I’ve spent twenty years in and around enterprise security, being a VAR, running SOCs, sitting through vendor bake-offs, and now on the other side of the table hearing the pitches. So believe me when I say the enterprise security market is the most crowded room in technology. Every category already has a leader, a few challengers, and a PE roll-up circling the rest. A Fortune 500 CISO fields forty pitches a week and buys from four. If your thesis starts at the enterprise, you’re starting where the moats are already dug.
Which is why I keep coming back to the SMB.
On paper it looks unglamorous. In practice, small and mid-sized businesses are most of the economy and most of the breaches. They hold the same regulated data, sit in the same supply chains, run the same SaaS stack as the enterprise , except there’s no security team, no SOC, and the budget assumes the IT guy handles it. Attackers figured this out years ago. Ransomware crews mostly stopped chasing hardened enterprises because the unit economics are better one town over. The SMB breach rarely makes headlines (it just makes a wire transfer).
So why hasn’t anyone solved it? Mostly because the SMB has been a graveyard for security companies, and the reason is boring: distribution. You cannot run an enterprise sales motion into a market of ten million buyers who each spend four figures a year. Every founder who tried learned the same lesson, the CAC math never closed, the market got abandoned to consumer-grade antivirus, and everyone went back upmarket to fight over the same 2,000 logos.
I think three things have changed, and I’d weight them differently than most people do.
The first is that the stack collapsed into SaaS. An SMB’s entire attack surface today is Microsoft 365 or Workspace, a handful of SaaS apps, and some laptops. That’s a knowable, API-reachable surface. You don’t need an agent on a server in a closet anymore; you need OAuth and a good posture engine.
The second is AI, though not in the way most pitch decks use the word. The reason SMBs never had real security is that security is expensive human labor i.e triage, investigation, response. For the narrow, repeatable threat model an SMB actually faces, that labor is now largely automatable. The very thing that made this market unservable happens to be what AI is best at.
The third, and honestly the one I’d underwrite the whole thesis on, is the channel. The MSP is now the buyer, the installer, and the renewer. Win one MSP and you’ve effectively closed their few hundred downstream clients. I spend a lot of time with MSPs and MSSPs these days, and the pattern is consistent: they are desperate for security products built for how they actually operate, and mostly being sold enterprise tools with a partner logo slapped on. More on this in its own piece.
What am I looking for? Not another enterprise EDR with an “SMB tier”, that’s a discount, not a product. I want companies architected from day one for the SMB reality: no security staff on the buyer’s side, SaaS-first surface, sold through the channel, priced per seat at a number a plumber’s office will actually pay. The product has to assume the end customer will never log in.
My bet is that the next decade of durable security outcomes, measured in breaches prevented, not just ARR, gets won here. The enterprise is where security companies go to compete. The SMB is where security still barely exists. I know which side of that I’d rather back.
--- The Security Thesis is where venture capital meets security — the enterprise, the SMB, the MSP/MSSP channel, physical AI, and dual-use & defense technology.