grow by about one thousand new users every day. We definitely had a very promising virally factor as well which wasn’t present at the time when you guys present of the term sheet. So, for each new user that registers with us, social sharing by that new user brings in more registered users so virally is starting to uptick as well and that by virally really comes a lot from engagement. We’re building features into our community that… they give people more of a reason to come back on a daily basis or weekly basis whereas before it was… We really built just an education model a lot like a #Udacity and Coursera and so now, the focus is absolutely shifted over to the community building and engagement.

Nick: Do you have a sense for how many users you can expect to acquire via an existing user on the platform?

Ryan: I do. Yes, for every user that registers, that user is currently worth 1.15 total users and let me state that we are attributing only in box based traffic. So, we are basing that number on the amount of traffic that comes to our site and registers as a new user strictly from and attributed mailbox or inbox.

Nick: Got it! So these are existing users that are inviting their friends or their colleagues that are in the industry to come join the network and start interacting within the platform…

Ryan: Correct.

Nick: Great. Are there any other companies that have built verticalized communities like you’re doing at Cybrary that may be good role models for the company?

Ryan: Yeah absolutely. Yeah, we spent a lot of time examining other models because you know we we have companies that we want to be like “when we grow up” and so we pay a lot of attention to #GitHub and how they’ve done things in the in the coder community. Might think that the key takeaway for us there is the repository factor that they have. You know, you can show your work, you can share your work, you can make others lives easier, you can connect with people and help them and mentor them and so on and so we’re trying to put as much of that into the Cybrary model as we possibly can. We want to place for people to show their work, share it with others and teach others from it. Another great one would be GrabCAD: It’s a mechanical engineering community that was at the end of the day after a couple of years of being around and growing, they essentially took the place in the industry as the only relevant community online for mechanical engineers and that’s important to us as well. That’s something that we’re working towards on a daily basis. There really is no clear winner as a cyber security professional network online. We have by far the most traction of anything out there and we’re working towards doing that.

Nick: Do you have any sense for that the stats on either GitHub or a GrabCAD when they were growing and doing various fundraisers?

Ryan: For GrabCAD in their case and we took a look at their growth model and their curve with data available on CrunchBase and TechCrunch and some of the press stories that are out there, they received an eight million dollars Series B. in October of 2012. Starting out that year 2012 they had seventy thousand users and then later on in the September, October timeframe, they had reached two hundred fifty thousand users. So that helps to earn them and eight million dollars Series B. and then just about two years later from what’s available here, looks like they were acquired for one hundred million dollars at a user level of 1.25 million so, obviously impressive growth over the next two years there. So, our growth curve coming out of the gate is similar. We have a bigger market we believe than the mechanical engineering market where cyber security professionals, bit more of them out there but the traction that we’ve had in the first year her and the organic growth that we’re getting is putting us on a pretty similar trajectory.

Nick: Yes, certainly a different market for cyber than for this other company you mentioned here but they have the vertical community for mechanical engineers and you found that the the platform is is a good cop for what you guys are doing?

Ryan: Very much so. Yes.

Nick: Got it! Let’s transition over to Justin. So, Justin we talk a lot about deal flow on the program here. Can you talk about how you first found Cybrary and how the relationship looked early going?

Justin: Yeah, sure. Absolutely Nick. So one of the first things I did when I relocated to the east coast from Silicon Valley and started spending full time looking for seed stage deals was I joined a number of the Angel groups. So, in the greater D.C. area it was a pretty decent history of early stage investing and growing some important companies and a lot of that started with the local angel Investment groups. Well one in Baltimore, one associated with the University of Maryland a couple directly in D.C. and Virginia and so I first met Ryan through his pitch to the Baltimore Angels group. Although I should say it was really the pre pitch so like a venture firm a lot of these angel groups work the same way. There is series applications which leads to eight or nine being selected per month to give a very quick. presentation which leads to three or four of those getting to present to the whole group and some percentage of those you know will get check. So, I met Ryan at one of those pre pitch the first in person opportunity to talk to the #Baltimore Angel Group and you know unfortunately, for Cybrary at the time, he wasn’t passed on to the next round where he could you know pitch the whole group for cash. I saw Ryan pitch in person and I don’t mind saying this with him on the podcast right now that his pitch was pretty raw. Let’s call it “raw” and I think this was you know February, March they might have been six or eight weeks post launch and there was a lot that was just coming together for them at the time and I’d say honestly it was so raw that even though I’m probably one of the people in the region who would be most primed to have that story resonate with me, it didn’t really clicked with me either. So kind of when our separate way and I didn’t immediately think a lot more about it but I did you know. Something was tickling the back of my head because Ryan I don’t think he had crystallized the story at the time but there was clearly something important about a place where this rapidly growing industry which desperately needs to suck in new talent and desperately needs to retrain existing talent you know, a single place where that could all happen. I don’t think at the time Ryan had much of a revenue model put together for that or necessarily much of a set of metrics that was going to make that work but he was clearly on to something and the idea lingered in my head for a while and I can say that one of the things that really brought it to others, there’s a researcher in the industry who I respect quite a lot. Her name’s Georgia Whiteman. When I found out that Ryan had convinced Georgia to create and host the advanced penetration testing course on cyber, that really put the notion of cyber in a different realm for me. I mean, that suggested it was you know, it wasn’t just slap dash content, it wasn’t just some things you pull off of some other sites like YouTube but this was really high level professional content and quite frankly Georgian and people like her have almost cult like followings for the work that they do. They’re extremely well respected and if that was the quality of content that Ryan and his partner #Ralph were able to attract to Cybrary, that made me think about it in a different way.

