What’s next for cybersecurity, according to Index Ventures’ Shardul Shah

SRS Aquiam, the smartest way to run a deal. Hello and welcome back to Equity TechCrunch's flagship podcast about the business of Startups. I'm Rebecca Belon and this is the episode where we bring on industry experts to help us explore a trend in the tech world and dive deep. Concern over AI safety and rogue agents has sent cyber stocks rising in recent weeks and led to a surge of investment in new startups promising to solve novel cybersecurity issues. We're seeing nine figured checks and valuations that wouldn't have made sense a few years ago. Nobody understands this better than Shardel Shah of Index Ventures. Shardel was an early investor in Whiz who led the cloud security startup through its monster $32 billion Google acquisition and he's got an eye towards what new cyber categories will emerge in the near future. Shardel, welcome back to the show. Thank you, Rebecca. Appreciate you having me. Yeah, nice to see you again so soon. We ran into each other at a dinner you were holding, Index Ventures was holding a couple of days ago or I guess at the time of this recording last week. So I'm really excited to chat to you about some of the things you've invested in and what your thoughts are on where AI is going and how it's affecting the world of cyber security. So just to back up a little bit, you have been Index Ventures for a while now. You joined in 2008? Yeah, it's been almost 20 years and I must say Rebecca, you're one of the best dinner guests we've hosted. You're very engaged, so I encourage others to invite you too. Yeah, I have a tendency for waxing a little philosophical, so I'm glad everyone hemored me. It was a fun discussion. Yeah, I think it was a good discussion and really nice food, so thanks for that. So you've covered a broad range of things, cyber security, AI, enterprise software, infrastructure. You also came on equity, I heard listeners recall your voice or your face back in March when Google bought Whiz for $32 billion, so we've got a lot to catch up on since then. I would love to hear a little bit about some of the other cyber bets that you've made recently. Yeah, and so much has changed since we last met. I think if you sum up the market caps of public companies, it's close to a trillion dollars of valuation exposed to cyber companies, and I think that speaks to the permanent, resilient need for security that's only growing as there's more technology in the world. So I think it's really relevant to think about not cyber as a cycle, but if AI represents a new category of security. I mean, there is kind of a cycle we're going through at the same time. I mean, maybe that's not the way you want to think about it, but we had recently Daryl Amadez letter about pacing the frontier, a lot of researchers are quitting these firms saying that they're concerned about mostly extinction events, but there's also a lot of that is or can be manifested, I think, through cyber attacks, whether that's humans using AI to perform cyber attacks or AI that kind of goes rogue and loses the plot. So it's like AI is simultaneously creating this cyber security crisis and a cyber investment boom at the same time. And I mean, you have a good eye into whiz. How has their day to day, if you're aware, changed over the last few months? Yeah. And just before getting into whiz, I think one of the things I learned about you at dinner was that you have a good eye for philosophy. So I'm curious, have you watched like Dr. Strangelove? No, I haven't. So Stanley Kubrick, like 1946, had this incredible satire, right? It's a kind of psychotic general who has the ability effectively to end the world. And my call is for Christopher Nolan to remake Dr. Strangelove because we're back. And you know, satire aside, I think you pointed it out that on one hand, there's always a security need to protect ourselves from ourselves. And second, there is a security need that's born from adversaries that have an incentive. And so I do think it's appropriate to think about whiz in so much, if we bring it not to 1946 to, you know, this decade, Ami, the co-founder and CTF whiz talked to me about this from the beginning of the business, which is how do we manage both of those needs for security. And so I think it's really prevalent. And I think it's the beginning of how this AI security category is actually going to be reshaped. Okay. I got to check out some Dr. Strangelove then. I mean, it's like a work, you hear that phrase, or I guess the movie title before, but I've actually looked into it. It's worth the watch. Maybe we'll have like a film event. Yeah. Yeah. That'd be cool. So, okay. So it's bringing about a new category of cyber. You've invested, you or at least index has invested in companies like seven AI, right? They do AI security agents. There's frame. This is AI enabled human risk and security training. It's not me if I'm wrong about any of these four, which gives identity for agents, Apex. How do these embody this shift that we're seeing? Yeah. So take a