RevealSecurity’s Series A deck is a highly technical, category-defining document that successfully raised $16M in 2023. The company targets the 'insider threat' problem, specifically focusing on authenticated users misusing enterprise SaaS and cloud platforms. By leveraging the Cyber Defense Matrix, the deck argues that while endpoint and network security are mature, the application layer remains a massive, unprotected blind spot. The narrative moves from the rising cost of breaches ($4.87M for long-lifecycle breaches, per Slide 4) to a proprietary '3rd Generation' detection method based on a…
Key takeaways
- The deck introduces 'ADR – Application Detection and Response' as a new, necessary security category on Slide 1.
- Breach costs are quantified using IBM data, showing that breaches lasting >200 days cost an average of $4.87M (Slide 4).
- The 'Impersonation Challenge' is highlighted as a primary driver, noting that bypassing MFA is 'complex but feasible' via social engineering (Slide 7).
- A gap analysis using the Cyber Defense Matrix identifies a total lack of 'Detect' and 'Respond' capabilities at the Application level (Slide 10).
- RevealSecurity positions itself as '3rd Generation' technology, moving beyond simple rules and volumetric analysis to 'Activity Flow Based Anomaly Detection' (Slide 16).
- The technical core of the product is explained through 'User Journey' mapping, identifying anomalies in sequences of authenticated actions (Slide 19).
- Risk scoring is granular, allowing sensitivity values to be assigned to specific activities within an anomalous session (Slide 22).
- The founding team presents a high-pedigree profile, with previous exits to Lytx, Gemalto, Salesforce, and F5 Networks (Slide 25).
The Category Creation Strategy
RevealSecurity’s pitch deck is a textbook example of category creation. Rather than positioning themselves as a better version of an existing tool, they spend the first third of the deck arguing that a new category—Application Detection and Response (ADR)—must exist. This is a common tactic for cybersecurity startups coming out of the Middle East (specifically Israel), where deep technical differentiation is the primary selling point. The deck, which supported a $16M Series A in 2023, focuses heavily on the 'why' and the 'how' rather than the 'how much.'
Slide 1-3: The ADR Manifesto
The deck opens with a bold declaration: ADR – Application Detection and Response . By leading with an acronym that mimics EDR (Endpoint Detection and Response) and NDR (Network Detection and Response), RevealSecurity immediately signals to CISOs and investors that they are filling a gap in a familiar framework. Slides 2 and 3 continue this branding exercise, establishing the product name TrackerIQ and the tagline 'Detect the Unknown.'
Slide 4: Quantifying the Cost of Silence
Slide 4 introduces the 'Problem' through the lens of cost. Citing the IBM Security, Cost of Data Breach Report 2021 , the slide shows a bar chart comparing breach costs based on the 'lifecycle' of the event. The data is clear: breaches lasting more than 200 days cost an average of $4.87M , compared to $3.61M for those caught sooner. This slide establishes the financial stakes: detection speed is the primary lever for reducing loss.
Slide 7: The Impersonation Challenge
This slide narrows the problem from general breaches to 'Compromised Accounts.' It highlights that attackers are no longer just breaking in; they are logging in. Key points include:
Stolen credentials and credential stuffing. · The feasibility of bypassing MFA via social engineering. · A focus on privileged users in SaaS applications and cloud platforms. · The expansion of the attack surface due to remote work and the shift from on-prem to SaaS.
This slide is crucial because it invalidates the 'perimeter' defense argument, suggesting that even 'authenticated' users cannot be trusted.
Slide 10: The Cyber Defense Matrix Gap
Slide 10 is perhaps the most effective 'Gap Analysis' slide in recent cybersecurity decks. It utilizes the Cyber Defense Matrix (sourced from cyberdefensematrix.com) to map security functions (Identify, Protect, Detect, Respond, Recover) against asset classes (Devices, Applications, Networks, Data, Users). The 'Applications' row shows tools for 'Identify' (SAST/DAST) and 'Protect' (WAF), but the 'Detect' and 'Respond' columns are empty, save for the RevealSecurity logo. This visual proves that the current security stack has a structural hole that only ADR can fill.
Slide 16: Generational Evolution
To further differentiate, Slide 16 positions RevealSecurity as '3rd Generation' technology. It contrasts their approach with:
1st Generation: Simple rules and IP deny-lists. · 2nd Generation: Volumetric and frequency analysis (SIEM, UEBA, CASB) which relies on single thresholds per event. · 3rd Generation: RevealSecurity’s 'Activity Flow Based Anomaly Detection,' which analyzes sequences of events rather than isolated actions.
This framing moves the conversation away from 'we have better AI' to 'we have a better architectural approach.'
