# Awake Security Financial Model

Awake Security - AI-driven Network Detection & Response (NDR) platform for the hybrid cloud, positioning as the "intent detection" layer of the SOC visibility triad.

- Canonical: https://finamodel.com/startups/awake-security
- Excel download: https://finamodel.com/startup-models/awake-security.xlsx
- Category: Hardware/Deep-tech
- Model type: SaaS ARR / Valuation
- Funding round: Late Stage
- Funding: $36M
- Founded: 2020
- Geography: US-headquartered; global deployments shown (10 locations across the globe, slide 17).
- Customer: B2B

## About the company

Awake Security provides AI-driven network detection and response for hybrid-cloud security teams. Its intent-detection platform gives enterprise security operations centres visibility into network behaviour, helping analysts identify suspicious activity that can be difficult to find through conventional rule-based monitoring.

The product is sold into enterprise SOC workflows, where buyer trust, deployment scale, and integration with existing security tooling matter. Its economics therefore resemble enterprise software with a usage component: customers contract for a platform, then generate data volumes and expand coverage as more network environments are monitored.

Model enterprise logos, initial contract value, monitored data volume, deployment, module adoption, expansion, renewals, and churn. Include sales engineering, security research, customer success, cloud processing, and support costs. Win rate, data usage, expansion, pricing, gross margin, and net retention should determine scenarios.

## What's included

- 5-year monthly revenue build with stage-appropriate growth assumptions
- Full P&L, headcount plan, and operating-expense schedule
- Cash-flow statement, runway, and burn-rate tracking
- Valuation via exit multiple with a DCF cross-check
- Returns analysis with MOIC and IRR
- Unit economics including CAC, LTV, payback, and cohort retention

## Product & value proposition

- Network Detection & Response (NDR) platform called "Awake Security Platform."
- Three components: Awake Sensors (on-premise / cloud), Awake Nucleus (cloud or on-premise analytics core), and Ava (autonomous expert system / AI triage engine).
- Core claim: reduces time, cost, and risk of security operations by converting raw network alerts into actionable "answers" without manual triage.
- Proprietary IP: patented Ava (autonomous triage), EntityIQ (device profiling), and Adversarial Modeling (intent detection).
- Covers unmanaged devices, IoT, OT, SaaS, IaaS, PaaS - segments that endpoint agents cannot reach.
- Positioned at the "predictive / intent detection" tier of the maturity curve, above legacy IDS/anomaly/behavioral tools.

## Market

- TAM - Information Security overall: $121B (2019) → $182B (2024); 8.3% CAGR.
- SAM - Network Detection & Response segment: $1.9B (2019) → $3.8B (2024); 14.1% CAGR.
- SOM - Not in deck explicitly. Slide 19 frames a "$8.9B across 27,500 enterprises" addressable pool (enterprises with revenue >$500M globally: 27,500 companies). Per-tier ASP and per-tier revenue contribution are redacted ($XB / $X ASP).
- Comparable public company valuations: Palo Alto Networks $20B, CrowdStrike $13B, Proofpoint $6B; average pure-play security public company market cap $6B (27 companies).

## Revenue model

- Subscription/PaaS model: customers buy Awake Sensors + Nucleus as a platform subscription.
- Deployment is sold by sensor count and throughput (e.g., "XXX Awake Sensors and Nucleus // 60 Gbps" for a Fortune 100 customer).
- Deal sizes observed: 6-figures (Cisco displacement), high 6-figures (retail Fortune 200 renewal/expand; Oil & Gas Fortune 500; Darktrace displacement), and 7-figures (RSA Netwitness displacement Fortune 100).
- All specific ASP values per customer tier are redacted in slide 19.
- Land-and-expand motion: initial sensor deployment → renewal → expansion of sensors/use cases/locations.
- Managed NDR offered as an add-on (noted as differentiator vs. Darktrace, slide 17).
- Go-to-market: direct enterprise sales (VP Sales in exec team); greenfield and displacement opportunities cited.

## Traction & metrics

- 65 employees.
- Raised: Series A (Greylock), Series B (Bain Capital Ventures + Greylock). Raising $30M.
- Awards: RSA Conference Finalist Most Innovative Security Company 2018; Business Insider 30 Hottest Security Startups; ETR+ #1 security solution in the Global 1000.
- Customer traction described qualitatively as "strong"; specific customer names, count, and ARR are fully redacted (slides 6, 14–18, 20).
- Deal size evidence (redacted amounts): Fortune 100 media (7-figure), Fortune 200 retail (high 6-figure renewal/expand), Fortune 500 Oil & Gas (high 6-figure), high-tech company (high 6-figure), finance company (6-figure).
- Detailed financial metrics/forecasts explicitly withheld: slide 20 is a section divider reading "REDACTED DETAILED FINANCIAL METRICS, FORECASTS ETC.".
- No ARR, revenue growth rate, gross margin, churn, or NRR figures disclosed.

