Authentication, identity management start-ups lead 2019 VC investing

The red-hot venture capital (VC) investment trend for cybersecurity start-ups turned white hot during 2019, with the number of investments deals in “pure-play” cybersecurity companies soaring from 2018 levels. According to one set of numbers, the Venture Monitor report produced by Pitchbook for the National Venture Capital Association (NVCA), the cybersecurity sector is attracting “unprecedented levels of VC deal-making.”

The goal of all this deal-making is to cash out wisely when companies are either acquired or go public on the stock exchange. Like VC spending, 2019 was a major year for cybersecurity acquisitions, with more than 150 deals totaling more than $23 billion taking place.

The NVCA data, however, shows a downtick in total venture investment in cybersecurity start-ups from 2018 to 2019, from around $6.5 billion to around $5 billion. That slip is consistent with a PwC/CBInsights report on 2019 venture spending, which doesn’t break out spending for the cybersecurity sector separately but shows overall venture investing falling toward the end of the year, with year-over-year spending levels dropping by 9% to $108 billion.

According to data I’ve tracked separately since the beginning of 2018, venture investments in cybersecurity start-ups are accelerating and not declining. (It’s not clear how NVCA or other firms define “cybersecurity.” Calls to the organization seeking clarity on this question were not answered). My data shows start-ups that make digital security the focus of business activity, and not an incidental activity to support other efforts such as cloud storage, saw the number of venture deals jump by 65% and the total amount of venture funding soar by 70% from 2018 to 2019. Overall venture dollars in cybersecurity totaled $3.9 billion in 2018, increasing by $2.7 billion to $.6.6 billion in 2019.

Fueling that growth was a spike in the number of deals: 133 in 2018 to 219 deals in 2019. The average deal value, however, grew only slightly between the two years. In 2018, the average venture investment was $29,188,405 and in 2019 the average deal was worth $29,998,164.

CSO / IDG

While the VC deal total decreased slightly during Q4 2019 to $1.3 billion compared to $1.4 billion in Q1, $2.3 billion in Q2 and $1.6 billion during Q3, a number of big-ticket deals took place during the quarter. That trend continued through the first quarter of 2020, indicating that the venture investing momentum continued at a strong pace during the first few months of 2020. (However, the VC market could be sensitive to the slide in the stock markets that began with rising fears of how the Coronavirus might damage economic growth.)

Identity and authentication the biggest investment area

Although VCs pumped money into a range of information security areas – from bug bounty platforms to diagnostics to automated software testing – the single biggest category of investment were companies focused on authentication and identity management. Nearly $900 million of the $6.6 billion in information security venture capital flowed to start-ups that in whole or substantial part are working on improved identity and authentication technologies. The table below details these investments.

Metacurity

This should come as no surprise that tackling authentication and identity management is a robust area of investment given how quickly enterprises are shifting to cloud-based data centers and away from local data centers. According to Gartner, by 2025, 80% of enterprises will shut down their traditional data centers, while 10% already have today.

This shift will move enterprises’ data to multi-cloud environments, allowing user access from a range of multiple locations and different types of devices. As that shift occurs, powerful authentication and access technologies will have to come into play to ensure security.

The next largest category for venture investments during 2019 was the broad-based one of training, which generated $418 million in venture capital money, largely driven by the hefty $300 million snagged by KnowBe4 for its security awareness training and simulated phishing platform.

Not far behind training as an investment category was the nearly $412 million generated by internet-of-things (IoT) security companies. SentinelOne dominated the investments in this category with a Series D round that netted the company $120 million for its endpoint security technologies.

(For the complete ranking of investments according to 42 different types of information security categories, please check out the ranking of these categories by dollar amounts.)