IriusRisk Financial Model
Enterprise/Security Startup Financials (Free Excel Download)
Automated threat-modeling SaaS that embeds security-by-design into the software development lifecycle.
professionals from Deloitte
Used by professionals from
About this model
IriusRisk automates threat modelling so security-by-design can be embedded into the software development lifecycle. The platform helps development and security teams identify and manage application risks earlier, instead of treating threat modelling as a manual specialist activity.
The company sells annual licences to enterprise and mid-market customers and has a phased expansion motion: an initial deployment can grow into more users and teams. A planned Jira Marketplace product creates a possible second, more transactional revenue stream alongside core licensing.
The model builds ARR from new logos, users or seats, expansion, churn, and net retention. It keeps Marketplace revenue separate and optional, while sales capacity, implementation, security-support costs, gross margin, R&D, and operating expenses show the capital required to scale.
A turnkey financial model
Live formulas, no hardcoded values
Outputs are driven by live formulas, so the workbook updates from its assumptions instead of relying on hardcoded results.
All assumptions in one tab
Inputs are clearly marked in the Assumptions tab and separated from calculations, making it clear what to change and what to leave intact.
Statements always balancing
For integrated-statement models, the balance sheet, cash flow, and supporting schedules tie through properly.
Distinct schedules for clarity
Debt, working capital, taxes, and cash flow can get messy quickly. We group calculations in clear schedules, not across disconnected tabs.
No hidden macros or external links
There are no unexplained external workbook links or macros to undermine auditability or portability.
Changes flow through the model
Update a key driver and see the impact carry through the forecast, financing, and return outputs. We never use hardcoded numbers in formulas.
About IriusRisk
iriusrisk.com
How to build a detailed financial model for IriusRisk
A complete walkthrough of the business, drivers, and assumptions behind the downloadable IriusRisk model - distilled from its pitch deck and publicly available information.
Product & value proposition
- Platform: IriusRisk automates threat modeling - architects and developers answer questionnaires or upload architecture diagrams; the platform generates a threat model, security requirements, and risk ratings, then syncs with ALM/issue-trackers (e.g. Jira).
- Core claim: reduces threat modeling from 3 days/$3,000 per application to minutes; no scarce security-expert headcount needed for each model.
- Integrations: draw.io (diagramming), ALM / issue trackers; planned Jira plugin sold via Atlassian Marketplace.
- Positioning: "Shift left" - secure design before code is written; competes with Excel/Visio manual process, MS Threat Modeler, MyAppSecurity, SD Elements.
Market
- TAM: $248B total cybersecurity market (2023)
- SAM: ~$12B global security testing market (2023); CAGR 19.9%; secondary cut of SAM shown as $5B (unlabelled inner ring - likely AppSec sub-segment)
- SOM: ~$1.2B (assumed 10% penetration of $12B SAM)
- Regulatory tailwinds cited: PCI Software Security Standard (mandates threat modeling for payment providers from Oct 2022), IEC 62443 (industrial control systems), ISO 21434 + UNECE WP.29 (vehicle systems), GDPR.
Revenue model
- Enterprise SaaS license - sold direct to Fortune 1000/2000, global financial services, global high tech firms.
- Pricing specifics for IriusRisk self-service tier: **** - not available.
- Benchmark stated: manual threat modeling costs ~€1,000/day × 3 days = ~€3,000 per application; a financial-services firm with 3,000 apps/year spends ~€9M manually.
- Planned future channel: Atlassian Marketplace - Jira plugin, per-user pricing for mid-market.
- No contract value, ACV, or ARR figures disclosed.
Traction & metrics
- Top-of-Funnel (from combo bar-line chart, slide 11 image):
- Total contacts: ~0 in Jun-18, growing to ~400 by Apr-20
- Leads: growing in parallel, reaching ~325 by Apr-20
- Trend is upward with an acceleration visible from late 2019 onward
- Customer example context: "We currently threat model 15% of our applications (= 1,000 applications)" → "We want to model 100% of them (= ~7,000 applications)" - used as a typical enterprise rollout scenario, not attributed to a named customer.
Unit economics
- Reference cost for manual baseline: $3,000 per application threat model (3 days × $1,000/day security expert).
- IriusRisk self-service cost: - model must assume.
Competition / moat
- Direct competitors named: MS Threat Modeler (free), MyAppSecurity, SD Elements.
- Indirect: Excel + Visio + security experts, doing nothing.
- Moat claims: proprietary threat-model knowledge base, integrations into dev toolchain (Jira, ALM), regulatory compliance traceability, speed advantage (days → minutes), co-founder is OWASP Java Project founder.
- Technical advisor: Adam Shostack (author of "Threat Modeling: Designing for Security").
Team & funding ask / use of funds
- CEO / Co-Founder: Stephen de Vries - 20 years AppSec experience, founded OWASP Java Project; previously ISS Systems (IBM), KPMG, Corsaire UK.
- CRO: Bas Nijjer - scaled entertainment software companies, most recently QA Symphony.