big step back. You're a decision maker at an organization and you're thinking about managing risk in your business. I think the first thing that actually do, and if any listener is on the board of any company of any size, my advice would be to try to offload some risk. And the way to do that is through cyber insurance. And so I am on the board of a company called Coalition, but I'm not trying to talk my book because if you make a considered purchase of cyber insurance, you have to go through a broker and that broker is going to help you choose the best solution that fits for your organization. But I think that's the first thing to do. The second is to think about people, process and technology. And so if you get to technology, you start to think through choices between incumbent vendors and startups. Now, again, as a mere venture capitalist, I'm very biased around startups. And the way I think about most incumbents is they're selling parachutes that are made of patches with kind of sketchy stitches. So it might make you feel good to have it on your back when you jump out of a plane, but gosh, like your life is in a little bit of danger. However, it's not so easy because again, if you're a decision maker, you're getting pelted with pitches from 1,000 plus security vendors. And it's so difficult to appreciate the distinction between snake oil and a real solution. And so it's really challenging to actually think through risk management, but I think it starts with insurance and then it actually begins with people and process. I'm happy to talk about any of the companies that you alluded to or others, but I think that's a really important step back framework. I didn't even know cyber insurance was a thing. I mean, I guess it doesn't surprise me that it is. But what did you say? There's like a whole industry based around this kind of mean. You know, I love my mom, but I probably really didn't think about sunscreen until I was an adult. And so, you know, there are like basics that are really healthy choices to make that some of us don't encounter because of whatever circumstances that were brought it. And that's how I think about cyber insurance. Eventually, it may become compulsory or even mandatory, but ahead of that, I think it's worthwhile organizations thinking about the prudent choice of just offloading a little bit of risk through cyber insurance. And what companies are doing this coalition, which also recently bought like Aliens's cyber insurance business. So you have massive companies in the world like Beasley and others that are providing insurance to all sizes, all industries, all geographies. Yeah, I mean, this just furthers the point that there is a lot in like AI is really creating the next cyber boom, right? And it's taking some interesting turns, right? We're seeing cyber stocks start to surge amid concern around advanced AI, the CrowdStrike and Palo Alto networks where at the time it's recording doing pretty well, but who knows what the what the market sentiment on the day that this gets published will be. So index, just to take a step back, index raised recently, what was it? Two billion across three rounds. So I think you've got 3.5 total capital going at the moment. Yeah, that's right. And that's following Wiz's exit, which you guys did great with. You had like, what was it? Like a 12% stake worth about 3.8 billion if I, if my homework is correct at the time of the sale. Um, you're close a little shy, but that's okay. A little shy. Okay. Don't, don't be too modest. So how much, when you're, when you're thinking about like allocating funds, like how much in the next few months, are you trying to find new solutions for cyber and then, yeah, I'll try to take the question in two parts. First, when it comes to cyber, we do try to invest in platforms. Ultimately, we think enterprises want to partner with platforms, not point solutions. And these are businesses that have multiple use cases for multiple people and multiple product areas over time. 70i is a great example of this. And that's a company that's aiming to be the foundational security company. And they build an as an AI native business from the get go. Again, that's really important and different from incumbents and it's analogous and it rhymes with whizz, how they started from the get go as a platform with a point of view around cloud, although that category had existed for a decade. So I do think startups have a natural advantage in how they build themselves. Second, to your point, there are existing categories like identity where in the past, organizations would think about managing human identities. And today, they manage both human and agent identities. And so our belief is there's a new platform that's required that has new primitives to manage agent identities, which operate very differently than human identities. And thus, new core is born. Or alternatively, we believe entity risk, human and non-human entity risk is different today than in the past. And so Talsh Shalomov, who came out of whizz and created frame, is really relevant