The Tech Sales Newsletter #64: Lessons from Lacework
For anyone who wants to be exceptional in tech sales, the most important first principle is a strong desire to know the truth. The truth about the product, the truth about the team's capabilities, the truth about the company's strategy, the truth about the customer's pain points and ultimately, their own capabilities.
As part of this article, we will contrast two separate stories from The Information, 30 months apart. Then we will take a look at the RepVue data during this same period.
If you are unfamiliar with Lacework, it’s the most VC funded cybersecurity startup in history. The majority of it was either made by Sutter Hill or initiated by them during the funding rounds, with many high profile (and typically sharp on research) funds such as Altimeter Capital, Tiger Global Management, D1 Capital Partners, Coatue Management and Durable Capital Partners. In addition, it advertised itself as a playbook company for tech sales reps, building out a network of leaders and reps that have previously worked in other playbook companies such as MongoDB and Cybereason.
Following a valuation as high as $8.3 billion, the company ended up being sold as a minor SKU line item to Fortinet, a second-rate player in network and endpoint for a fraction of that value.
Now let’s take a look how a company that has never had a workable product market fit or a strong GTM organization, ended up being hyped as “one of the best investments in the industry”.
The key takeaway
For tech sales: While Lacework was advertised as an exciting and cutting-edge opportunity in cybersecurity, with a GTM org built as a playbook company, the reality was that it was a trap that had stained many careers. Doing your due diligence before joining rather than relying on hype was the only way to avoid being part of the fiasco.
For investors: The reason why I advocate for only investing in public tech companies versus early-stage companies is because the risk profile changes dramatically. Back in ‘21 when the majority of investment occurred in Lacework, their leadership team was able to keep raising additional funds by passing "credentialism" as competence and a real market opportunity. While we have more tools today to make realistic assessments from the outside, early-stage companies remain difficult to vet at scale, and finding insiders willing to share critical information about product-market fit or sales execution is hardly guaranteed.
The missing gap when evaluating cloud infrastructure software companies.
Act 1: 2021
A couple years ago, Lacework reached the kind of crossroads where once-promising startups can easily slide toward also-ran status—or worse.
Faced with sluggish sales of its cloud-based cybersecurity product, Lacework was struggling to raise more money from existing investors and facing a revolving door of CEOs. At one point, after Lacework had spent nearly two years searching for a CEO, a software industry veteran who agreed to take the job, Dan Streetman, backed out at the last minute for a job at another company, said two people with direct knowledge of the matter.
Around the same time, Lacework founders seriously considered acquisition offers from network security firm Palo Alto Networks and data analytics provider Splunk of between $200 million and $300 million, the people said—which would have represented a disappointing outcome for the company and its backers. The details about Lacework haven’t been previously reported.
Now, though, Lacework has largely shaken off the doldrums. It has raised a total of nearly $1.83 billion in two funding rounds this year. Each round was the largest in the history of the cybersecurity industry at the time of its announcement. Amid annual revenue growth of 200%, investors last month valued the company at more than $8 billion on paper and have compared it to cloud database company Snowflake, which like Lacework is backed by Sutter Hill Ventures. Snowflake saw a similar surge of investment in the year before its blockbuster initial public offering in September 2020.
It’s very difficult to read this, knowing how things played out. While business is all about narratives, building up Lacework as a strong performer with great backing is a story that we hear way too often in the industry.
“I don’t think the headline here is ‘turnaround,’” said Hatfield, who declined to discuss details about the company’s past. “I see this as an ambitious vision from the early days to completely change how security was done.”
The story of Lacework’s resurgence-that-shall-not-be-called-a-turnaround stems partly from the company’s efforts to get its own house in order by bringing stability to its executive ranks, bolstering its sales staff and refining its product to gather and process large amounts of data using machine learning. But there’s also an element of timing and luck in its improved prospects. The demand for companies that secure computing jobs running in the cloud is suddenly red-hot, in part because of the growing scourge of cyberattacks.
