At a Glance
Gili Raanan is the founder of cybersecurity VC Cyberstarts, whose fund has achieved remarkable returns by focusing on "resilient" founders and the "Sunrise" methodology. He believes cybersecurity is in a "perfect storm," where global conflicts and AI advances have made threats unprecedented. Gili Raanan's core judgment is that AI will redefine, not improve, cybersecurity; in the future, both offense and defense will use AI, and the defense methods of the past 80 years will become obsolete.
Theme Sections
I. The Cybersecurity "Perfect Storm": Dual Drivers of Global Conflict and AI
Gili Raanan believes cybersecurity is facing a "perfect storm" driven jointly by geopolitical and technological change.
- Historical Context: In 2018, cybersecurity was still seen as a "boring part" of IT. Today, global conflicts (Ukraine, Gaza, etc.) have turned "offensive cybersecurity into a lethal weapon for nations and powers, even a strategic weapon," and attack tools are continuously flowing from the state level to criminal organizations and ordinary hackers.
- Mechanism Breakdown: AI is the catalyst. The same large language models and AI agents used to predict and defend against attacks can also be used to launch attacks of "unprecedented scale and complexity." Past rule-based and behavior-based systems (e.g., fixing misconfigurations, patching software vulnerabilities) will become useless.
- Deduction and Verification: Raanan analogizes the evolution of AI's role in warfare to "from better analytics, to human augmentation (like tanks), to workflow automation, and finally to autonomous AI control." He believes AI agents can now generate and execute thousands of attack scenarios simultaneously. This is no longer science fiction but "today's reality." Defenders must use the same LLMs to predict attack vectors and give AI agents control authority to respond in time.
II. The Counterintuitive Investment Methodology: Pick People First, Then Find the Problem, Finally Build the Product
Gili Raanan shares an investment philosophy contrary to his experience at Sequoia Capital: traditional VCs ask about market, product, and technology, but early-stage founders don't have the right answers; this process is just "paying taxes."
- Founder Screening: The key is not "the smartest person" but "resilience" and "the ability to overcome adversity." He calls it "looking for imperfect" people—those who didn't start life smoothly but can overcome and succeed. For example, Fireblocks founder Michael Shaulov, who grew up as the child of an immigrant single mother, faced the bankruptcy of 6 out of 10 design partners in the first "crypto winter." It was this resilience that kept him going.
- Methodology Reversal — "Sunrise": Raanan concluded from his own experience of inventing CAPTCHA in 1997 but failing to find a business model that the process should be completely reversed.
- Step 1: Chase the Pain Point. Founders need to spend up to 6 months talking to dozens of CISOs at large organizations. The core is "chasing pain," not asking "What is your pain point?"—because the answer will change in a week. His preferred questions are: "Who is your most hated vendor?" and "What have you done about it?" The latter is key because "words are cheap; look at what the customer has done." If a customer claims a problem is painful but has taken no action, it's not a real pain point.
- Step 2: Reverse the Power Balance. Promise the customer: "The Cyberstarts team will invest $100 million (about three years of average R&D budget) to solve one of your pain points." This forces the customer to think seriously.
- Step 3: Only start writing code after confirming the pain point and validating the solution concept. This ensures that "the software they build solves a major pain point and has been validated by dozens of real customers."
- Deduction and Verification: The goal of this method is to find pain points that are "urgent" rather than "important." For startups, urgency is core because it accelerates customer engagement, learning, and revenue growth. Raanan believes that as long as the market buyers are relatively homogeneous (e.g., B2B SaaS), the model can be reused in fintech, gaming, or even medical devices.
III. The Wiz Case: From "Urgent" Pain Point and "Four-in-One" Persona to the Fastest SaaS Company Ever
Wiz is the best example of Cyberstarts' investment methodology, perfectly illustrating the combined power of an "urgent" pain point, a single persona, and a high-pricing strategy.
