Where entrepreneurial investors meet founders

By Lightbird’s Thuy-Linh

Most software today isn’t written from scratch — in fact, it is estimated that over 80% of code in any modern application is code written by others, whether it is code from open source projects and Github repositories, remote call-outs to third-party services, or libraries acquired from third-parties. While re-using third-party code makes absolute sense in terms efficiency, efficacy, speed and cost, these external software artifacts are potentially subject to vulnerabilities and hacks that can negatively impact one own’s software security. In fact, with the rise in popularity of open source components (the average software application in 2021 depended on more than 500 open source libraries and components, up 77% in two years), the exposure of software to vulnerabilities inherited from potentially unsecure third-party’s components is expected to rise too. And indeed, in the past few years, the number of attacks that took advantage of these software dependencies — so called software supply chain vulnerabilities — increased in average 740%+ YoY (!).

So, how can one address the security challenges of using third-party’s and especially open source software components?

In this article, you’ll read more about our research in the state of software supply chain security (SSCS), our opinion on the current status quo (incl. a list of players / tools in the field) and where we see market gaps and opportunities for new entrants.

Status quo and respective challenges

In the aftermath of recent massive software supply chain attacks (e.g., SolarWinds, Log4j), politics around the world, including the White House and the EU, were awaken to the criticality of SSCS and intensified efforts to better protect software from supply chain vulnerabilities. This global concern has by now also spread to the private sector with for instance a large industry group, including the likes of Google, Amazon, Ericsson, Intel, Microsoft and VMware, pledging $30 million to work with the Linux Foundation and Open Source Security Foundation to improve the security of open source software. In the same vein, many initiatives, frameworks and guides were subsequently developed, such as S2C2F (“Secure Supply Chain Consumption Framework”) or SLSA (“Supply Chain Levels for Software Artifacts”; pronounced “salsa” 💃). Software supply chain security issues also took the center stage at the Black Hat conference in 2022.

While the issue of SSCS gets strong public and private interest today, and despite the risks that software supply chain issues could expose an organization to (see the latest supply chain attack targeting 3CX users and more than 600,000 companies worldwide), 27% of medium to large companies still do not have any established security policy in place to deal with software governance and open source security. For small companies this number approaches more than 45%. Worse than that, latest surveys show a great discrepancy between what people think is happening within their organization vs. what is really happening: while 68% of respondents are confident that their applications are not using known vulnerable libraries, close to 70% of 55’000 enterprise applications revealed known vulnerabilities in the underlying open source software components.

In fact, the core challenge for companies is that software supply chain security is highly complex as it spans various and vast aspects of software development that an organisation cannot directly control. Months after the Log4j vulnerability was reported for instance, it was still responsible for security breaches: this attack taught us that it is not enough to only know where one’s own developers are using Log4j, organizations have to also know all of their software that uses Log4j. As such, organizations have to implement processes and tools that help them check components across their entire software development lifecycle, including in-house code, outsourced development, commercial software packages, open source deployments, interfaces and protocols, development tools, … and anything else that makes up or interacts with the final solution.

In addition to “scanning all individual components” thanks to SCA or SAST tools for instance, the understanding of the dependencies within a project is equally vital (e.g., how do the different parts of the code interact with each other? how would a vulnerability affect the rest of the software chain? who has access to what and when?). Along with choosing and managing hundreds of initial dependencies, developers are thus asked to track an average of 1,500 dependency changes per year per application while maintaining software quality at all times. This is commonly referred to as dealing with the “Dependency Hell”.

And so, while SCA and SAST tools are relatively in use (around 35% of all respondents to a recent survey by the Linux Foundation have such tools in place), they typically can only address a portion of all the aspects around software supply chain security:

To date, various tools and frameworks exist across the three pillars of SSCS as illustrated above to help companies use third-party’s code and open source components more securely. 👉 Look at the end of this article for our list of 25+ companies, incl. companies recently out of stealth such as Oligo or Ox Security, providing solutions in this space.

