At the forefront of the evolving security investment landscape, Thomvest Ventures Managing Director Umesh Padval and Principal Ashish Kakran shared their perspectives on the opportunities and challenges of artificial intelligence (AI) as the initial public offering (IPO) window begins to open.

Thomvest Ventures is a San Francisco-based $750 million evergreen venture capital fund founded by Peter Thomson of Thomson Reuters. Recently, the firm announced a new $250 million fund to expand its investment capabilities in companies across financial and real estate technology, security, cloud and AI infrastructure. Its portfolio includes Cotendo (acquired by Akamai), Cylance (acquired by BlackBerry), Lastline (acquired by VMware), Skyhigh (acquired by McAfee) and ThousandEyes (acquired by Cisco).

Padval told SDxCentral that the firm’s current investment plans focus on three areas: the extensive use of AI automation for vulnerability identification and security operations, identity security for hybrid cloud environments, security for AI environments and AI rules, regulations and governance.

He added that the valuations of the security and cloud companies are starting to come back to more normal levels from the hype during the pandemic.

According to a Q1 2024 cybersecurity funding report from Pinpoint Search Group, the team recorded 101 transactions in the cybersecurity vendor space, totaling $2.3 billion across 77 funding rounds and 24 M&A events. This accounts for about a 2.7% increase in transition volume from 75 in the first quarter of 2023 and a 20% decrease in fundraising from $2.9 billion.

Simply claiming to use AI is not enough for security VCs

However, the valuations of AI companies are still high because of the future potential, and Padval and Kakran cautioned that not all “AI companies” are truly driving innovation.

Padval noted AI is not the key factor in Thomvest Ventures’ investment decisions for now. “We 100% believe that AI is going to change every company on earth. And if people do not adopt AI, they're not going to exist in five years, because the productivity gains from AI are so massive.”

It’s still in the early stage with very few enterprises that have deployed AI, he said, adding only a few companies like Nvidia, AMD and Microsoft are making money from AI thus far and the next in line is the large language model (LLM) companies.

Both Padval and Kakran, with their engineering backgrounds, emphasize the importance of thorough technical evaluation over simply investing in companies because they claim to use AI.

“It means to do due diligence. If we find that they're just putting AI to raise money, we do not invest. If it's real AI is used in security or the cloud to solve real problems and they're good entrepreneurs, that's our criteria to invest,” Padval said. “So it has to be real AI rather than marketing AI.”

“AI has gone through multiple iterations over time,” Kakran said. “Today there is a combination of predictive AI and generative AI, so it's very use case specific how you deploy these products in production, so when we have conversations with founders, for us that unique technology differentiation is very important.”

Thomvest Ventures expects an active IPO and M&A landscape this year

Padval noted current cybersecurity market valuations are exceptionally high, creating an opportune environment for mergers and acquisitions (M&A), due to the following reasons:

1. For acquisitions to be appealing, buying companies must be in a strong financial position, with growing business metrics and market capitalizations, as seen with companies like Microsoft, Zscaler and Palo Alto Networks.
2. The valuations for private companies went down for the last few years but now they are seeing the improved growth rate of businesses.

He also predicts an active IPO landscape in the latter half of the year. “IPO window definitely opens this year.”

“It's a good environment I feel for public companies whose valuations are high, multiples are high and private companies are starting to grow,” Padval said. “So this is opening up the market window … unless the economy just goes down again.”

He added there are about 200 to 400 companies with annual recurring revenues (ARR) of $100 to $200 million and healthy growth rates, that are poised for IPOs.

“I think it depends on the company strategy, but at least one or two security companies will go public this year for sure,” he said.

Last week, data security provider Rubrik filed for an IPO and plans to list its Class A common stock on the New York Stock Exchange under the ticker symbol “RBRK,” following other recent tech IPOs such as Reddit and Astera Labs.