Enterprises and other large organizations have long been a lucrative and obvious target for cybercriminals, but in recent years — thanks to more sophisticated breach techniques and the rise of AI — small and medium businesses are now also very much on the map. Now, Coro — one of the startups building tools specifically for smaller businesses — is announcing a big round of funding after seeing its recurring revenues shoot up 300% in the last year. It has raised $100 million in a Series D round of funding. Sources close to the deal tell TechCrunch that its valuation is over $750 million post-money.
New York-based Coro has up to now focused squarely on the U.S. market — no surprise, given that there are more than 33 million SMBs in that country alone — but with this round, the startup wants to scale its business internationally, starting with Europe. To that end, it’s notable that the lead investor in this round is One Peak, the UK later-stage firm focusing on enterprise tech. Previous backers Energy Impact Partners and Balderton Capital are also participating.
Coro also plans to use the funding to continue working on its R&D — specifically in bringing ever more AI tools into its one-stop-shop platform in order to better match and ideally beat the capabilities of the most sophisticated malicious hackers.
IBM research estimated that the average cost of a data breach in 2023 to $4.45 million, and while single attacks aiming at very large organizations may still grab the most headlines, cybercriminals have increasingly started to focus more on SMBs, applying the law of economies of scale, and using one of the biggest trends in enterprise in the last two decades — the rise and domination of SaaS.
“The barrier of entry for attackers has dropped dramatically over the last two years,” said Dror Liwer, the co-founder (and CMO), in an interview. The culprit, he said, is the rise of attack-as-a-service techniques, specifically ransomware-as-a-service.
“In the past, in order to execute a very sophisticated attack, you needed to know a lot and the attack itself was very expensive to execute. Today, you can go to a website, upload a list, and rent an attack and go after a market. So the cost of the attack also has dropped tremendously. It means the ROI of attacking a mid market or small business has improved dramatically, because it used to be very expensive to do that.”
Liwer said that in the past it could have cost $1 million to gain lists of 100,000 because of the payoff. Now you can pay $50,000 for many lists apiece, “and still be still very, very profitable.”
Those stats are definitely being felt by startups themselves. Last year, some 73% of small businesses reported security incidents, according to research from Tripwire. And among SMBs responding to a survey from Digital Ocean, 74% named data privacy a top concern.
The opportunity in the security market for SMBs that Coro has identified is that these businesses typically lack the teams and internal IT budgets to dedicate to building and managing their defenses. Coro’s approach has therefore been to build all-in-one platforms covering the various points of entry that a criminal might take, including email protection, endpoint protection and cloud protection. It’s working in a competitive space. Others in the same category include very large providers like CrowdStrike through to younger startups like CyberSmart and Guardz.
But the growth that Coro has been seeing particularly in the mid-market (50-2,000 employees), using channel partners like ISPs to go to market, has been what’s caught the eye of investors.
“As a growth investor, we look for companies that target large, underserved markets and are in prime position to dominate that field,” said David KIein, co-founder and managing partner of One Peak, in a statement. “Coro has already achieved phenomenal growth and success in the SME market. We are convinced that Coro has the right tech stack, a world class management team, and unlimited potential to scale the business to the next level. We’re excited to partner with Coro to help them execute on their vision and support the team in their next leg of explosive growth.”
For some context on Coro’s valuation: At a time when startups, especially those that are later stage, are still finding it hard to close rounds, Coro — which got its start as CoroNet on the Disrupt Battlefield stage — has been on a yearly cadence. Its round last year, in April 2023, was $75 million at a $575 million valuation (also post-money).
