start	end	text
0	5080	All right. This is going to be the meet the VC panel. FYI, there are two mics there. If
5080	10240	you have any questions when it's Q&A, by direction here, please go to one of the mics. Cool.
10460	11580	Give me a big hand.
16360	22160	Cool. So my name is John Herring. I work at a company called Lookout. You know, the company
22160	26220	Lookout, for those who don't know, does mobile security. We started here at DEF CON. After
26360	30400	a number of years of doing research and spending time in the community, we were able to build
30540	33760	a business and ended up raising venture capital. So I thought it might be interesting to share
33760	37880	some of our stories and spend some time getting to know some of the top venture capitalists
37880	41480	who work in the security industry as well. So maybe we can introduce ourselves, starting
41480	42180	with you, JJ.
43220	51900	Hello. My name is John Jack. I go by JJ. Clever. I was the CEO of a security company called
51900	57980	Fortify Software, which was security at the application level. We were one of the pioneers
57980	64240	in that space, at least in terms of commercializing a lot of work that had been done prior to
64240	71960	us starting the company. We grew that company fairly well, became the standard in financial
71960	78540	institutions, governments, telcos, and actually the standard in commercial software providers.
78540	86160	People like Oracle and SAP and EMC all used this product in order to root out vulnerabilities
86160	91880	in the software that they delivered to their customers. That company was acquired by Hewlett
91880	99500	Packard in 2010. Previous to that, I was CEO of a couple of other companies, one we sold
99500	109480	to VMware, one we sold to a company called Corporate Data. And now I work part time with
109760	116140	a VC firm called Andreessen Horowitz. We have a number of investments in security.
116780	122820	And I also part time do some consulting and serve as an independent director on other
122820	127060	venture‑backed companies. Thank you.
128420	137040	Hi. My name is Matt Ocko. I very unglamorously go by Matt. I'm the co‑founder and co‑managing
137040	143960	partner of a firm called Data Collective. We like doing deep, dark, difficult stuff
143960	150800	that most of our venture colleagues, ironically, except for the guys on this panel, disdain
150800	155940	or don't understand. It's where we've made most of our money. It seems to be a reasonable
155940	165860	thesis across 220 companies over nearly 25 years. We've had fewer than 20 losses and
165860	173700	we've made our entrepreneurs about $30 billion net of boom, bust, IRS, you name it.
174680	181220	I think some of the distinguishing characteristics of our firm that may be a little unusual is
181220	188060	that three out of the four partners still read and write code. Still understand chip
188060	193480	design. If you show me a 10 million gate design and you're lying to me about the clock tree,
193480	201560	I will know. And we've really enjoyed doing really fundamental stuff. We're the seed investors
201560	206220	in Zen Source. We're very early on in VeriSign. A number of our companies in the security
206220	213040	space are important parts of Google and VMware and Facebook and some other demanding customers
213040	216760	around the world. And we love this stuff. And I'm very happy to be here today.
217340	221640	Good afternoon. My name is Ping Lee. I'm a partner at Excel. I've been doing venture
221640	227740	investing for close to ten years now. Excel is an early stage venture capital firm. We've
227740	234380	backed companies from the seed stage to the growth stage, offices here in the U.S., Silicon
234380	241400	Valley, in London, China, and India. And our goal is to always find exciting entrepreneurs
241400	245160	that are trying to build category‑defining companies and have been investing in security
245160	250000	for quite some time and look out. It's just one of many companies we work with.
252740	257080	Hi, I'm Deepak Jeevan Kumar from General Catalyst Partners.
260740	266060	We are an early stage and late stage venture capital firm with $2.5 billion under management.
266060	271200	And we have backed companies across multiple industries, including cyber security. Some
271200	279000	of our investments that you know of are Kayak, Airbnb, Stripe, Snapchat, more recently. And
279000	286460	we also have not shied away from hard technology investments. So actually, Excel and us used
286460	292160	to share an investment called BBN Technologies, where the early Internet research was done.
292620	297160	And one of our companies called Reveal Imaging did like a hardware for bomb scanners, and
297160	302920	they had only one customer called the TSA. So personally, I started writing code when
302920	308300	I was about seven or eight years old. I don't remember now. And the first one was Logo.
308300	315780	I don't know if you guys ever used Logo before. And I have hacked quite a bit, and I think
315780	320720	I was lucky to be involved in two of the largest supercomputing projects. I was an architect
320720	327740	on those projects in human history. So happy to share and happy to ‑‑ I hope we can
327740	330040	convince more of you to become entrepreneurs in cyber security.
331340	335180	So it's interesting. So this is my 11th year at DEF CON, and I can tell you when I first
335180	338860	started coming, it's not something I would have expected to see venture capitalists at
338860	343720	DEF CON. And it's definitely changed a lot as time has gone on. Just the interest from
343860	348980	a mainstream capacity in cyber security in general has changed a lot as this technology
348980	353160	has touched the fabric of society and people's everyday lives. I'm curious, what are you
353160	356920	guys looking for? I'm sure a lot of people in the audience are curious, you know, as
356920	360580	they're building projects and whatnot, what is it going to take to get funded by a venture
360580	364160	capitalist? What are the types of things you look for when you're looking for a security
364160	367400	investment, looking for people at a conference like this?
