Cybersecurity Traction Slides: 8 Real Pitch Deck Examples
How security startups show traction: a paid-customer count, customers with analyst ratings, proofs of concept with a bank and a telecom.
Cybersecurity Traction Slides: Real Pitch Deck Examples
Eight traction slides from security decks (including a developer tunnelling service, a network access control vendor, a cloud security platform, a medical device security company and a secure messaging company), shown in full. Security buyers are cautious, so investors look for paying customers and proof that large organisations trust the product. The stronger slides count paying customers; the weaker ones rely on logos, trials or future targets.
TL;DR
A cybersecurity traction slide should count paying customers and show who trusts the product. ngrok states 30,000 paid customers, with its ARR figure left blank in the shared deck. Portnox gives nearly 1,000 customers beside a Gartner Peer Insights rating and SOC 2 Type 2. Loqr lists 1,000 organic users, one pre-revenue client and two proofs of concept. DivvyCloud shows twelve enterprise logos and an unattributed quote. CrowdSec shows user and turnover targets for 2021 to 2024, a plan rather than results, the weakest example here.
Cybersecurity traction slides
Each example shows the exact stored slide above its analysis and links to the full teardown. Stronger examples first. Claims and figures are as shown on the slides; we have not verified them.
ngrok traction slide — slide 4
Series A (recorded). Secure tunnels and ingress for developers. Two large figures split by a line.
ngrok deck, slide 4. Exact stored slide matched to this analysis.
Our analysis: The strongest single number here because it counts payers, but without ARR or a time axis the size of each customer is unknown.
Evidence and limitation: One paid-customer count; the ARR amount is blank in the shared version; no dates or growth.
What a founder can adapt: Keep the paid-customer headline and add ARR and the same figures a year earlier; if you must hide ARR in a shared deck, say so.
Supporting analysis
What the deck claims: "Why you should be excited." "30,000 paid customers." "$ million ARR", with the number left blank.
Presentation choice: A large paid base shows developers buy without a sales team, which security investors look for in bottom-up products.
When it does not fit: A blank figure with no note; readers may assume it is small.
Series A (recorded). Network access control. Five facts on the left, three panels on the right.
Portnox deck, slide 3. Exact stored slide matched to this analysis.
Our analysis: Good trust evidence for a security buyer, but after years of operation the slide gives no sense of growth.
Evidence and limitation: A customer count with third-party ratings, a compliance badge and analyst quotes; no revenue, growth or customer sizes.
What a founder can adapt: Add customers and revenue by year, and say how many reviews stand behind the rating.
Supporting analysis
What the deck claims: "About Portnox." "Founded in 2007", "50+ employees", "Nearly 1,000 customers", "Offices in US, UK & Israel", "VC-backed". Panels: "Trusted" with a Gartner Peer Insights rating of 4.7; "Secure" with a SOC 2 Type 2 badge; "Recognized" with quotes from Gartner, 451 Research and Frost & Sullivan.
Presentation choice: Analyst ratings and SOC 2 answer the question security buyers ask first: can we trust this vendor.
When it does not fit: Company facts (founding year, offices) taking the same space as customers.
Stage not recorded. Identity and authentication, Portugal, deck dated January 2016. Seven text lines.
Loqr deck, slide 6. Exact stored slide matched to this analysis.
Our analysis: Honest about being pre-revenue. The bank and telecom client counts describe the prospects, not Loqr's reach.
Evidence and limitation: Users, one unpaid client, two proofs of concept with large firms' client bases, a patent and an award; no revenue.
What a founder can adapt: State each proof of concept's dates, success measure and conversion terms, and show the prospect size as context, not traction.
Presentation choice: Proofs of concept with a bank and a telecom are meaningful for an identity product, but investors want to know what happens after the demo.
When it does not fit: "1 / 2 partner(s)": give the exact number.
Series B (recorded). Cloud security and compliance. A headline panel beside a quote and twelve logos.
DivvyCloud deck, slide 5. Exact stored slide matched to this analysis.
Our analysis: Impressive names, but the quote is unattributed and nothing shows how much each customer pays or how many there are.