- CTO: Paul Santapau - 20 years security analysis, large online gaming environment.
- R&D / Co-Founder: Cristina Bentué - Barcelona Activa, Inverline Networks.
- Operations: Raquel Ollés - 15 years business development consulting.
- Financial Advisor: Cristina Berenguer (JME Ventures).
- Existing investors / advisors: JME Ventures, Sonaeim, Swanlaab Venture Factory.
Recommended financial model
- Archetype + why: B2B SaaS ARR model. IriusRisk sells annual enterprise licenses with expansion potential (Phase 1 → Phase 2 seat expansion within accounts). Metrics to model: ARR, logo count, seats/users, net revenue retention (NRR). A secondary revenue line for the planned Atlassian Marketplace Jira plugin (per-user, transactional) can be a separate tab once launched.
- Forecast horizon & granularity: 5-year forecast (Year 1–5), monthly for Year 1–2, annual thereafter. Early stage with limited disclosed traction warrants quarterly granularity in the near term.
- Key drivers & assumptions:
| Driver | Value |
|---|---|
| Starting ARR | Unknown |
| Average Contract Value (ACV) - enterprise | €50,000–€150,000/year per customer |
| New logos / year (Year 1) | 10–20 |
| New logos growth rate | 50–80% YoY |
| Net Revenue Retention (NRR) | 115–130% |
| Gross Margin | 75–85% |
| Sales cycle | 3–6 months |
| Atlassian Marketplace revenue | $0 in Year 1, ramp from Year 2 |
| Regulatory-driven demand step-up | +20–30% TAM penetration acceleration from 2022 (PCI mandate) |
| Headcount - Sales & Marketing | 40% of OpEx |
| Headcount - R&D | 35% of OpEx |
- Scenarios (Base / Bull / Bear - which variables flex):
- Bear: 8 new logos/year, 110% NRR, ACV €50K, slower regulatory pull-through.
- Base: 15 new logos/year, 120% NRR, ACV €100K, PCI mandate drives step-up from 2022.
- Bull: 25 new logos/year, 130% NRR, ACV €150K, Jira plugin adds meaningful PLG top-of-funnel.
- Required sheets / outputs:
- Assumptions - all drivers in one place, scenario toggle
- Revenue - new ARR, expansion ARR, churned ARR, total ARR, MRR bridge
- Customer cohorts - logo count by year, ACV × NRR waterfall
- P&L - revenue, COGS, gross profit, S&M / R&D / G&A opex, EBITDA
- Headcount plan - by department
- Cash & runway - cash burn, funding milestones
- Marketplace revenue tab (stub, activated from Year 2)
- Dashboard - ARR bridge, burn rate, key SaaS metrics (CAC, LTV, LTV/CAC, payback, NRR)
Frequently asked
Is the IriusRisk financial model free?+
Yes. The IriusRisk model is a free Excel (.xlsx) download with live formulas. Sign up with your email and the workbook is yours to keep, review, and edit.
What's included in the model?+
A 5-year monthly forecast with P&L, cash flow and runway, valuation (exit multiple plus a DCF cross-check), MOIC/IRR returns, and unit economics, with live formulas throughout.
How was this model built?+
It was built from IriusRisk's pitch deck and publicly available information, then structured to investment-banking standards as a fully editable Excel model.
Can I change the assumptions?+
Yes. You can change assumptions and the live formulas will recalculate in the downloadable Excel model.
Have more financial modelling questions? Contact us
Created by ex-finance professionals
Hey, I’m Alex and I created Finamodel.
Over my years in the finance industry I kept building the same models over and over again. Same structure, same assumptions, different logo. So I started building frameworks to turn them into clean, reusable templates.
Every model here is one I’d actually use for a client, and I personally vet each one before it goes up.
I’m not an expert in every industry, but I’ve built enough models to know what belongs in one. And when something is completely foreign to me, I reach out to my network for experts to work on our models with us.
Having a template library on hand cuts a first build from hours to minutes.
Need help finding your model? You’ll find me in the Finamodel app!
Other Enterprise/Security Startup Financial Models
Browse another startup in the same category.
AgBiome
AgBiome is a microbial-platform agtech company that discovers, develops, and commercialises biological crop protection products (and licences the platform across adjacent markets).
Alation
Enterprise data intelligence platform - data catalog, governance, and metadata management for large organisations.
Archer SPAC
Archera
Cloud resource automation platform that continuously optimizes AWS commitment purchases, de-risks overcommitment, and automates FinOps workflows.
Ardoq
Cloud-native Enterprise Architecture (EA) SaaS platform that helps large enterprises navigate digital transformation through automated data collection, graph-based architecture modelling, and change impact analysis.
Ascend
Ascend.io is an enterprise big data automation platform ("Enterprise Intelligence Platform") that abstracts away the complexity of big data engineering so non-experts can build and run data pipelines.
Athennian
Cloud-based legal entity management system (EMS) uniting entity data with workflow and document automation.
Auditboard
Cloud-based integrated risk management platform connecting audit, risk, compliance, and ESG teams across the enterprise.