for this new age. That said, it might sound like we're really intentional and thoughtful and thematic about how we invest in security. But the truth is, as index, we invest almost as a collection of artists, right? We have this seat fund, a venture fund, a growth fund, and these are the three families that you alluded to that add up to $3.5 billion. But it's the same group of individuals who are investing across the three. And our objective is to be the first investor in category defining companies. And that's the starting point. How we get there, the craft of investing, whether it's thematic or a view on a business model or most often a view on a founder, is very personal to each investor at index. And so we don't step into a new fund with the view on how are we going to allocate capital by sector. Right? It's more organic and a little bit more chaotic. It's interesting. Okay. So it's more organic. It's based on the founder. You mentioned frame, which the founder came from whizz. I wonder if because of whizz becoming such a powerhouse in this space, that will lead to others branching off from that company and starting their own startups. You'll almost immediately have a connection with those founders, and you'll be able to do your due diligence and know if they're worth investing in. If they're interesting founders, you know they're pedigree already. I guess what I'm asking is, do you imagine that whizz will become sort of a PayPal, a Palantir, if you will, in terms of being one of those category defining companies that spawn others within the category? Yeah. Well, the founders of whizz, the first business where I had the opportunity to serve on the board about a decade ago, Othellum, actually had companies that came out of that talent pool to start new businesses. Armas is one terrific example of a company that's enjoyed great success after the team left Othellum. Whizz is, is to your point somewhat similar because Asaf, Ami, you know, and Roy, the founders of whizz attract really ambitious entrepreneurial individuals, and they celebrate their growth and impact in the next leg of their career and journey. And to your point, we also invested in a business called Enigma, Jonathan Jacobi, what was a member of the whizz team, and he's working on a robotics foundation model. When we invested in his business, we actually shook hands before the company was incorporated. And frankly, before we knew what they were going to do, they probably had an idea. But I certainly didn't imagine myself as a robotics investor, and here we are. And so I do think whizz is unusual in so much as there's so much density of entrepreneurial talent that I do imagine that talent exploring new adventures. And even on the commercial side, I think it's amazing that Dolly Rajik, who ran go to market for whizz, is now the zero of opening eye. I mean, I think that was an absolute coup because Dolly's really the best go-to-market leader on the planet. And so you're absolutely right, whizz attracted a real dense talent core. If you work in the world of private target M&A, there's a name you need to know, SRS Aquiam. Since 2007, SRS Aquiam has brought unmatched expertise, insight, and innovation to the industry through their superior escrow agent, paying agent, and professional shareholder rep solutions. They've streamlined how deals get done for 96% of top global private equity firms and 88% of top global venture capital firms. To learn more about how SRS Aquiam is the smartest way to run a deal, check out SRSaquiam.com. That's SRS-ACQ-U-I-O-M.com. I mean, just picking up on this thread a little bit, what is, like, you never thought that you would invest in in robotics, but what is it about a founder? You kind of want to ask this to every investor, but they'll roughly say this similar things, but I'm curious, maybe I'll say something interesting. What is it about a founder that draws you to them that makes you think, okay, I'm going to invest in you. Like, I'm going to not only invest, but I'm going to follow on, like, before you even close this round, we're going to talk about the next one. Yeah, you know, you used a word that was pretty specific, and I wanted to disagree with. I think just because I know of someone doesn't mean we connect. So actually, the first time I met Jonathan was over Zoom, and I told him I don't make investment decisions over Zoom. It turned out we had some health stuff in the family. A Jonathan has got a really warm heart, and so he jumped on the next flight to see me in New York, and on Saturday, we spent the day together from 6am to 2am. What happened in like that sprint over the weekend? It's a little bit of that like, you can't put your finger on it. I think often investors label it as intuition, right? It's a, it is a sensation, it's a feeling. However, we do try to rationalize it, both to ourselves and to our, typically to our partnership, right, in order to exercise judgment. And I actually think that it's like, it's super interesting and dangerous to rationalize because sometimes we're too smart, and