Awake Security Pitch Deck Breakdown: Dominating the NDR

What this deck actually is

The Awake Security pitch deck is a Series C-stage fundraising document (labeled as a $30M raise following a Series B) used to position the company as the emergent leader in the Network Detection and Response (NDR) category. Dating from April 2020, the deck is a masterclass in displacement-based selling. It focuses heavily on how Awake replaces "legacy" incumbents like RSA, Cisco, and Darktrace, positioning itself not just as a tool, but as the third pillar of the modern Security Operations Center (SOC) visibility triad alongside SIEM and EDR.

The single most important finding in this deck is its aggressive competitive positioning through quantified displacement case studies . Rather than speaking in abstractions, the deck provides five distinct "Displacement Case Studies" that name competitors by name, cite specific Fortune-tier industries, and highlight contract values in the 6-to-7-figure range. This signals a mature, high-velocity sales motion capable of unseating established incumbents.

Slide-by-slide walkthrough

Slide 1: Title Slide

The title slide establishes immediate industry credibility. It features the company name, "AWAKE," alongside the descriptor "Advanced Detection and Response for the Hybrid Cloud." The bottom right is dedicated to third-party validation: RSA Conference Finalist for Most Innovative Security Company 2018, Business Insider’s 30 Hottest Security Startups, and an ETR+ ranking as the #1 security solution in the Global 1000.

An investor reads this and immediately understands that Awake is a "hot" commodity in the enterprise security space. The mention of the Global 1000 ranking is particularly potent because it moves the narrative from "startup with potential" to "solution already validated by the world's largest buyers." The timestamp (April 2020) suggests this deck was being shopped at the very beginning of the COVID-19 pandemic, making the "Hybrid Cloud" focus highly relevant to the sudden shift in remote work.

The strongest version of a title slide usually includes a one-sentence value proposition that explains how the detection is advanced. While the awards are impressive, the slide is purely focused on social proof rather than the core mechanism of the product. However, for a late-stage round where brand momentum is key, this is a standard and effective layout.

Slide 2: Opportunity

This slide states the vision: "To be the market leader in cyber detection and response for the hybrid cloud." The visual is a 3D rendering of a computer monitor displaying a dashboard, which provides a tangible, if distant, look at the product interface.

This is a standard "vision" slide. It defines the sandbox Awake plays in (Detection and Response) and the environment it secures (Hybrid Cloud). By claiming the "market leader" aspiration, it sets the stage for a deck that needs to prove it has the growth rates and competitive wins to justify that title.

A stronger version of this slide would define the "Opportunity" in dollars or specific pain points rather than just an aspiration. "Leader" is a title one earns; the "Opportunity" is usually the market gap that allows one to earn it. The slide is a bit light on substance, serving more as a transition than a data point.

Slide 3: Executive Summary

This slide serves as the high-level roadmap for the deck. It covers four quadrants: Team (65 employees), Differentiators (Ava, EntityIQ, Adversarial Modeling), Key Customers (Cisco/RSA/Darktrace displacement), and Current Investment (Bain and Greylock). It explicitly states a fundraise goal of $30M.

For an investor, this is the "cheat sheet." The mention of Greylock and Bain Capital Ventures provides an immediate "pedigree" check—these are top-tier firms that have already de-risked the early stages. The mention of 65 employees gives the investor a sense of the company's burn and scale. The $30M target suggests a Series C round aimed at scaling the sales motion described in the "Key Customers" section.

The strongest version of this slide would include a "Current Momentum" metric, such as ARR growth or NRR (Net Revenue Retention). While it mentions "Strong customer traction," providing a specific percentage or growth multiple here would make the $30M ask more compelling. The term "unreasonable in our goals" is a subjective culture note that adds flavor but lacks the weight of the other data points.

Slide 4: Awake Market Opportunity

This slide provides a quantitative breakdown of the market. It compares the broader Information Security market ($121B to $182B) with the specific Network Detection & Response (NDR) segment ($1.9B to $3.8B). It also lists the market caps of leaders in adjacent categories: Palo Alto ($20B), Proofpoint ($6B), and CrowdStrike ($13B), noting an average $6B market cap for pure-play security companies.

