Koi’s 9-slide Series A deck is a masterclass in establishing urgency and credibility within a crowded cybersecurity market. By framing the problem as an 'evolution of endpoints' that traditional tools cannot handle—specifically targeting non-binary assets like AI models, extensions, and packages—Koi carves out a niche in a $17B market (Slide 1). The deck leans heavily on qualitative validation, dedicating entire slides to raw inbound Slack/form submissions (Slide 6) and testimonials from CISOs managing up to 130,000 endpoints (Slide 7). While it lacks a formal business model or financial proj…
Key takeaways
- The deck identifies a $17B market opportunity specifically targeting the 'evolution of endpoints' beyond traditional binaries (Slide 1).
- Koi highlights a team with experience from industry giants including Microsoft, Zscaler, Sygnia, and Akamai (Slide 2).
- The problem statement focuses on the dominance of non-binaries such as MCPs, AI models, and browser extensions (Slide 3).
- Product functionality is distilled into a three-step process: Discover, Assess, and Enforce (Slide 4).
- The 'Risk Engine' slide claims to have detected the biggest security campaigns of 2025 (Slide 5).
- Social proof is prioritized via a collage of raw enterprise inbound demand messages from security teams (Slide 6).
- Customer testimonials cite significant ROI, including one claim of eliminating the workload of 20 full-time employees (Slide 7).
- The funding ask is framed around two primary pillars: building the GTM team and supporting R&D/post-sale operations (Slide 8).
The $38M Narrative: Security for the Modern Endpoint
Koi’s 2024 Series A deck is a concise 9-slide presentation that successfully raised $38 million in a challenging venture environment. The deck’s primary strength lies in its ability to redefine a mature category—endpoint security—by focusing on a new, unmanaged attack surface: non-binary software assets. By moving away from traditional antivirus and toward the governance of AI models, browser extensions, and developer packages, Koi positions itself as a necessary evolution rather than a redundant tool.
Slide 1: The $17B Hook
The title slide is minimalist, featuring the logo and a clear value proposition: 'Koi Endpoint Security Platform.' The sub-headline immediately establishes the scale of the ambition, stating they are 'Going after the $17b endpoint protection market.' This sets a high-stakes tone for the rest of the presentation, signaling to investors that this is a venture-scale opportunity in a proven spending category.
Slide 2: Team Pedigree
Slide 2 focuses on the human capital behind the technology. The headline, 'We have built the best team to go after a $17B market opportunity,' reinforces the market size from the previous slide. The slide displays 22 team members, with the leadership row highlighting roles such as Head of GTM, Head of Customers, CPO, CEO, CTO, VP R&D, Head of Product, and Head of Finance. Crucially, it includes logos of former employers: Microsoft, Zscaler, Sygnia, Akamai, and what appears to be an Israeli intelligence unit crest. This creates immediate institutional trust.
Slide 3: Defining the 'Non-Binary' Problem
Slide 3 provides the 'Why Now?' for the investment. It argues that 'Organizations can't handle the evolution of their endpoints.' The slide categorizes the new threat landscape as 'Non-Binaries,' listing Apps, Packages, Models, MCPs, Extensions, and Containers. It features a wall of logos representing the modern developer and employee ecosystem, including Maven, NPM, DockerHub, Chrome, VS Code, Hugging Face, and Jupyter Notebooks. The implication is clear: traditional security tools protect the OS, but they don't protect the tools employees actually use to work.
Slide 4: The Three-Step Solution
Slide 4 introduces the product interface and the core workflow: Discover ('Any piece of software in your IT ecosystem'), Assess ('Every single software item's risk'), and Enforce ('Through policy-based enforcement and remediation'). The screenshot shows a dashboard inventorying items like 'Adblocker for Chrome' and 'Prettify JSON,' flagging them with severity levels like 'Critical' or 'High' based on findings like 'Malicious Activity Detected' or 'Vulnerable to Remote Code Execution.'
Slide 5: The Risk Engine and 2025 Campaigns
Slide 5 highlights the 'Risk Engine.' It features a counter showing '048923564' items scanned. A notable claim in the top right box is that the engine 'Detected the biggest campaigns in 2025.' This suggests the deck was used for a late 2024 or early 2025 fundraise, emphasizing the real-time efficacy of the platform against modern threats like Malware, Infostealers, Vulnerable code, Ransomware, and Spyware.
