DAPPCON 2025: Inside the Trenches: Building a Security Company in 2025 - Odysseus

Transcript

Thank you so much. Hello everyone. Thank you so much for being here and thank you for inviting me. So in this talk I want to talk a bit about two things essentially. How to build a company in general because you know we keep talking about engineering and we keep forgetting what the PMF is. Um and then how to build a company in security and why I think this year um is going to be great for security which has been traditionally not an easy industry to be in.

So let's start with fundraising. Um the I want to talk a bit about a few tips I've learned as I was fundraising. The first and foremost is that if you talk with VCs and investors and maybe it's just a no, right? Like don't waste your time. If they're taking too much time to respond to you, just go to the next one. You have to expect a yes, but not too early. If a yes comes too early, that means they're not doing a lot of DD.

They're not very good VC at the end of the day. If it comes too late, that means they're trying to derisk their investment to you, and that's also not very good. So, ideally, you want to come to a yes somewhere in the middle. And of course, as you're discussing with them, a verbal offer is not offer at all, right? You should always expect a term sheet only if it's in writing. This is when you know they're real. Now, as you talk with uh investors, fog of war is your ally. You don't want to tell them who else you're talking with, right? You want to keep them guessing.

You want them to FOMO. So, you should tell them if you're having other discussions, you know, valuations or offers, but you shouldn't tell them with whom. You should try to avoid VCs um that avoid uh that have invested in competitive startups because more often than not they'll try to get as much information from you strategically uh implementation wise and finally to their own uh portfolio right so sometimes you can't avoid it but ideally you want to avoid it if you talk with someone that has you know a reputation of being very open and sharing but they're still a good uh investor You can attempt to approach it as a

black box. You can tell them what are you doing, what are the inputs, what are the outputs, but you should at no level tell them exactly how it works or show them the code. Right? At the end of the day, they should believe in you, the founder or the founding team, to know what you're you're doing and be, you know, honest about it. Expiry dates. Expiry dates are There's no expiry dates on term sheets. If they tell if they tell you that the term sheet has an expiry date, they're trying to force you in the decision, and that's not a good sign. If they like the deal, they they like what you're doing, they like you, they'll let you uh wait.

They'll let you finish your all your discussions so you can have a better view of the market. Now, as you talk with investors, uh you want to sequence them smartly, right? You want to start with investors where you really don't care about having them on your cup table. This will be a very useful training mode for you, right? As you talk to them and you understand what are their questions, uh what are their reservations, where your pit has some holes. So when you talk with investors you really want on your cup table, you can be ready.

Warm intros are always a must. Before you start the fundraising process, you have to prepare all the warm intros, right? You have to make sure that you have a warm intro to every single investor you want. And when you start fundraising, you you go into a blitz, right? You reach out very aggressively. And of course, you don't want to close too early. You want to wait for all your discussions to start back. It's very important how you craft your cap table. Um, you don't want cheap money, but also you don't want to uh people that will push your valuation too low, right? You want a a mixture. You want good investors that obviously will be more realistic with their valuations,

but also more enthusiastic investors will go gung-ho, right? So that's way you can get both value out, but also uh a valuation that works for you. Crypto is inflated. We have to accept that. And that's why you'll probably expect your uh token warrants to be antiluted, right? That's something you have to expect. And it's okay because you know they give you an inflated valuation. As you choose your investors, you had these discussions now and you're trying to understand who is a good one. Um don't pay attention to marketing.

There's a lot of investors who do a lot of marketing, open source, whatever. But if you look at their portfolio uh performance is not that good. The way you can understand is an investor will be good for you will be good value ad is by looking at the portfolio. Are they winning right? Do they have returns for their LPS or not? This will tell you who is really useful and of course avoid pump and dumps VCs. I mean that's goes uh with you know not even worth discussing about it and generally speaking if you have if you see red flag you walk um raising money it's not easy but also we have leverage as builders they need to allocate right

as much as we need the capital so don't fear to walk out of a meeting and finally terms and closes um everything is negotiable right you can you should expect that they can ask for everything and you can ask for everything. Um, nothing is off the table. There's no rules. So, if you want, you can get really creative, right? You can even ask for a banana as part of your term sheet and we can put that in writing. Finally integrity. You have to be honest. Tell them what you know, what you don't know, and how you expect to find out. They will appreciate that. You don't want to them. That's very important to create trust.

Um, and of course, if an investor is unprepared in your meetings, you should call them out in return, right? In the same way they would call you out if you're unprepared, you should tell them that, you know, they're wasting your time. So, we fund raise now and we need to build. The first most important thing in a company is a culture. as a founder and as a team. As a founder, be uh you have to have humility, right? You have to accept that you don't know everything and reach out to mentors and people to uh that will help you find out what you don't uh what you don't know, right? You should expect that you will have to deal with a lot of new things.

