As you well know by now, the cloud is about shifting information technology labor to more strategic initiatives. Or as Andy Jassy, Amazon Web Services Inc. and soon-to-be Amazon.com Inc. chief executive, posited at the first AWS re:Invent conference in 2012: It’s about removing the undifferentiated heavy lifting associated with deploying and managing IT infrastructure.

Cloud is also about changing the operating model and rapidly scaling up a business. Often overlooked with cloud, however, is the innovation piece of the puzzle. A main source of that innovation is venture-funded startup companies with brilliant technologists who have a vision to solve hard problems and enter large markets at scale.

In this Breaking Analysis, we’re pleased to welcome a special guest, Erik Suppiger, author of the Elite 80 – a report that details the hottest privately held cybersecurity and IT infrastructure companies in the world. Erik is a senior analyst at JMP Securities and will share insights from this report. We’ll also contextualize the market with data from Enterprise Technology Research in the cybersecurity and IT infrastructure segments.

What is the Elite 80?

Erik Suppiger shared with us that JMP is a middle-market investment bank, based in San Francisco. Its focus is on technology, healthcare, financial services and real estate. Suppiger’s focus is cybersecurity firms, public companies and IT infrastructure firms more broadly. Based in San Francisco, he has kept a good dialogue with private companies that compete with the public companies in his coverage area.

About seven years ago, he started the Elite 80, which is designed to highlight emerging private companies that are well-positioned to be leaders in their respective markets. The list today comprises 80 companies and is designed to keep tabs on the firms that are thriving.

Watch and listen to Erik Suppiger’s full description of the Elite 80 report and how the firms qualify.

Key takeaways from the Elite 80

The first two takeaways comment on the perspectives of the technology companies and the buyers of their products and services. First, it seems that the pandemic really got startups to sharpen their focus. We distinctly remember talking to some VCs early on in the lockdown and they were all over their portfolio companies to reset their ICP – Ideal Customer Profile – and sharpen their UVP – their Unique Value Proposition — specifically in the context of the new reality.

On the buy side, if you weren’t a digital business… you were out of business.

The Elite 80 raised more than $3 billion last year, eclipsing the previous highs of 2019. A huge portion of that capital went to only 10 of the 80 firms. And most of that went to cybersecurity plays.

Erik Suppiger shares his thoughts on these takeaways.

Where did the money go?

Erik and the JMP team segmented the $3 billion in raised capital into a number of different categories, as shown in the chart above. Most of it went into cybersecurity categories such as application security, assessment and risk, endpoint protection and identity, both of which boomed during the pandemic.

Suppiger explains how these categories were derived and what the data means. 

10 startups received most of the funding

The lion’s share of the funding went to 10 companies, as shown in the following graphic.

These 10 companies saw significant funding rounds, with OneTrust securing more than $500 million. Four others nabbed a quarter-billion dollars or more in funding.

Suppiger explains how they tracked this data and what it means.

$100M in revenue used to be a magic number for IPO

The left side of the chart above gives a sense of the size of the companies in the Elite 80. Most of the companies have broken through the $100 million revenue mark, but you can see the breakdown. And the right side of the chart shows the most active investors – those with three or more transactions. And it’s interesting to see the players there, including Citigroup Inc. and Cisco Systems Inc., along with some private-equity players.

Suppiger explains the changing $100 million dynamic.

The security market in context

The chart above is from Optiv, one of the Elite 80. We’ve shared this graphic with you before and the point is the cybersecurity market is extremely fragmented, with hundreds of companies providing a mosaic of solutions. It comprises an extremely complicated and bespoke set of tooling that buyers must digest. Combined with a lack of skilled expertise, it makes for a really dynamic market.

Erik Suppinger’s takeaway on this data is it underscores the need for best-of-breed solutions.

Spending data shows momentum is bifurcated

The chart below shares a popular view of the ETR data that provides a nice snapshot of a market. On the vertical axis is Net Score or spending velocity, and the horizontal axis shows Market Share or pervasiveness in the data. Remember that anything above 40% on the vertical axis (as shown in the dotted red line) is considered elevated and you can see there are a number of companies in cyber above that mark.

A couple of points here to add some color:

First, the market, while fragmented, is quite large at over $100 billion annually and growing in the low double-digits. There are some big pure plays such as Palo Alto Networks Inc. and Fortinet Inc., but the market also includes some large companies such as Cisco, which also has built a sizable security business. Microsoft Corp. is another example as the company participates in most markets and serves its software customers. The ETR data covers only a subset of the players in the market, but you can still see how crowded the market is today.

We’ve superimposed in red the recent valuations for some companies, and the other point we want to make is there are some big numbers on some of the pure plays. The pandemic has fueled a shift in cybersecurity strategies toward endpoint security, identity and cloud. And you see that in CrowStrike Holdings Inc.’s $50 billion-plus valuation. OktaInc. is at $34 billion, and it’s acquiring Auth0 Inc. for $6.5B. Zscaler Inc is at $28 billion. Proofpoint Inc. is going private at $12 billion.