370630	380590	Okay. We're still going in reverse order. Because it says number four here. So I would
380590	385090	not ‑‑ I won't address the technical side of it, because my background, I think
385090	389950	you can tell from the introduction, I'm not a super ‑‑ I'm not a hacker, despite
389950	397950	the shirt that I proudly wear. I can tell you that I would say two things in terms of
397950	403870	what do we look for in a security investment. I mean, the first is obviously we look for
403870	410350	something that has a wide applicability so that the market opportunity is big. And if
410350	415430	you take ‑‑ if you think about how you can leverage a large market opportunity, one
415430	422750	of the key things is are you leveraging something beyond just a security solution? So a lot
422750	427730	of security solutions are, frankly, point solutions to address a tough problem in security.
427730	432750	And you can make some nice companies out of that. But if you're also leveraging another
432750	438970	major trend, so, for example, enterprises moving to the cloud and cloud‑based applications.
438970	443930	So one of the investments we made at Andreessen Horowitz in which I'm on the board is called
443930	449170	Cypher Cloud. And what Cypher Cloud does is essentially allow people who use Salesforce
449710	456630	and Office 365 and Gmail and Box and other cloud‑based applications, it allows them
456630	462250	to secure the data that's in the cloud such that if a government organization cites the
462250	467890	Patriot Act and says to Salesforce, give us all the data for XYZ company, the data is
467890	472410	encrypted. It won't be meaningful. So it's therefore protected. And when you're in a
472410	477390	heavy regulated industry, that's something you need to address. So there's a company
477390	485290	that not only has solved a security issue, but is also leveraging a broader trend in
485290	491130	technology, which is people moving workloads from on‑premise into the cloud in one form
491130	496710	or another. So that's an example of looking at an opportunity that might be bigger than
496710	505970	just a purpose‑built specific solution to a security problem.
506330	514290	And the other thing I would say is that we look for really smart entrepreneurs that are
514290	522650	super motivated, that really have a lot of drive, a lot of ambition and really want to
522650	529270	be successful. And so when you put those two together, you have kind of a winning formula.
530990	539470	So I think John makes an excellent point. Big markets are important. But in a number of
539470	543350	the investments that we've done, some of which actually ended up being co‑investments
543350	552030	with Ping's team at XL or John's team at Andreessen, as they went through the end of
552030	560910	their seed stage or into later stages, are distinguished by not addressing a big market today.
561210	570150	So, you know, half the Fortune 500 runs ‑‑ or more than half. 90% of the Fortune 500, 95%
570150	578010	runs these Potemkin Village antivirus systems. That's a big market. You can say, hey, 10 bucks
578010	584970	on every aging desktop PC for the U.S. and other G7 countries is a big market. We have
584970	590870	no interest in that. We're interested in the stuff that's going to cause a CIO or a CSO
590870	599070	to ‑‑ in a late stage adopter company, three years from now, to panic and say, I
599070	607050	must have this at all costs. Because one of the dark but unspoken truisms in venture
607050	614050	capital is anything worth doing actually takes a long time. And all of these sort of
614050	621010	huge fantasy outcomes that are celebrated as overnight successes or inevitable successes
621010	631400	like a Google, actually took seven or eight years of really hard work. Things like
631400	637380	CIRA, congratulations to Andreessen for having the foresight to invest in that, are kind
637380	642460	of random events. So when you're building a product, if it's doing something meaningful, by the time
642460	647720	you've got it polished and by the time somebody is going to pay you actually gives a crap, it's
647720	653240	been a couple years. Maybe more. So if you're looking at stuff that will motivate a customer
653240	660300	today, you've already put yourself out of the running. So to do that, to John's point, takes
660300	666240	incredible intestinal fortitude. It takes people who can solve difficult multidimensional
666240	672440	problems about how to run their company and keep their team happy and keep their customers
672440	677740	happy all at the same time on limited amounts of money. And because you're going for the gusto
677740	685460	for something in the future, it takes incredible tech jobs. So, I mean, everybody on this panel
685460	690640	is motivated not to invest in me too tech, even if it's looking three years out or something
691260	697660	undifferentiated. We want to see stuff that has sustainable competitive advantage. And so two
697660	709420	interesting examples. We're in a company called Sentinel that we did with Ping's crew at
709420	719020	Excel. Those guys are standing a lot of existing security assumptions on his head. They're doing
719020	723520	something very, very interesting that actually produces deterministic results for important
723520	728740	stuff and runs only in user space. They don't hook the kernel at all. I was astonished. I
728740	734700	didn't believe it. It took me a long time to understand it. But it's light years ahead of
734700	739680	anything else out there. That was worth doing. We're in a company with John and his team at
739680	747900	A16Z called Illumio that's doing things that people said was impossible to enforce security
747900	754520	for fungible workloads in the cloud. And by the way, John, I think it's fair to say that when
754520	759120	those guys started doing that, most people were disdainful that real corporate compute
759120	763860	workloads would move to the cloud. So anyway, I hope that's useful.
