Ross Haleliuk

Venture in Security

Industry's top newsletter (750,000 reads annually) about building startups, as well as business and investment sides of cybersecurity. Covering topics like venture capital, go-to-market strategies, and business models in cybersecurity.

Author | Blogger

Cyber for Builders (Amazon Best Seller)

'Cyber for Builders: The Essential Guide to Building a Cybersecurity Startup'  is the most comprehensive resource about building the future of cybersecurity available on the market. Within hours of the official launch, the book instantly became the Amazon best seller in several categories. In 2024, 'Cyber for Builders' got recognized as Book of the Year at the SANS Difference Makers Awards, the most prestigious recognition available to cybersecurity authors globally. 

Most cybersecurity books talk about how to do security. This book is different as it is intended first and foremost for builders - startup founders, security analysts, security engineers, marketing and sales teams, product managers, VCs, angel investors, software developers, investor relations and analyst relations professionals, and others who are building the future of cybersecurity.

Author

Inside the Network

Inside the Network is all about building category-defining cybersecurity startups.

Collectively, we’ve spent decades building, researching, and investing in cybersecurity companies. On this podcast, we invite you to join us inside the network where we bring you the best founders, operators, and investors building the future of cyber.

We will talk about the hard parts of the founder journey - launching companies, getting to product-market-fit, raising capital, and scaling to an exit. Both the success stories and the epic failures. We are here to make the founder journey easier, but not too much easier because anything worth building is hard (but you already knew that 😊).

Podcast Co-Host

Clutch Security

Clutch is addressing the increasingly critical challenge of non-human identity security within modern enterprises.

As digital infrastructures expand and become more complex, the management and security of non-human identities—ranging from API keys and secrets to tokens and service accounts—have emerged as a pivotal yet often neglected aspect of cybersecurity. Recognizing this gap, Clutch is developing an enterprise platform dedicated to the comprehensive protection and management of these identities.

Angel Investor

Security Tinkerers

Member of The Security Tinkerers, a non-profit organization championing the advancement of cybersecurity. I am proud to be part of a community of world-class CISOs, CTOs, cybersecurity CEOs, and industry leaders. Our collective mission, encapsulated in our byline "Advancing cybersecurity through trust," focuses on fostering growth and innovation in the cybersecurity field. Through collaborative efforts, we aim to nurture a safer digital environment by sharing knowledge, resources, and expertise.

Member

Nullify

Nullify augments your AppSec team with AI agents capable of carrying out multiple levels of product security work autonomously.

SANS Institute

The SANS Difference Makers Awards shine a light on the cybersecurity practitioners who are leading innovative developments in the industry, who’ve made outstanding security achievements, and who are contributing back to the InfoSec community in ways that deserve recognition.

Advisory Board - SANS Difference Makers Awards 

Stealth Startup

Cybersecurity has been caught in the same patterns for too long. The hardest problems remain unsolved - not because they’re impossible, but because we haven’t asked the right questions.

It’s time for a new approach. A new way of thinking. A product that doesn’t just tell CISOs they’ve got problems. We have a lot of visibility. It’s time to make security actionable. 

Having built and scaled products for the past decade, I am embracing the most ambitious journey yet. It’s time to build. More soon.

Co-founder & CEO

Amazon Web Services (AWS)

AWS & CrowdStrike Cybersecurity Accelerator in collaboration with NVIDIA is an equity-free program designed to empower cybersecurity startups from EMEA and US with product development, GTM and fundraising support.

Mentor - AWS and CrowdStrike Cybersecurity Accelerator

LimaCharlie

LimaCharlie enables organizations to detect & respond to threats, automate processes, reduce the number of vendors, and future-proof their security operations.

We do it by giving security teams full control over how they manage their security infrastructure. Get full visibility into your coverage, build what you want, control your data, get the security capabilities you need, for however long you need them, and pay only for what you use.

Head of Product

Experienced operator & builder shaping the future of cybersecurity. Now working on something new. 

📙 Book about building the future of cybersecurity 👉🏻 cyberforbuilders.com
📬 Blog & newsletter 👉🏻 ventureinsecurity.net
🚀 Angel syndicate for security practitioners  👉🏻 visangels.com

"Write something worth reading or do something worth writing." —  Benjamin Franklin

“Life is too short to do mediocre work, and it is definitely too short to build shitty things.” — Stewart Butterfield, Co-Founder of Slack

"As you start to walk on the way, the way appears." — Rumi

In security or otherwise, trends are temporary. Stick to fundamentals.