Evidence and limitation: Twelve large logos and one quote with no speaker or company; no customer count, revenue or contract sizes.
What a founder can adapt: Attribute the quote, add the total customer count and ARR, and mark which logos expanded after the first purchase.
Supporting analysis
What the deck claims: "Customers Love and Trust DivvyCloud." ""DivvyCloud has been the most successful security product roll-out in our history."" Logos: Nike, Fidelity Investments, First Data, Kroger, 3M, CoStar Group, Pizza Hut, General Electric, Twilio, Discovery, Fannie Mae, Autodesk.
Presentation choice: Included for contrast: logos show reach into large enterprises but not the size or growth of the business.
When it does not fit: An anonymous quote as the main evidence.
Container and cloud security. The slide is marked "Sysdig Proprietary Information". Two charts side by side.
Sysdig deck, slide 10. Exact stored slide matched to this analysis.
Our analysis: Strong on growth and expansion, the two things security investors ask about, while keeping amounts private.
Evidence and limitation: A growth multiple over two years with dates (company claim, no amounts), and a per-customer expansion chart with no customer count or legend.
What a founder can adapt: Show growth as a multiple with dates if you must hide amounts, and add a customer count and legend to any expansion chart.
Supporting analysis
What the deck claims: "Global Enterprises Accelerate Momentum". Left: "Rapid ARR growth", three bars for Q3CY17, Q3CY18 and Q3CY19, labelled "> 5X growth", with no amounts. Right: "Enterprise ARR expansion pattern", a scatter chart of current ARR as a multiple of initial ACV (0 to 10) against completed months since the initial deal (0 to 50).
Presentation choice: The expansion chart shows customers growing to several times their first contract, which supports a land-and-expand argument without a single summary number.
When it does not fit: Two colours with no legend, and no note on whether lost customers are included.
Security for medical device manufacturers. A closing summary slide with five bullets; the product guide uses a different slide from this deck.
Medcrypt deck, slide 11. Exact stored slide matched to this analysis.
Our analysis: A useful format for a concentrated market, linked to a regulatory reason to buy now.
Evidence and limitation: A customer count and a share of the five largest buyers (company claims); no revenue, no paying/pilot split, and the three manufacturers are not named.
What a founder can adapt: State your share of the largest buyers, define how you rank them, and say whether each pays.
Supporting analysis
What the deck claims: "Summary". "New FDA cybersecurity rules released April 2022". "55 customers, including 3 of the top 5 MDMs". The team includes people formerly at the FDA, Symantec, Medtronic, Becton Dickinson, Varian, Lockheed and Boeing. "Raised $14M to date from Section 32, Johnson & Johnson, Y Combinator, Eniac, and others".
Presentation choice: Winning three of the five largest buyers is a stronger signal than a raw count when a few buyers hold most of the market.
When it does not fit: Traction mixed with team and funding on one summary slide, where it is easy to miss.
Private and secure communications. Mid-market customers in finance. In the shared version, revenue figures and logos are blurred.
Worldr deck, slide 11. Exact stored slide matched to this analysis.
Our analysis: Included for contrast: the slide's structure (customers and revenue by quarter) is good, but a reader of this version learns almost nothing.
Evidence and limitation: No readable figures: the revenue amounts and logos are hidden in the shared version.
What a founder can adapt: If you redact, keep a count of customers, a growth rate or a date visible, and note that figures are available on request.
Supporting analysis
What the deck claims: "Mid market success", "Q2 companies". Labels "Q2 Total Revenue:" and "H1 Revenue Approaching:" with blurred dollar figures, and twelve blurred customer logo tiles with small captions.
Presentation choice: It shows the cost of redacting a traction slide completely, compared with Sysdig, which keeps the growth rate visible.
When it does not fit: Blurring every number, which leaves a slide that looks like traction but contains none.
Whether each slide counts paying customers, gives revenue, shows trust signals and separates results from plans.