It is nonetheless important to highlight here that given the complexity and vastness of SSCS, it is almost impossible for anyone to be 100% protected or “clean” of vulnerabilities, and thus for any tool to provide a bullet-proof solution. In fact, an external dependency per se already contains risks and potential vulnerability exposure. Like other aspects in cybersecurity, it ultimately comes down to the extent of an organization’s risk appetite.

Market development and opportunities

As mentioned earlier, SCA and SAST are the most widespread tools currently in use against software supply chain security vulnerabilities. However, they can only cover parts of what would be needed — thereby creating opportunities for new entrants and innovative solutions. At Lightbird, we are excited about the following developments in the SSCS space:

• The provision of more comprehensive / aggregating tooling across various aspects of software supply chain security. 59% of all respondents in a recent survey by the Linux Foundation found that “adding intelligence to existing software security tools (e.g., SAST, SCA, SBOMs, IaC)” should be the top priority to improve SSCS. And while a few players — such as Sonatype (US, 2008) or Snyk (US, 2015) — have been developing and commercializing suite of tools to address various aspects of SSCS, new technologies and an increasing availability of data will enable the next generation of more encompassing solutions. Endor Labs (US, 2021), for instance, backed with $25M in seed funding from Lightspeed, started the commercialization of a product suite claiming to go further and deeper than any other tools in SSCS matters. Ox Security from Israel also emerged from stealth in late 2022 with $34M in funding to introduce a more comprehensive version of the Software Bill of Materials (SBOM), called PBOM or Pipeline Bill of Materials, which covers not only the code but also each of the procedures and processes that impacted the development of a specific application.
• Tools and frameworks to facilitate the adoption of best practices and endorsement of organizations that do so. Google has for instance launched its Assured Open Source Software service which gives enterprises and government users access to the same vetted open source packages that Google itself uses in its projects. According to the company, these packages are regularly scanned, analyzed and fuzz-tested for vulnerabilities and built with Google Cloud’s Cloud Build service with evidence of SLSA-compliance. Chainguard (US, 2021) also took this route with products that allow developers to only build with SLSA compliant containers with provenance and SBOM verified by digital signatures. Chainguard was founded by the team behind the SLSA framework itself and is funded by Sequoia.
• Automated analysis and remediation of security vulnerabilities for SMBs. Security by default from the start should be encouraged, yet not every developer needs to be a cybersecurity expert, nor do all companies have the resources to address the complexity level of supply chain security. Because supply chain vulnerabilities can however affect companies of all sizes with the same impact, we see an opportunity for new entrants to offer basic, developer-friendly (i.e. embedded in a developer’s workflow) yet performant security tools targeting the particular needs of SMBs. Aikido Security — one of the few European players in this space — based in Belgium is taking this route by addressing teams with less than 50 developers.
• The adoption of bottom up go-to-market approaches. At Lightbird, we back companies with strong distribution advantages that come from adopting innovative go-to-market strategies beyond traditional sales & marketing. It’s fair to say that cybersecurity has remained one of those industries where traditional sales motions have endured. And so, it is not surprising that SSCS companies often target security officers, CISOs and compliance teams in a top down approach. Yet, with Snyk leading the way, we are particularly excited to see more and more cybersecurity companies start adopting an innovative go-to-market approach, typically targeting developers and incentivizing developer communities around security to evangelize the product from the bottom-up.

We’ve put together a list of active companies in the SSCS space 👉here. Have we missed anyone? If you are building something to improve software supply chain security and enable more secure use of open source software, we’d love to exchange perspectives and hear from you! Feel free to reach out via LinkedIn or to hello@lightbird.vc.

Thanks to my colleagues at Lightbird for their feedback as always and a special thank you to Charles for the insightful input!

