Frankly Speaking, 6/4/19: Safeguarding a User's Internet Experience
A weekly(-ish) newsletter on random thoughts in tech and research. I am an investor at Dell Technologies Capital and a recovering academic. I am interested in security, blockchain, and devops.
If you were forwarded this newsletter, you can subscribe here, and view old newsletters here.
I want to give a shoutout to Dell Tech Capital portfolio company, Twistlock*, for being acquired for 410M by Palo Alto Networks. We are privileged to have supported you since co-leading the seed round. I'm extremely grateful and proud to be a team that has seen 4(!) security exits in the last 18 months (Redlock, Cylance, Zscaler). If you or anyone you know is starting a security company, definitely send them my way!
WEEKLY TECH THOUGHT
When I was running the MIT security seminar, Nick Feamster, a Princeton professor in privacy and security, gave a talk titled "Bots, Bubbles, and Bottlenecks" a couple of years ago. There was a lot in his talk, so if you’re interested more in his research, please visit his site. I will summarize some interesting topics in this post.
In the beginning, the Internet was small. There were few stakeholders, one government, and no real security concerns. However, today, there are many ISPs, governments, and attackers. Protocols in the early days could guarantee good end-to-end performance, but now, the internet experience depends on economics, policy, security, psychology, and interfaces.
Nick talked about three major stakeholders: ISPs, attackers, and content providers.
User vs. ISP: Users want good, affordable, and reliable connectivity to content and services. ISPs care about profit. There is no single notion of performance. The conventional approach is to measure performance at the end host. However, Nick proposes using a home router. His work BiSmark is a broadband internet service benchmark. This allows for experience-driven experimental systems research that strives for simplicity, balances competing objectives, and debunks implicit assumptions.
These three implicit assumptions were debunked by his experiments:
Latency on Internet paths is dominated by speed of light propagation and queueing.
To get better performance, simply upgrade your ISP serverice plan
When performance is poor, it’s usually the ISPs fault
Latency is actually affected by access technology, DSL interleaving, peering, and equipment choice. Faster links don’t help because page load times stop improving after a certain point, and last-mile latency hurts. Wireless bottlenecks are common.
These realizations lead to new research, such as approaches for reducing latency and new measurement tools. For specifics on the research he has done, please visit his website.
User vs. Attack: Spam is 95% of all email traffic. Target attacks are steady. Conventional approaches use content filters and IP addresses to identify spam. His new approach is to detect spam based on network-level behavior (filter email based on how it is sent in addition to what is sent and who sent it). The goal is to go from axioms to practice.
Agility: Spammers must escape detection. Understanding network-level behavior and detecting agility (BGP, DNS)
Exposure: Spammers behave differently. Supervised learning based on features, but which features to use?
Coordination: Spammers behave like each other. Clustering based on common behavior, but what behaviors cluster well?
Finally, there are the content providers. Personalization is creating situations where we only see things that already suit our own tastes, but this can be exploited. There is a need to detect inconsistent results, and detect pollution attacks. His work Bobble bursts the filter bubble.
Nick’s talk contained a lot of interesting information. It really gives us a perspective on how the many stakeholders in the Internet affect the user experience. This is more important now than before, especially given how much social media and certain large Internet companies heavily influence our culture and our daily lives! Definitely food for thought.
LET'S BE FRANK
One major thing I learned as VC is that not all revenues are treated equal. So, whenever entrepreneurs tell me that they have a certain revenue and as a result, should have a certain valuation, I respond that revenues are a factor in valuation, but there is another mysterious factor: revenue multiple. I call it mysterious because revenue multiples are subjective and market-driven. Sometimes, I believe that certain revenue multiples don't make sense, e.g. why service revenue multiples are so low, but there's really nothing I can do about it.
For example, in enterprise IT, security revenue has better average revenue multiples than other types of enterprise IT revenue. It's because the market perceives it as high growth and more strategic. I'm sure there are other reasons, but I believe it boils down to that. That's why market leaders get better multiples compared to those who trail behind them. Ultimately, whatever the reason, this revenue multiple is subjective and defined by market forces beyond one person's or team's control.
What does this mean for companies and startups? There are ways to position yourself to be more strategic and a "hotter" company by trying to capture thought leadership in a space, and that's been perceived to increase revenue multiples, especially in security. It also means that as a company, you can break your back trying to increase your revenue, but it might not increase your valuation substantially. The opposite is also true, if you can increase your valuation without revenue increase. However, ideally, you can do both so that your revenues "go further" to increasing your valuation.
As a startup with limited resources, I think you should be doing a mixture of both. Like all things, it's much harder to increase your revenue multiple because it's something you have less control over. This is definitely a board level discussion to ensure you are not just focusing on sales, but also focusing on increasing the brand awareness of your company and ensuring your company is strategically positioned.
Anyway, it's always important to remember that valuation = revenue multiple * revenue. Revenues are important but aren't the only important factor in valuation.