Example
Product
Paying customers
Revenue
Trust signals
Results or plan
ngrok
Developer tunnels
30,000
Left blank
No
Results
Portnox
Network access control
Nearly 1,000
No
Rating, SOC 2, analysts
Results
Loqr
Identity
None (1 pre-revenue client)
No
Patent, award
Results
DivvyCloud
Cloud security
Not counted
No
12 logos, unattributed quote
Results
CrowdSec
Threat sharing
Not shown
Targets only
No
Plan
Sysdig
Cloud security
Not counted
Growth multiple only (> 5X)
Expansion chart
Results
Medcrypt
Medical device security
55 customers (not split by paying)
No
3 of top 5 buyers, funding
Results
Worldr
Secure communications
Blurred
Blurred
Blurred logos
Results (hidden)
Key Takeaways
Lead with paying customers, not users or trials.
Say which logos are paying customers and since when.
Mark proofs of concept as unpaid until they convert.
Keep targets on a separate slide from results.
Build your cybersecurity traction slide
Count paying customers, show revenue over time and add the trust evidence security buyers check.
Payers. Paying customers today and a year ago.
Revenue. ARR by quarter, or a note that it is withheld in this version.
Trust. Compliance (SOC 2, ISO 27001), rated reviews with their count, named references.
Pilots. Proofs of concept: with whom, since when, and what converts them.
Copyable framework: [n] paying customers, up from [n] a year ago; ARR [amount]. [certification]; rated [score] from [n] reviews. [n] proofs of concept with [customer type], converting on [terms].
Illustrative example 1 — written by us
Before: Customers Love and Trust DivvyCloud. "DivvyCloud has been the most successful security product roll-out in our history."
After: [n] enterprise customers including Nike, 3M and GE; ARR [amount], up [n]% year on year. "Most successful security roll-out in our history" — [title], [company].
What improved: Our illustrative rewrite; not DivvyCloud's wording. Bracketed parts are placeholders to fill with real facts. It adds a count and revenue, and attributes the quote.
What this guide adds
The library has cybersecurity problem, solution and product guides but no cybersecurity traction guide. This page looks at how security companies show buyers are paying and trusting them.
Sector labels come from the sector recorded for each published teardown (high confidence for Portnox, Loqr and CrowdSec; medium for ngrok and DivvyCloud). None of these five slides appears in another guide; the product guide uses a different ngrok slide, and the competition guide cites a different Portnox slide.
Three ways security decks show traction
Paying customer counts (ngrok, Portnox): one clear number, with trust signals beside it.
Trials and proofs of concept (Loqr): early buyers testing the product, with their size.
Logos and plans (DivvyCloud, CrowdSec): recognisable names or future targets, with no count of what has been paid.
Showing growth without giving away the numbers
Many security companies don't want exact revenue in a deck that may be forwarded. The three slides added in this update show three ways to handle that. Sysdig shows its ARR as three bars, from Q3 2017 to Q3 2019, labelled "> 5X growth", with no amounts on the axis. An investor learns the growth rate and the time period, and can ask for the amounts in a meeting. Worldr goes further: its shared version blurs both the revenue figures and the customer logos, leaving only the labels "Q2 Total Revenue" and "H1 Revenue Approaching". Medcrypt gives no revenue at all, and instead states a customer count with a share of the largest buyers.
The difference matters. A growth multiple with dates (Sysdig) is still evidence: it tells a reader how fast the business moved. A blurred number (Worldr) is a placeholder: it tells a reader that a number exists but nothing about its size. If you must hide figures in a shared version, keep the ratio, the dates or the customer count visible, and say that exact amounts are available on request.
Expansion: the traction signal security buyers create
Security products often start small inside a large company and grow as more teams, servers or users are covered. Sysdig's right-hand chart shows this directly: each dot is an enterprise customer, placed by months since the first deal and by current ARR as a multiple of the first contract value. Several customers sit at five to ten times their first contract after three to four years. That is an argument about net revenue retention made with a picture rather than a single percentage.
The chart has limits a reader should notice. The slide doesn't say how many customers are plotted, what the two colours mean, or whether customers that left are included. A short note covering those three points would let an investor trust the pattern. If you have a net revenue retention figure, put it next to a chart like this, with the period and the group of customers it covers.