- Historical Context: Wiz's four co-founders previously grew a cloud security business to $1 billion in revenue at Microsoft. They initially founded Beyond Networks, used the "Sunrise" process to find that direction was "important but not urgent," then quickly pivoted to the cloud security area they knew best and renamed the company Wiz.
- Mechanism Breakdown:
- "Four-in-One" Persona: Raanan proposes a "four-persona" theory: a product faces four types of people: the person with the pain point, the person with the budget, the person with decision-making authority, and the end user of the product. If these four are the same person, that's a "super lucky case." Wiz faces exactly the CISO—he or she alone has the problem, the budget, the decision authority, and the AWS credentials to deploy the product directly.
- Verification and Decision: Wiz can ask for the customer's AWS credentials on the first call and instantly demonstrate real value customized for the organization, rather than a demo environment. This accelerates product validation.
- Pricing Strategy: Wiz abandoned the Silicon Valley-favored "product-led growth (PLG)" low-barrier strategy and went the opposite direction, targeting large enterprises for high-priced sales from day one. This led to fast revenue growth ($1 million in Q1 of the first year, $25 million in Q4), attracting top investors and talent.
- Deduction and Verification: Raanan believes "expensive products are expensive from the start," like Airbnb and Instagram. If you miss them because of price, you'll miss all good companies. He predicts Wiz will be the fastest SaaS company to reach $1 billion ARR and asserts that within 10 years, another cybersecurity company will break that record.
Mentioned Targets
| Target |
Guest Attitude |
Key Data |
| Wiz |
Bullish (as core case of methodology, narrating its success path) |
From 0 to $32 billion valuation in four years; fastest SaaS company to reach $100M, $500M, and potentially $1B ARR; first-year ARR growth from $1M to $25M. |
| Fireblocks |
Bullish (as case of "resilient" founder) |
Seed round of $3 million, valuation of $8 billion; thousands of clients, including BNY Mellon, BNP Paribas. |
| Island Security |
Bullish (as portfolio success case) |
Invented the enterprise browser category; valuation in the tens of billions. |
| Beyond Networks |
Neutral (mentioned as failure case, demonstrating the "important but not urgent" trap) |
Not provided. |
Judgments Worth Remembering
1. AI will redefine, not improve, cybersecurity. The attack and defense methods of the past 80 years will become obsolete because the speed, scale, and complexity of attacks will be unprecedented. (Gili Raanan)
2. Look for founders with "resilience," not the smartest people. The mark of success is the ability to overcome adversity, not a perfect starting point. Fireblocks' Michael Shaulov lost 6 of 10 clients during the crypto winter but persisted because of his childhood experiences. (Gili Raanan)
3. The core of the "Sunrise" methodology is "reverse operation": first find a customer pain point worth paying for, then build the solution. Inventing CAPTCHA but failing to find a business model proves that the "technology-first, market-second" path is wrong. (Gili Raanan)
4. The way to judge a pain point is to look at what the customer has done, not what they have said. If a customer claims a problem is painful but has taken no action (e.g., deploying open-source tools, contacting vendors), it is not urgent. (Gili Raanan)
5. "Important" pain points are traps; "urgent" pain points are opportunities. "Urgency" accelerates all aspects of a startup: customer engagement, learning, iteration, and revenue growth. (Gili Raanan)
6. The "Four-Persona" Theory: a product faces four types of people (pain point, budget, decision, use). If these four are the same person, it's a "super lucky case" (e.g., Wiz's CISO); if two, it's a good company; if three, it's a borderline case; if four, you should give up. (Gili Raanan)
7. The best engineers are those whose "hobby is writing code." Wiz's R&D head Roy Resnick screens talent exactly by this criterion, resulting in a multiple efficiency multiplier. (Gili Raanan)
8. "Expensive" is the DNA of good companies, not a flaw. Airbnb, Instagram, and Wiz were all expensive from the seed round; if you miss them because of price, you'll miss all good companies. High prices and high valuations are inherent attributes of high-growth companies. (Gili Raanan)