Black Hat USA 2025 | Barmak Meftah, Ballistic Ventures

Clips
More from Black Hat USA 2025

Barmak Meftah

Co-Founder & General Partner

Ballistic Ventures

play_circle_outline Barmak Meftah's background includes significant roles at Oracle and in cybersecurity companies.

play_circle_outline Ballistic Ventures focuses on early-stage cyber security investments and incubations.

play_circle_outline Mid-market companies face high cybersecurity risks with limited resources and expertise.

play_circle_outline Making Cybersecurity Affordable: Streamlining Security Solutions for SMBs to Enhance Operational Efficiency and Accessibility

Info
Transcript

Barmak Meftah, Ballistic Ventures

Barmak Meftah

Co-Founder & General Partner Ballistic Ventures

At Black Hat USA 2025, Barmak Meftah, co-founder and partner at Ballistic Ventures, joins theCUBE’s Jackie McGuire to discuss the venture capital landscape in cybersecurity and the evolving challenges for modern defenders. Meftah shares his journey from enterprise software roles at Oracle to building Fortify Software and AlienVault, leading security businesses at HP and AT&T, and now steering Ballistic Ventures’ early-stage investments in cyber and cyber-adjacent markets. He explains the firm’s dual approach of funding Series A and seed rounds while incubatin... Read more

explore Keep Exploring

What experiences and connections influenced the decision to become an entrepreneur in the technology sector? add

What challenges are companies in the cyber security sector facing in their development? add

What are the key reasons for focusing on the mid-market in terms of cybersecurity challenges and solutions? add

What challenges do mid-market companies face in implementing cybersecurity controls, and what solutions are being explored to address these challenges? add

bolt Powered by CUBE AI

Barmak Meftah, Ballistic Ventures

search

Jackie McGuire

>> Welcome back to Black Hat 2025. I am with theCUBE at Mandalay Bay in beautiful Las Vegas, Nevada, and I am here with Barmak Meftah. He is the co founder and partner of Ballistic Ventures. Barmak, thank you so much for being here.

Barmak Meftah

>> Thanks for having me. Appreciate it.

Jackie McGuire

>> We had Jake on yesterday, so I'm really excited because I've been kind of hammering on we need to bring more venture capital, more investors on theCUBE to talk about the state of the market, because that's something that companies ask me quite a bit. So yeah, could you give us a little bit of your background and how you ended up at Ballistic? You have a pretty interesting background.

Barmak Meftah

>> Yeah, absolutely. So spent formidable years in enterprise software. I was at Oracle for about seven and a half years, and this is mid '90s where Oracle was still fighting with Informix and Illustra and Sybase and Ingres. And so I'd say probably one of the most iconic companies when it comes to enterprise software. If you want to build enterprise products and sell enterprise products, it's a great place to get trained. And I got to meet the folks at Kleiner Perkins back in 2002 fortuitously, and one of the senior partners, Ted Schlein, became a very good friend.

Jackie McGuire

>> Yeah.

Barmak Meftah

>> And through him, I met my third founding partner, Roger Thornton, and they were contemplating building an application security company that was going to be incubated out of Kleiner Perkins. And Ted and Roger compelled me to be an entrepreneur, and so I joined them early on. We built a company called Fortify Software that was kind of the OG static analysis software composition, this pre-dates Snyk and Semgrep and Checkmarx, and all those other companies. We actually created the Gartner MQ with Gartner around static analysis, sold it to HP in 2010, ran the security business for HP for about a year and a half. Then subsequently took a company that had started in Spain called AlienVault in the threat detection space and brought the team with me. And we ran the company for about eight years, sold it to AT&T, and the idea behind AlienVault was taking threat detection down market. And I was the president of the cyber business for AT&T for about 24 months. Stepped down, tried to retire for the third time, got bored.

Jackie McGuire

>> You're not good at that.

Barmak Meftah

>> First month was great. Dropped some weight hiking. Second month was not so great, and got together with Ted and Roger. And Ted was at Kleiner Perkins for 26 years at that point, and he's got a huge passion for cyber, and we decided to create the fund. And that's how the fund came to be.

Jackie McGuire

>> That's fantastic. Yeah, I worked with Kleiner Perkins quite a bit when I was at SVB, so they have a lot of very visionary investors there. It's always interesting to see how they're on the front edge of things that are the things that are going to be cool. So at Ballistic, what are the types of problems that you're most interested in solving when you think about investing? What are the hardest things that the companies you're investing in are working on?