So for those couple reasons, I reached back out to Ryan. We started having a series of conversations and I mean, he had already made a lot of progress in the intervening weeks and months but the idea started to crystallize that this was a place where leading with training and education content, that you could build perhaps the most important community in the cyber security field and I became convinced pretty quickly that if you do that, the revenue opportunities are are massive. There’s just a gaping need to attract new talent into companies and government. There’s a critical need to push out new information about new attacks, new responses, new Vendor, training content, new products and services into that community, that there is a revenue opportunity along every one of those. The certification process in the industry is pretty broken that there’s a new opportunity to disrupt that online and so just all these different sectors. Once you build a community I think you could take it somewhere. So that was sort of the evolution from an initial pass to something that I started spending more and more of my time on in the late spring.

Nick: Yes. So, when did it switch over from being interesting in being sort of something that you were going to track to being a potential investment and can you walk us through your thought process and maybe your thesis on that investment?

Justin: Yeah, absolutely! So, it’s all hard to put your finger on the the moment where you know you know, you’re going to invest but you know you’re not going to invest until all of the pieces are in place and so for me especially at the seed stage, that really leads with the idea. I like to know that the thing that the entrepreneur wants to create you know, that the world is going to be better off for it, that the world is sorely lacking in this thing and it’s so hard, the entrepreneurial process is so difficult. You meet so many challenges, there is so many incumbents. You know, you have to be doing something unique and important I think to propel you to take all that on and as I said Ryan’s first attempt to convey that fell flat for me but over a serious conversations with him, it really… I think we pushed each other’s thinking and it really evolved into something that I began to find very, very compelling. So after or alongside the idea, you have to believe in the team that you’re backing and that was a very critical part of this investment thesis. You know, coming from Silicon Valley where I think entrepreneurship is sort of you know, in the baby vitamins and you kind of take it for granted, that’s not necessarily true in the greater D.C. area. I mean, around here there is some fantastic technical talent. Some absolutely world class cyber security talent and yet, crossing that with someone that you would trust your money or time on a very open ended idea who has a true entrepreneurial spirit to drive it through to success, that’s a little bit harder to find.

Nick: Yeah.

Justin: Ryan and his partner Ralph though they do nothing but start companies you know. They’ve started four or five companies between them. They’ve all been successful you know. They’re not used to being brought in to large corporations and sort of being handed the keys to the kingdom and make it work that way. They only know how to make it work from scratch and Ryan and Ralph strike me as every bit as entrepreneurial as any successful founder that you’ll fine Silicon Valley or elsewhere and so that was a really important piece. The third piece was that this wasn’t just a good idea and a good team but it was actually working. That’s also a little hard to find at the seed stage. Sometimes depending on the type of company, you might just have to take a leap based on those two things alone but in Cybrarians is case you know, on very, very little capital a lot of scrappiness, they have already made something work. So you know, I saw him and his February pitch and he was able to talk about tens of thousands of users and I reconnected with him in April and he was able to talk about seventy or eighty thousand users and you know by the time we’re started talking about a term sheet, it’s one hundred or one hundred ten thousand users. I mean, you know that something really important is happening. It also creates that momentum for you to say’ “Well I think I’d rather be in this in May at one hundred ten than October, two hundred and fifty.” So, that was the third critical piece and frankly if I were running a fifty million dollars seed fund, that would be the end of it for me. I would have cut them a half million dollars check and have joined the board and gone from there but that’s not my model. I’m investing mostly personal capital and building small syndicates of trusted friends and so the are the right target for Cybrary was a four hundred thousand dollar seed round and I can’t speak for that directly and so the last piece for me was, “I can love it all I want but if I can’t work with people that I like and trust to do this together, it’s not really going to work. I can’t have my chin hanging out there with a seventy five thousand dollars investment not knowing where the rest is going to come from” and so the final piece was really connecting with you Nick and new stack as somebody who also believe in this vision who had another great network that can help us build a syndicate and put it together and so knowing that you know, I had the chance to work with some compelling co-investors that we could confidently fill the around that Cybrary needed. That was really the final 29:47 (unclear) and that’s when we moved to lock this up and to make it happen.

Nick: Awesome. Yeah. I mean, we had a similar experience just…

Justin: Yeah, I’d like to turn it around to Nick. I’d like to hear your process and getting to know them and how you decide to pull the trigger.