Slide 6: Proving Inbound Demand
Perhaps the most persuasive slide in the deck, Slide 6 is a collage of 'Enterprise Inbound Demand.' Instead of a bar chart showing growth, Koi shows raw evidence: screenshots of Retool form submissions and Slack messages. One message from a 'National Security Engineer' asks for an API key for 500 users; another from a 'Senior SOC Analyst' mentions dealing with a specific 'Cyberhaven Chrome extension info stealer issue.' This slide proves that the market is actively seeking Koi's specific solution.
Slide 7: CISO Validation
Slide 7, titled 'Don't take our word for it,' provides qualitative social proof. The testimonials are categorized by the size of the deployment, ranging from 3K to 130K endpoints. One InfoSec Director claims the product 'eliminates the workload of 20 full-time employees,' while a CISO states they have 'instructed our legal team that complete this deal is the top priority for our entire organization.' These quotes address the 'pain' and 'ROI' questions that investors typically ask.
Slide 8: The Funding Roadmap
Slide 8, 'Funding Round,' is a simple timeline showing how the capital will be deployed. It identifies two primary milestones: 'Building up the GTM team' and 'Pipeline support, pre-sale, post-sale, R&D.' While it lacks a specific dollar amount or valuation (common in decks shared post-raise), it indicates a transition from product-market fit to scaling the organization.
Slide 9: Closing
The deck concludes with a 'Thank You' slide featuring a whimsical illustration of a red airship, maintaining the consistent visual theme of clouds and flight used throughout the presentation.
What Koi Does Well
Koi excels at category reframing . By focusing on 'non-binaries' like AI models and browser extensions, they make the $17B endpoint market feel underserved. They also leverage raw social proof exceptionally well. Slide 6’s collage of inbound requests is more convincing than a polished growth chart because it shows the specific, technical language of customers who are currently 'drowning' (as Slide 7 puts it) in manual vetting processes. Finally, the team slide is positioned early to establish that this is an 'expert-led' venture, which is critical in the cybersecurity sector where trust is the primary currency.
What is Missing from the Koi Deck
The most glaring omission is quantitative financial data . There are no mentions of Annual Recurring Revenue (ARR), Net Revenue Retention (NRR), or Customer Acquisition Cost (CAC). While the inbound demand is shown, the conversion rate and deal size are left to the imagination. Additionally, there is no competitive landscape slide. While one testimonial claims they are the 'only player,' the cybersecurity market is notoriously crowded with 'shadow IT' and 'SaaS security' startups that overlap with Koi’s mission. A founder using this deck as a template should be prepared to provide a detailed data room to back up these qualitative claims.
Founder Takeaways: Copy the Proof, Not the Omissions
Founders should emulate Koi’s use of specific customer pain points . The quotes on Slide 7 aren't generic 'great product' blurbs; they mention specific endpoint counts and headcount savings. Copy the visual consistency and the problem-first approach that identifies a specific shift in the market (the 'evolution of endpoints'). However, unless you have a team with a similar pedigree and a massive influx of inbound enterprise leads, you should not omit the business model or competitive analysis. Koi likely raised on the strength of their team and early enterprise traction, but most startups will need to show the math behind the momentum.
Frequently asked questions
- How much did Koi raise with this deck?
- According to publisher-reported facts from Business Insider, Koi raised $38 million in a Series A round in 2024. The deck itself does not state the specific dollar amount requested, only the intended use of funds for GTM and R&D.
- What specific problem does Koi solve in cybersecurity?
- Koi addresses the security risks associated with 'non-binaries' that traditional endpoint protection often misses. As shown on Slide 3, this includes software add-ons, browser extensions, AI models, MCPs, and packages from repositories like NPM, PyPi, and Hugging Face.
- Does the deck include a competitive landscape or matrix?
- No. The deck does not feature a traditional competitor grid. Instead, it uses customer testimonials on Slide 7 to claim they are the 'only player in this space' and that organizations were 'drowning in vetting' before using the platform.
- What are the primary use of funds for the Series A?
- Slide 8 outlines two main areas for investment: building up the Go-To-Market (GTM) team and providing pipeline support across pre-sale, post-sale, and R&D functions. It uses a minimalist timeline graphic to illustrate these priorities.
- How does Koi demonstrate product-market fit?
- Koi uses Slide 6 to show 'Enterprise Inbound Demand' through a series of screenshots of form submissions and Slack messages. These messages show security professionals from various firms requesting POCs, pricing, and API access.
