# Inside the Trenches: Building a Security Company in 2025

- Channel: [Dappcon](https://streameth.org/dappcon)
- Date: 2025-06-16
- Duration: 18:02
- Watch: https://streameth.org/watch/685043414ac43bf73d4aa844

## Transcript

Hello everyone, thank you so much for being here and thank you for inviting me. So in this talk I want to talk a bit about two things essentially. How to build a company in general, because we keep talking about engineering and we keep forgetting what the PMF is, and then how to build a company in security and why I think this year is going to be great for security, which has been traditionally not an easy industry to be in. So let's start with fundraising. I want to talk a bit about a few tips I've learned as it was fundraising. The first and foremost is that if you talk with VCs and investors, and maybe it's just a no, right, like don't waste your time, they're taking too much time to respond to you, just go to the next one. You have to expect a yes, but not too early. If a yes comes too early, that means they're not doing a lot of DD, they're not a very good VC at the end of the day. If it comes too late, that means they're trying to de-risk their investment to you and that's also not very good. So ideally you want to come to a yes somewhere in the middle. And of course, as we're discussing with them, a verbal offer is not an offer at all, right? You should always expect a term sheet. Only if it's in writing, this is when you know they're real. Now as we talk with investors, fog of war is your ally. You don't want to tell them who else you're talking with, right? You want to keep them guessing, you want them to FOMO. So you should tell them if you're having other discussions, you know, valuations or offers, but you shouldn't tell them with whom. You should try to avoid VCs that have invested in competitive startups because more often than not they'll try to get as much information from you strategically, implementation-wise, and finally to their own portfolio, right? So sometimes you can't avoid it, but ideally you want to avoid it. If you talk with someone that has a reputation of being very open and sharing, they're still a good investor, you can attempt to approach it as a black box. You can tell them what are you doing, what are the inputs, what are the outputs, but you should at no level tell them exactly how it works or show them the code, right? At the end of the day, they should believe in you, the founder or the founding team, to know what you're doing and be honest about it. Expired dates. Expired dates are bullshit. There's no expired dates on term sheets. If they tell you that a term sheet has an expired date, they're trying to force you into a decision, and that's not a good sign. If they like the deal, they like what you're doing, they like you, they'll let you wait. They'll let you finish all your discussions so you can have a better view of the market. Now, as you talk with investors, you want to sequence them smartly, right? You want to start with investors where you really don't care about having them on your cap table. This will be a very useful training mode for you, right, as you talk to them and you understand what are their questions, what are their reservations, where your pitch has some holes. So when you talk with investors you really want on your cap table, you can be ready. Warm intros are always a must. Before you start the fundraising process, you have to prepare all the warm intros, right? You have to make sure that you have a warm intro to every single investor you want, and when you start fundraising, you go into a blitz, right? You reach out very aggressively, and of course, you don't want to close too early. You want to wait for all your discussions to circle back. It's very important how you craft your cap table. You don't want cheap money, but also you don't want people that will push your valuation too low, right? You want a mixture. You want good investors that obviously will be more realistic with their valuations, but also more enthusiastic investors who will go gung-ho, right? So that's where you can get both value-add, but also a valuation that works for you. Crypto is inflated. We have to accept that, and that's why you'll probably expect your token warrants to be undiluted, right? That's something you have to expect, and it's okay because, you know, they give you an inflated valuation. As you choose your investors, you have the discussions now, and you're trying to understand who is a good one. Don't pay attention to marketing. There's a lot of investors who do a lot of marketing, open source, whatever, but if you look at their portfolio performance, it's not that good. The way you can understand if an investor will be good for you, will be a good value-add is by looking at the portfolio. Are they winning? Do they have returns for their LPs or not? This will tell you who is really useful. And, of course, avoid pump-and-dumps VCs. I mean, that goes, you know, not even worth discussing about it. And generally speaking, if you see a red flag, you walk. Raising money, it's not easy, but also we have leverage as builders. They need to allocate, right, as much as we need the capital. So, don't fear to walk out of a meeting. And finally, terms and clauses. Everything is negotiable, right? You should expect that they can ask for everything and you can ask for everything. Nothing is off the table. There's no rules. So, if you want, you can get really creative, right? You can even ask for a banana as part of your term sheet and we can put that in writing. Finally, integrity. You have to be honest. Tell them what you know, what you don't know, and how you expect to find out. They will appreciate that. You don't want to bullshit them. That's very important to create trust. And, of course, if an investor is unprepared in your meetings, you should call them out in return, right? In the same way they would call you out if you're unprepared. You should tell them that, you know, they're wasting your time. So, we fundraise now and we need to build. The first most important thing in a company is a culture, as a founder and as a team. As a founder, you have to have humility, right? You have to accept that you don't know everything and reach out to mentors and people that will help you find out what you don't know, right? You should expect that you will have to deal with a lot of new things and face brutal facts with honesty. This is the only way because, a lot of the times, what you want to build will not be the same as, in the end, what is valuable to build. And the only way for you to pivot is if you are honest with yourself and your team and the leadership team and you face the brutal facts with honesty. As a team now, basically there are three things. You have to find, as a team, what you're passionate about, what you're good at making money, and what you can be the best at. You need all of three. If you're not passionate, people will get bored and will leave the company. If you're not good at, you'll never build a great company. And obviously, if you're building something that's not valuable, then that's not a business, that's charity. Okay. Yeah. So, as you build for the product, there's a lot of books and things, you know, known. But I think the most important aspect that we don't often talk