Barmak Meftah

>> So a bit about the fund, we're a cyber security fund. And when we talk about cyber security, we always talk about cyber and cyber adjacent. And so things related to identity privacy compliance will fall under the purview of investing. We're early stage investors, so we do series As primarily in seed rounds. We also doing incubations, and incubations are typically, if we see a trend emerging, we don't see an investment opportunity that we actually start the company from whole cloth within the fund. So one of us kind of takes the acting role as the CEO, one of us becomes the acting CTO, get it off the ground for the first six, seven months, find product market fit, and then hire the operating executives around it. Fund one was 300 million, fund two was 360. Fund one is fully invested. We're kind of about a third of way in fund two. And we look for... Well, early stage investing, as you know, is more an art than a science. You look for teams that are phenomenal. You look for addressable markets that are big. And more importantly, you look for market timing because sometimes it can be too early for the market, especially with these new emerging threat vectors, and you spend a lot of dollars to educate the market and sometimes you're late in the market.

Jackie McGuire

>> So that somebody else can come along much less expensively with no debt.

Barmak Meftah

>> And enjoy the fruit fruits of your labor.

Jackie McGuire

>> Yeah.

Barmak Meftah

>> And so getting-

Jackie McGuire

>> I've been the victim of that a couple of times myself, by the way.

Barmak Meftah

>> Yes, yes. And especially in cyber because the themes change so often. And so good market timing, great addressable market, great teams. And then more importantly, we look for, I'm going to choose my words carefully, but companies that have an act one, act two, and an act three. So we see a lot of feature companies in cyber, and it's hard to imagine how you can grow a feature to be an IP oval entity. So when we invest in a company, we're always having an eye towards can you get into adjacent areas where there's an act two behind it, act three behind it?

Jackie McGuire

>> Or is there a hyperscaler who's just going to build that feature into their product?

Barmak Meftah

>> Into their product and it's hard to invest. Exactly.

Jackie McGuire

>> Yeah. I've told many companies that without some other product, this seems like more of a feature than it does a standalone product.

Barmak Meftah

>> Exactly.

Jackie McGuire

>> And I guess that kind of segues into the next part of the conversation. So I've been very, very snarky about platformization. Because to me, it's just the natural, we're going through a consolidation cycle, and it was because as security became crazy complex and all these new identity and threats emerged. You need startups building features because a lot of times you can't get the budget to build those features at the large companies. So it's natural. I just hate that we're trying to act like buying 15 companies and slapping a UI on top of it is a platform, and it's not.

Barmak Meftah

>> Yes. Yeah, people don't buy... So like a CISO doesn't get up in the morning and say, "I have a platform problem." They have a secure email gateway problem, they have a data security posture problem, they have a cloud security posture problem. So they typically buy business problems. Now the question of platforms is an interesting one because if you're a platform company, what want to do is you want to attach yourself to that demand. When you install your product, you're solving a specific problem for the CISO. As long as you have an architecture that's extensible, that you can say, "Look, if I'm already inserted and I can add blades or SKUs to the same architecture," I think that's what I was talking about with act one and act two. So it is great to be a platform company from an architectural perspective, but if you kind of set your go-to-market that I'm going to sell a platform, people don't have platform problems. And then the other part that you mentioned is super important, which is cybersecurity, the adversary is constantly innovating, and new threat vectors emerge. And big companies in general, Apple is probably the exception to the rule where they invented new categories under Steve Jobs every two to three years, but big companies are known for one thing specifically. And so a lot of great innovation I still think comes from smaller innovative companies.

Jackie McGuire

>> Yeah. And if I'm a company and I'm making hundreds of millions of dollars on four SKUs and somebody wants to invest in a project to build a feature that is not a clear... When you're publicly traded, when you have shareholders to answer to, when you have to do those quarterly reports, it's not as easy to say... You can't all be Meta and say, "We're going to sink $80 billion into this thing." Sometimes it's, "We can't afford to build that."

Barmak Meftah

>> Exactly.

Jackie McGuire

>> I've also been the victim of that at some companies that it was like, "Yeah, we see the value in what you want to build. It's just the path to revenue is too long for our quarterly earnings."

Barmak Meftah

>> That's right. That's totally . And in big companies, typically, not all of them, but big companies, there's a lot of political issues that come to be.