Software Supply Chain Security: addressing cybersecurity challenges in using open source software was originally published in Marcau Partners on Medium, where people are continuing the conversation by highlighting and responding to this story.

The Nordics are the new SV (Sustainability Valley). What is behind the success of the region in the startup ecosystem?

The Nordic countries have a proven track record of being home to some of the most contented, affluent and inventive individuals worldwide. The impact the region is having in the European environment is so relevant that a recent McKinsey’s report defines it as “the new SV”, which is usually the acronym used for the Silicon Valley, but referring to “Sustainability Valley” this time.

With 42 total unicorns produced, including Skype, Spotify, Klarna, Supercell, Kry just to name a few, more than 1627 successful exits in the last four years only, the fastest (12.5x, 2017–2022) growth in Europe for the number of mega rounds ($100M+), the Nordics have a very sound reputation among investors and founders. This is even more true in the impact and sustainability space. In 2022, 35% of all VC funding in the region went to impact startups: with this number averaging around 22% in Europe, this performance makes the Nordics the most impact-focused region in the world. Even after a challenging 2022 that saw investments in the Nordics dropping by nearly 30% from 2021 but still 2x compared to 2020, the Nordics can be definitely considered a hotbed for innovation.

But what is the secret sauce that makes the region rise through the ranks? Are there any lessons that can be applied in other ecosystems?
While the answers to these questions may be hidden behind several social, economic and geographical factors, we have tried to identify four macro-areas that can help to explain the Nordics success.

TL;DR

1) A well established tradition of entrepreneurship and innovation

2) Combination of private and public effort in supporting the startup ecosystem

3) The high-quality education system in the Nordic region produces a skilled workforce extremely keen on entrepreneurship

4) Sustainability is an intrinsic value in the Nordics, it’s not just an objective

The Nordic region is a technological reference point due to its tradition of entrepreneurship and innovation

The Nordics region has a strong history in innovation that creates a common and shared tradition of entrepreneurship. In fact, while in recent years the Nordics gave birth to a significant number of unicorns and very successful companies, the region’s culture of entrepreneurship and innovation has longstanding and strong roots. With a sound reputation as pioneers in the mobile phones industry with Nokia and Ericsson, that were among the first to prove the possibility to compete at a global level even against the big Asian and American powers, the region continued to boost giants even in more traditional industries with colossus like IKEA, Maersk, Volvo, and H&M. These enterprises became undoubtedly iconic examples of the Nordics’ reputation all over the world.
The ecosystem around innovative products and business models has proven even more solid with the definite proof of power in the recent software revolution, with Skype’s contribution above all.

In this context of established entrepreneurial tradition and focus on innovation, it comes with no surprise that Sweden is at the forefront, especially driving digital disruption in every industry. One of the most significant events that boosted the technological inclination of the country was the late-1990s government policy to put a computer in every home. Over the course of the program, from 1998 to 2001, around 850,000 household computers were distributed for free, up to a quarter of Swedish households. Many individuals who couldn’t otherwise afford such machines were given access to a completely new possibilities and digital skills. Sebastian Siemiatkowski, Klarna’s founder, began to code on a computer his mother bought with the government support. Another catalyst for the spread of digital innovation in the early 2000s was the fast adoption of broadband, which was even faster than in the US: in 2005, when Klarna was founded, there were 28 broadband subscriptions per 100 people in Sweden, compared with 17 in the United and a global average of 3.7.

The overall ecosystem is a recognized asset from its participants themselves who work pro-actively to preserve and to sustain it, enhancing a flywheel that accelerates its development speed. Numerous pioneers of the Nordic technology industry are in fact dedicating their next steps to continue to develop the ecosystem, either by launching fresh startups like Spotify’s founder Daniel Ek did with Neko Health, or by reinvesting their resources, like Niklas Zennström, the founder of Skype, who founded Atomico and then supported Klarna. Talents (and capital) remain in the region, and they set even more ground for the future.

