Prerequisite plug that you should come see my talk with Dr. Nicole Forsgren at Black Hat next week (16:00 in South Pacific)!

What type of vendors are showing themselves off in the Business Hall? Are they mostly startups?

Chart of number of vendors by funding type for the Black Hat USA 2019 Vendor Hall Exactly like last year, 46% of the vendors in the Business Hall are startups backed by venture capital (VC) firms. Private companies represent only 13% of total vendors this year (vs. 17% last year), and there are far more acquired companies ("M&A" within the chart) this year (8% vs. 5% in 2018). Some of them were acquired within the past year, which means they already booked the booth in their name. However, others are companies acquired awhile ago that still retain their brand name as distinct from their new owners. Chart of number of VC-backed companies by age of last raise Over half of VC-backed vendors received fresh funding within the past year, up quite a bit from 44% last year. We saw a 80% were funded within the past two years, and 92% were funded within the last three. Only nine companies have not been funded in the last three years, and those companies are very likely itching for exit (i.e. M&A) opportunities now.

How many vendors from 2018 are exhibiting again in 2019?

67% of vendors who exhibited in 2018 are exhibiting in 2019, while 33% are not. Of the 31% of VC-backed security vendors who exhibited in 2018 but are not in 2019, some are vendors who were acquired (e.g. Twistlock, ProtectWise), while many of the others are well-known to be “long in the tooth” (e.g. Bromium, CounterTack). Others were still funded recently (e.g. Digital Guardian), so it’s possible they calculated a lack of ROI from the event.

An interesting statistic is that the VC-backed vendors who are exhibiting again received their latest VC infusion more recently than those who are not still exhibiting. For VC-backed vendors exhibiting again in 2019, the delta between their last funding round and Black Hat USA 2018 (which was August 2018) was 482 days (a mean of April 2017). For VC-backed vendors not exhibiting again in 2019, the average was 622 days (a mean of November 2016). This might support the notion that vendors who have not received VC funding for awhile are less financially healthy, and therefore unable to pony up the cash for another booth at Black Hat.

Outside of VC-backed vendors, around half of the publicly-traded non-security vendors from last year decided not to exhibit this year. 8 companies that were acquired decided not to exhibit this year (for instance, Phantom presumably now will be present at the Splunk booth). Around half of the privately-owned vendors from last year decided not to exhibit. All of the publicly-traded security vendors are exhibiting again this year, save for Gemalto (who knew they were being acquired by Thales). Perhaps not surprisingly, DarkMatter decided not to show their face at BlackHat this year. Can’t imagine why.

How many VCs are dedicated to investing in infosec?

Chart of the number of VC funds by companies invested Out of the 168 investors who led a funding round in a security vendor exhibiting at the Black Hat USA 2019 Business Hall, 69% only led one round. This suggests that the amount of investors "dabbling" in infosec is not decreasing, which is a shame. Ideally, investors educated on the space would make most of the funding decisions as, at least in theory, they can better sift through the FUD and buzzwords to determine which vendors actually fill a need in the market.

There were 16 investors who led 4 deals or more, which is down from 21 last year. 25 venture capital firms led 3 deals or more, which is a convenient number to remember as a proxy for the amount of VCs at least somewhat dedicated to infosec investing. Below is the Top Ten list, which includes all VC firms who led at least 5 funding rounds in this year’s exhibitors:

What venture stage are vendors & how much capital are they raising?

Chart of the number of VC-backed vendors, by latest round The distribution of exhibitors by funding stage looks a little different than last year. While the number of late-stage companies (Series C or later) stayed roughly constant, there was a notable spike in early-stage companies (Seed through Series B) -- from 53% last year to representing 61% of all VC-backed startups in 2019. This may reflect the increasing dollar-size of early-stage rounds over the past year, as younger companies can now more easily afford to purchase booths.

Supporting evidence for my theory is that the median dollar amount raised in Series A deals increased 45% for exhibitors who raised after August 1, 2018 vs. those who raised before then. A counterpoint is that Seed and Series B median deal sizes were down from 2018 (-15% and -4%, respectively). Late-stage deals boomed in median dollar amount raised, increasing 32% for Series C, 40% for Series D, and 119% for Series E rounds.

The median amount raised across all stages increased 38%, from a median of $17.0 million in 2018 to $23.5 million in 2019. I use the median here since the mean is skewed by some absolute unit late stage deals since August 2018. Nevertheless, the mean amount raised across all stages increased 89%, from $21.6 million to $40.8 million.

Chart of the average size of funding rounds, by stage

How many Private Equity firms are backing companies on the floor?

There are 29 companies backed by 20 total Private Equity firms in the Business Hall this year. Last year, there was roughly the same number of companies (30), but significantly more Private Equity firms (27). It is still true that the vast majority (85%, up from 81%) of Private Equity investors are one-off investors, and only 3 Private Equity firms invested in / acquired 2 or more security companies. Dominating that figure is Thoma Bravo, who has 5 portfolio companies exhibiting in 2019.

How fresh is the Innovation City?

Chart of Innovation City 'residents,' by type Innovation City now has 44 "residents" (up from 41 in 2018), and has a significantly higher concentration of VC-backed companies than the total population (73% vs. 46%). Last year, Innovation City was only 59% VC-backed, and part of the increase this year was at the expense of the proportion of privately-held but unfunded vendors.

True to its promise as a bastion of “startups and emerging companies,” 91% of the VC-backed residents of Innovation City are Seed through Series B stage – way more than the 61% present in the total population. The median amount of the latest round of funding was $10.0 million among Innovation City residents, in contrast to the total population’s median of $23.5 million.

Fascinatingly, 12 of the 44 Innovation City residents were also residents last year – over a quarter of the population. I personally assumed they rotated vendors to keep things fresh for attendees attempting to scout the most cutting-edge vendors of the flock, but I was clearly pretty wrong.

How U.S.-centric are the vendors at Black Hat?

Chart of all companies, by geography The Business Hall is marginally less U.S.-centric in 2019 than in 2018, decreasing to 79% from 83% last year. Even the proportion of VC-backed companies that are U.S.-based decreased, from 86% in 2018 to 82% in 2019. The EU grew its portion of VC-backed companies, which now represent over half of all EU-based vendors. Perhaps this is the GDPR effect in action? Chart of VC-backed companies, by geography It surprises me somewhat that the number of Israeli startups is still quite low proportionally, despite the substantial number of them funded each year. I suspect the reason is that many Israeli startups end up switching their headquarters to the U.S. (particularly California) once they've reached the Series A stage or later. Thus, many of the startups founded in Israel may not be reflected in these numbers.

Within the U.S., California makes up 43% of all U.S.-based vendors presenting, and over half (53%) of VC-backed startups in the Business Hall. After California, Massachusettes, New York, and the D.C.-region dominate, though Texas is ascendant.

Chart of all U.S. companies, by state

Final note: I have no idea what is happening with Brexit (does anyone?), but given the UK has more representative companies than the definitely-EU-countries combined, I kept the UK separate.

A few notes on the data

Vendors were retrieved from the Black Hat 2019 Business Hall Floorplan, and exclude any federal agencies, educational organizations, or nonprofits. I also excluded any companies in the Career Zone, as they are aiming to recruit security talent rather than sell products or services.

Location and funding information was collected through Crunchbase. There may be errors if a company’s Crunchbase page is not up to date.