# IriusRisk Financial Model

Automated threat-modeling SaaS that embeds security-by-design into the software development lifecycle.

- Canonical: https://finamodel.com/startups/iriusrisk
- Excel download: https://finamodel.com/startup-models/iriusrisk.xlsx
- Category: Enterprise/Security
- Model type: SaaS ARR / Valuation
- Funding round: Series A
- Funding: $6.7M
- Founded: 2020
- Geography: HQ Spain (Barcelona); target markets global - Fortune 1000/2000, Global Financial Services, Global High Tech. [DECK slide 9]
- Customer: B2B

## About the company

IriusRisk automates threat modelling so security-by-design can be embedded into the software development lifecycle. The platform helps development and security teams identify and manage application risks earlier, instead of treating threat modelling as a manual specialist activity.

The company sells annual licences to enterprise and mid-market customers and has a phased expansion motion: an initial deployment can grow into more users and teams. A planned Jira Marketplace product creates a possible second, more transactional revenue stream alongside core licensing.

The model builds ARR from new logos, users or seats, expansion, churn, and net retention. It keeps Marketplace revenue separate and optional, while sales capacity, implementation, security-support costs, gross margin, R&D, and operating expenses show the capital required to scale.

## What's included

- 5-year monthly revenue build with stage-appropriate growth assumptions
- Full P&L, headcount plan, and operating-expense schedule
- Cash-flow statement, runway, and burn-rate tracking
- Valuation via exit multiple with a DCF cross-check
- Returns analysis with MOIC and IRR
- Unit economics including CAC, LTV, payback, and cohort retention

## Product & value proposition

- Platform: IriusRisk automates threat modeling - architects and developers answer questionnaires or upload architecture diagrams; the platform generates a threat model, security requirements, and risk ratings, then syncs with ALM/issue-trackers (e.g. Jira).
- Core claim: reduces threat modeling from 3 days/$3,000 per application to minutes; no scarce security-expert headcount needed for each model.
- Integrations: draw.io (diagramming), ALM / issue trackers; planned Jira plugin sold via Atlassian Marketplace.
- Positioning: "Shift left" - secure design before code is written; competes with Excel/Visio manual process, MS Threat Modeler, MyAppSecurity, SD Elements.

## Market

- TAM: $248B total cybersecurity market (2023)
- SAM: ~$12B global security testing market (2023); CAGR 19.9%; secondary cut of SAM shown as $5B (unlabelled inner ring - likely AppSec sub-segment)
- SOM: ~$1.2B (assumed 10% penetration of $12B SAM)
- Regulatory tailwinds cited: PCI Software Security Standard (mandates threat modeling for payment providers from Oct 2022), IEC 62443 (industrial control systems), ISO 21434 + UNECE WP.29 (vehicle systems), GDPR.

## Revenue model

- Enterprise SaaS license - sold direct to Fortune 1000/2000, global financial services, global high tech firms.
- Pricing specifics for IriusRisk self-service tier: **** - not available.
- Benchmark stated: manual threat modeling costs ~€1,000/day × 3 days = ~€3,000 per application; a financial-services firm with 3,000 apps/year spends ~€9M manually.
- Planned future channel: Atlassian Marketplace - Jira plugin, per-user pricing for mid-market.
- No contract value, ACV, or ARR figures disclosed.

## Traction & metrics

- Top-of-Funnel (from combo bar-line chart, slide 11 image):
  - Total contacts: ~0 in Jun-18, growing to ~400 by Apr-20
  - Leads: growing in parallel, reaching ~325 by Apr-20
  - Trend is upward with an acceleration visible from late 2019 onward
- Customer example context: "We currently threat model 15% of our applications (= 1,000 applications)" → "We want to model 100% of them (= ~7,000 applications)" - used as a typical enterprise rollout scenario, not attributed to a named customer.

## Unit economics

- Reference cost for manual baseline: $3,000 per application threat model (3 days × $1,000/day security expert).
- IriusRisk self-service cost: - model must assume.

