Bugcrowd hit $1M in bookings in year one, $3M year two
Casey Ellis · He tested his pitch on Uber drivers—then built a cybersecurity platform to $180M raised. | Casey ... · PMF Show · Oct 13, 2025 · at 42:50
Casey Ellis, founder of crowdsourced security platform Bugcrowd, recounts the company's early bookings trajectory.
0:00 / 0:08exact quote · 8.9s
▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark
“We hit a million in bookings in the first year. We did, I think it was three million the following year.”
quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →
More from Casey Ellis
VC rejection usually reflects poor founder communication, not investor stupidity
“My job is to understand this industry, like the market, the future of the market, where it's going, like see around corners, do all those different things. Like that's my job. And my job is to be the best in the world at that. Their job Is to be the best in th…”
Founders should exhaust personal networks before hiring sales reps pre-Series A
“Like don't think about marketing funnels or PLG or like hiring salespeople or any of that stuff until you as a founder have figured out how to tap out your existing networks. I think the bulk of the power that you're going to have pre series A is probably goin…”
Startups should never hire just one initial salesperson; always hire two
“Then I hired two salespeople, because if you're going to do that, you never hire one, you always hire two, because that way they compete with each other and G each other up.”
Hourly pen testers cannot match unconstrained crowds of adversaries
“The problem that I had with it was this idea that, like, you know, the whole reason that we're here as a cybersecurity defender industry is because of this crowd of adversaries, right? It doesn't look like one person being paid by the hour. It looks like this …”
Founders must not sell risk-reducing security products to compliance-only buyers
“Never sell security to people that don't care. If you're trying to position a product that's genuinely going to reduce risk, don't try to sell that thing to people that only care about compliance or only care about checking the box.”