Um and face uh brutal facts with honesty. This is the only way because a lot of the times what you wanted to build will not be the same as in the end what is valuable to build. And the only way for you to pivot is if you are honest with yourself and your team and the leadership team and you face uh the brutal facts with honesty as a team. Now um basically there are three things you have to find as a team what you're passionate about, what you're good at making money, and what you can be the best at. You need all of three. If you're not passionate, people will get bored and will leave the company. If you're not good at, you'll never build a great

company. And obviously, if you're building something that's not valuable, then that's not a business. That that's charity. This one, I prefer this one. There's this noise. Could you do it? Thank you. Yeah. So as you build for the product um there's a lot of books and things uh you know known but I think the most important aspect that we don't often talk is you should listen to your customers but you should always remember that your customers are the masters of the problem space not the solution space. You shouldn't talk to your users about solutions. You should talk to your users about problems. Right? If they

tell you they want uh they want, you know, a better pen, you should question that and maybe ask them like, "Do you really want a pen?" Or maybe you just want something to write because if you want something to write, maybe the best product is actually a pencil. As Ford said, if he listened to customers in the 1800s, he wouldn't build a car. He would build a faster horse. So the first step is to determine your target customer. You have to go through this uh uh process. It's very valuable to do it at least once internally for the team. It really helps you to focus who are you targeting? Why? What do they care about? What are their needs? Really

flesh it out. Then after you understand who is your customer, you want to identify the under and underserved customer needs, right? what is the problem they have and where is the hole in the market and this is an exercise. It's not easy to go through that because as engineers we like to we like to build and we go straight to the solution without really exploring the problem space. Finally and not final actually that's step three you want to define the value proposition.

You know your customer, you know their needs, and now you're trying to identify the value proposition of your product or feature. And really what the pro the value proposition is very simple. You define the current state of things. How do they do u something right now and how they will do it in the future with your product. The delta the difference is the future state. And this is something useful to do it on a product level, but also something useful to do it on a feature by feature level. It will really help you to uh refine your prioritization process and build the right features.

And finally, the MVP. Now is the time to really get specific, write your user stories, uh, and remember that MVP is viable. It has to produce value for the customer. If you spend all your time making it faster, but there's no UX, there is it's not usable, that's not MVP. That's a piece of technology. An MVP must be viable, which means it has to give some value to the user. And this is not something that you will um define. That's the that will the user defines. The user will tell you that the your MVP is an MVP.

Okay, we've built a startup now. We know the basics. Why do I think securityurities now is a good industry to be in? To do a recap of the market from 2019 to 25. We had what we call the digent capital, right? They just care about maximizing their yield. Um, a lot of money, but it's diggent, right? They don't care about risk. They don't care about anything. They just want to maximize their yield. And this has been the uh power engine so far for the market industry.

But now we're seeing the uh a very important addition of traditional capital entering the market. And this is a very different type of user, right? They're risk averse. They care about yield, but they also care about risk. And DeFi can't compete without reducing the risk, right? Because if it offers just 5% better yield with like a totally different risk profile mainly due to hacks, that's not good. And the market is exploding, right?

We're seeing a lot of uh stable coin movement. We're seeing a lot of inflows. Bitcoin, Ethereum, and you know, lately Shopify, Stripe are exploring co stable coins. So this is not just a theory. We are seeing traditional capital traditional players entering the market right now and they want security right. Kraken for example on base they launched their own superchoss they made security a core value USB of their networks they talk about it on blog post or whatever suie apttos for example or converge they're also talking about security in different ways so we are seeing this traditional capital asking for more security

and there is a flywheel really more institutional adoption has inflows more inflows more capital to play with, creates trust, has more users to be on boarded. Trust plus security means that developers can experiment with new use cases. It means that we can self-regulate as an industry and we don't need to be strictly regulated. And this is how we fight PMF. And with PMF, because of new use cases, we have more adoption and the flywheel continues.

The final uh you know I think core pillar of why I think security is a big opportunity now is the new clarity act that is being discussed and voted uh in the United States. It ends the regulation by enforcement and splits the oversight for crypto between SEC and CFTC very clearly. And this is a big opportunity for us. It's good for the industry because for the first time it defines a digital commodity right like oil or gold and that's different from a security and digital commodity is linked in this act with mature blockchain systems for

example Ethereum right and a system either it's a DAB or a blockchain network will want to be identified as a mature blockchain system because then it's regul regulated as a commodity and not a security. And this will also push a lot of networks to become mature blockchain systems because they will not want to be regulated as securities. So a mature blockchain system has distributed control, distributed ownership of uh over some digital community and operates with transparent rules. Nobody controls more than 20% as they say in this bill. So for example in

Ethereum you know if Vitalik wants to sell ETH he doesn't have to disclose it right because it's a mature blockchain system it's a commodity but for other networks if a founder wanted to sell some more tokens they would have to disclose it and why I think this is very good for security it's because security has always been pushed by compliance even in web two right is an industry that is being pushed by complian liance and now security because becomes a prerequisite for compliance. Right? Hack prevention is a core component of this regulatory framework because it talks about the security posture of pro of

protocols and security posture now becomes a competitive advantage and I think it's opportunity especially for web3 security because uh centralized security now will will endanger a protocol from having a mature blockchain system right because a centralized security solution. For example, you know, posing a DAP if a hack is about to happen means that there is some party that can exert um control. There is a party that can alter substantially a protocol and just this uh the possibility to exert control will endanger the definition of a mature

blockchain system. And this is the opportunity, right? This compliance with a new um, you know, legislation that will push protocols to actual decentralization, right, for their own selfish um, obviously incentives. So now decentralization theater will no longer be viable either in traditional crypto industry or in security. So we'll see more security companies um appearing that will tackle security concerns either with hack prevention or um other aspect of security but in a way that respects the centralization.

So this is what I had to talk to you about today. We spoke about a bit how to invest, how to actually how to fund raise. Then we talked about some basics on how to build a team, how to build a product. Finally, we close this discussion with why 2025 is a good year to build a security product. Thank you so much.