Naming share of the biggest buyers
In markets with a small number of very large buyers, a count of customers says less than which buyers have signed. Medcrypt, which sells security tools to medical device manufacturers, states "55 customers, including 3 of the top 5 MDMs" (medical device manufacturers). Winning three of the five largest manufacturers is a strong sign in a concentrated market, and the slide ties it to a regulatory change: "New FDA cybersecurity rules released April 2022". These are the company's claims; the slide doesn't name the three manufacturers or say whether they pay or are pilots.
If your market works like this, say how you define "top" (by revenue, units or market share, and from which source), name the customers if you are allowed to, and say whether each is paying. Without a definition, "top five" is easy to claim and hard to check.
Choosing which traction format fits your stage
Earlier companies usually have proofs of concept, design partners or a handful of paying pilots. Show each one with the buyer type, the start date, whether it is paid and what would make it convert, as Loqr does with its bank and telecom trials. Later companies should lead with paying customers, revenue or ARR, and expansion, as ngrok, Portnox and Sysdig do. A company selling into a concentrated or regulated market, like Medcrypt, may get more from naming its share of the largest buyers than from a raw count.
Whatever the stage, keep three things consistent: label every number as a result, a claim or a target; give the date each number refers to; and avoid mixing traction with team or funding details on the same slide. Investors in security read traction slides closely because buyers move slowly, so a slide that is easy to check builds more trust than one that only looks impressive.
Questions investors ask about security traction
Expect questions such as: How many customers pay today, and how many are in trials or proofs of concept? What is the average contract value, and how has it changed? How much do customers expand after the first deal, and how many leave? How long does a typical security review or sales cycle take? Which certifications (for example SOC 2 or ISO 27001) do you hold, and which are in progress?
Across the eight slides, only ngrok and Portnox give a paying-customer count, only Sysdig shows expansion, and none gives a sales cycle length. Answering one more of these questions on the slide, with dates, is usually the most useful change a security founder can make.
Common mistakes
Logos without a count. Give the total customer number beside any logo wall.
Unattributed quotes. Name the person's role and company, or leave the quote out.
Prospect size as reach. A bank's client base is not your user base.
Targets on the traction slide. Label plans clearly or move them to financials.
Diagnostic checklist
Paying customers counted.
Revenue shown or its absence explained.
Trust evidence named and sourced.
Results separated from plans.
Frequently asked questions
How we chose these examples
Corpus: published pitch deck teardowns on StartupFundraising.com. Founder-uploaded private decks are excluded.
Selection (2026-09-27): we took teardowns whose recorded sector is cybersecurity, with a stored slide image and slide text about traction, customers, users, revenue, pilots or growth. We read the candidates and viewed six slide images, left out listed-company decks (KnowBe4, Ixia), problem, solution, team and market slides, slides already used in other guides and a slide with no stored image (MetaCert), and kept five. DivvyCloud and CrowdSec are included as weaker examples for contrast. Mobility and hardware were considered; they had too few startup slides showing the company's own traction.
Sector is the category recorded for each teardown (confidence given in the section above). Stages as recorded: ngrok and Portnox, Series A; DivvyCloud, Series B; CrowdSec, seed; Loqr, not recorded.
Review: the first five slide images were checked on 2026-09-27 and matched to company, deck and slide number, and quoted text was read from the images (editorial model review). No person has yet completed an editorial review of this page.
Update (2026-10-01): we added Sysdig slide 10, Medcrypt slide 11 and Worldr slide 11, read from images made from the original deck files (AI editorial model review). Not used: Awake Security slide 3 (a customer logo panel close to the DivvyCloud example; other Awake slides are used in the market and customer-switching guides), and DoControl slide 22 (a company summary with "Dozens of US customers" and no count). Sysdig, Medcrypt and Worldr are treated as private companies; we found no stock-exchange listing on their slides.
Claims and figures are as shown on the slides; we have not verified them. We make no claim that any slide caused a fundraising outcome.