764940	770800	The one point I would echo that Matt just said is some of these security markets have become
770800	776420	really large are not obvious at first. And China, the great entrepreneurs are the ones I kind of
776420	781700	see around the corner. I remember when we first invested in John's company, John Herring's
781700	787680	company years ago around mobile security, the Android phone didn't exist. The iPhone was
787680	792060	just shipping. It wasn't obvious there was going to be any security problems on the mobile
792060	796700	phone at the time. And having that foresight to be that far ahead of the market and
796700	802400	understanding where the hackers are going to be I think is a real set of instincts that we
802400	807640	look for. Security is particularly hard to invest in because it's an arms race. Every time
807640	811800	someone comes to our office with a great idea, there's ten hackers out there with a better
811800	816640	idea that's going to get around his great idea. So you really have to find entrepreneurs
816640	821680	that we found that really have been coming to DEVCON for the last X number of years. They have
821680	826180	to be in the cutting edge of whatever the hacker community is thinking about and pushing the
826180	832000	envelope on. And that's really hard to find. Folks that actually understand the problem but
832000	836580	also understand the opportunity to build a company around, that intersection is really
836580	846180	rare. That's what we look for in security. I totally agree with most of those points. One
846180	852100	thing I would like to add is that we are at the intersection of three major trends at the
852100	856740	same time in the history of computer science and technology. Mobile, cloud computing and big
856740	861800	data. A lot of people have written about this. But what that means is that we are going to
861800	867740	see multidimensional security problems that we have never seen before. So it is an
867740	873020	amazingly good time to be thinking about innovations in cyber security. I actually wrote
873020	878940	an article yesterday on the Forbes on cyber security for the app economy. But the point I
878940	884760	make is that we have to make tools that are faster and more better than things that we have
884760	890140	seen before because of this multidimensional problem that exists today. And in terms of the
890140	897120	entrepreneurs that we look for specifically, number one, you need to be great evangelists
897120	904060	of your product without overselling it. Then number two is you should have the ability to
904060	909360	look around market changes because markets do change. Human behavior changes very rapidly
909360	914880	than what we think it does. And to Ping's point, you need to be best of breed in what you
914880	921100	do and you need to stand the test of your peer groups who are almost as good as you or even
921100	931260	better than you. I guess broadly speaking, everybody in this audience is kind of in the cat
931260	940660	bird seat for building a company. Because as much as fluffy consumer companies get love and
940660	948060	attention and big valuations, that's actually not where the real money is. And everybody in
948060	954260	this room is probably aware of somewhere between a mini to a full-scale security
954260	962620	holocaust that's in process. I mean, I'm pretty convinced that RSA up to 512 bits is
962620	968520	irretrievably broken, which means every bank and web server and DNS cert out there is
968520	973420	effectively vulnerable right now. I'd say that's a pretty large problem. And the only
973420	979700	alternative, I mean, there are alternatives. The only practical one is stuck rotting away
979700	986000	inside of RIM. So there's a giant $10 billion company right there that I don't see anybody
986000	993120	doing right now. People are fantasizing about the so‑called Internet of Things. I can't
993120	998560	even leave my Bluetooth on here because I'd really prefer not to pay for your guy's next
998560	1009460	vacation. And so everything from my future pacemaker to the electric meter on my house to the
1009460	1015740	thing that orders food for my kids in my refrigerator circa 2020 is going to be produced by
1015740	1027350	the same ass clowns that can't even have effective security on my phone. So, I mean, John
1027350	1031130	asked a really good question. What are we looking for? Well, the answer is we're looking for
1031130	1037370	you guys to step up much as John did when everybody was pretty smug about the state of mobile
1037370	1042950	security, shock the hell out of us and produce a giant solution to a giant problem that nobody
1042950	1049670	was thinking about. And also I'd really like to not pay for your next vacation in the process.
1049670	1055970	I turned off my Bluetooth. Yeah, well, I remembered to turn off mine about an hour ago.
1055970	1060330	So let me ask the opposite question. So, you know, you meet lots of people working on super
1060330	1064770	interesting projects, many of which, you know, can be intellectually interesting but many
1064770	1069450	times won't end up being a business of the scale that we've talked about, billions of dollars.
1069450	1073090	That doesn't mean it's not interesting. When does it make sense not to raise venture capital
1073090	1078790	from someone like yourselves? How do you think about the difference between the types of
1078790	1081890	things you would want to actually fund and the types of things that someone might want to go
1081890	1085570	turn into a business? But it doesn't make sense to talk to people like you guys.
1085950	1088090	Are we pushing or popping the stack, John?
1088090	1090010	We're pushing the stack, it's you.
1091770	1098850	I'll try to be as brief as I can. There's a concept in finance called net present value.