The investor takeaway here is about the "Exit Potential." By showing CrowdStrike and Palo Alto Networks, Awake is saying, "We are the equivalent leader for the NDR category." The CAGR data (14.1% for NDR vs 8.3% for broader security) justifies why this specific sub-sector is worth a $30M investment—it is growing significantly faster than the market at large.

This is a very strong slide because it uses credible third-party sources (Gartner, Momentum Cyber). It clearly defines the "Why Now" by showing the growth trajectory. The only improvement would be a more explicit calculation of Awake's specific TAM (Total Addressable Market) based on their seat-based or sensor-based pricing model, rather than just quoting Gartner’s total market spend.

Slide 5: Leadership Team

The team slide features nine executives and four board members/advisors. The logos at the bottom are a "who's who" of cybersecurity: Cisco, FireEye, Symantec, McAfee, Palo Alto Networks, and Carbon Black. Notably, it includes Kevin Mandia (CEO of FireEye) and Enrique Salem (former CEO of Symantec) as board members.

This is arguably the deck's strongest slide. In enterprise security, "who you know" and "where you've been" are critical for breaking into the Global 2000. Having the former CEO of Symantec and the founder of Mandiant on the board gives Awake instant access to every CISO in the world. The management team’s experience across "Security, Networking & Data Science" covers the three technical pillars required for NDR.

The slide is excellent as-is. The only minor improvement would be to specify the roles these individuals held at the logoed companies (e.g., "Former CTO" vs "Engineer"), although the "Deep Expertise" headline and the board titles mostly handle this.

Slide 6: Key Customers & Pipeline

This slide is entirely redacted, featuring two large white rectangles with the word "REDACTED" in pink. It is intended to list the logos of current customers and high-probability pipeline deals.

An investor seeing this in a public-facing version of the deck understands that the company protects the privacy of its enterprise clients—which is expected in security. In a live pitch, these would be the names that prove the "Global 1000" claim from Slide 1.

While redaction is necessary for public versions, a "stronger" version for an investor would at least categorize the customers by vertical (e.g., "3 of the top 5 US Banks," "2 Global Pharma Leaders") to show market breadth without naming names.

Slide 7: The Analyst Perspective

This slide utilizes the "Gartner SOC Visibility Triad" to position Awake. It places Awake as the NDR leg of a triangle that includes SIEM/UEBA (Splunk, IBM) and EDR (Cylance, Carbon Black). It includes quotes from Gartner and 451 Research emphasizing that network traffic is "one of the only options" for visibility into unmanaged IoT and mobile devices.

This is a strategic positioning masterstroke. Awake is telling investors, "You've already invested in EDR and SIEM; those categories are mature. NDR is the missing third piece, and it's now a 'must-have' for compliance and multi-cloud." It moves NDR from a "nice to have" to a structural necessity for an enterprise security stack.

The slide is highly effective. It uses external authority to validate the company's existence. The strongest version might include a small "Awake Differentiator" note within the triangle to show why they beat the other NDR players mentioned in the Gartner report, but the focus on the "Triad" is generally sufficient for a Series C narrative.

Slide 8: The Challenge

The slide highlights three core problems: >50% of devices are "unmanaged" (IoT, etc.), ~50% of breaches involve no malware (living-off-the-land attacks), and there are >3M unfilled security jobs. These are connected by red triangles, suggesting a downward pressure on security teams.

This slide defines the "Enemy." The enemy isn't just hackers; it's the complexity of the "New Network" and the lack of human talent to manage it. By citing the 3M unfilled jobs, Awake sets up the value proposition for "Ava," their autonomous expert system, which is mentioned in Slide 3.

The slide is clear and punchy. To make it stronger, it could connect these challenges directly to the "Answers" on the next slide. Currently, these are three disparate facts; a "So what?" statement would bridge the gap to the solution more effectively.