Director of Product

Behind every successful security company is a software engineer you’ve never heard of. Here are some examples: 

- How many people know Yuming Mao, Chief Architect and one of the co-founders of Palo Alto Networks? He served as Chief Architect and a Distinguished Engineer at Juniper Networks, which he joined through the acquisition of NetScreen, but I was barely able to find one picture of him on the internet. 

- Most  people in security have never heard of Alex Ionescu, a brilliant technical powerhouse who served as CrowdStrike’s founding Chief Architect and Vice President of Endpoint Engineering. Early employees of CrowdStrike will tell you that there would be no Falcon as we know it without Alex Ionescu, but he doesn’t often talk about his story.

- Another software engineering powerhouse behind one of the most valuable security companies in the world is Zscaler co-founder Kailash Kailash. Here is how Kailash himself talks about the origins of Zscaler, which was formerly known as SafeChannel: “It was during dinner at Jay’s house when he first proposed the idea of a cloud security platform. After we spoke, I was so convinced that this is the future, but the problem wasn’t easy to solve from a technology standpoint, and it hadn’t been done. After four months of development, discussion, and lots of trial and error, it seemed that we had a viable solution.”

- The truly tragic story that few people in the industry know is what happened to the brilliant technologist behind Cloudflare. While today most know Matthew Prince (CEO) and Michelle Zatlyn (President), three people started Cloudflare. Lee Holloway, Cloudflare’s third co-founder and the technical genius who architected the platform and recruited and led the company’s early technical team, stepped down from Cloudflare in 2015, suffering a truly tragic form of dementia when he was only 36 years old.

These stories are great examples that software engineers are building the future of security, not just adding vulnerabilities. 

Know other good examples?

Security product leader, author, advisor, board member and investor.

AI isn’t going to kill security products anytime soon, not even close. 

Over the past several months, I have heard some people say, “I can now vibe code most of the security products over the weekend”, predicting that the wave of vibe coding will lead enterprises to stop buying SaaS. In my opinion, this could not be further away from the truth.

People who believe enterprises buy software only because they can’t build it in-house fundamentally misunderstand how large organizations operate. Open source has been around for decades, so why do enterprises still spend millions on freely available software? Because at their scale, the real cost isn’t in per-seat licenses; it’s in maintenance, reliability, and support.

Once a company reaches 5,000 employees (and definitely beyond 25,000), it needs scalable systems of ownership, maintenance, and accountability. If everyone just vibe coded their own tools and moved on, the whole structure would collapse. Every large enterprise already has a few internal tools whose creators have left (or even passed away), leaving behind fragile systems no one is brave enough to touch. That’s exactly why they choose to buy, not build, and that’s why they are so careful about throwing AI at problems.

Another aspect of security is that it is all about depth. Sure, anyone can vibe code some high-level basic system that will ingest cloud configs and output some findings. That is indeed very easy. However, to make it work for enterprise scale, enterprise complexity, and enterprise environments, for that, no vibe coding will be enough. More critically, to identify risks in complex systems, security products have to be five inches wide and 10 feet deep, and that depth is something that comes from human expertise, research, and clear focus, not from telling Claude to write some “cloud detection logic”.

"What you mean you’re going to hire developers? *You* are the developers!”

That’s what Tomer Weingarten’s dad told him when Tomer said, “We’re building a company, so we’re hiring developers,” back when he was starting SentinelOne. Tomer shared this story on the latest Inside the Network episode Sid Trivedi, Mahendra Ramsinghani, and I released a few days ago and it's worth a listen. 

These days, I often meet people who haven’t worked in security or infrastructure but who saw that Wiz got acquired for ~$40B and decided that "it's time to get into cyber because it's hot". I even met people who think they can just use Claude or GPT to build security products for enterprises, with no experience in security or coding. 

That’s not how it works. AI has given many people the illusion that expertise no longer matters but in reality, it matters more than ever. AI gives you speed, but you still need to know in what direction you're trying to go and roughly how to get there. 

Check out the latest Inside the Network episode if you haven't already, it's gold.

For years, everyone was saying "CISOs have to become business leaders" and now that they did, you see plenty of upset startups. You see, in 2025, you can’t scare a CISO, you need to show real ROI. 

