26 January 2023
By Renny McPherson, Managing Partner at First In, and Brian Mongeau, Principal at First In
The proliferation of cyber attacks and cyber crime in recent years have made it clear that cybersecurity is, and will be for years to come, both an important investment theme and central to national and global security. From 2016 to 2021, the FBI reported that the costs of cybercrime increased 393% for American businesses to $6.9 billion. In the first half of 2022, cyberattacks grew 42% compared to the first half of 2021. Major cyberattacks made front page news as they caused disruptions across wide swaths of society. As the number of cyberattacks grew, bad actors continued to seek new vulnerabilities in complex digital systems and learned from both their successes and failures to hone future attacks.
Technological advances have led to more connected systems and devices — and therefore more opportunities for hackers — than ever. This trend is likely to accelerate, with one estimate projecting the number of connected devices to grow 2,400% over the current decade to reach 500 billion by 2023. Due to the vulnerabilities inherent in these digital systems, commercial enterprises, small- and medium-sized businesses, and governments are all increasingly aware of the cyber threats emanating from both traditional and nontraditional threat vectors. As a result, our 2023 focus areas will include newer cybersecurity subsectors that should continue to grow from a small base and holistic approaches to more traditional cybersecurity subsectors that require novel solutions:
- Operational Technology (OT) and Internet of Things (IoT)
OT/IoT is a nontraditional and newer subsector of cybersecurity that has received significant attention in recent years — yet gaps still remain, particularly in critical infrastructure. The number of OT cyberattacks grew rapidly in recent years, increasing 2,000% in 2020 compared to the year prior. The fallout from high-profile cybersecurity attacks since then demonstrate the problems that continue to persist and the potential for widespread negative ramifications across society that can occur from such attacks. As a case in point, the 2021 Colonial Pipeline attack by a Russia-linked cyber group was a defining moment for non-experts to appreciate enterprises’ digital operating vulnerabilities. Recognizing the need for greater OT security, First In invested in Shift5 in both 2021 and 2022 to support the company’s innovative military and transportation asset protection solutions. IoT, and even more greenfield space, provides a similarly situated vertical of opportunity for startups, with IoT endpoint connections projected to grow to over 25 billion in 2025 from 14 billion in 2022.
We wrote last year about how government regulation can help drive commercial adoption of crucial cybersecurity capabilities. With this in mind, it is notable that the US Government (USG) increased its focus on critical infrastructure OT in 2022. Legislatively, the Cyber Incident Reporting for Critical Infrastructure Act empowered Cybersecurity and Infrastructure Security Agency and places requirements on companies to share information on security breaches. Additionally, the National Security Council is leading joint public-private collaborative cybersecurity efforts in the energy and transportation industries, as detailed by Deputy National Security Advisor Anne Neuberger. The upshot of these efforts is a government-led tailwind for more robust and innovative OT security solutions to continue to develop in 2023 to fill gaps in a wide-ranging market.
- Threat-informed defense that unifies security for increasingly complex digital environments
The integration of threat intelligence, observability, and proactive defense in depth, now called threat-informed defense (TID), is a promising area for growth by bringing needed holistic approaches to traditional IT environments. Twelve months ago, TID was a relatively abstract concept that sought to build on threat intelligence capabilities by providing customers with actionable insights given their particular threat landscape, rather than merely providing large amounts of data that would often overwhelm security teams. As TID emerged, First In invested in Tidal in 2022 to help companies secure their operations with tailored assessments and solutions.
Going forward, TID innovation is likely to continue in several adjacent areas. Organizations’ modern, sprawling digital asset infrastructure systems are rarely properly inventoried, inhibiting effective cyber-risk analysis. Relatedly, solutions to unify cyber defenses will be crucial as inexorable — and complex — cloud migrations continue. Gartner projects cloud spending to increase 20% in 2023 as organizations continue migrating workloads to the cloud and 90% of companies operate multicloud environments. Evolving holistic solutions to these themes will be central to the early stage cyber landscape in the year ahead.
- Novel threats mean novel targets
As society and organizations have digitized at an accelerating pace, industries that have historically spent less energy, time, and money on cybersecurity are now enduring attacks. In addition to critical infrastructure, verticals ranging from transportation and logistical assets to biotech are all increasingly aware of the vulnerabilities they face, including from international adversaries. As cyber defenses against evolving threats proliferate, industry-specific solutions will also likely be needed — which will in turn unlock significant and, to-date, often untapped market opportunity.
- Threats to an expanding definition of digital systems
Historically, point solutions were the locus of the cybersecurity industry, but modern broad digital systems enable adversaries to access a vastly increased and complex threat landscape far beyond the confines of individual IT networks. As the quantitative growth of society’s connectivity continues, the forms of digitization likewise continue to evolve. From cloud-based edge devices to social media, low-cost democratized online access enables organizations and individuals to rapidly connect across vast geographic reaches than at any time in history. As a result, however, a vast amount of micro-level data is available for hackers to steal and weaponize at scale. Individuals can have their sensitive data harvested and exploited through multiple vectors, whether via breaches against organizations with which they are customers or through social media platforms they freely use. First In invested in the data privacy company 360 Privacy in 2022 in recognition of the need to provide greater protection for individuals’ digital footprints in an ecosystem no one individual can control on their own. Digital systems are now omnipresent across all elements of society. The need for protection across multiple layers of systems in our online world for both organizations and individuals is likely to increase over the next year as connectivity continues to grow.
The evolution of cyber attacks and cyber security over the last decade has been remarkable. Developments over the past three years in particular, have confirmed that the macro level need for more robust cyber defenses. Cybersecurity companies will need to adapt and develop novel solutions in the face of new challenges in the years ahead. Recognizing this dynamic, First In believes there are many opportunities for great cybersecurity companies to be built today – companies that address novel and growing threats.