1099010	1105590	How many of you guys are familiar with that? Awesome. That's a disturbingly well educated
1105590	1116250	hacker crowd. So the dirty secret or the other dirty secret of venture capital is that your
1117090	1125350	NPV utility curve and the VC's NPV utility curve can diverge pretty rapidly. So thanks to a
1125350	1132610	feature of preferred stock investment, most VCs get the right to keep investing in your
1132610	1137730	company every time you take money. Which means as long as we have deep enough pockets, our
1137730	1144850	stake doesn't go down and it may in fact go up a little bit. Your slice of the pie as more new
1144850	1151710	dollars pour in is in effect reduced over time as you continue to build a company. So if you
1151710	1157330	build a really giant company and you and your founding team own 10% and you sell it for a
1157330	1161770	billion dollars after 10 years, that's 100 million bucks. That seems like a pretty good
1161770	1170150	outcome. But if you own 80% of your company and you sell it for $100 million two years into it,
1170150	1179530	that's $80 million. So you would have had a better NPV selling earlier than later for a
1179530	1184510	supposedly more impressive number. And when you factor in risk, building billion dollar
1184510	1192550	outcomes is really freaking hard. You're definitely better off selling for 80 million bucks in
1192550	1197570	two years. Now, that's also, that magic outcome is hard to do. And I'm picking deliberately
1197570	1205370	simplistic examples. But when you are pretty sure that you have a point solution, I think as
1205370	1211150	John referred to, that solves a really difficult problem that's a quote unquote awesome family
1211150	1219350	business. Makes $10 or $15 million a year with great cash flow for you and your friends.
1219810	1225390	That's probably not a business that you want to take venture capital for. There's no reason for
1225390	1231370	you guys to dilute yourselves. If you need money, take angel money. Keep 80% of your equity.
1231690	1238130	And, you know, when one of the big bruisers panics and realizes they need this point solution
1238130	1242310	and pays you a hundred million bucks, laugh all the way to the bank. If you are doing one of
1242310	1249810	these global platforms that John and Ping alluded to, the kind of thing I alluded to, like
1249810	1255810	replacing all of RSA, then you probably need venture capital. You probably need people who have
1255810	1260930	been through it before, whether they're CEOs like John or other former operating guys like Ping
1260930	1267170	to help you build that gigantic business. So that's kind of how I see the world.
1267170	1274230	I'll give two examples to kind of put a finer point to what Matt's saying. The answer isn't always
1274230	1280250	venture capital. We are currently investors in a company called Tenable, which is the guys
1280250	1286370	that created Nessus. And that company was bootstrapped by the founders for I think five, six
1286370	1291090	years before we even put any money into the company. And it was profitable, growing very
1291090	1296230	rapidly. Nessus is a very popular vulnerability scanning tool. And they didn't need the money
1296230	1301790	because the business could fund itself. And they didn't need someone like myself because they
1301790	1305490	knew they didn't need those resources in the network to grow their business. It was growing very
1305490	1311550	fine. And in the last year or so, they decided they saw a larger opportunity around going global,
1311550	1315130	about attacking, extending the product line where they needed additional capital. More
1315130	1319990	importantly, they needed a partner that knew and had experience in expanding the business in
1319990	1324530	ways they haven't expanded before. So the decision to make and take venture capital was less
1324530	1328910	about the money, since the business is profitable, but more about the expertise and value add
1329550	1334950	a partner can bring. In the case of John Herring Lookout, it was very different, right? Obviously
1334950	1339730	from the very beginning, they were going after an exploding market in the mobile security
1339730	1344890	space where speed to market, time to market and getting out ahead of the mobile platform,
1344890	1349950	which is getting innovated by Google and Apple, was a precondition they just had to deal
1349950	1355210	with from day one. Venture capital was needed to accelerate the business and also helping
1355210	1359750	scale a team and do a lot of other things around company building was needed day one.
1359750	1364550	So I think it all really depends. And I don't believe for the majority of the businesses
1364550	1369250	out there that you require venture capital. I think it's something that you should look
1369250	1374350	at deeply before you take money. Because as Matt says, once you take money from another
1374350	1379210	partner, it's a partnership. And it's not a sole proprietorship anymore. That's a very
1379210	1384150	big transition. So I think it really depends on the opportunity and what you want to do.
1384570	1390730	If I could jump in, I think Ping makes a great point that sometimes there's a perception
1390730	1396610	that what venture capital is, is you get money and then the VC comes to your board meeting
1397230	1402010	hoping you're doing well. And that's... We do that though.
1404950	1414170	You really do, in the early stages, if you do decide to accept venture funding, you really
1414170	1419630	do need to look for a partner. You really do need to look for a firm that has people
1419630	1424530	and services that will add value to what you're trying to do. I mean, these firms you see
1424530	1429810	up here are all firms that have done a lot in security. So obviously we all have resources
1430630	1435250	that help you be successful. At Andreessen Horowitz we have a thing called the Executive
1435250	1442090	Briefing Center that John knows about that we bring in chief security officers and government
1442090	1449190	officials and all sorts of people on a weekly basis and bring in our portfolio companies
1449750	1455550	and they get to present to people even before they've released the product to test the market
1455550	1464010	for their idea. And as they mature, like John's company has, they get to talk to real buyers
1464010	1470910	of the solution. And that's a real big service that, for example, Andreessen Horowitz we
1470910	1478210	bring for our entrepreneurs. So to Ping's point, you really do want to pick a partner that's
1478210	1485530	often both the firm and the individual partner at the firm that's going to be your chief
1485530	1492210	liaison and help you grow the company. And actually I want to chime in and amplify John's
1492210	1500150	point. It's not just the firm. It's not brand. There's a company that John and I actually
1500150	1506830	have in common that's desired right now by a lot of people in the venture capital community.