## Competition / moat

- Direct competitors displaced in case studies: RSA Netwitness, Darktrace, Cisco Stealthwatch.
- Also competes with: SIEM/UEBA (Splunk, IBM, Exabeam) and EDR (Cylance, Carbon Black).
- Competitive moat claims:
  - Patented Ava (autonomous triage), EntityIQ (device fingerprinting), Adversarial Modeling (intent detection).
  - Immediate time-to-value vs. legacy SIEM (no lengthy tuning period).
  - Platform covers unmanaged/IoT/OT devices that EDR cannot reach.
  - PaaS approach: consolidates multiple network security tools into one platform.
  - Greenfield displacement cited: Cisco, RSA, Darktrace all present as takeaway targets.

## Team & funding ask / use of funds

- CEO: Rahul Kashyap; Chief Architect: Keith Amidon; Chief Scientist: Gary Golomb; Chief Data Scientist: Debabrata Dash; VP Product: Rajdeep Wadhwa; VP Engineering: Jeffrey Wang; VP Sales: Randy Cheek; VP Marketing: Rudolph Araujo.
- Board / advisors: Asheem Chandna (Greylock, Palo Alto Networks founding board); Sarah Guo (Greylock, fmr. board Demisto); Kevin Mandia (Founder Mandiant, CEO FireEye); Enrique Salem (fmr. CEO Symantec, Bain Capital Ventures).
- Team pedigree companies: ArcSight, Big Switch, Bromium, Cisco, Cylance, Darktrace, E8 Security, Foundstone, FireEye, HP, McAfee, NetWitness, Symantec, SS8, VMware.
- Funding ask: $30M.

## Recommended financial model

- **Archetype + why:** Enterprise SaaS/PaaS ARR model with a seat/sensor-based expansion layer. The business is subscription-driven (recurring platform fee per sensor deployment), has land-and-expand dynamics, and targets Fortune 500/Global 2000 enterprises - classic enterprise SaaS ARR mechanics apply. A hardware sensor COGS layer is needed on top of a standard SaaS P&L because physical sensors are shipped to customers.
- **Forecast horizon & granularity:** 5-year annual model (2020–2025) with monthly detail for Year 1–2 given the $30M raise and likely near-term burn focus. Quarterly thereafter.
- **Key drivers & assumptions:**
  - New logos per year
  - Average sensors per deployment
  - Average Contract Value (ACV) by customer tier:
    - Tier 1 (revenue >$10B, ~1,200 enterprises):
    - Tier 2 (revenue $1B–$10B, ~10,800 enterprises):
    - Tier 3 (revenue $500M–$1B, ~15,500 enterprises):
    - Total addressable pool cited as $8.9B across 27,500 enterprises; per-tier allocation redacted
  - Net Revenue Retention / expand rate
  - Gross churn
  - Blended gross margin
  - Sales headcount ramp
  - CAC / Sales cycle
  - R&D as % of revenue
  - G&A
  - Cash burn / runway
- **Scenarios (Base / Bull / Bear - which variables flex):**
  - Bull: logo growth 40/yr, NRR 130%, faster tier-1 penetration
  - Base: logo growth 25/yr, NRR 120%, balanced tier mix
  - Bear: logo growth 15/yr, NRR 110%, longer sales cycles / macro slowdown
  - Primary flex variables: new logos, ACV by tier, NRR, and gross margin (sensor hardware cost volatility)
- **Required sheets / outputs:**
  - Assumptions (all drivers in one place)
  - ARR Bridge (new logo ARR, expansion ARR, churn, ending ARR)
  - P&L (Revenue, COGS, Gross Profit, S&M, R&D, G&A, EBITDA, Net Loss)
  - Headcount Plan (by department; feeds S&M, R&D, G&A)
  - Cash Flow & Runway (given $30M raise; monthly burn, months to next raise)
  - Unit Economics summary (blended ACV, CAC, LTV, LTV/CAC, payback period)
  - Market Penetration (logos as % of 27,500-enterprise TAM)
  - Dashboard / KPI summary

## Frequently asked questions

### Is the Awake Security financial model free?

Yes. The Awake Security model is a free Excel download with live formulas.

### Can I change the assumptions?

Yes. The workbook is editable and its live formulas recalculate when assumptions change.