Building a Security Start-Up

If only building a security start-up was as predictable as transitioning from caterpillar to butterfly!  But, it’s not. Unfortunately, it usually requires many turns and corresponding changes. Consider companies like Blackberry, once a ubiquitous handset provider, now an enterprise security provider. Or Radware, once a load balancing product company, is now known for its DDoS solutions. The most dramatic change in our industry is Amazon, once a book company, now marketing a whole range of secure cloud solutions.

If you are a start up, you want to avoid the dreaded “pivot” with its associated hard resource costs and, potentially, people costs. How do you keep up with constantly changing marketplace requirements without pivoting? I recently discovered an amazing tool for this purpose, the Business Model Canvas. It’s not brand new, but if you aren’t using it, please read on for a short introduction. For details and much more, please see the original work—Business Model Generation (2010)–by Alexander Osterwalder and Yves Pigneur.  It is one of the best practical business books I have read.

Business Model Canvas

This canvas approach allows you to build a picture of your prospective business in one page using a one day brainstorming session. The 9 categories in the canvas above illustrate the key things you need to get right. Notice that technology is not specifically one of them!  Of course, it is imbedded in all of the categories, especially “Value Proposition”. Value Proposition is not what you do great, but why prospects will choose you over competitors or over doing nothing. It is the business elevator speech.

The other great thing about the “Canvas” is that it is easy to change. Whereas a formal business plan might fill up 30-100 pages, the Canvas can be changed on a regular basis. This facilitates the incremental, lean approach to business model optimization. In today’s rapidly changing market, this is a critical success factor. The one page canvas forces you to consider all of the components needed for business success. Who are your customer segments? If you don’t have marketing focus, you don’t have marketing.

Osterwalder and Pigneur have some great suggestions on how to build the canvas for your venture, and then how to follow it up and execute. The next step after building the model is developing a formal business plan. Their prototype plan has five section: “Team”, “Business Model”, “Financial Analysis”, “External Environment”, “Implementation Roadmap”, and “Risk Analysis”.  The material supporting the canvas can be used as input for each of these sections. For example, “Cost Structure” and “Revenue Streams” will map to “Financial Analysis”. What we have here is a business plan in a box! Now you just need to test it with real customers and tweak as needed.

What if you are an intrapreneur, within an existing business? Osterwalder and Pigneur show how to map their 9 business model categories to the 5 key domains within an existing organization:  strategy, people, structure, rewards and processes.  By using the language of the existing parent organization, you can achieve start-up goals effectively.

Frederick Scholl

Frederick Scholl is an accomplished Global Senior Information Security Risk Manager. Dr. Scholl earned a BS and Ph.D. in Electrical Engineering from Cornell University. In 1991, Fred founded Monarch Information Networks, LLC to enable forward-thinking organizations to protect their information. Previously, he co-founded Codenoll Technology Corporation (NASDAQ: CODN). He chaired the IEEE committee that wrote the first standard for Ethernet communication over fiber optic links, now used world-wide.

Book an Appointment for Cybersecurity Issues

Request an appointment with Dr. Fred Scholl. We will discuss any cybersecurity issues you have.

More Good Reading

Cybersecurity Thrives in An Organizational Context

The First National Cybersecurity Summit

New Privacy Laws Require Security Professionals Up Their Game

Cybersecurity Workforce Development: Real or Imagined Problem?

Antidote for Fake Everything

Information Security Risks, Gray Rhinos and Black Swans

Managing Information Security On a Limited Budget

Building a Security Start-Up

Cybersecurity Risk Management for Directors

My Reading List for Security Start-Ups

Should Your CIO Learn to Code?

How IT Leaders Can Keep a Seat at the Table

Equifax points out—again—the need for speed in security management

Anatomy of a Security Breach

The Smartest Information Security Companies

Book Review: Play Bigger

Long Term Beneficiaries of WannaCry

RISK: A NEW MOVIE ABOUT JULIAN ASSANGE

TRADE SECRET THEFT CONTINUES UNABATED

TENNESSEE LEGISLATORS MUDDY WATERS AROUND PRIVACY BREACH NOTIFICATION REQUIREMENTS

LEADERSHIP CHECKLIST FOR SECURITY PROFESSIONALS

SIEM VENDORS HAVE IT ALL BACKWARDS

THE SECRET TO GROWING YOUR SECURITY STARTUP

CLOUD JOBS PEAKING?

The Spy Who Couldn’t Spell

IS THERE A CYBERSECURITY PROFESSIONALS SHORTAGE?

No Blue Pill for Cybersecurity Failures

Presidential Cybersecurity Commission Makes Some Good Suggestions

Understanding Intelligence

Align Your Security Program With the Business

Don’t fall victim to BEC

Enterprise Risk Management and Information Security

Evidence Based Risk Assessment: Lessons Learned from the Y-12 Breach

First Conviction for Illegally Distributing Android Apps

Locking Up the Ivory Tower

Cloud Vulnerabilities

More Security Lessons Learned from the Y-12 Breach

Security or Compliance?

Home Disaster Recovery Planning

Cloud Computing: Trust but Verify

Background Checks May Not Be Enough

PERFECT SECURITY STORM FOR LAW FIRMS?

How Not To Be a Cyber Janitor

SECURITY MEMO: IT CAN’T HAPPEN HERE, CAN IT?

Don’t Forget Cloud Availability

Compliance v. Security

GAO Report on Information Security in Federal Government

Lean Security

Mitigate Your Social Engineering Vulnerabilities

HIPAA Security. Are We Making Progress?

Brand Your Security Program

PDCA is Dead

LEARNING FROM PAST MISTAKES

How Better Security Can Create Shared Value

C’est La Vie, You Never Can Tell: Lessons Learned from the HBGary Hack

DDOS Tutorial

The future of information technology

Data Governance Anyone?

Learning from the oil spill disaster

Down the Rabbit-Hole…Again?

Ideas on Risk Management