we talk ourselves out of really deep conviction. And so I think rationalization for me is very useful to pressure tests and feel my intuition because I'm not always like in my body, I'm often in my head. But at the source of it, I think it is that it's like a strong sense of intuition. Okay. So it's got feeling. I think so. The second part of what you said is a really difficult art, right? Which is, I think the question was like, how do you choose one to double down? And so with Whiz, we did lead co lead, six consecutive rounds of investments. And that was at the time, the largest investment in aggregate that index had ever made. But we shouldn't confuse the outcome with those individual decisions, right? In the moment, I did feel fear. Like it's really scary every two months to come back to your partnership and say, I actually know more and want to invest more when in your partner's like, what else could you possibly know? It's only been two months and one month was like December. And so it's actually really challenging to make that that judgment call. And we've failed to make that judgment call in many circumstances because we often underestimate the magnitude of the largest companies in the world. Yeah. And I'm sure it's like, you know, there's been plenty of times where, you know, you make that bet. And it doesn't work out in someone, you know, that you thought was a great winner ended up not being one. Yeah. And in venture, that happens more often than not. Right. And so there's a degree of either delusion or masochism or confidence. I don't know why. How do you even trust your own intuition if you get, you know, if the spaghetti falls off the wall more often than not? Yeah. I think you and I debated this at dinner too, like optimism, skepticism, cynicism, you know, how do you apply a combination of optimism and skepticism to private judgment without falling into the trap of cynicism? But how do you learn from mistakes you make in order to avoid making the same again? I think another, and this is a bit of a detour. But I think another mistake investors often make is to try to pattern match. I actually think there are no patterns and pattern matching is a fallacy. And so it, it again, almost creates a prerequisite to trust ones intuition. Interesting. I hope that was different from what other investors have told you. Yeah. It was, it was definitely interesting. I'm, I'm thinking about it through the lens of like if I'm a founder listening to us, I'm like, am I, am I going to learn exactly how to get investment from index ventures? And it's like, well, you just, yeah, I, I think your intuition is probably telling you, I mean, you've been in the game long enough, right? So, so that's you are seeing patterns, whether you recognize it or not, or whether you want to call it that or not, but there's clearly something you're seeing that's going to make you want to invest in someone. And so, yeah, I think just like time in the field will really give you, I mean, it's the same as news judgment in a way, right? It's like, well, how do I know when something's a story and when something's not? I mean, I might be wrong, but sometimes I write something. I think this is definitely a story and no one's going to read it, but I'm not sure. So first, I think most entrepreneurs may not want to work with me. And that's okay. Like, I'm not a visionary. Often entrepreneurs want to work with someone who has a shared belief on where the world is going to go. And that makes a lot of sense, because you don't want to kind of relitigate your set of beliefs. We don't want to constantly have friction with convincing someone. of the future state in the world. And so you want alignment around shared vision. I'm not a visionary. And so if entrepreneurs want a visionary, and I mean this with great respect, they should go talk to Vinod Kostler, who can see the future, right? I seek belief in people, because some of the best companies that I've invested in, they pivot. And for me, it's belief in a person, I don't fall in love with my own belief of the future state that really matters in the business. Now that framework is not relevant to every entrepreneur in the world, but I'd be delighted for them to know, to disqualify and not spend their precious time trying to convince me of something that doesn't make sense for themselves. Yeah, whether or not you believe in, or think that you have a strong vision of what you think the future is going to be, you're placing bets every day, and we're in a world. Hopefully not, that would be too bad. Even in today's environment, that would be too fast. That would be too fast. Well, you're placing bets on a regular basis, and we're living in a world where the future is increasingly uncertain, right? And I think that's why you're seeing a lot of funding gravitate towards these cyber companies, right? That are trying to, I guess, give enterprises or individuals a little bit of hope that something will be okay, that they're protected for the oncoming wave, right? We saw recently a hundred plus companies