Slide 9: Alerts -> Answers

This slide shows a "Before and After" scenario. On the left is raw log data (text-heavy, timestamped JSON). On the right is a clean, visual dashboard. The headline is "Reducing Time, Cost & Risk of Security Operations."

Investors love efficiency plays. The "From Alerts... To Answers" phrasing suggests that Awake isn't just another tool that generates noise; it's a tool that provides solutions. This directly addresses the "3M unfilled jobs" problem from the previous slide by implying that the software does the heavy lifting that a human analyst would normally have to do.

The strongest version of this slide would quantify the time savings. "Reducing Time" is a claim; "Reduces Mean Time to Resolution (MTTR) by 70%" is a data point. The visual comparison is good, but metrics would make it undeniable.

Slide 10: The Awake Security Platform

This slide breaks the platform into three value pillars: See the New Network (Hybrid-cloud & IoT), Know Current Threats (Insider & External), and Protect with High ROI (Automate with an expert system).

This is a high-level product architecture slide. It confirms that the product handles the three major phases of security: visibility, detection, and response. The inclusion of "High ROI" is a nod to the CFO as much as the CISO, acknowledging that budgets in 2020 were under scrutiny.

This slide is a bit generic. It uses standard icons and "marketing-speak." A stronger version would include a screenshot of the actual "Expert System" (Ava) or the "EntityIQ" mentioned in the summary, giving the investor a glimpse of the proprietary tech mentioned earlier.

Slide 11: The Future of Detection & Response

This slide uses a quadrant-style chart to show the evolution of security. It plots "Threat Complexity" against "Security Maturity." Awake is positioned at the top right, representing the "Predictive" stage and "Intent Detection," moving beyond reactive Intrusion Detection or proactive Anomaly Detection.

This is a classic "Up and to the Right" slide. It attempts to create a new category ("Intent Detection") and place Awake at the summit. By labeling Anomaly Detection (which many competitors like Darktrace use) as a lower level of maturity, Awake is subtly undermining its competition.

The slide is effective for positioning, but "Intent Detection" is a bold claim that requires a technical explanation. How does software know "intent"? Without a brief explanation of the "Adversarial Modeling" mentioned in the summary, this can come across as "magic" rather than "technology."

Slide 12: Why We Win? Key Differentiators

This slide lists five bullet points: support for the new network, tool consolidation, autonomous entity tracking (EntityIQ), adversarial modeling, and autonomous triage (Ava).

This slide finally puts names to the proprietary tech mentioned in the executive summary. "Autonomous triage" is the most compelling point here, as it addresses the labor shortage mentioned earlier. The "Consolidates various network tools" point is also a strong financial argument for a $30M round—Awake is a platform play, not a point solution.

The slide is text-heavy. The strongest version would pair each bullet point with a specific outcome (e.g., "EntityIQ: Track devices even as IPs change, reducing false positives by X%").

Slide 13: Detection and Response for the Hybrid Cloud

This is a technical architecture diagram. It shows Awake Sensors across On-Premise, PaaS/IaaS, and SaaS, feeding into the "Awake Nucleus" (the brain), which then interacts with "Ava" (the expert system) for autonomous response.

This slide clarifies the "Hybrid Cloud" claim from Slide 1. It shows that Awake is not just a hardware appliance in a data center; it has software sensors that can see into AWS/Azure and SaaS apps. The "Nucleus" and "Ava" relationship clarifies how the data is processed and acted upon.

This is a solid architecture slide. The strongest version would show where the "Response" actually goes—does it integrate with a firewall to block an IP? Does it send a ticket to ServiceNow? The "Autonomous Response" arrow is a bit vague on the actual enforcement mechanism.

Slide 14: RSA Netwitness Displacement Case Study

This is the first of five displacement slides. It details a Fortune 100 Media company where Awake replaced RSA Netwitness. It cites a 60 Gbps deployment, 7-figure contract value, and reasons for winning: lower storage costs and broader use cases.

For an investor, this is "The Proof." Replacing a legacy giant like RSA in a Fortune 100 account is a significant achievement. The "7-figure" price tag justifies a high valuation. It shows that Awake is not just winning "Greenfield" (new) accounts but is actively taking budget away from established players.