The events in 2021 are a reflection of peak Zero Interest Rates decision making. While the overall market was indeed going towards accelerated adoption of cloud, Laceworks significant execution issues were already very visible. Rather than trying to completely rethink the approach, it’s investors and leadership team (or shall we say, Sutter Hill) decided to keep repeating what didn’t work, but this time with more funding.
Under its current leaders, sales have accelerated significantly. A key hire was enterprise software veteran Andy Byron, who in September 2019 became Lacework’s president in charge of sales and marketing. But sales turnover has remained high since Byron joined, with several people departing after less than a year, said a person who has witnessed it firsthand.
Still, Lacework’s sales team is doing something right. At the beginning of the year, Lacework set a target of $45 million in annual recurring revenue—customer commitments to buy its subscription software over the next 12 months—by the end of 2021. But it passed that mark a few months ago and raised the target to $70 million, according to a person with direct knowledge of the numbers, which haven’t been reported previously.
One reason for the growth is that the company has gotten better at selling to large companies, a process startups often struggle with because they haven’t yet gained the trust of corporate IT departments. In addition to working with Nextdoor and VMware, both of which Lacework lists as customers on its website, the company has inked major deals over the past year with Epic Games and Airbnb, said a person with direct knowledge of the matter. The average sale price of Lacework’s deals is also on the rise, growing from around $100,000 two years ago to roughly $150,000 now, the person said.
Hatfield declined to comment on Lacework’s revenue figures but said, “We’re thrilled with the financial performance of the business.”
BIG LOGOS, BIG ACV GROWTH, BIG TURNAROUND, SOFTWARE VETERANS IN CHARGE. At least that’s what the headlines claimed.
Act 2: 2024
Last summer, more than a hundred people crowded into the brightly lit basement of a Lululemon store in Manhattan at the invitation of Lacework, a cybersecurity unicorn. By all appearances, the startup seemed to enjoy an enviable position, with an $8.3 billion valuation and an assortment of blue-chip investors, including Sutter Hill Ventures, Coatue Management and Tiger Global Management. But behind the scenes, Lacework CEO Jay Parikh was, in fact, desperate to rekindle the company’s growth, which had slowed dramatically. To lure event attendees into mingling with Lacework salespeople at the store, the company handed out $300 Lululemon gift cards to each of them, at a total cost of more than $30,000, said a former Lacework employee involved in organizing the event.
Like many ploys attempted by Parikh and Lacework over the last several years, the event was for naught. According to someone present at the event, the majority of the people who showed up for it didn’t end up becoming customers of the company, whose main product is software that sits in customers’ cloud servers, flagging potential abnormalities that could be signs of a hack. Similarly lavish giveaways of goodies have also failed to yield results for Lacework.
Let’s acknowledge the sheer ridiculousness of what’s going on. We are talking about a company focused on selling sophisticated technology at the cutting edge of CNAPP. It’s sales teams should be focused on developing deep competence into the cloud infrastructure space and presenting novel approaches to improve security breaches.
For years, there was nothing out of the ordinary about a startup spending wildly to win publicity and customers. But Lacework’s extravagant tactics came at a time when the demise of the zero-interest rate era was supposed to have ended such spending. That’s especially true of startups like Lacework, which has a history of losses, stalled revenue growth and a revolving door of leaders (Parikh was the startup’s sixth CEO in four years).
By mid-2023, the company’s annual recurring revenue had barely grown over the prior two years, hovering below $100 million. Lacework’s effort to expand beyond its main customers—small and medium-sized businesses in healthcare, finance and other categories—to court large businesses mostly stalled. Throughout 2022 and 2023, it laid off roughly 300 employees, mostly salespeople. Some customers, including the Winklevoss twins’ Gemini crypto exchange, were ditching it for competitors. And Lacework was still incinerating cash: In all, it burned roughly $200 million in 2023 to achieve a measly $2 million in net new revenue.
