In June 2021, Colorado-based Coalfire acquired Denim Group, ending the 20-year run of one of San Antonio’s leading cybersecurity companies. I was fortunate to be part of that deal, alongside my partners, Sheridan Chambers and Dan Cornell, and a talented management and technical team. Right after the sale, Mike Lynd, CEO of Kairoi Residential and co-chair of greater:SATX, asked me a simple question:
“What is the next San Antonio-based cybersecurity company that will have a successful acquisition like Denim Group?”
His question caught me a bit flat-footed. I replied simply, “I don’t know.” What Mike was really asking about was the pipeline of security companies in San Antonio. Surely in “CyberCity USA” there was another Denim Group waiting in the wings for its own acquisition, or, as we say in the business, its “exit.” But to Mike’s dismay, and mine, there wasn’t an obvious next company.
For more than a decade, Denim Group was a national leader in software security and a trusted advisor on software risk to many Fortune 500 companies. Headquartered in San Antonio, it grew to around 100 people, with a satellite office in Austin and employees scattered across the country. Within the cybersecurity industry, Denim Group was well known and a regular fixture at national conferences like Black Hat and RSA. In many ways, the company was better known in the industry outside San Antonio than here in our own backyard.
Mike’s question has gnawed at me ever since, because our city has called itself “CyberCity USA” for more than a decade. We have foundational assets like the 16th Air Force, NSA Texas, and UTSA, along with other universities and a strong contractor community that supports the military missions here. That’s an embarrassment of riches.
Yet we are not producing a pipeline of successful commercial cybersecurity companies. We should be.
Why not?
There have been commercial cybersecurity successes in San Antonio before and after Denim Group, and they offer some clues. One goes back to the industry’s earliest days. In 1995, a group of Air Force security veterans and industry experts founded a network security firm in San Antonio called WheelGroup. In 1998, Cisco acquired WheelGroup and its intrusion detection technology for about $124 million, a deal that startled many at the time. The acquisition put San Antonio on the cybersecurity map, even if most people have since forgotten it.
The success of Lee Sutterfield, Rick Jordan, Toney Jennings and the rest of WheelGroup’s founders directly influenced my decision to join Sheridan Chambers and Dan Cornell in building Denim Group.
The WheelGroup and Denim Group exits had four common denominators. Both companies focused on commercial markets despite deep Air Force roots on Security Hill. Both raised capital: venture capital for WheelGroup and a strategic investment from Wipro for Denim Group. Both had proven commercial products — WheelGroup’s NetRanger and Denim Group’s ThreadFix — and owned the intellectual property inside them. And both were led by serial entrepreneurs who had seen success and failure at previous companies. Those traits set WheelGroup and Denim Group apart from many other companies that were pure services firms, served mostly local markets, or were government contractors with a narrow set of clients.
The other truth entrepreneurs know is that building a cybersecurity startup from the ground up is hard and risky. Many talented cybersecurity operators may not have the risk appetite to start a business. I know countless former Air Force colleagues who followed a successful career in uniform with a second one at government contractors such as Lockheed Martin or General Dynamics. For many of them, the natural next step is working for someone else, not breaking the mold to start a new venture. WheelGroup’s and Denim Group’s leaders had a bigger risk appetite and the ability to execute in fast-moving environments. They could also recover quickly when things didn’t go as planned. That resilience is another common denominator of successful startups.
I’ve said publicly that quitting your day job to start a company can be borderline reckless. But San Antonio needs more reckless founders, enough to build a pipeline of cybersecurity companies, so the next time someone asks me Mike’s question, I have an answer.
John Dickson is a former Air Force officer who was a principal at Denim Group for 17 years, through its 2021 sale to Coalfire.