This slide is very strong. The inclusion of the "7 Figures" figure is key. The only missing piece is the "Before and After" metric—did they reduce the number of analysts needed, or did they find threats that RSA missed? The "Why Awake?" section touches on this, but more data would be better.

Slide 15: Land, Renew & Expand Case Study

This slide focuses on a Fortune 200 Retailer with 3,000+ store locations. It highlights a "High 6-figure" renewal and expansion. The win was based on a "single pane of glass" visibility across distributed locations.

This slide addresses "Retention" and "Scalability." It shows that once Awake is in, the customer stays and buys more. For a Series C investor, Net Revenue Retention (NRR) is a critical metric, and this case study provides a narrative for why NRR would be high.

A stronger version would explicitly state the expansion percentage (e.g., "Expanded from 1,000 to 3,000 locations, a 3x increase in ACV"). The "Redacted" strip over the map is a nice visual touch that emphasizes the global nature of the deployment.

Slide 16: Incident Response to Product Sale Case Study

This slide features a Fortune 500 Oil & Gas company. It shows a "High 6-figure" deal where Awake was initially brought in for Incident Response (IR) and was then purchased as a permanent product. It notes a win over a SIEM.

This highlights a "Trojan Horse" sales strategy. By being the tool used during a crisis (an incident), Awake proves its value immediately, leading to a permanent sale. This is a highly efficient customer acquisition cost (CAC) model.

The slide is good, but comparing "Awake VS. SIEM" is interesting because earlier the deck said Awake complements SIEM (the Triad). The slide should clarify if they replaced a specific SIEM use case or the entire SIEM budget for that location, as the latter would contradict the earlier "Triad" narrative.

Slide 17: Darktrace Displacement Case Study

This slide shows a displacement of Darktrace (a major NDR competitor) in a High Tech company. It notes a "High 6-figure" deal and highlights "Advanced threat hunting" and "Managed NDR" as the reasons for the win.

This is the "Competitive Dominance" slide. Darktrace is the most direct competitor mentioned in the market charts. By showing a direct win against them, Awake is telling investors that they have superior technology, not just better marketing. The mention of "Managed NDR" suggests Awake has a service component, which adds to its stickiness.

The strongest version would be more specific about why Darktrace was displaced. "Advanced threat hunting" is a bit vague; "Finding X% more threats with 50% fewer false positives" would be a much more devastating competitive data point.

Slide 18: Cisco Stealthwatch Displacement Case Study

This slide details a win against Cisco Stealthwatch in a Finance company. It's a "6-figure" deal focused on GDPR/PCI compliance and Shadow IT visibility.

This proves Awake can compete with the biggest players in the networking space (Cisco). It also highlights "Shadow IT," which connects back to the "Unmanaged Devices" problem on Slide 8. It shows the product is versatile enough to handle both security and compliance needs.

Like the other case studies, this is strong. However, having five case studies with the exact same layout (text on left, map on right) starts to feel repetitive by Slide 18. Consolidating these into a single "Competitive Wins" table might have kept the momentum higher, though the individual focus does emphasize the scale of each win.

Slide 19: Path to the First $100M

This slide is a pyramid showing the target market: 1,200 companies with >$10B revenue, 10,800 with $1B-$10B, and 15,500 with $500M-$1B. The total market identified is $8.9B across 27,500 enterprises.

This is the "Scale" slide. It shows that Awake has a clear plan for reaching $100M in revenue by targeting these three tiers. The "ASP" (Average Selling Price) is redacted, but the math is there: they know exactly how many customers they need in each tier to hit the goal.

This is a very professional market segmentation slide. It shows the company is thinking about its "Go-to-Market" (GTM) strategy with mathematical rigor. The inclusion of source links (Forbes, World Bank) adds to the credibility.

Slide 20: Financial Metrics (Redacted)

This is a placeholder slide for detailed financials and forecasts.

In a real presentation, this is where the Series C investor spends 50% of their time. They would look at ARR, Burn, CAC, LTV, and Magic Number. Since it’s redacted here, we can only infer that the company has these metrics ready to go.