Remember how back in 2021, the company was having a MAJOR SALES TURNAROUND?
To woo C-suite executives, Lacework executives regularly booked boxes at New York Yankees and Golden State Warriors games. And at one point last summer, just as the “Barbie” film reached zeitgeist status, Lacework licensed the Barbie brand for a pricey advertising campaign mostly focused on digital ads. The startup even had 50 Chief Information Security Officer Barbies custom-made—each in a black, Lacework-branded hoodie—and gave away the dolls at a conference, along with an assortment of pink phone cases and fanny packs.
“We were handing out gifts left and right like Oprah,” said a former Lacework salesperson. “It didn’t matter if we were pitching some low-level security admin with no ability to purchase software in their org. We were that desperate just to get a net-new meeting with anyone who resembled a customer.”
It’s difficult to overstate how dramatically out of touch this is from the day-to-day reality of what cybersecurity sales is. The target audience is deeply technical, very overworked, often demoralised and extremely distrustful of software vendors. As the spend in cybersecurity sales has reached it’s historical peak, so has the scale and damage incurred by repeated breaches. There is a big mismatch between the jargon-heavy marketing of those companies and the process/staff challenges that the actual practitioners in the industry are focused on.
It’s particularly painful when you consider that Lacework management prided itself on being a “playbook company”. This term however doesn’t carry the same weight nowadays:
Source: The Deal Director on X
In the middle of this, Lacework was burning investor cash on CISO barbie dolls.
Initially, Lacework focused on small- and medium-size customers, according to current and former employees, while many of Wiz’s first sales were seven-figure deals with larger companies. Later, as Wiz’s revenue grew steadily, it added features to compete more directly with Lacework’s offering.
The pressure of the Wiz rivalry fell largely on Lacework’s president, Andy Byron. The company’s fourth CEO, Dan Hubbard, had hired him to oversee its sales operations. Quickly, Byron developed a reputation as a tough manager, say five current and former Lacework employees, some of whom described him as a “bulldog” and a “sweatshop leader.” His motivation tactics often involved expletive-laden rants.
During one memorable bid to boost morale following a wave of layoffs in 2022, Byron gathered hundreds of salespeople on a Zoom call and delivered a “Wolf of Wall Street”–style motivational speech, according to someone present, urging them to work as hard as they could to boost the company’s valuation.
“I’m not fucking leaving this company until we take it to $50 billion!” he shouted. “That’s what I came here for, and that’s what I’m doing.”
There is a lot more that happened as outlined in the article, but I’ll stop here. Lacework is a good example of how leaders of early stage companies and investors who play a public role in promoting them are incentivised to do “performative” management, rather than face deeper scrutiny on the execution side.
The severe mismanagement of Lacework was very visible to anybody who had spent any amount of time trying to engage with the previous and current sales reps of the company.
More importantly, it could be reliably traced on RepVue.
The quantified and qualified view
Source: RepVue
This is what a complete failure of sales execution looks like in slow motion.
Source: RepVue
Source: RepVue
If we have to outline some of the key behaviours that would’ve helped investors avoid getting involved in this situation:
Willingness to understand the fundamental dynamics from a tech sales perspective in the industry they want to invest in.
Reviewing “field reports” in the form of reviews and ratings for companies coming from the sales teams.
“Prospecting” into the sales teams by reaching out and discussing their experiences in the company and what their view of the long term outlook is.
Instead, for many investors the due diligence was limited to focus the pitch decks from Sutter Hill and puff-pieces about “the industry veterans reshaping the GTM strategy”.
While we should always root for individuals to learn and improve from their mistakes, if our goal is the truth, then we shouldn’t ignore what is happening with the next company in line for “the Lacework treatment”.
Source: RepVue
It will be interesting to see whether this turns into a redemption story. I just can’t advise anybody to bet money or their time on it.
