Here’s a blast from the past. Do you remember the Melissa e-mail virus, which heralded the flood of viruses landing in your e-mail boxes? If you don’t, you certainly couldn’t avoid being hit by, or at least hearing about, the “I love you” virus, which proved again that a laboratory experiment can cause a lot of damage, even if it's only from a computer student in the Philippines.
To this flashback, now add Finjan Software – the Israeli anti-virus company that starred in the technological and financial press in 1996-1999, but has kept its head down every since. It seems that Finjan is now busy raising money in its fourth or fifth financing round, but founder, chairman, and CEO Shlomo Touboul talks as if this were a seed round.
”Look,” Touboul says, “after our down round two years ago, we’re going back to the mode of a new start-up, certainly where valuation is concerned. So why shouldn’t we try to raise seed money?”
The company raised its first few millions from Israel Seed Partners, and Israel Seed Partners general partner Michael Eisenberg took a place on the company board (and also contributed some particularly entertaining moments to the conversation). It was Israel Seed’s second investment in the security industry, following its investment in Alchemdia. Finjan is now considering adding new partners. Touboul prefers not to make premature statements, but hints about “interesting pressure on new investors to enter.”
What happened on the way to the security company paradise? Touboul: “In 1996, what we did was on the cutting edge. A lot of water has gone under the bridge since then, both in the field of computer security and in Java. I think Finjan is just now coming into its own. I think of Finjan as a six-month old start-up with six years of experience.”
”Globes”: Nevertheless, you’ve gone six years without an exit, at a time when the market was good.
Toubout: ”Something happened in the Java environment that delayed everything. Anti-virus companies also deliberately delayed the malicious mobile code, until it blew up in their faces.”
Finjan deal in the anti-virus field in its wider sense. The company developed a system for handling destructive code before it does any actual damage. Marketing was done using a sandbox [virtual computer]. The code entered this special area, where it was run and tested. If it proved to be benign, it was allowed to enter the system. Touboul responds to comparisons with the similar technique of Aladdin Knowledge Systems (Nasdaq: ALDN) and Pelican Security by claiming that Finjan got there first, as well as other distinctions. Finjan has raised $23 million to date and is now looking for more.
The first round in March 1996 raised $915,000 from Star Ventures Enterprises at a company value of $2.4 million, before money. Touboul later recruited Bessemer Venture Partners general partner David Cowan, a founder of VeriSign (Nasdaq: VRSN), and convinced him to lead the second round in July 1996, which included Star Ventures and raised $3.2 million for the company. Bessemer, Star, Apex Investment Partners, CSK Venture Capital of Japan, and RRE Investors of the US invested $10 million in October 1997.
Touboul, who sold Shany Computers to Intel (Nasdaq: INTC) and also worked for the global conglomerate for a while, still waxes enthusiastic when recalling young Finjan’s favorable publicity. “We were a hit. We won innumerable prizes. I don’t know if any other Israeli company was praised in so many reports in its second year of operations. We got good reviews and ratings from “Upside”, “Red Herring”, and “Fortune” – all of them.
I went to the board of directors and told them that the CEO should be located in the US, because while development was in Israel, all marketing and sales was oriented toward the US. They wanted me to emigrate to the US, but I told them no way – I wouldn’t relocate; they should recruit an American CEO. The board was rather surprised, since we had just raised $10 million, and I brought $2.5 million in credit from Israel Discount Bank and Comdisco, while we hadn’t even used up the money from the previous round.”
Finjan president and CEO Bill Lyons, former VP of the IBM (NYSE: IBM) computer division and former CEO of Ashton Tate, which was sold to Borland Software Corporation (Nasdaq: BORL) for $426 million, was appointed in place of Touboul, who became chairman. “The rumor circulated that Borland fired me. What can I do; only they and I know the truth.”
What did Touboul do immediately after declaring that he wouldn’t relocate? “I took my family on a six-month trip across the US in a mobile home,” Touboul says.
Stuck on the track
Touboul’s next career phase was devoted to the idea of an incubator. “All sorts of people came to me for advice, so I told myself I could make a business out of it. Not for money, though, but to regularize the process, so it would be done properly. I also refrained from investing at the time; all I did was give advice.” Eisenberg said, “I told him he shouldn’t get involved in venture capital; he should be an entrepreneur. He barely listens to other people’s advice, so how can he himself give advice?”
After signing a consultation agreement with five companies under the auspices of the Runaway incubator, however, Touboul decided he needed a deeper pocket for investing in companies at the seed stage. Together with French communications company Alcatel (NYSE: ALA), he founded Runaway Telecom.
The joint venture made only one investment of $1.5 million in optical communications company ZettaLight. In April 2001, Touboul got a phone call from Cowan, who told him that four months earlier, Lyons had tossed the keys on the table and said he was leaving.
”David told me, ‘I have no CEO, the money’s all gone, I can’t raise any more, because I have no CEO, and I can’t recruit a CEO, because no one will work for a company without money. Help me sell the company, and you’ll get a nice commission.’ I thought, ‘I’ll treat it like one of my portfolio companies, without any special sentiments, and sell it.’ Before I found a buyer, however, I thought it was important to talk with the existing customers to see what they thought about the company. In the end, I went to Cowan and said that it was obvious that we shouldn’t sell the company. He told me I was an idiot and said I should take my commission before the investors took their share.