For a teardown, we note that the presence of this slide confirms the deck was used for serious late-stage due diligence, not just a high-level pitch.

Slide 21: Summary

This slide is an identical copy of Slide 3 (Executive Summary), repeating the Team, Differentiators, Key Customers, and Fund Raise ($30M) points.

Repetition in a pitch is useful for "bookending" the presentation. It brings the investor back to the core "Why" after they've seen the technical and competitive details. It reinforces the $30M ask.

The slide is functional. A slightly stronger version would update these points with the new information learned in the deck—for example, instead of just saying "Strong customer traction," it could say "Proven 7-figure displacement wins at Fortune 100s."

Slide 22: Closing / Thank You

The final slide includes the slogan "See More. Know More. Protect More," the contact info, and the copyright. The color scheme is consistent with the rest of the deck.

Standard closing slide. It keeps the contact info visible during the Q&A portion of a pitch.

Slide 23: Appendix - The Malicious Insider Case Study

This appendix slide tells a story of an IT contractor tapping into a VoIP phone system. Awake identified the cluster of phones and the encrypted data exfiltration. The visual is an iPad showing a network diagram.

This provides a "real-world" example of the product in action. It moves the conversation from "features" to "outcomes." Investors like these stories because they can visualize the software "catching a bad guy."

This is a great slide for the Q&A. The strongest version would include a timeline: "Attacker tapped phones at 10:00 AM; Awake alerted at 10:02 AM; Incident resolved by 10:15 AM."

Slide 24: Appendix - The Nation State Threat Case Study

This slide describes a Russian remote access tool found on a Windows 2003 server at a Municipal Water Authority. It highlights the "EntityIQ" feature which profiled the device.

This hits the "Critical Infrastructure" and "Nation State" buzzwords, which were (and are) major themes in cybersecurity. It shows the product's ability to handle "legacy" systems (Windows 2003) which are common in OT (Operational Technology) environments.

The laptop graphic showing the actual software interface is excellent. It shows that the UI is professional and provides detailed data points (OS, MAC address, Risk Level).

Slide 25: Appendix - The Targeted Attack Case Study

The final slide describes a malicious Chrome extension used to steal AWS credentials from a financial services company. It shows how an on-premise asset was used to hack the cloud.

This brings the narrative full circle to the "Hybrid Cloud" visibility mentioned on Slide 1. It proves that Awake can track threats as they move across different environments (from a browser extension to cloud infrastructure).

This is a strong technical proof point. It demonstrates "Lateral Movement" detection, which is a key requirement for modern security tools. The 3D monitor visual is consistent with the rest of the deck’s design language.

Concrete fixes in priority order

Quantify the Differentiators: The terms "EntityIQ," "Ava," and "Adversarial Modeling" are used repeatedly but never fully explained in terms of their technical advantage or quantitative impact. The deck should explicitly state how much faster Ava is than a human analyst or what percentage of false positives EntityIQ eliminates. · Resolve Positioning Contradictions: Slide 7 positions Awake as a complement to SIEM (part of the triad), while Slide 16 highlights a win against a SIEM. The deck needs to clarify if it is a replacement or a companion, as an investor will want to know if the TAM is limited to "triad expansion" or if it includes "SIEM replacement." · Include Growth Metrics: For a $30M Series C, the absence of high-level growth percentages (e.g., "3x YoY growth") makes the "Executive Summary" feel more like a Series A slide. Even if specific dollars are redacted, the multiples of growth should be highlighted to justify the round size. · Consolidate the Case Studies: Five individual slides for displacements (Slides 14-18) leads to repetitive reading. A single, high-impact table comparing Awake against all four mentioned competitors across five categories (Cost, Visibility, Automation, etc.) would be more efficient and demonstrate broader market dominance. · Define the "Intent Detection" Mechanism: Slide 11 claims a new category of "Intent Detection." Since this is a core differentiator, the deck needs a simplified technical explanation of how intent is calculated to avoid it being dismissed as marketing hyperbole.