Slide 19-22: The Technical 'How'
Slides 19 and 22 dive into the mechanics of the engine. Slide 19 asks 'Which User Journey is an Anomaly?' and displays 12 different sequences of numbered actions. This visualizes the complexity of the problem—to the human eye, these sequences look similar, but the software identifies 'Journey I' as the outlier. Slide 22 explains the Risk Score per Anomalous Session , showing how sensitivity values are assigned to specific activities to compute a final risk score. This provides transparency into the 'black box' of their analytics.
Slide 25: The Pedigree Slide
The 'Who We Are' slide is exceptionally strong. The three co-founders—Doron Hendler, David Movshovitz, and Adi Degani—list a combined history of leadership roles and exits. Notable mentions include acquisitions by Salesforce, F5 Networks, Lytx, and Gemalto . The inclusion of logos like Redis, CyberX, Imperva, and Oracle in the 'The Team' sidebar suggests a high density of talent from top-tier tech firms. For a Series A, this level of founder-market fit is a significant de-risking factor for investors.
What RevealSecurity Does Well
The deck excels at logical progression . It starts with a macro problem (breach costs), identifies a specific technical gap (the application layer), proves that gap exists using an industry-standard framework (Cyber Defense Matrix), and then explains why previous attempts to fix it (1st and 2nd Gen tools) have failed. By the time the investor reaches the team slide, the 'why' and 'how' have been thoroughly defended.
The use of visual metaphors for complex data—specifically the user journey maps—allows non-technical investors to grasp the concept of 'sequence-based detection' without needing to understand the underlying machine learning models.
What is Missing from the Deck
Despite raising $16M, the deck is missing several standard 'VC-ready' components:
The Ask: There is no slide stating how much they are raising or the terms of the round. While this is often removed from public versions of decks, its absence in a 27-slide document is notable. · Traction and Metrics: There are no slides detailing Annual Recurring Revenue (ARR), growth rates, or pipeline velocity. For a Series A, investors typically want to see proof of product-market fit through numbers. · Customer Proof: While 'TrackerIQ' is mentioned, there are no specific case studies or named customer logos showing the tool in action. · Competition: The deck assumes the 'gap' in the matrix is empty, but it doesn't address how they compete with emerging startups in the SSPM (SaaS Security Posture Management) or ITDR (Identity Threat Detection and Response) spaces.
Lessons for Founders
1. Own the Matrix: If you are building in a crowded space, find a recognized industry framework (like the Cyber Defense Matrix or MITRE ATT&CK) and visually demonstrate where the 'white space' is. It is much harder for an investor to argue with a third-party framework than with your own custom chart.
2. Define the 'Generations': Positioning your product as the '3rd Generation' of a technology is a powerful way to dismiss incumbents as legacy without having to name them individually. It suggests that your competitors aren't just 'worse'—they are obsolete.
3. Lead with Logic, End with People: RevealSecurity spends 24 slides building a logical case for the product before showing the team. This works well when the problem is complex. If the logic is sound, the team slide acts as the final 'proof' that these are the right people to execute the vision.
4. Don't Fear Technicality: Many founders are told to 'keep it simple.' RevealSecurity ignores this, providing detailed diagrams of user flows and risk scoring. In deep-tech sectors like cybersecurity, showing the 'plumbing' can build credibility with technical partners at VC firms.
Frequently asked questions
- What is the primary problem RevealSecurity solves?
- RevealSecurity addresses the 'Insider Threat' and 'Compromised Account' problem. As noted on Slide 7, attackers are increasingly impersonating legitimate users to abuse SaaS applications and cloud platforms. Traditional security measures like MFA can be bypassed through social engineering, leaving a gap where authenticated users can perform malicious activities undetected within business applications.
- How does RevealSecurity differentiate its technology from existing solutions?
- On Slide 16, the company categorizes existing solutions as 1st Gen (Rules) or 2nd Gen (Volumetric/Frequency analysis like SIEM/UEBA). RevealSecurity claims to be 3rd Gen, using 'Activity Flow Based Anomaly Detection.' Instead of looking at single events or thresholds, it analyzes the sequence of events to identify deviations from normal user journeys.
- What evidence is provided for the market need?
- The deck uses the Cyber Defense Matrix (Slide 10) to show that while devices, networks, and data have detection and response tools (like EDR and DDoS mitigation), the 'Applications' row is empty for those functions. It also cites IBM data (Slide 4) showing that the cost of a breach increases significantly the longer it remains undetected.
- Who are the founders and what is their track record?
- The team (Slide 25) consists of Doron Hendler (CEO), David Movshovitz (CTO), and Adi Degani (Chief Architect). They have a strong track record of exits, including companies acquired by Salesforce, F5 Networks, Lytx, and Gemalto. The CTO and Chief Architect both held senior roles at Salesforce following an acquisition.
- What is missing from this Series A pitch deck?
- The deck is notably missing a slide detailing the specific investment ask, a breakdown of how the $16M will be spent, and a financial roadmap. It also lacks a dedicated competition slide and specific customer case studies or logos, though it mentions the 'TrackerIQ' product name throughout.