Availability of funding and investment is the result of a unique combination of private and public effort

One of the strengths of the Nordic ecosystem is the synchrony between the governments-public interests and the private ones for the development of the tech and startup ecosystem.
Governments in the Nordic countries have been proactive in promoting entrepreneurship and innovation and have implemented policies and initiatives that encourage investment in startups. This support includes funding for research and development, tax incentives and easy access to public financing.

In Norway, for example, you can claim an income deduction on personal investments up to NOK 1 million (around EUR 89K). In Sweden, instead, state-owned pension funds are a real boost for the startup-ecosystem development. Back in 2016 Northzone, an early investor in Spotify, was able to raise its biggest fund back then of €350M, also thanks to investment from state-owned pension funds AP3 and AP6. All in all, Nordic pension funds account for 16% of total VC funds raised in the region, while in the DACH this number fluctuates around the 2% and it is 3.5% in France and Benelux. Beyond public pension funds’ activity Nordics government are notorious for establishing public programs for investing, both directly or indirectly through other VC funds, in startups, supporting their tech development or international expansion. For example, in 2016 the Swedish government established Saminvest, that actively supports both national and international venture capital funds and angel investor programs that will add value to the Swedish ecosystem. Similarly, Business Finland, the Finnish government organization for funding and trade, provides services and funding for Finnish startups and SMEs, to foster their international growth and to fuel business and product development as well as technical R&D. The entrepreneurial spirit in Sweden is also supported by strong social policies and foundations: “The social safety net we have in Sweden allows us to be less vulnerable to taking risks” — Gohar Avagyan, Vaam’s co-founder, referring to the range of income insurance funds that protect business owners when their venture fails or for startups’ employees if they lose their job, guaranteeing up to 80% of your previous salary for the first 300 days of unemployment (Reuters).

Beyond public capital and government incentives, the Nordics are attracting at the same time a massive amount of private money to the VC space. Startups in the area raised $11.7B in 2022, almost USD 417 pro capita, while in the DACH region the total amount raised was USD 16.1B (EY, Sifted, VentureLab), close to USD 170 pro capita. For the Nordics, this is 36% lower than the all-time high in 2021, but more than 50% higher than 2020’s total. In this context, Sweden results to be the gold reserve of all VC money in Europe. Swedish key venture capital firms, among the others, include Northzone, Creandum, and EQT Ventures. These firms have not only invested in successful startups, including Spotify, Klarna, and iZettle, but they manage the largest funds of the entire European region. Among the top 5 funds in term of size, 4 are managed by the Swedish trio, with EQT (with its EQT Growth I and Ventures III respectively at the first and second position) and Northzone (Northzone X) monopolizing the podium. Creandum follows at the fifth place with its Creandum VI, preceded by the UK-based Felix Capital.

Another key aspect that is worth being pointed out is the lower severity of the funding gap problem through the entire startup lifecycle. If later stages are well covered by incredibly large-size funds, the Pre-Seed and Seed panorama offers an outstanding roster of professional funds laser focused on the growth of the Nordics ecosystem too. Just to name a few: Lifeline Ventures and Inventure in Finland, Heartcore Capital and Seed Capital in Denmark, Industrifonden and Norrsken VC in Sweden, and Skyfall Ventures in Norway.

Even in terms of acceleration programs and community events the region stands out. Nearly 12’000 people attend Helsinki-based Slush conference each year, which has fast become one of the world’s top tech and startup events. There’s also a slew of tech accelerators that have been a huge asset to the region’s popularity in the startup space. Apart from the international ones with a presence in the Scandinavian area like Seedcamp, Antler and Startupbootcamp, the region presents original programs with a strong success path like the Danish Accelerace or Sting, that since 2002 have supported hundreds of promising Stockholm-based startups.

This combination of government support in both financial and infrastructure aspects, large amount of private money interest and a vibrant community, creates a very unique fertile terrain for startup to be founded and then scaled.