1506970	1515470	And they met with one of the very senior guys at one of the top ten firms in the world.
1515530	1522830	Every Fortune, Forbes article, you know, New York Times, Wall Street Journal, TechCrunch,
1522830	1529850	I mean, however you want to view kind of external validation, this firm had it. And to some
1529850	1538410	extent this guy had it as well. And he was such an arrogant dickhead in the meeting that
1538410	1543590	the entrepreneur said, not only will this guy not be helpful, right, I mean, however
1543590	1551310	giant a check he wants to write, but he'll be actively harmful. And by contrast, and in
1551310	1559010	credit to JJ, the entrepreneur said, look, what I want is somebody like JJ, who's an
1559010	1563310	operating guy, who's done real stuff, who's been through good times and bad times, it can
1563310	1567350	help me move a little further down the road. He basically said, I want another partner
1567350	1574610	because I'm stuck in the boat with this person for ten years. And, you know, Ping and his
1574610	1581310	team are successful in this because they act like partners. And the entrepreneurs that we
1581310	1587070	fund early on like both of these firms because they're happy with them. We're still waiting
1587070	1592930	for Deepak to start writing checks, so it's a gentle nudge. We've got a few for you, buddy.
1594270	1600870	So let me frame this problem, right. The problem is this. As an entrepreneur, the odds of
1600870	1604750	failure are far higher than the odds of success. That's history, that's data, you can read
1604750	1611910	anywhere. So every step you take, every meeting you go to, everyone you talk to should be
1611910	1617610	able to increase the odds of success. That's a fundamental underpinning here. So all the top
1617610	1622430	venture firms I can say, largely speaking, are there to help you to increase the odds of
1622430	1631270	success. Helping to find the right mentors for you. Finding a mentor is really, really
1631270	1635710	important. I never underrate that. So I think most of the top VC firms can help you do
1635710	1643650	that. The other thing is, you know, when do you not take venture capital money to your
1643650	1649630	question? If the business is low risk, for example, one small check that we do is, okay,
1649630	1656690	can a bank lend to this company for expanding their business? Definitely not. And it's
1656690	1660850	not a VC investment. We look for really high risk investments that need to grow really
1660850	1666370	fast. Banks look for low risk investments that don't grow that fast. So typically,
1666370	1670630	venture capital money is going to help you go from zero to 10 million to 100 million in
1670630	1675630	like three to four years. In that situation, venture capital money is a good fit.
1677510	1682450	So maybe I can share a quick story for those who might be interested and are thinking about
1682450	1687650	starting companies. On the flip side of all of this, too, is you can hear an infinite
1687650	1691650	amount of no's, but you only need to hear yes once. And it's really important to keep
1691650	1696510	that in mind. I remember vividly when we were first getting off the ground, we were doing
1696890	1701550	obscure wireless research and a lot of mobile stuff, and there was not a lot of interest
1701550	1706310	in what we were doing at first. Ping wrote us a check and a few of our early angels did.
1706310	1711030	But most of our investors that we pitched did not understand what we were doing at all.
1711330	1716710	And it's really easy to get depressed when you're running around trying to raise money
1716710	1722310	and everyone is telling you you're basically an idiot. But having the fortitude to continue
1722310	1726310	on I think is one of the greatest lessons I've ever learned in raising venture capital.
1726310	1731810	And it never gets easier. You just get better. And hopefully the market is on your side.
1732050	1735110	But I vividly remember, I don't know if you ‑‑ sometimes it takes, you know, the irrational
1735110	1739810	‑‑ reasonable people will work on reasonable problems, but consensus, accurate predictions
1739810	1744390	never yield outsized results. Really important thing to understand. The outliers come from
1744390	1749370	things that are not obvious. And unreasonable people will work on unreasonable problems,
1749370	1754190	thus you probably need to be pretty unreasonable to do something amazing. And this guy, Vinod
1754190	1758550	Khosla, for those who don't know who he is, can be an unreasonable dude and he's very,
1758550	1763110	very brilliant. Found us in microsystems and I'll never forget we were pitching him and
1763110	1766270	everyone had been telling us no. And halfway through the meeting he's like, all right,
1766270	1770450	I've heard enough. I'm like, shit, he's going to throw us out. This is horrible. And he's
1770450	1774050	like, I'm in. What's the valuation? And he literally wrote us a $5 million check that
1774050	1777950	afternoon and I've never experienced anything like that after hearing no's for just like
1777950	1782690	50 no's and then something like that happens. And then not long after that, Excel got involved
1782690	1786650	and the company really started to take off and there's definitely a world where this
1786650	1790450	company never would have even existed if we wouldn't have kept going, not because we were
1790450	1793610	there to make money and not because we were there to build a business, because we love
1793610	1799170	what we do. I mean, there's 140 people at DEF CON from Lookout. We're a much bigger
1799170	1803730	company now and it's who we are. Nothing's changed, even when we're a lot bigger. That's
1803730	1807370	really exciting to me. So I think it's something really important to think about as everyone
1807370	1811190	here starts businesses is the foundations of passion and it's a lot about having the
1811190	1818170	fortitude to keep going. So my question for this group is how do you think about spotting
1818170	1822990	the nonobvious investments? Like when you see deals that you're willing to make a nonobvious
1822990	1827090	investment in, I'm curious, Ping, I know you've done a bunch of these, what are the things
1827090	1830870	that you look for in an entrepreneur when you're willing to make a bet that seems really
1830870	1831870	out there?
