Why Menlo Ventures invested in Sonrai

About Menlo Ventures

Menlo Ventures provides capital for consumer, enterprise, and life science technologies from seed to growth stages.

• San Francisco, California, United States
• 51-100
• Venture Capital
• Early Stage Venture, Late Stage Venture
• www.menlovc.com

 About Sonrai

Sonrai Security delivers enterprise cloud security for companies running on AWS, Azure, and Google Cloud.

• New York, New York, United States
• 51-100
• Series C
• Private
• sonraisecurity.com

Our Investment in Sonrai

The shift to the cloud is inevitable. And with that shift, cloud identity and data governance become primary concerns.

As enterprises move first to one public cloud, and later to multiple clouds, the problems around Privilege Access Management, configuration drift, and sensitive data loss become increasingly complex.

A single company could have 75,000 compute resources open, 20,000 of which are active at any given time, more than 200 AWS and Azure accounts, hundreds of cloud services, and thousands of services roles, with multiple DevOps teams continuously dropping hundreds of workloads and infrastructure as code.

Impressive? Yes. But also incredibly complex—especially if it’s your job to secure and protect that organization.

Introducing Sonrai Security

And this is where Sonrai Security, the newest addition to the Menlo portfolio, comes in, to automatically and elegantly address this complexity at scale.

Sonrai Security delivers an enterprise identity and data governance platform for AWS, Azure, Google Cloud, and Kubernetes.

The Sonrai Dig platform is built on a sophisticated graph that identifies and monitors every possible relationship between identities and data inside an organization’s public cloud.

Dig’s Governance Automation Engine automates workflow, remediation, and prevention capabilities across cloud and security teams to ensure end-to-end security.

Sonrai Security solves a pervasive problem that will only become more prevalent as the trend towards public cloud usage grows.

The Team Behind Sonrai

It takes a world-class team to build such a comprehensive solution to a complex problem and then sell it to sophisticated security buyers.

The founders of Sonrai Security, Brendan Hannigan and Sandy Bird, are repeat entrepreneurs.

They founded and served as CEO and CTO, respectively, of Q1 Labs, a company they started, scaled, and sold to IBM for ~$600 million.

We know Q1’s success story well; Menlo backed them in that journey, cheering them on as they developed a concept communicated on PowerPoint slides to a company that reached $70 million in sales before their acquisition.

After the sale, Brendan and Sandy stayed on at IBM Security, again taking on CEO and CTO roles, respectively.

In three years, they grew revenues to more than $1 billion, and Gartner validated their vision documenting their products ascension from niche player to quadrant leader.

While there, IBM honored Sandy as a distinguished Fellow. This is a team to bet on, and we are proud to back them a second time.

Menlo’s Checklist for Cybersecurity Investments

Sonrai Security has many of the attributes we look for in a security investment:

• Founder DNA – VCs often crow about funding teams with founder experience and sector knowledge.
• Successful security companies tend to be led by experienced entrepreneurs who are making a second go.
• (Examples include George at Crowdstrike, Todd at Carbon Black, Nir and Rajiv at Palo Alto Networks, Stuart and Ivan at Cylance, Jay at Zscaler, and Azhar at Fireeye.
• Focus on applications and data – If the past focused on networks and devices, the present is all about users. Future security companies will be built on applications and data.
• GTM targets Global 2000 companies (not SMB) – Our analysis of the space reveals that the massive majority of security value has been created by servicing the global 2000. Very few companies reach meaningful scale selling to SMBs
• “Multi-cloud-native” DNA and architecture – “Cloud-native” must be a core design principle vs. a buzzword.
• Successful security products will be designed for the cloud and support multi-cloud, with a flexible data architecture that works wherever the data is stored.
• Key DevOps features that marry security functionality ­– As DevOps’ influence grows, security vendors must speak that language.
•  UI, ease-of-use, and graceful degradation will become important purchasing factors because DevOps teams will need to maintain products that touch the application and data.
• The future is clearly “DevSecOps.”

Conclusion

We are excited to welcome Sonrai Security to the Menlo portfolio. They are in good company, joining category leaders that include Appdome, BitSight, Dedrone, and StackRox.

We remain bullish on cybersecurity: The need for great solutions in this space will accelerate as cloud penetration increases.

The amount of enterprise spend budgeted to this category is already gargantuan: JP Morgan spends more than $600 million annually, with 3,000 security personnel on staff, while Microsoft invests ~$1 billion every year.

As we look to fund more companies in the space, we are particularly interested in:

• Cloud security (cloud workload management, cloud access controls and configuration)
• Risk management (asset and inventory tracking)
• Vulnerability ranking
• Cyber insurance
• Remote access and next-generation VPN
• The convergence of data security, compliance, and audit
• Next-gen MSSP

If you are building a company in any of these categories, we’d love to hear from you at [email protected].

You can read the rest of “Why we invested in” collection here:

See the collection