Jackie McGuire

>> No.

Barmak Meftah

>> So executives want to own things and typically innovations get killed in the embryo before they're off the ground.

Jackie McGuire

>> And so I know that you're particularly interested in the mid-market, and I want to talk about that because I've had several. So I'm also the research analyst for theCUBE, and I've had a bunch of briefings this week, and mid-market has come up more than any other time in the last five years that I've been an analyst. And I think it's because, one, from my perspective, within five years, security's going to be a utility. It is so ubiquitously necessary and critical to the ability of our economy to run, that I do think that at some point it'll be almost like unemployment insurance and that it's got to be this giant national fund. But many, many vendors now are trying to move down into-

Barmak Meftah

>> Down market....

Jackie McGuire

>> the mid-market because, one, companies just don't have a choice. And as these companies are trying to spin up all these new AI projects, obviously you have to secure them. So obviously you saw this early. So what is it about the mid-market that you find particularly compelling other than what I just said?

Barmak Meftah

>> I think from an impact perspective, they have a huge attack surface. They just don't have the financial and human capital experience and maturity that a big enterprise has. And so if you put the two together, which is they can't afford to buy, they just don't have the experience yet, the attack service is completely exposed, it's an area that we have to go solve for. And the way we've solved it in the past has been very inefficient. So the way we typically take cybersecurity controls down market is we augmented with a lot of MSS. There's a lot of managed security services and a lot of engagements. And there was a study done, I'm trying to remember which analyst, but for every $1 of security control spent in the mid-market, there's about 4 to $5 of services spent. And so operationalizing these security controls down market becomes very complicated. And so an area that is of intense interest to me is how can we simplify operationalizing best-of-breed security control. Like a mid-market or an SMB still would like to have a CrowdStrike, a Zscaler, and Okta, but they just don't want to pay the PS and the MSSB elements that are so complicated. So we led an investment in Zip Security. Zip uses AI to essentially automate and orchestrate provision best-of-breed security controls for the mid-market. So I think simplifying the consumption of security and mid-market I think is a great area to get into. The other area that I focus on a lot is AI risk and AI security, and I think that's kind of on the ascendancy. We did an incubation fund, one that's doing incredibly well, but mid-market is big attack surface. And it's going to grow, and we have to find a way to solve the problem for these guys.

Jackie McGuire

>> Yeah, and I think generally the mid-markets benefited from the fact that because they're not the largest targets, up until a couple years ago, the likelihood of getting breached was lower as a mid-market company. But unfortunately because of AI, we can automate attacks now. And I've had a handful of conversations over the last few days that attackers are breaching systems and then as soon as they breach them, they just put them on a list for somebody else to exfiltrate data from.

Barmak Meftah

>> Exactly.

Jackie McGuire

>> I complain, even at the consumer level, I complain all the time. There is literally not a single good endpoint management detection response for the mobile device for the consumer.

Barmak Meftah

>> Right.

Jackie McGuire

>> And I understand that that's a difficult market to address that there's a lot of education needed, but how in the world is it 2025, my smartphone is arguably my largest attack surface, the I'm most likely to do something stupid, and I can't protect it?

Barmak Meftah

>> Yep, yep. There's two issues. Consumers getting into the consumer market with security, antivirus did it to some level of success, but you have to remember, human beings are optimistic by and large. And security is always the frontal lobe part of the brain, which is you always think about what can go wrong. And so try to attach the consumer around fear, uncertainty, and doubt is going to be really hard. And so finding an angle that's going to hit home with a consumer that at least you sort of occupy a bit of real estate and then upsell security is the way to go. That's another area that we're looking at actually intensely see how to solve that problem. But the SMB and the mid-market, the thing I do want to say, you'd be surprised how big companies... So if you take Fortune 200 out, as soon as you certainly get below Fortune 500, you see companies with 8,000 employees, 10,000 employees, that the security teams are only eight people, seven people. So when we talk about mid-market SMB, I'm not talking about your accounting offices and law offices, I'm still talking about these companies with about 3, 400 million revenue, 500 million revenue, and the CISO has six people, and they have to do the same job that a JP Morgan Chase or Wells Fargo is doing with 3, 4,000.