1831870	1838770	Yeah, I think the ‑‑ at least the way we think about it, the venture guys don't
1838770	1845650	come up with the ideas. We never confuse ourselves with the entrepreneurs. So what we look for
1845650	1851090	is for the entrepreneurs to provide that inspiration. And it really is from going out and talking
1851090	1855330	to as many entrepreneurs as you can. The reason I'm at DEF CON isn't because I'm going to
1855330	1860330	win, you know, any hack competition or anything like that. It's because I can spend time with
1860730	1865570	what I think are really smart people that are thinking about things 10, 15 steps ahead
1865570	1870930	of what I'm thinking about. And our job as venture guys is just to identify those people
1870930	1876810	that have those insights. So it's really in some ways I always say, like, the best entrepreneurs
1876810	1882390	are the ones that convince me that doing the impossible is actually possible. Because we
1882390	1886230	sit there every day and we see hundreds of ideas. And there's thousands of things wrong
1886230	1889470	with every idea. But there's always that one entrepreneur that comes through the door and
1889470	1894190	for some reason every question you ask of him or her, the answer comes back in such
1894270	1898710	a way that you're like, wow, this guy may actually pull this off. And I'm like, that
1898710	1903310	is really actually possible what he just said. And no matter how you poke and prod at them,
1903310	1909210	they've thought through every single angle of the problem. I can't tell you how thoughtful
1909210	1913390	the entrepreneur are that we back in whatever space they're in. It could be big data, cloud,
1913390	1917270	security, mobile. They've literally thought through every single possible permutation
1917670	1923130	of the problem. From the customer's angle, from the business model, to every single angle.
1923130	1927250	And it's really that that kind of gives us conviction. Not to say they have all the answers,
1927250	1930550	but they've thought through all the problems in the questions. So that's kind of how we
1930550	1934710	end up finding ourselves backing entrepreneurs, oftentimes in spaces that we did not have
1934710	1938550	any idea or know anything about before we worked with that entrepreneur.
1939290	1949390	I would actually echo that. I joked earlier in the kids' presentation where we're trying to drive
1949390	1954450	our investment limit down to 9-year-olds. We're working hard on this.
1954510	1955710	There's no law against that.
1955710	1961170	Yeah, there isn't. It's not child labor as long as the LLC is in the dad or mom's name.
1966770	1975890	So kidding aside, what I said there is I want entrepreneurs who will make me feel like a moron.
1975990	1985830	And my wife would say that's actually not very hard. But what I would say is, to Ping's point,
1985830	1992210	you can be in a meeting with an entrepreneur, and I've watched this process both at Excel and
1992210	1998470	Andreessen Horowitz and in my own career and deals we have in common. You think you're being
1998470	2007590	very clever. The entrepreneur, I'll pick a fairly abstruse example, the entrepreneur is doing
2007590	2012330	something that for some reason involves zero knowledge proofs. Maybe it's a hobby of yours.
2012330	2018550	You read a couple of the Scientific American articles about it or IEEE spectrum or ACM
2018550	2025130	proceedings, thingamajiggy, and you think you've actually caught this person out. And they're
2025130	2033170	nine steps ahead of you. And by the way, everything else that you ask, you have the sense as the
2033170	2040890	big baller VC that you're a child that this person is patiently explaining how the world really
2040890	2048990	works. And that's when, as empirical as we try to make VC, that's when you get the gut feeling,
2048990	2055870	especially if the person is passionate and engaged and driven about what they're doing, that
2055870	2062090	this is a human being that you can back. That they have this combination of, as Ping said, all
2062090	2070330	the answers, but the fire in the belly to go through with it. And, you know, John, you come
2070330	2076850	across as a fairly quiet guy, but clearly you had the fire in the belly as well as all the
2076850	2086010	answers when Vinod stopped you halfway through. One more thing is, we're wrong all the
2086010	2094290	freaking time. So to John's earlier point, or his earlier story, you can't look at a VC saying
2094290	2105950	no as a valid condemnation of your dream or objective or goals. You have to look at it as a
2106210	2113430	fallible human being or group of human beings with incomplete data making the best literal guess
2113430	2118730	that they can. And by the way, no's are good. I mean, one of the things that we brought
2118730	2123790	ourselves on is, no matter how crazy the idea, we will write a couple of paragraphs that
2123790	2129570	explain in detail our decision making for the no. We never send an email saying, yeah, it's
2129570	2135090	just not a fit. All right. Check you later. We say, hey, look, you know, you had this product
2135090	2140790	flaw and we talked to the four customers you asked us to and they were lukewarm and, you know,
2140790	2145710	you have 17 competitors and you only listed four. The market may be more crowded than you
2145710	2154110	think. And a lot of the time we get a thank you instead of an FU even when we say no because
2154110	2162650	it's actually useful for the entrepreneur. I've always wanted to do that. I do a lot of panels.
2162650	2167770	First time I could say fuck. I just wanted to get that out.