”I did another round of the customers , but this time, I also spoke with analysts and companies who were possible candidates for acquiring the company. I came back to Cowan with a name of a public security company and the price they were willing to pay. I again told him that the company shouldn’t be sold, and this time he was interested, because what kind of fool turns down a big check in order to fight for a company?” Eisenberg interjects, “I would have taken the money and run. Shlomo, you’re really dumb.”
Cowan gave in and arranged Touboul’s return to the company, without relocating. On June 24, 2001, Touboul returned to the office he had left three years before. He agreed with Alcatel to liquidate their joint venture and return the money to the investors, including Dankner family group Ellern-Elgar, which announced that it planned to invest $2 million at the beginning of June 2001.
Where we were and what they did
Touboul admits that Finjan’s sales weren’t particularly bad in his absence. He regrets, however, that Lyons failed to make a number of strategic decisions that would have moved the company forward. Touboul says that among other things, Lyons didn’t notice that the money was running out and failed to organize another financing round. The company was virtually out of cash when he left. In the same breath, Touboul says that two quick financing rounds from the previous investors were held in 2000 and early 2001 and raised $6 million, but at a substantially lower company value.
It is reasonable to assume the security market would boom after the Melissa and "I love you" viruses. Isn’t two years afterwards a little late, though?
Eisenberg: ”Let’s put things in the right perspective. Look at the organizational applications market. How many sub-segments are there in this market with revenue of over $1 billion?
”ERP, CRM, etc. – there are 20 such sub-segments. Now look at the security market. How many sub-segments does it have with over $1 billion in revenue? One – the anti-virus segment. The next one will be firewall. Shlomo came to me just after I reached the conclusion that anti-virus is the only field that can sell a lot, so it was the right investment to make.”
Touboul: ”Anti-virus is very low tech, that makes very high revenue.” Up until 1999, the anti-virus companies put the market to sleep by insisting on combating viruses mostly through the signature-based identification method, which is a dumb method. Do you see how ridiculous that is? The anti-virus company wants to persuade the customers that it provides a quick response to a virus attack. The company tells them that when a new virus is discovered, it will update the virus’s definition within a few hours and send the update to the customer on the Internet. At that time, the customers thought that was quick enough for them.”
In addition to saying the anti-virus companies left the customers off guard, Touboul also “blames” Microsoft (Nasdaq: MSFT) for the slower than expected spread of Java, because the company developed its own version, in addition to the Active-X version. If Java had spread more quickly, the threat posed by viruses that use it as a means of infection would probably have been proportionately greater.
In 1999, however, things changed. E-mail was responsible for only 32% of the damage-causing viruses in 1998, compared with the old-fashioned floppy discs that passed from hand to hand. When the Melissa virus appeared, e-mail took the lead with 56% of viruses, compared with 39% for floppy discs. The proportion of infection by e-mail rose to 87% in 2000, compared with 7% for the discs.
On his second tour of the customers, Touboul discovered that the customers did understand what the anti-virus companies didn’t. “Viruses distributed via e-mail create a window of vulnerability for organizations,” he says. “In the first few hours, when the virus goes from e-mailbox to e-mailbox, the network manager can do nothing except to disconnect uninfected computers from the network. He himself puts them out of action.”
Finjan decided to use this concept and prove to the world that it could stop the malicious mobile code in its tracks. Armed with a sympathetic report from the International Data Corporation (IDC), Finjan signed an OEM agreement with McAfee, which together with Symantec (Nasdaq: SYMC) has the largest share of the anti-virus market. Enterprise users are familiar with McAfee’s products, while home users recognize Symantec’s Norton Antivirus. Touboul, however, plans to use the model of the market number three, Trend Micro of Taiwan, to achieve Finjan’s new breakthrough. Touboul: “Trend Micro holds undisputed control of the e-mail gateway. Instead of battling the giants for PCs or work stations, they bypassed them by going for the servers. We’re also going for the servers. Instead of installing the product on every computer, why not stop the plague on entry?”
Finjan’s original model was also copied from another company – Check Point (Nasdaq: CHKP). Check Point signed an agreement with Sun Microsystems (Nasdaq: SUNW), which kept Check Point’s head above water in its first years. Touboul admits there’s only one Gil Shwed. Although Finjan has signed OEM agreements with four companies, including Cisco (Nasdaq: CSCO) and Intel (Nasdaq: INTC), it hasn’t managed to reproduce Check Point’s success.
How do you fight a monster like Trend Micro, which you admit is exactly where you want to be?
Touboul: ”I meant it when I said we were an 18-month old start-up with six years of experience. All the feedback we got from customers over the years has enabled us to develop a better product than the one Trend Micro is trying to produce. The customers are also a factor – we have a lot of customers in banking, and we are approaching a total of 800 customers. Many of the customers have paid a year, and even three years, in advance. For me, that’s a tremendous vote of confidence in us.”
Touboul avoids citing numbers for revenue, but well informed sources say the Finjan’s revenue since he returned to the company is an estimated $9 million. Like most start-ups, Finjan has had to cut its payroll. After layoffs and recruitment, the company currently has 45 employees, after its staff numbered 70 for years.
If Finjan is close to breaking even, why the dilution? Touboul says, “Organizations today are very tough regarding their suppliers. They prefer not to buy products from start-ups that don’t know where they’ll be in another six months. Strong investor backing will help us soften them up.”
Published by Israel's Business Arena on April 10, 2002