Nov 22, 2021 · 27m · top-founders
SecurityScorecard Breaks $71m ARR, 1700 Customers, $200m in Bank to Fuel Product Expansion
0:00 / 0:00
gold bands on the timeline = statements, start to end. Hover to read, click to jump. CC turns on captions
SecurityScorecard CEO Alex Yampolskiy details how the cybersecurity ratings leader scaled past $71 million in ARR with 50% YoY growth, outlining the company's proprietary data moat, capital efficiency, and strategic roadmap toward a future IPO.
How this conversation actually went
Every chapter scored 0–10 on four independent dynamics. Hover any point for the reasoning behind the score. Nathan holds 29.9% of the talking time here. How this is scored →
Nathan as informed peer 5.4 Guest teaching 2.3 Guest disagreement 1.5 Nathan pushing back 2.3
speaking balance: gold is Nathan, purple is the guest (3 minute bins)
Sharpest disagreement ▶ 24:16 Alex rejects Nathan's conservative ARR estimate
When Nathan proposes that the company might hit $85M to $90M ARR next year, Alex directly cuts in to contradict the lower projection and states they will exceed $100M.
Hardest push from Nathan ▶ 22:08 Nathan extracts a minimum floor on million-dollar contractsAfter Alex attempts to deflect giving the exact number of seven-figure enterprise accounts, Nathan refuses to let it slide and negotiates a firm floor of over 10 accounts.
Biggest teaching moment ▶ 1:16 Alex explains cybersecurity ratings vs traditional toolsAlex educates Nathan on why SecurityScorecard does not compete with standard endpoint security vendors like KnowBe4 or Malwarebytes, defining the outside-in KPI ratings category.
Nathan holds their own ▶ 9:37 Nathan analyzes competitive capital efficiencyNathan showcases strong domain preparation by contrasting BitSight's capital raised against its ARR to highlight SecurityScorecard's superior capital efficiency.
the scores for every segment, with the reasoning behind each
| Chapter | Topic | Nathan as informed peer | Guest teaching | Guest disagreement | Nathan pushing back | Why |
|---|---|---|---|---|---|---|
| Alex Yampolskiy on Cybersecurity Ratings and Category Creation | 4 | 5 | 2 | 2 | Nathan opens by comparing SecurityScorecard to endpoint security and awareness vendors like Malwarebytes and KnowBe4. Alex politely reframes the category, explaining that SecurityScorecard creates objective outside-in risk ratings rather than endpoint protection tools. | |
| Customer Milestones, Freemium Network Effects, and Company Origins | 6 | 2 | 1 | 2 | Nathan walks through the unit economics and calculates on the fly that 1,700 customers at an average $40k ACV yields roughly $70M to $71M in ARR. Alex confirms the figures and elaborates on the company's zero-marginal-cost data model. | |
| Competitive Win Rates, Capital Efficiency, and Category Creation | 7 | 2 | 2 | 2 | Nathan cites BitSight's capital metrics, noting they raised $400M to reach $100M ARR compared to SecurityScorecard's $290M raised. Alex highlights their 70% bake-off win rate and customer-first engineering culture. | |
| Valuation Expansion, Net Retention Goals, and IPO Readiness | 6 | 2 | 1 | 3 | Nathan probes Alex on historical valuations, backing into the 2019 round's post-money valuation. Alex shares current gross margin benchmarks and net revenue retention goals heading into an eventual public offering. | |
| Sponsor Break: Flatfile Data Onboarding Solution for Startups | 4 | 1 | 1 | 2 | Following the sponsor read, Nathan asks how much growth could be generated purely from upselling the existing install base. Alex asserts they could hit 50% expansion without even adding new customers. | |
| OKR Implementation, Executive Cadence, and Strategic Objectives | 7 | 3 | 1 | 1 | Nathan pulls specific data points from the physical OKR planning sheet he saw in Alex's office, citing Pendo stickiness metrics and marketplace win rates. Alex details how weekly executive cadence solved earlier OKR rollout failures. | |
| Enterprise Seven-Figure Contracts, Historical ARR, and IPO Horizon | 7 | 2 | 3 | 5 | Nathan pushes Alex to disclose the number of seven-figure enterprise contracts, eventually getting him to confirm more than 10. When Nathan suggests a conservative ARR target for next year, Alex boldly rejects it and guarantees crossing $100M. | |
| The Famous Five: Leadership Habits and Personal Insights | 2 | 1 | 1 | 1 | Nathan concludes the interview with the standard Famous Five rapid-fire questions covering favorite business books, mentors, and sleep habits. |
Statements from this episode (16)
Yampolskiy: Companies with bad ratings are 7x more breach-prone
“We've demonstrated historically that companies with a bad score have a seven times higher likelihood than companies with a good score to suffer a data breach.”