2171970	2179910	I guess being luckier because I've had entrepreneurs on occasion invent entirely new mathematical
2179910	2188330	symbologies to tell me how bad they wanted me to fuck myself. But John's absolutely right.
2188330	2194370	You can take a no as definitive. And I think when you do get a no, the one piece of feedback that I
2194370	2202170	have for everybody in this room is demand the reasoning behind it and use it to go strengthen
2202750	2208590	your pitch. And go see Vinod. Apparently he writes $5 million checks in less than 30 minutes.
2208590	2212810	So I think we've got about ten minutes left. I want to make sure we have time for Q&A. So
2212810	2217110	there's two microphones right there for those who want to ask questions. We'll start over
2217110	2223170	there. Let's talk about the logistical process of how you get started. You've talked about it
2223170	2229110	from a hypothetical. At what point are people interacting with you? Is it when they have a
2229110	2233070	full‑fledged product like a prototype? Obviously it's going to be different from hardware
2233070	2236970	software. Hardware is going to have a lot more capital expenditure to begin with. Let's talk
2236970	2240310	about some of the logistics of how they would interact with you to contact you guys.
2240930	2248000	Well, the ‑‑ so from my personal experience, not as a VC, but as someone who started a company,
2250410	2255110	I don't ‑‑ I don't think you ‑‑ I don't think you need to wait at all. I think you can
2255110	2264650	start building relationships with VCs by, you know, you get introduced or you introduce yourself and
2264650	2269970	you simply say I have a concept I'd like to talk to you about. Most VCs to ‑‑ I think
2269970	2275670	Ping said it earlier, want to talk to as many entrepreneurs as possible. And you can come in
2275670	2280430	and say I'm not ready to raise money yet, but I just want to test the waters with you with this
2280430	2287890	kind of concept. And good VCs will not only, you know, test the waters with you, but they'll give
2287890	2293110	you advice about, you know, you're thinking about this right, but have you thought about what your
2293110	2300370	cofounders would look like or, you know, one thing that I tend to tell a lot of people is you can't
2300370	2306070	just invent a product without thinking about how you're going to get that product into customer's
2306070	2312590	hands early on. Like you don't want to build this huge monolithic thing, I'll give you an example,
2312590	2318770	that requires an appliance and an agent on every end point. You know, it's just not going to get
2318770	2325210	sold. It may solve a problem, but it's no one buys technology now that requires something
2325210	2331310	implemented on every end point. So, yeah, you don't need to wait. You can start the process
2331310	2338170	right away and don't be afraid that, oh, shit, I didn't have a great... this is the place you can
2338170	2345390	swear, right? I didn't have a great meeting, so now I screwed my relationship with that particular VC.
2345390	2349830	If you did, then that VC is not the right VC anyway.
2350070	2351270	On the left.
2353430	2358350	Hello? Okay. So here it is. Talk about the impossibility. So I'm from New Jersey. You've
2358350	2362590	ever heard the expression waste management? Guys from New Jersey and New York, what business are
2362590	2368190	you in? Waste management? So I'm in the business of eliminating and killing and crushing foreign
2368190	2373910	adversaries for child pornography. Now, that's an impossible attempt to go against foreign
2373910	2379830	adversaries, organized crime figures, people who actually don't want to actually step up to the
2379830	2385290	plate. So I'm in the waste removal business. Something that nobody can say no to. Because
2385290	2390070	if you say no, you're saying no to helping kids. I challenge the panel right here, right now.
2390250	2394770	I got the technology. I got streaming data. I got security. I got everything you can possibly
2394770	2399990	imagine to get these people off the streets. Russians are making $8 billion a year just in
2399990	2404730	child pornography alone. And they're selling it through cyber security and other areas under the
2404730	2410390	radar. So what do you guys think about addressing an issue that actually collectively helps save
2410390	2416810	the youth of the nation that people say it's impossible to do? Who says it's impossible?
2417110	2421330	Everybody says it's impossible to address because nobody wants to address the issue because of the
2421330	2425210	ugliness of the intellectual property and the issue that goes along with it. Nobody wants to
2425210	2432150	stare at 80 million kids being raped. In video alone, nobody wants to go through the process,
2432150	2435750	filter it, decipher it and put it in the right position and remove it and try to figure out how
2435750	2440150	to get it out of the hands of people who then would actually not want to have it or have it
2440150	2448970	creep up on social media. So two comments. One, it is sunnier in California. I think we got a
2448970	2454950	better attitude about the impossible than maybe in Secaucus. So come visit. The second thing
2455590	2462090	I can't speak to my fellow panelists. I know some of them had tight schedules. But I will come find
2462090	2465950	you and I will listen for ten minutes to your impossible idea and I will give you the best
2465950	2474090	advice that I can. Any other opinion on the panel? I'll be outside right afterwards. Is it just you
2474090	2478490	or nobody else has any comments? I have no idea what my colleagues can do. But I will step up.
2478490	2486590	Great. Over here on the right. Yes. Hello. I'm an internet veteran from decades back.
