The same names keep appearing at the top of cybersecurity funding rounds. Not because investors have short memory or weak deal flow. Because those founders have already done this, sold it, and started again.

By the third company, the founder is not learning enterprise sales. They already know which titles in a Fortune 500 security org actually control budget (hint: it is rarely the CISO in early-stage deals), how long a POC realistically takes before procurement stalls, and which product bets sound good in 2024 but kill you at Series B.

That knowledge took years to accumulate. It also took failure. Tomer Weingarten spent years at SentinelOne before the IPO, navigating a market where CrowdStrike had more brand, more sales reps, and a head start. He did not win on product alone. He won because he understood the buying motion deeply enough to out-execute on distribution. That kind of clarity does not come from reading case studies.

First-time founders in cybersecurity are not at a disadvantage because they lack intelligence. They are at a disadvantage because the feedback loops in this industry are slow. Enterprise sales cycles run 6 to 18 months. A bad positioning call does not surface until you have burned 18 months of runway chasing the wrong ICP. By the time a first-timer figures that out, a repeat founder is already closing Series B on their next bet.

Capital knows this. A repeat founder with one exit raises a seed round in weeks, often at a valuation that a first-timer would not see until Series A. That gap in starting conditions compounds fast.

There are two honest paths for a first-time founder in this market. Join as a co-founder alongside someone who has already run the cycle, and absorb the pattern before going solo. Or spend 4 to 6 years as a senior operator inside a scaling cybersecurity company, close enough to the actual decisions to understand why they were made. Neither path is quick. Both are faster than learning it the expensive way with your own investors’ money on the line.

Predictable Growth is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Cybersecurity has become dramatically harder to build and sell in over the last decade.

Peter Laakkonen mentioned that back in 2006, he could count serious cybersecurity product companies in India on his fingers. Today, Bangalore alone probably has 3–5x that number. Every category is crowded. Every vendor promises AI, automation, faster detection, and platform consolidation.

The challenge is no longer just building good technology. The challenge is making buyers understand why your product matters before they mentally group you with every other vendor saying similar things.

That’s why GTM cannot begin after the product is built anymore. Positioning, buyer understanding, messaging, and distribution have to evolve alongside the product itself. In today’s market, clarity creates more trust than technical depth alone.

Really enjoyed this conversation with Peter Laakkonen on how cybersecurity GTM has evolved and what founders need to rethink while building security companies today.