Mandiant CEO Kevin Mandia: too many security startups

“When you look at all the startups [in security], I feel like probably 80% of them shouldn’t be there,” Mandia said in an interview with Protocol.

In addition to his day job, Mandia is now a strategic partner with the cybersecurity-focused venture capital firm Ballistic Ventures, which announced the expected close of its first fund Tuesday at $300 million. And with his VC hat on, Mandia says his mission now is to use his rare acumen to help the Ballistic team only back the startups that bring the most useful ideas in security.

One common issue he sees with security startups is having the “wrong founder.” Too many founders enter the fray and announce, “‘we’re gonna fix this cybersecurity problem’ — with no history in cybersecurity,” Mandia said.

Another issue with many security startups, he said, is they lack a strong or original idea.

But while 80% of security startups may not be necessary, that doesn’t mean Mandia thinks they will all fail.

“There’s probably a higher percentage of them that are good investments,” he said. “My idea of success probably is more from the practitioner’s mind — [that] they’ve got the solution I would pick. And that’s hard for a startup.” Google is expected to close its $5.4 billion acquisition of Mandiant later this year.

Still, Mandia’s instincts on spotting the startups that could make a real difference in the fight against cybercrime would seem to be exactly why Ted Schlein, the prominent former Kleiner Perkins VC, tapped Mandia while forming Ballistic Ventures.

Mandia says his “superpower” on the Ballistic team is the ability to “understand founders,” and quickly discern if their idea and background are right for the task in security.

Cybersecurity startups that Ballistic Ventures has backed so far are Pangea, Concentric, Nudge Security and Veza.