warned that AI enabled attacks will soon become more widespread and more sophisticated. And we saw GBT Astra crossing this critical cyber capability threshold so it can autonomously find and exploit previously known vulnerabilities. So I think it's pretty clear, everyone's pretty clear on the fact that AI is changing cyber and it's making it to like a game of whack-a-mole. But what existing security categories do you think might be getting destroyed by AI? You know, I think we need to very quickly evolve to a world of continuous security. And so there have been categories that are periodic. An example of this is security testing. Today it's regulated for public companies to get periodically tested against security controls. And how it works is usually you get like a agency, you get a team from that agency that give you a report and you may or may not take action on that report, but a board of directors will look at that report and ask you why are you A, B, C, or D or a number one through 10 and ask if you want more resources to improve your score, right? That world of discontinuous security does not exist going forward. So will external pen testing evolve absolutely and there's a field of emerging companies that are oriented? That's like one idea that comes to mind. Second, I think that to your point, the adversary landscape has evolved. So adversaries can consist of like nation states, of criminal syndicates, of individual hackers, right? And they have access to different technologies and different resources and infrastructure in order to launch attacks. Those attacks might be politically motivated. They might be economically motivated, right? So there's different people with different incentives that are part of this adversary landscape. What has happened because of the advancement of AI is more adversaries can launch more sophisticated attacks with less money, right? So I can soon imagine a single individual in a rogue state that launches a agent's form of 10,000 to conduct ransomware attacks across the globe. That's pretty scary. So on the other side, the world needs to evolve to a machine to machine cyber war state. If a human is in the loop on the defense side, compute or cost will drive an overwhelming force. Therefore, any human in the loop oriented security business needs to evolve. And I think that's the core of the thesis behind 70i. As well as again, an emerging set of companies, there's a new stack that will form. There might be security foundation models or might be security defensive swarms. There may be new services organizations that can collect data in different ways or leave behind information in different ways in order to make the economics of an attack more costly for adversaries. And so I do think it's a super interesting question because there will be massive shifts in how defense operates. - Yeah, definitely. So new categories appearing for sure. What do you think will make an AI security startup defensible when the underlying models keep improving? - Well, it starts with the people, again, not to be cliche and simplistic, but it's a true belief. Like it starts with an ambition, the ability to identify a team and motivate that team to go on this irrational journey to start a company. Most companies will not succeed. So it's completely irrational to start a business. It's actually irrational to join a company. And it's probably even more irrational to invest in it. But we're all in it together. - Yeah, we're all met here. - So it starts with the people. I get attracted if I try to use my rational brain and not just give you the genocic law, I think I'm attracted to individuals that can hold contradiction. And so how do you create a service that's easy to use but is extraordinarily sophisticated? Because ultimately, I think the best companies will build platforms. - Yeah, okay, so what does the next ways look like? - I try not to compare companies to ways. I actually learned this lesson from DataDog. DataDog was, it is a wonderful business. I still serve on the board. But it made me a bit of a snob. And I'm worried on the back of the incredible journey that we experienced that was that I become a snob again. And so I'm-- - Like snob because you're like, "I picked a winner." - Well, no, it's not. I mean, I happen to be in the right place at the right time with an incredible group of people. It's not about myself. But confusing that with myself exactly would be problematic. I also wanted to switch gears a little bit and ask you, well, it really makes a good AI investment anymore, right? So index invested in instinct, which that was a $250 million series B. I think I'm just gonna rattle some stuff off. That was at a $2.5 billion valuation for a very young company, a very young consumer AI agent company. Then there's similes, $200 million series B, similes doing AI simulations of people for markets and societies. Enigma, you mentioned earlier that a $71 million seed round. That's an AI robotics company, seven AI's, $130 million series A for cyber agents. So these are monster checks