Oso’s Series A deck is a masterclass in narrative framing for developer tools. By positioning authorization as a 'mess' that forces engineering teams into high-friction, undifferentiated work, Oso creates a compelling case for a dedicated, developer-first solution. The deck effectively uses social proof and specific case studies—such as Gusto’s 10-month refactor—to quantify the pain of the status quo. While the deck is light on traditional financial metrics like ARR or CAC, it leans heavily on technical credibility, citing a Rust-based core and a team with deep roots at MongoDB. The presentat…
Key takeaways
- The deck frames the problem as a friction gap, contrasting developer-friendly tools like Stripe and Twilio against high-friction security legacy systems (Slide 3-4).
- Oso uses a specific case study from Gusto to illustrate that building internal authorization can take a team 10 months of work (Slide 10).
- The product is described as an embedded policy engine built on a Rust core, supporting cross-platform and cross-language deployment (Slide 12).
- Market sizing is calculated by aggregating related markets: $10B for IAM, $3B for AppSec, and $17B for Infrastructure Protection (Slide 15).
- The competitive landscape is categorized into DIY, specialized tools like Styra/OPA, and legacy InfoSec tools like Axiomatics (Slide 16).
- The team slide emphasizes technical pedigree, highlighting a CEO from MongoDB and a CTO with a PhD from Cornell Tech (Slide 18).
- Oso claims strong engagement signals after only 14 weeks with approximately zero marketing investment (Slide 14).
- The deck identifies two distinct entry points: 'Greenfield' for new apps and 'Brownfield' for legacy migrations (Slide 13).
The Narrative of Developer Friction
Oso’s pitch deck for their $8.2M Series A is a study in how to sell to investors by focusing on the 'maker' experience. In the world of enterprise software, security is often viewed as a bottleneck. Oso flips this by positioning their tool as a way to remove friction, placing them in the same category as developer favorites like Stripe and Twilio.
Slides 1-2: The Hook
Slide 1 introduces the brand with a minimalist logo—a bear (Oso) made of stippled dots. Slide 2 immediately dives into the cultural context, showing a Meetup event titled 'Why Developers Don’t Care about Security.' This sets the stage: there is a disconnect between security requirements and developer priorities. By starting here, Oso isn't just selling a tool; they are selling a solution to a cultural and workflow problem within engineering organizations.
Slides 3-6: The Friction Gap
Slides 3 and 4 use a simple horizontal axis to define the market. On the left, 'Low Friction' tools like Stripe, Twilio, and AWS are the gold standard for developers. On the right, 'High Friction' legacy security products like SAML, OpenLDAP, and AWS IAM are depicted as the status quo. Slide 5 delivers the mission statement: 'We put security in the hands of the makers.' Slide 6 reinforces this with a tweet from Charity Majors, a well-known figure in the dev-tools space, who describes the category as 'Consumer-quality developer tools.'
Slides 7-10: Defining the Mess
Slide 7 simply says 'Authorization,' transitioning the deck from general security to Oso's specific niche. Slide 8, titled 'Authorization is a mess,' shows a chaotic mix of code snippets, databases, Active Directory, and Auth0. The argument is that authorization is currently fragmented across too many layers. Slide 9 explains that dev teams repeat this 'undifferentiated work' across every new project, from HR SaaS to Banking APIs. Slide 10 provides the 'ah-ha' moment with a case study from Gusto. It quotes an engineering blog stating that layering granular authorization into their app took a team 10 months. This slide is crucial because it quantifies the 'wall' that growing companies eventually hit.
Slides 11-12: The Oso Solution
Slide 11 asks 'What is Oso?' and answers it by showing a code snippet of a 'VC policy.' The benefits are split into 'Why anything?' (delegate to experts, write less code) and 'Why Oso?' (single place for auth, natural language, deploy in seconds). Slide 12 gets technical, highlighting the 'Embedded policy engine' and the 'Rust core.' Mentioning Rust is a strategic move to signal performance, safety, and modern engineering standards to technical investors.
Slide 13: Use Cases and Implementation
Slide 13 addresses the 'how.' It divides the market into 'Greenfield' (new applications) and 'Brownfield' (existing applications). While the specific company names are redacted in this public version, the slide lists use cases like 'basic RBAC,' 'GraphQL,' and 'export control.' This demonstrates that Oso is versatile enough to be integrated into legacy systems, not just new builds.
Slide 14: Traction and Social Proof
Slide 14 claims 'Strong signs of engagement after 14 weeks' despite having '~no marketing investment.' It features two testimonials. Karan Talati (CEO at First Resonance) claims his team got up to speed with one engineer in three weeks. Gaurub Pandey (CTO at Dhi) claims Oso sped up their roadmap by 4x. These quotes serve as a proxy for traditional growth metrics, which might be early at this stage.