Yampolskiy: SecurityScorecard's moat is historical breach calibration data, not code
“Even if I gave you all our source code, all our architecture, all of our 25 plus patterns, and said, go compete with us, you're not going to have this historical dataset where we calibrate what datasets map more accurately to likelihood of a breach, and the mo…”
SecurityScorecard Reaches 1,700 Paying Customers and 25,000 Freemium Users
“So we are right now at about 1700 plus paying customers, right? So people who use our scores to rate others, we have over twelve million companies in a data set that we rate, 1700 paying customers, and then there's over 25,000 freemium users.”
Yampolskiy: SecurityScorecard's average contract value is around $40,000
“So the average contract is about, you know, 40,000 bucks a year paid upfront. Some people pay us millions dollars a year paid upfront and some people There's 10, 20 K. The average is about 40,000.”
Yampolskiy: SecurityScorecard's data resale model has zero marginal cost per customer
“If I charge you to monitor Lotka magazine, right? And I charge 20 other people to monitor Lotka magazine, I don't incur any additional costs because I recompute the scorecards once a day, and then I just resell the data. It doesn't cost me anything more to, yo…”
Yampolskiy: SecurityScorecard will finish 2021 between $70M and $73M ARR
“We're going to finish this year at about, you know, anywhere from. 70 to seventy three million annual recurring revenue.”
Yampolskiy: SecurityScorecard grows over 50% while competitor BitSight barely grows at 20%
“We're consistently exceeding 50% plus growth rate much faster than our direct competitor. Direct competitor is barely growing at 20% rate. Nathan Latka: Who is your direct competitor? Alex Yampolskiy: Bitsite is our primary direct competitor.”
Yampolskiy: SecurityScorecard will easily surpass $100M ARR in 2022
“Next year we plan to continue the same growth rate. So we're going, and more. So we're going to by far surpass, you know, the hundred plus next year and beyond. We actually anticipate to be able to grow faster next year.”
Yampolskiy: BitSight generates ~$100M ARR, growing at barely 20%
“Those guys are going to do about a hundred million in ARR, and they're growing kind of barely at 20%.”
Yampolskiy: SecurityScorecard beats BitSight 70% of the time in bake-offs
“Well, look, we beat them. We beat them. 70% of the time in a big off.”
Yampolskiy: SecurityScorecard holds almost $200M in cash reserves
“And we're still sitting on almost two hundred million in cash. In the bank.”
SecurityScorecard: Valuation will triple or quadruple within 18 to 24 months
“We believe that within the next. 18 to 24 months, again, we're going to triple or quadruple evaluation of a company or more.”
SecurityScorecard: Net retention rate is hovering between 115% and 120%
“Our net retention kind of like a growth on net retention is hovering between one 15 to one 20%.”
SecurityScorecard: Gross margins are between 75% and 80%
“Our gross margins are, you know, our gross margins are very healthy between 75 to 80%, and we're not worried there.”
Yampolskiy: Weekly executive standups create the accountability needed to make OKRs work
“We made only one small tweak. Now, every Monday we have a standup exec meeting for all VPs and above, and we start that meeting by going over the OKRs. What did you say you were going to do last week? What did you actually do? And so it creates social pressure…”
Yampolskiy: SecurityScorecard has multiple customers paying millions annually
“I can tell you, but I can tell you we have, A whole variety of customers across government, insurance, private equity, right? Like, and you know, we have a whole slew of customers and those guys are paying us millions of dollars a year and deploying us on, on …”