The high-quality education system in the Nordic region produces a skilled workforce extremely keen on entrepreneurship

The Nordic region’s education system is considered one of the most successful in the world. When adjusted for GDP, Finland’s higher education system is the best in the world, according to the Universitas 21 (U21) rankings. Denmark and Sweden, are also both present in the top 5. This achievement is the result of a strong tradition of investing in education and providing equal opportunities for all students. The education systems are designed to foster creativity, critical thinking, and problem-solving skills, rather than simply focusing on academic achievement. Nordics students practice the most useful soft-skill in entrepreneurship since their school days. In Sweden, they even practice the hard-skills: entrepreneurship training for high school students started already in 1980. The number of students who participated in the training grew steadily and entrepreneurship eventually became part of the national curricula for both elementary and upper secondary schools in 2011.

Moreover, Nordic countries have a strong focus on research and development with a particular attention to the scientific fields. The Technical University of Denmark (DTU) is a top-ranked university that excels in engineering and environmental science research. KTH Royal Institute of Technology, located in Stockholm, Sweden, is known for its world-class research in areas such as information and communication technology, energy, and transport. Chalmers University of Technology, located in Gothenburg, Sweden, is a highly ranked engineering and technology university with a strong focus on collaboration with industry. Aalto University, located in Espoo, Finland, is a multidisciplinary university that excels in innovation and entrepreneurship in fields such as science, engineering, and design. Finally, the University of Helsinki, the largest and oldest university in Finland, is renowned for its research in fields such as ecology, materials science, and quantum physics. These universities share a common commitment to research, academic excellence, and innovation, making them among the top scientific and engineering schools in the world.

Sustainability is an intrinsic value in the Nordics, it’s not just an objective

Nordic Regions rank first in almost all reports about sustainability. In 2022 (and even in previous editions) Finland, Sweden and Denmark monopolized the podium of the Europe Sustainable Development Report with regards to the percentage of SDGs achievement analyzed. The Nordics have a long and established tradition about sustainability that is embodied and delineated in each aspect of the society, both in the local cultures and in political agendas. The Nordic Council, has identified three priority strategic areas in a joint statement on which all countries involved commit to work together as a unique identity. These areas are the transition to a green economy, promoting social sustainability, and ensuring competitiveness in the region. Denmark for example, has taken the lead in the transition to a green economy, successfully reducing CO2 emissions by more than 50% since 1996. On the other hand, Finland has set an example for sustainable use of resources and is the first country to establish a detailed roadmap for it.

The attention to the sustainability is an issue that is becoming increasingly important especially in the consumers space, driving a significant shift in a market that has been crucial for the development of the Nordics ecosystem. But even from an investor perspective, this theme is becoming more and more relevant. First of all, investment portfolios face significant risks from climate change and global warming, so that investors are starting to prioritize impact investing to hedge their positions. Institutional investors have been noting that hazards associated with ESG matters can significantly impact a company’s market value and public image. Companies have witnessed a reduction in their earnings and gains due to occurrences such as work-related accidents, environmental damage or contamination, and supply chain disruptions caused by weather and social conditions, or even bad governance. Adding to that, sustainability is core to align fund strategies with the priorities of beneficiaries and broader stakeholders. According to US Trust, two-thirds of high-net-worth millennials implement their investment decision expressing their social, political and environmental values, indeed.

Given the primary position the Nordics hold in the sustainability space, both in terms of social engagement and technological development, the region gravitates at the center of the most discussed and material theme of the next decades.

What’s next
So far, the optimism is definitely predominant and the overall sentiment is that the Nordic startup boom will continue into 2023 and beyond, due to the region’s global approach, intrinsic tradition for innovation, and risk-taking mentality.

The Nordics are the new SV. What is behind the success of the region in the startup ecosystem? was originally published in Marcau Partners on Medium, where people are continuing the conversation by highlighting and responding to this story.