ROI doesn't mean "Here's more work for the security team so that your company is more secure". ROI means doing more with less, saving money on expensive tooling, saving money on headcount, cutting the amount of time needed to do stuff, and on and on and on. I have never been more convinced that the playbook of "Here's this scary threat, you have to buy a tool to guard against it" is dead. 

It's not that FUD doesn't work at all; it still kinda does but only for prioritization, and it's weaker than people think. ROI wins over FUD, ROI + FUD wins over ROI. That's the math.

AI doesn’t make it much easier to build security startups. Here's why: 

1. AI doesn’t really make it significantly easier to validate demand in security. 

AI prototyping tools can help gather feedback, learn about the problem, and even plan what capabilities should be prioritized first based on user feedback. The one thing prototypes do a poor job at is validating that someone is going to pay real money (which is what validating demand is). 

2. AI doesn’t significantly expedite go-to-market in security

Andrew Peterson of Aviso Ventures puts it well: “AI is changing how fast you can build products and features but it isn’t changing how slow sales cycles are in security. This will continue to hamper the speed of growth in infosec despite the increased speed to build features."

If building a feature drops from 9 to 6 months, that’s a big win. But if selling it still takes a year, the overall timeline only shrinks from 21 to 18 months and may even grow as security teams scrutinize AI-generated code. Faster development means little if sales cycles don’t shorten too.

3. AI doesn’t make it possible to avoid hiring senior engineering talent

Experience and domain expertise still matter, especially for scale, reliability, and precision all of which are so important in security. The best teams pair great engineers with great tools and companies that lean too heavily on AI without guardrails will drown in technical debt. 

AI does enable startups to solve problems that were fundamentally unsolvable before. In addition, it amplifies a lot of the security problems our industry has been trying to solve (data security, SaaS security, third-party risk management, etc.). All this creates new possibilities, new problems, and therefore new markets and new opportunities.

However, what AI doesn’t do in my view is change how security companies are built. It does make some things like prototyping easier, but it doesn’t make a bad idea a good one, and it doesn’t make “this looks good” a real validation. AI makes great developers even more productive than before, but it doesn’t turn a junior developer into a senior, or an unmotivated developer into a 10x high-performing engineer. In other words, AI is a great amplifier, but it’s not a compensator.

Let me say this out loud: the rate of growth of cyber startups will never match the rate of growth of the new AI companies. Even new AI x security companies won't just fly off the shelves because they are AI-native. 

The reason is pretty simple: in cyber, growth moves with the speed of trust, not the speed of shipping new features. Interestingly enough, as AI is accelerating the speed of shipping new features it's actually extending the speed of trust so POCs can become longer. 

If the current trend continues, I think it's going to drive a lot of the tourist VCs out of cyber because they just won't be able to justify investing in "slower-growing" security companies over all these "AI supernovas" with $10M ARR after one year. Looking at this nice chart from Bessemer, cyber is gonna stay as "Cloud Centaur" by default and by design. 

Over the long term, this is going to be a good thing for the industry, I think. 

And yet, none of this changes the fundamentals of the security market, the fact that cyber is a trillion-dollar opportunity, and that there will be many fantastic returns. It's just that successful companies in cyber will probably look like pretty average AI startups in other industries if all you look at is ARR. 

P.S. Yes, I know, there's Delve and similar companies that are "AI-native and cyber" but I'll stand my ground that the reason they're growing so fast is because they are sales enablement tools and not security or compliance tools. What they do is super valuable but it's a different market ("get your cert to sell to enteprises") with different rules of the game.

taplio

Ross Haleliuk's Linkedin Analytics

Ross Haleliuk

Performance ScoreRoss Haleliuk's LinkedIn Performance

What is Ross talking about?

Who is engaging with Ross

Ross Haleliuk's Best Posts (last 30 days)

Ready to grow your LinkedIn presence?

taplio

.css-6ytdur{background-image:linear-gradient(284deg, rgba(39, 43, 72, 1) 0%, rgba(33, 47, 183, 1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Ross Haleliuk's Linkedin Analytics

Ross Haleliuk

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Ross Haleliuk's LinkedIn Performance

What is Ross talking about?

Who is engaging with Ross

Ross Haleliuk's Best Posts .css-1emoo84{font-size:var(--chakra-fontSizes-md);font-weight:400;color:var(--chakra-colors-gray-600);}(last 30 days)

Ready to grow your LinkedIn presence?

Ross Haleliuk's Linkedin Analytics

Performance ScoreRoss Haleliuk's LinkedIn Performance

Ross Haleliuk's Best Posts (last 30 days)