early in company formation. And that's just the ones that index has invested in. We're very early in the whole AI race. You guys are putting crazy checks into companies at stages where investors used to need a lot more proof. What do you know that makes those prices rational? - Yeah, well let's take one as an example and you know June at similes. So maybe we can start there because you'll be able to ask more pointed questions. The first investment in June was like pretty classic. We had deep conviction in a team that had the moral authority to build in a category that we thought would be important. And then we learned because we're really close to the business and we had more context than I think anyone else, that there was incredible market demand across geographies, across verticals from some of the largest companies in the world. And I hadn't seen that amount of market demand since the beginnings of Whits. So that triggered our next investment. And then the market demand translated into business model traction where they were able to close, not only close large contracts, but also renew, expand multiple contracts and close even bigger contracts with larger companies in an incredibly short period of time. I was on stage earlier today. So yes, last week based on the timing of this pod, but I was on stage with Prague at the primary event in New York. And I asked Prague this question of how does he think about the financing environment? Because he's raised from us multiple times, but also other terrific investors, including First Round Capital, Coastal Ventures, Kleiner Perkins, Sequoia, like, and he's got an incredible set of investors. And what he shared was he wants to have every customer in the world, but he doesn't want to have every investor in the world. And he believes that he actually agrees with me that it's irrational to start a company. And what he looks for in investors is an irrational amount of belief. - Sure. - And it turns out when you have an irrational amount of belief-- - You put forward irrationally sized checks. - Exactly. And so that made me feel really good on stage. - Okay, so basically, we are just all swept up in this low key irrational hype. And that's just what it is. It is what it is. - Well, I mean, University of Chicago is where I studied. Economics 101, it's perfectly rational for there to be irrational participants in a market. - Yeah, okay, that's fair. Okay, last question for you. I'm sure we're all still talking about-- Dario is pacing the frontier essay. I'm curious, not that any investor that I have spoken to actually believes that the frontier will be paced, but let's say it is, let's say it does get paced. Could that actually interrupt the assumption that everyone's basing pricing on, that models will just keep getting more capable, compute, will keep scaling, and the demand will keep exploding? I think that the technological advancement in the last two years has definitely surprised me. However, the diffusion of that technology into industry, into the hands of consumers, is lagging. As a consequence, if your hypothesis is correct and we are paced at the frontier, I still think there's a significant lag in the world actually having diffusion and acceptance of existing technologies and capabilities, which are pretty significant. Right, so you're saying that even if we paced, we slowed it down, we stopped development. The existing technology that is out there today, it's so underutilized and there's so much demand that we're not going to see, there will still be money flowing, buildouts happening, people buying. Yeah, I think so. I think the outstanding question then would be, is there irrationality that leads to a set of people who whisper to another set of people that kicks off a bankrupt? And again, this is a topic we talked about at dinner. Yes, well, before we dig into that extremely exciting, inducing topic, I will say thank you for joining us on the show. It has been, as usual, a very interesting chat. Working our listeners connect with you and you'll find your work online if they want to get to know you a little bit better. Oh, thank you. It's a pleasure. Next time we won't start on anxiety. I hope we don't end on it either. I think we probably will, but that's just that's more of a me thing than a you thing. But if folks want to find me linked in is the best location, I do check it really frequently and I'm pretty religious about accepting folks that are specific with questions and ideas. That's okay. Specific with questions and ideas people, all right? Don't just say let's talk. Well, Charter, thank you so much for joining us on the show. To our listeners, you can find me also on LinkedIn and on Twitter and you can find equity on Twitter and Threads at EquityPod. Talk to you next time. Equity is hosted by TechCrunch senior reporters and produced by Teresa Lo Consolo with editing by Cal. Subscribe on YouTube or wherever you get your podcasts and find out what's next at TechCrunch.com/events. Thanks so much for listening and we'll talk to you next time.