How to Establish Startup Incubators and Ensure Successful Exits by Jerusalem Venture Partners

In the first quarter of 2015, 166 Israeli high-tech companies raised $994 million, a 48 percent increase year-over-year, according to research firm IVC. “We are on a positive slope right now,” Gadi Tirosh told me recently, “which is fine, as long as it’s not over-hyped. At the end of the day, what drives the numbers are significant outcomes.”

Tirosh is very familiar with the “significant outcomes” that have produced new record numbers for Israeli entrepreneurs and venture capitalists. He is Managing Partner at Jerusalem Venture Partners (JVP), one of Israel’s leading venture capital firms, established in 1991. The founder, Erel Margalit, is now a member of the Israeli Parliament; the other managing partners currently are Kobi Rozengarten and Raffi Kesten.

JVP was the lead investor in computer security startup CyberArk, one of the best-performing IPOs of 2014 and where Tirosh is serving as Chairman.

“Having an outcome like CyberArk,” says Tirosh, “creates a virtuous cycle. It makes people understand that the prize at the end might be very very significant.” This may explain why we have seen in recent years more IPOs by Israeli startups. The general tendency for years has been to sell quickly even before reaching any meaningful revenues (I found out about 10 years ago that the word “exit,” as in a successful sale of a startup, has become widely used by Israelis, including those not working in high-tech). Tirosh points out, however, that while “CyberArk gives everybody in the industry something to wish for, you have to be opportunistic and if there are good outcomes on the way, that’s a judgement call you need to make.”

“Having an outcome like CyberArk,” says Tirosh, “creates a virtuous cycle. It makes people understand that the prize at the end might be very very significant.” This may explain why we have seen in recent years more IPOs by Israeli startups. The general tendency for years has been to sell quickly even before reaching any meaningful revenues (I found out about 10 years ago that the word “exit,” as in a successful sale of a startup, has become widely used by Israelis, including those not working in high-tech). Tirosh points out, however, that while “CyberArk gives everybody in the industry something to wish for, you have to be opportunistic and if there are good outcomes on the way, that’s a judgement call you need to make.”

JVP made recently just such a judgment call when it sold CyActive, a startup fresh from JVP’s cyber security incubator (more on this later), to PayPal (for a reported $60 million). “It absolutely made sense for the founders and ourselves to integrate this very innovative technology into a bigger home,” says Tirosh.

So what’s hot in cyber security today? One way JVP knows the answer to this question is by tracking the deal flow in 17 different segments of the security market (see chart below). In addition to established areas of computer security, they track new and emerging technologies, knowing that entrepreneurs look to target security gaps created by the introduction of these technologies.

For example, says Tirosh, “the move to the cloud creates a whole new set of security challenges.” Your data is in the hands of a third-party and your beloved single-point-of-entry that you used to protect nicely with a firewall has just vanished. How do you protect your data when it is processed on servers located around the world that are provisioned on-the-fly? You need a new security paradigm, says Tirosh, and JVP has invested in GreenSQL, a startup offering security software that protects both traditional, on-premise databases and databases in the cloud.

New technologies create new security headaches, but they also provide new solutions. Take for example big data analytics. One of the startups in JVP’s portfolio, ThetaRay, has developed a unique approach to anomaly detection, using sophisticated algorithms to protect against unknown threats.

Traditional approaches for detecting credit fraud, for example, do not scale because they rely on pinpointing deviations from a pre-defined set of rules.  “As the system grows, you end up writing more and more rules, making it impossible to manage,” says Tirosh. “Not only that,” he adds, “once you define the set of rules, you actually define the next hack. You identify for the hackers what are the rules that they need to circumvent.”

Rule-based systems create a lot of false positives, issuing alerts for incidents that are not real fraud or threat. “The problem with dealing with so many false positives,” says Tirosh, “is that they don’t let the operators get to the true positives. It is well documented that with the Target breach, all the alarms went off. But the problem was that there were simply too many alarms.”

In contrast, ThetaRay’s algorithms do not assume anything about the domain they’re analyzing. They are derived from academic research into building a multi-dimensional, even “hyper-dimensional,” data matrix. The more data is analyzed, the better they get at detecting anomalies, knowledge that is combined with the domain expertise of the customer to identify the true positives, the real threats. By analyzing 250 million transactions, ThetaRay’s algorithms identified, in a matter of hours, fraud incidents worth 10 million euros, incidents that were not detected by the existing rules-based system, says Tirosh.

ThetaRay got its start in a JVP incubator. JVP is unique in that it’s a venture capital firm that runs two startup incubation programs. Much talked-about Silicon Valley-based incubators, such as Y Combinator (which bills itself as having “created a new model for funding early stage startups”), are just the best-known examples of some 1,250 business incubators in the U.S. and 7,000 around the world (2012 numbers from the National Association of Business Incubators). Typically, sponsors of incubators are academic institutions (about a third of U.S. business incubators) or economic development organizations (about a quarter).

JVP operates two incubators, JVP Media Labs in the areas of media and storage (in Jerusalem) and JVP Cyber Labs, in the area of cyber security (in Beer Sheva). It is not an academic institution or an economic development organization, and unlike Y Combinator, JVP does not focus only on early stage startups, so why incubate?

“We are the only VC firm running an incubator within the fund itself,” says Tirosh. One good reason to do that is that the Israeli government adds $500,000 as a risk-free loan to the first $100,000 JVP invests.  “So we have a pool of at least $600,000,”says Tirosh, “to experiment with new ideas and new teams and we can make these decisions pretty rapidly.” In that sense, it’s a unique economic development model, where the government invests and takes risks but lets private sector experts manage and nurture.

This does not explain, however, why other Israeli VC firms are not taking advantage of the State of Israel’s incubator program, sponsored by the office of the Chief Scientist. Tirosh expounds on JVP’s philosophy:  “It’s the question of what do you do with the companies that succeed and graduate out of the incubator. Having it as part of the fund allows us to fund the entrepreneurs that graduate the incubator, people we know really well. We’ve been growing the company together with them.”

Tirosh says JVP’s success in investing in all stages of the life of a startup is due to the operational background of many of the partners: “It requires a lot of involvement. You need to make sure you like it. Also, you need to be relatively good at it. Most VCs take a much more hands-off approach.”

For the entrepreneurs, JVP’s approach promises a significant follow-on investment from the main fund if and when they graduate the incubator. “It helps them build a longer-term view,” says Tirosh, “and it helps them raise money as they come out of the incubator,” having JVP’s stamp of approval.

JVP Cyber Labs was established in 2014 with the goal of identifying, nurturing and building the next wave of cyber security companies. It is located at the Beer Sheva Advanced Technologies Park, in close proximity to Ben-Gurion University (which has a leading computer science department with a special focus in computer security), the IDF’s elite computer units, and R&D centers of many multinational companies. This could be the highest concentration in the world of cyber security expertise per square foot.

“We had our Jerusalem incubator running for a while,” Tirosh told me. “It has been successful and we got quite a lot of requests to replicate it in other places around the world. None of us wanted to re-locate so we were looking to replicate it here in Israel. Since we’ve opened the Cyber incubator in early 2014, we’ve made six investments and we had our first exit when we sold CyActive to PayPal.“

And many more exits to come, no doubt.

Originally posted on Forbes.com