Slide 15: Market Opportunity
Slide 15 attempts to size the 'Multi-billion dollar opportunity.' Rather than just picking a large number, they break it down into related Gartner-sourced markets: IAM ($10B), AppSec ($3B), and Infrastructure Protection ($17B). They also map 'App Authorization' spend to specific project costs, ranging from $1M for Gusto to $1.8M for an infrastructure tech company. This helps investors visualize how small project-level wins aggregate into a massive TAM.
Slide 16: The Competitive Landscape
Slide 16 categorizes the competition into three buckets: DIY (Active Directory, Auth0, Open Source), Specialized (Styra/Open Policy Agent), and InfoSec Tools (Axiomatics, Authress). Oso positions itself as the only option that avoids architectural limitations (like data segregation in OPA) while remaining developer-centric (unlike legacy InfoSec tools).
Slides 17-18: The Roadmap and Team
Slide 17 outlines the plan to 'Double down on unique foundation.' The goals include more 'batteries' (built-in features), more integrations, and tripling the headcount with a focus on engineering. Slide 18 introduces the team. CEO Graham Neray is highlighted for his time at MongoDB, and CTO Sam Scott is noted for his PhD from Cornell Tech. The presence of high-profile angel investors like Dev Ittycheria (CEO, MongoDB) and Charity Majors (CTO, Honeycomb) adds significant credibility to their 'bottom-up GTM' strategy.
What Makes This Deck Work
Clear Problem Definition: The 'Authorization is a mess' slide (Slide 8) is visceral for anyone who has managed a software project. It uses visual clutter to represent technical debt. · Quantified Pain: The Gusto example (Slide 10) is the strongest part of the deck. Telling an investor that a company spent 10 months on a single feature is a much better way to sell a $1M+ solution than just saying 'it's hard.' · Developer Credibility: By mentioning Rust, Prolog-inspired logic, and a team from MongoDB, Oso speaks the language of the people who will actually use the product. · Strategic Market Sizing: Instead of claiming they will own the entire $10B IAM market, they show how they fit into the existing spend of major tech companies.
What Is Missing
Revenue and Financials: There is no mention of current revenue, pricing models, or customer acquisition costs. This is common for early Series A dev-tool decks, but it leaves the 'Commercial product' (Slide 17) as a bit of a question mark. · The Ask: The deck does not explicitly state how much they are raising or the terms of the round, though catalogue data confirms it was an $8.2M raise. · Churn and Retention: While they mention 'engagement,' there is no data on how many developers continue to use the tool after the initial 14-week period.
Founder Takeaways
Use 'Friction' as a Metric: If you are building a developer tool, your primary enemy is friction. Map your product against legacy competitors on a friction axis to show your value proposition clearly. · Leverage Social Proof Early: Even if you don't have thousands of users, a few high-quality testimonials from respected CTOs can carry a deck through a Series A. · Show, Don't Just Tell, the Code: Including a small, readable code snippet (Slide 11) helps technical investors understand the product's elegance immediately. · Categorize Your Competition: Don't just list names. Group competitors by their 'fatal flaw' (e.g., 'Optimized for security instead of developers') to make your positioning undeniable.
Frequently asked questions
- What is the core problem Oso is solving?
- Oso addresses the 'mess' of application authorization. According to Slide 8 and 9, developers currently waste time on 'undifferentiated work' by hardcoding roles and logic into databases and codebases. This leads to high-friction environments and eventual 'walls' where teams must spend months refactoring their security infrastructure as the application scales.
- How does Oso differentiate itself from competitors?
- Oso differentiates by prioritizing 'developer experience.' Slide 16 critiques competitors like Styra/OPA for having architectural limitations and data segregation issues. Unlike legacy InfoSec tools optimized for security teams, Oso positions itself as a library that developers can deploy in seconds, using a policy language that feels like natural language.
- What evidence of market demand does the deck provide?
- The deck provides qualitative social proof and project-based spend estimates. Slide 14 features testimonials from CEOs and CTOs claiming Oso 'sped up our authZ roadmap 4x.' Slide 15 translates this into dollars, estimating that a single authorization project at a company like Gusto represents $1M in spend.
- What is the technical foundation of the product?
- Oso is built on a Rust core, which allows it to be cross-platform and cross-language (Slide 12). It functions as an embedded policy engine that reaches directly into the application, utilizing a logic-based language inspired by Prolog to handle complex authorization rules.
- What is missing from the Oso pitch deck?
- The deck notably lacks a slide on unit economics, churn, or specific revenue figures. There is no mention of the current ARR or the specific valuation sought. Additionally, while it mentions a 'Commercial product' in the roadmap (Slide 17), it does not detail the pricing tiers or specific sales strategy beyond 'bottom-up GTM.'