2486590	2492150	And my question is, when are ideas too big for you guys to be interested in? I heard earlier
2492150	2496970	on you talked about Cypher Cloud, something like that. Well, I come from maybe a slightly
2496970	2502150	different alternate universe from this crowd, from the standards field and there's this,
2502150	2506990	gone through this multiple times in the past, but currently there's something called DNSSEC,
2506990	2510290	could be a platform for a whole bunch of security, solving a lot of problems,
2510290	2515270	maybe eating some security vendors' lunch as well. And I've heard when I'm looking for interest
2515270	2522850	from investors, not to make money myself, but to make this stuff happen, I get, well, you know,
2522850	2529910	Rick, that's a big play. That's too big. That's too rich. And so you were talking about looking
2529910	2534210	for the, I understand maybe it's one out of ten, then you're doing really good if you're successful.
2534210	2539190	So I understand risk is not something you're afraid of, but I'd like to get maybe one sentence,
2539190	2545670	short little response about when is something not appealing at all to you guys? That's just
2545670	2552770	too big. Thanks. Well, I couldn't hear everything, but just your question about when is something
2552770	2559390	too big, there really isn't anything too big. And when you're in the venture capital business,
2559390	2563150	we're about finding big opportunities. I think the thing that I would think about
2563710	2568870	with your particular opportunity is to actually break the problem down into smaller pieces.
2568870	2574490	Don't try to solve the end state right from the beginning. I think a lot of entrepreneurs
2574490	2581870	see the end state, but the market or the industry may not be as far along as where you want it to
2581870	2587850	be. So one of the failure modes we've seen in a lot of companies is being too early to a market
2588490	2593650	and just making sure that you line yourselves up with market realities. It will play out over
2593650	2598030	time. Sometimes things take longer or they take a path that's slightly different. So the end state
2598030	2602830	is usually bigger than what anyone imagines, but how you get there sometimes is very different.
2602830	2610810	I think a lot of people try to do the big thing first. So be patient, I guess. Great, thanks.
2610810	2617470	Okay. So I'm one of these people that has an idea. I'm not ready to come to venture
2617470	2623170	capital yet. And because what I'm working on is two-factor authentication, behavior and bio
2623170	2629790	in one fell swoop, I'm going to need to put an end point on every ‑‑ an appliance on every
2629790	2635450	end point. Unfortunately that's just the nature of the beast. How do I ‑‑ it requires software
2635450	2639850	and hardware. The hardware has been invented but not in the right size. And the software,
2639850	2645350	somebody could program it, that's not me. How do I get it to a point where I can bring it to
2645350	2650470	somebody to get some money so I can hire someone to build the hardware the size I need it and do
2650470	2654430	the programming? Because I don't have the money. How do I get it to a point where I can get some
2654430	2661570	help? You can come today and then we can talk about it. And I'm sure the ‑‑ to an earlier
2661570	2667010	point here, it's okay to go to VCs before you are ready, before the product is in the market,
2667010	2672330	so we can give you advice on what we have seen on how to bring this product to market.
2672370	2676230	I'm assuming I need to have you sign an NDA? VCs don't do that.
2676230	2680990	Yeah, we normally do not sign NDAs. Maybe I can chime in here.
2680990	2685350	Okay. A couple things. One,
2685350	2693910	the only purpose of an NDA that you can argue for is actually in the first to file patent regime
2694650	2701570	which would be to protect you from future claims by somebody that you'd exposed your
2701570	2706310	information in public and therefore you couldn't patent it. As it turns out, if you're talking to
2706310	2712250	somebody about financing your company, there's an exemption in the law for that that applies
2712250	2718490	internationally. So you're not jeopardizing your patents by talking to a VC under first to file.
2718490	2724810	And VCs can't sign NDAs because all it takes is a small handful of surly people
2724810	2732450	filing nuisance lawsuits and not our money but our time is then so consumed in that kind of
2733130	2738050	litigious regime that VCs would just stop investing in promising young companies.
2738050	2747350	So literally to protect, to achieve herd immunity, not signing NDAs is a form of vaccination.
2747350	2752650	As far as what you want to do, even if it's not the right thing for a VC, there's Kickstarter
2752650	2757810	and a whole bunch of other crowdfunding stuff. There is Angel List. We know the guy as well
2757810	2764410	there. We're actually investors in that platform. That's an awesome way of getting like‑minded
2764410	2769930	people to back you. And you know what? I don't know exactly what you're doing, but if you showed
2769930	2777270	up and said, you know, hey, I've got something that plugs into a USB port or works over low
2777270	2784130	power Bluetooth, next generation laptops, and I can provide bulletproof, authenticatable security
2784130	2791890	locked to an individual human being, you know, maybe that's my sign‑in for, you know, my true
2791890	2797330	crypt. I can unlock true crypt with your gizmo. You're right with me. Keep going.
2798250	2804750	There's half a million dollars of human beings interested in that on Angel List or Kickstarter
2804750	2808270	without a huge amount of effort. So I say go for it.
2808710	2811070	Matt's going to write you a $5 million check.
2812710	2817230	You need another 30 minutes before I raise you the $5 million. I'll make the time.
2817810	2821150	Unfortunately we're out of time, but I know the panelists will probably be up here after
2821150	2824630	for questions. So anyone who does have questions, just come on up and grab the panelists after.
2824630	2826290	Let's thank everybody. Appreciate it.