So you can see why the VCs are pouring money into this market. There are some really attractive valuations.

Erik Suppiger comments on the disruption in the cybersecurity market.

IT infrastructure is a different story

Below is the same two-dimensional view of the ETR data and we’ve cut it by networking, servers and storage. This is a very large market – more than $200 billion — but it’s much more of an oligopoly with more concentration at the top.

You have some really big names such as Cisco and Dell Technologies Inc., which is spinning out VMware Inc. so it can unlock more value for the core Dell company. Dell’s valuation is $79 billion and that includes its 80% ownership in VMware – so you do the math as to how the Street views Dell’s value with its current ownership. Hewlett Packard Enterprise Co. is much smaller and it’s notable that its valuation is comparable to NetApp Inc.’s. NetApp is around one-fifth the revenue of HPE.

Arista Networks Inc. stands out as the lone player that is having some clear success against Cisco.

Pure Storage Inc., with a $5 billion valuation, and Nutanix Inc. at $7.4 billion were the only two infrastructure companies other than Arista to break out last decade and truly reach escape velocity.

Cohesity Inc. ($3.7 billion), Rubrik Inc. ($3.3 billion) and Veeam Software Inc. ($5 billion from the Insight acquisition) are the logical candidates for this decade to break out. SUSE Group ($7 billion) is planning an IPO.

Erik Suppiger comments on Arista, networking and the data management space. 

How CIOs should evaluate startup bets

What does it take to make the Elite 80?

According to Suppiger, a few factors can help get companies to this elite level. First is their performance. If a company is not growing, JMP will probably pull it from the list. The quality of of company management is another key consideration. JMP does take time to meet with all these management teams. If it feels like they’re putting together a leadership team that’s going to be around for a long time and they’ve got a product position, that’s an advantage. Beyond these factors, feedback from the channel and even competitors weighs in the equation.

Another key factor is the enthusiasm for the respective markets in which the companies play. If it’s a market that is going to be difficult or flat or not very interesting, then that would certainly be a factor for excluding a firm. Conversely, even if it’s small company, if it’s a sector that is going to be around for quite a while, and it’s differentiated, then that will favor the inclusion for the startups.

What are the risks and rewards of working with startups?

The other thing we discussed was the risks and rewards of working with startup companies. We’ve had chief information officers and enterprise architects tell us that when they go to a request for proposal, they’ll pull out the Gartner Magic Quadrant. They will always pick a couple in the top right just to cover their butts.

But many say, you know what– we also pick some of those in the challenger space that are really interesting to us and we run them through the paces. We manage those risks so we don’t run the company on their products, but it helps us find diamonds in the rough. Think about in the second part of last decade, if you picked a Snowflake Inc., you might’ve been able to get ahead of some of your competition in areas such as data sharing and streamlining analytics. Or maybe you found an Okta to improve identity and you were better-prepared to be a digital business.

Suppiger stated that he doesn’t think a company today can work using all legacy technologies. The greater risk is falling behind from a digital transformation perspective. As the pandemic underscored, you can’t go with just a traditional legacy architecture in a key aspect of your business. And so with startups you’ve got to take the “risk” of working with one that’s got a viable opportunity. The risk of having an IT infrastructure that’s inadequate is far greater, according to Suppiger.

How will startups penetrate the enterprise in the modern era?

Most of these startup players are either software firms or sell software-defined offerings. Software is a capital-efficient business, yet you’re seeing companies raise hundreds of millions of dollars. You see companies go to IPO that have raised more than a billion dollars, and much of that, if not most of it, goes to promotion and go-to-market efforts.

According to Suppiger, one of the really interesting things that we’ve seen in the last couple of years is a lot of changes to sales models. And if you look at the midmarket, the ability to leverage viral sales models has been wildly successful for some companies, a great strategy. One public company, Ubiquiti Inc., has built a multibillion-dollar business without a sales organization. So there are some pretty interesting directions that sales and go-to-market are going to incur over the coming years.

Will traditional enterprise sales change? Maybe not overnight, but there are many efficiencies that are going to come in sales over the coming years. And the possibility is that instead of just pouring money at promotion, maybe get more efficient with got to market and free up more money for engineering, because that really is the long-term sustainable value that these companies are going to create.

Today’s super-funded startups have taken somewhat of a brute-force approach: Raise a ton of capital and try to run the table on the competition. Although that has worked, especially as capital is plentiful, when the market turns, new models of efficiency will likely emerge that leverage the cloud, automation and more efficient ways of reaching customers.

Ways to keep in touch

Remember these episodes are all available as podcasts wherever you listen. Email david.vellante@siliconangle.com, DM @dvellante on Twitter and comment on our LinkedIn posts.

Also, check out this ETR Tutorial we created, which explains the spending methodology in more detail. Note: ETR is a separate company from Wikibon and SiliconANGLE.  If you would like to cite or republish any of the company’s data, or inquire about its services, please contact ETR at legal@etr.ai.

Here’s the full video analysis:

Image: radoma