is, you should listen to your customers. But you should always remember that your customers are the masters of the problem space, not the solution space. You shouldn't talk to your users about solutions. You should talk to your users about problems, right? If they tell you they want a better pen, you should question that and maybe ask them, like, do you really want a pen or maybe you just want something to write? Because if you want something to write, maybe the best product is actually a pencil. As Ford said, if he listened to customers in the 1800s, he wouldn't build a car, he would build a faster horse. So, the first step is to determine your target customer. You have to go through this process. It's very valuable to do it at least once internally for the team. It really helps you to focus. Who are you targeting? Why? What do they care about? What are their needs? Really flesh it out. Then, after you understand who is your customer, you want to identify the underserved customer needs, right? What is the problem they have and where is the hole in the market? And this is an exercise. It's not easy to go through that because as engineers, we like to build. And we go straight to the solution without really exploring the problem space. Finally, I'm not final actually, but I'm free. You want to define the value proposition. You know your customer, you know their needs, and now you're trying to identify the value proposition of your product or feature. And really, the value proposition is very simple. You define the current state of things. How do they do something right now? And how they will do it in the future with your product? The delta, the difference, is the future state. And this is something useful to do it on a product level, but also something useful to do it on a feature-by-feature level. It will really help you to refine your prioritization process and build the right features. And finally, the MVP. Now is the time to really get specific, rapid user stories, and remember that MVP is viable. It has to produce value for the customer. If you spend all your time making it faster, but there is no UX, it's not usable, that's not MVP. That's a piece of technology. An MVP must be viable, which means it has to give some value to the user. And this is not something that you will define, that's what the user defines. The user will tell you that your MVP is an MVP. Okay, we've built a startup now, we know the basics. Why do I think security now is a good industry to be in? To do a recap of the market from 2019 to 2025, we had what we call the digital capital, right? They just care about maximizing their yield, a lot of money, but it's digital, right? They don't care about risk, they don't care about anything. They just want to maximize their yield. And this has been the power engine so far for the market industry. But now we're seeing a very important addition of traditional capital entering the market. And this is a very different type of user, right? They're risk averse. They care about yield, but they also care about risk. And DeFi can't compete without reducing the risk, right? Because if it offers just 5% better yield, it's like a totally different risk profile, mainly due to hacks, that's not good. And the market is exploding, right? We're seeing a lot of stable coin movement. We're seeing a lot of inflows, Bitcoin, Ethereum, and lately Shopify, Stripe are exploring stable coins. So this is not just a theory. We are seeing traditional capital, traditional players entering the market right now. And they want security, right? Kraken, for example, Ambez, they launched their own superchannel, they made security a core value USP of their network. They talk about it on blog posts or whatever. Sui, Aptos, for example, or Converge, they're also talking about security in different ways. So we are seeing this traditional capital asking for more security. And there is a flywheel, really. More institutional adoption has inflows. More inflows, more capital to play with creates trust. It has more users to be onboarded. Trust plus security means that developers can experiment with new use cases. It means that we can self-regulate as an industry, and we don't need to be strictly regulated. And this is how we fight PMF. And with PMF, because of new use cases, we have more adoption. And the flywheel continues. The final, I think, core pillar of why I think security is a big opportunity now is the new Clarity Act that is being discussed and voted in the United States. It ends the regulation by enforcement and splits the oversight for crypto between SEC and CFTC very clearly. And this is a big opportunity for us. It's good for the industry. Because for the first time, it defines a digital commodity, like oil or gold. And that's different from security. And digital commodity is linked in this act with mature blockchain systems. For example, Ethereum. And a system, either it's a DAPP or a blockchain network, will want to be identified as a mature blockchain system because then it's regulated as a commodity and not a security. And this will also push a lot of networks to become mature blockchain systems because they will not want to be regulated as securities. So, a mature blockchain system has distributed control, distributed ownership over some digital community, and operates with transparent rules. Nobody controls more than 20%, as they say, in this field. So, for example, in Ethereum, if Vitalik wants to sell ETH, he doesn't have to disclose it, right? Because it's a mature blockchain system. It's a commodity. But for other networks, if a founder wanted to sell some tokens, they would have to disclose it. And why I think this is very good for security is because security has always been pushed by compliance, even in Web 2. It's an industry that is being pushed by compliance. And now security becomes a prerequisite for compliance, right? Hack prevention is a core component of this regulatory framework because it talks about the security posture of protocols. And security posture now becomes a competitive advantage. And I think it's an opportunity, especially for Web 3.0 security, because centralized security now will endanger the protocol from having a mature blockchain system, right? Because a centralized security solution, for example, pausing a DAP if a hack is about to happen, means that there is some party that can exert control. There is a party that can alter, substantially, a protocol. And just the possibility to exert control will endanger the definition of a mature blockchain system. And this is the opportunity, right? It's compliance with a new legislation that will push protocols to actual decentralization, right? For their own selfish, obviously, incentives. So now decentralization theater will no longer be viable, either in traditional crypto industry or in security. So we'll see more security companies appearing that will tackle security concerns, either with hack prevention or other aspects of security, but in a way that respects decentralization. So this is what I had to talk to you about today. We spoke about a bit how to invest, actually how to fundraise. Then we talked about some basics on how to build a team, how to build a product. Finally, we closed the discussion with why 2025 is a good year to build a security product. Thank you so much. Thank you.