Jackie McGuire

>> And $18 billion. So JP Morgan spoke at Dell Tech World, and that was one of the things that was kind of mind-melting for me is they're like, "Yeah, we manage an $18 billion security budget." And I'm in the crowd thinking, "If I'm a CISO in this crowd and I've got like $600,000 and two guys-"

Barmak Meftah

>> How do I do it? How do I do it? Exactly.

Jackie McGuire

>> Even just hearing that, it just makes me feel-

Barmak Meftah

>> It's incredible. It's incredible. Yeah.

Jackie McGuire

>> It's so overwhelming.

Barmak Meftah

>> Yeah.

Jackie McGuire

>> And I do think you're correct in that services isn't the be all end all of... And if you're not good at managing service providers, you waste a lot of money. But there's also, at some point we need to, there needs to be... One of the things I always lament is there is no equivalent coming from finance of a fiduciary duty for security. So if you're a C level, you do have a fiduciary as a C level, but you don't have a standard of care as a CISO that you're held to. And so I've actually been talking to a bunch of different state CISOs about, "I really think we should mandate a standard of care at the service provider level," because then I think CISO's will be able to adapt that and say, "Okay, if I can't meet this standard of care, I need to bring in an outside party, or I need to bring in a company to help me meet the standard of care." And I think, because of my background, I'm biased, but I've been kind of operating under this theory as an analyst that we're probably going to have to apply financial frameworks to security.

Barmak Meftah

>> Yeah.

Jackie McGuire

>> I think the only way, from an insurance standpoint, and this is where from cyber risk insurance, I think they're going to have to start insuring the data.

Barmak Meftah

>> That's right.

Jackie McGuire

>> Because the data is what is actually the value. And I think we're going to start treating data like a security and insuring it like that. But that's kind of my working theory on it.

Barmak Meftah

>> I agree with you. If you look at the board of directors, there are typically audit subcommittees of the board, and the audit subcommittees are typically chaired by CFOs. And so there's a huge amount of financial risk, assessment, and efficacy that gets applied to a company, especially after you have an IPO. The same level of risk is not applied in the cyber side. So I've actually been a big proponent to puts chief risk officers and CISOs to co-chair these audit committees. So you sort of treat cyber risk akin to financial risk to your point. And unless that gets elevated at the board level, then it becomes a second class citizen, which is we'll get to it when we get to it.

Jackie McGuire

>> Yeah. Well, and I've heard a lot of CISOs express kind of concern that their D&O insurance probably doesn't cover a lot of the-

Barmak Meftah

>> That's right. They're exposed. They're exposed.

Jackie McGuire

>> Yeah. Because when you have a fiduciary standard, you know exactly how you're held accountable, what you're liable for. And CISOs right now are like, "There's no equivalent of malpractice in cybersecurity."

Barmak Meftah

>> Totally.

Jackie McGuire

>> I could get sued by my board.

Barmak Meftah

>> By the SEC. You saw a couple of cases where the SEC went after CISOs. And to your point, they have all the exposure, but they don't have the safe harbor protections and they don't have the D&O insurance protections, and they certainly don't have kind of the board-level protection that the CFO, for instance, would have. And so they're kind of exposed. And the problem with security is there's not absolute security. So basically security is only as good as your risk acceptance. And so god forbid a company gets breached, typically a CISO is exposed, and that has to be solved. I think the efficacy of how you operationalize cybersecurity controls for the SMB has to be solved. These are big problems and they're, right now, exposed, unfortunately.

Jackie McGuire

>> Well, hopefully somebody hears us and will start working to solve them.

Barmak Meftah

>> Yes, there is.

Jackie McGuire

>> Then they can approach you and you'll fund them.

Barmak Meftah

>> We'd love it. We'd love it.

Jackie McGuire

>> We'll solve all of the problems of the world together.

Barmak Meftah

>> We'd love it. We'd love it.

Jackie McGuire

>> Barmak, thanks you so much for coming on.

Barmak Meftah

>> Yeah, thank you.

Jackie McGuire

>> So, so happy we were able to make this happen.

Barmak Meftah

>> I appreciate that. Thank you so much. I really enjoyed it.

Jackie McGuire

>> This is one of the better conversations.

Barmak Meftah

>> Thank you so much. I enjoyed it. Thanks so much.

Jackie McGuire

>> Thanks. Stay tuned. We will be back for more Black hat 2025 at the Mandalay Bay in Las Vegas, Nevada. I have a few more great guests. We hope you'll come right back.