## Competition / moat

- Direct competitors named: MS Threat Modeler (free), MyAppSecurity, SD Elements.
- Indirect: Excel + Visio + security experts, doing nothing.
- Moat claims: proprietary threat-model knowledge base, integrations into dev toolchain (Jira, ALM), regulatory compliance traceability, speed advantage (days → minutes), co-founder is OWASP Java Project founder.
- Technical advisor: Adam Shostack (author of "Threat Modeling: Designing for Security").

## Team & funding ask / use of funds

- CEO / Co-Founder: Stephen de Vries - 20 years AppSec experience, founded OWASP Java Project; previously ISS Systems (IBM), KPMG, Corsaire UK.
- CRO: Bas Nijjer - scaled entertainment software companies, most recently QA Symphony.
- CTO: Paul Santapau - 20 years security analysis, large online gaming environment.
- R&D / Co-Founder: Cristina Bentué - Barcelona Activa, Inverline Networks.
- Operations: Raquel Ollés - 15 years business development consulting.
- Financial Advisor: Cristina Berenguer (JME Ventures).
- Existing investors / advisors: JME Ventures, Sonaeim, Swanlaab Venture Factory.

## Recommended financial model

- **Archetype + why:** B2B SaaS ARR model. IriusRisk sells annual enterprise licenses with expansion potential (Phase 1 → Phase 2 seat expansion within accounts). Metrics to model: ARR, logo count, seats/users, net revenue retention (NRR). A secondary revenue line for the planned Atlassian Marketplace Jira plugin (per-user, transactional) can be a separate tab once launched.

- **Forecast horizon & granularity:** 5-year forecast (Year 1–5), monthly for Year 1–2, annual thereafter. Early stage with limited disclosed traction warrants quarterly granularity in the near term.

- **Key drivers & assumptions:**

| Driver | Value |
| -- | -- |
| Starting ARR | Unknown |
| Average Contract Value (ACV) - enterprise | €50,000–€150,000/year per customer |
| New logos / year (Year 1) | 10–20 |
| New logos growth rate | 50–80% YoY |
| Net Revenue Retention (NRR) | 115–130% |
| Gross Margin | 75–85% |
| Sales cycle | 3–6 months |
| Atlassian Marketplace revenue | $0 in Year 1, ramp from Year 2 |
| Regulatory-driven demand step-up | +20–30% TAM penetration acceleration from 2022 (PCI mandate) |
| Headcount - Sales & Marketing | 40% of OpEx |
| Headcount - R&D | 35% of OpEx |

- **Scenarios (Base / Bull / Bear - which variables flex):**
  - **Bear:** 8 new logos/year, 110% NRR, ACV €50K, slower regulatory pull-through.
  - **Base:** 15 new logos/year, 120% NRR, ACV €100K, PCI mandate drives step-up from 2022.
  - **Bull:** 25 new logos/year, 130% NRR, ACV €150K, Jira plugin adds meaningful PLG top-of-funnel.

- **Required sheets / outputs:**
  1. Assumptions - all drivers in one place, scenario toggle
  2. Revenue - new ARR, expansion ARR, churned ARR, total ARR, MRR bridge
  3. Customer cohorts - logo count by year, ACV × NRR waterfall
  4. P&L - revenue, COGS, gross profit, S&M / R&D / G&A opex, EBITDA
  5. Headcount plan - by department
  6. Cash & runway - cash burn, funding milestones
  7. Marketplace revenue tab (stub, activated from Year 2)
  8. Dashboard - ARR bridge, burn rate, key SaaS metrics (CAC, LTV, LTV/CAC, payback, NRR)

## Frequently asked questions

### Is the IriusRisk financial model free?

Yes. The IriusRisk model is a free Excel download with live formulas.

### Can I change the assumptions?

Yes. The workbook is editable and its live formulas recalculate when assumptions change.