# Sysdig Financial Model

Unified cloud-native security and monitoring platform (Secure DevOps) for enterprises running Kubernetes and containers.

- Canonical: https://finamodel.com/startups/sysdig
- Excel download: https://finamodel.com/startup-models/sysdig.xlsx
- Category: Dev Tools
- Model type: SaaS ARR / Valuation
- Funding round: Series E
- Funding: $70M
- Founded: 2020
- Geography: Global (deck references "global enterprises").
- Customer: B2B

## About the company

Sysdig is a cloud-native security and monitoring platform for Kubernetes and containers, spanning build, run, and response. It combines image scanning, vulnerability management, runtime protection, forensics, incident response, compliance, and observability, using low-touch instrumentation and cloud or Kubernetes context to avoid security and monitoring data silos.

The company commercialises open-source Falco runtime security and Prometheus monitoring through annual enterprise subscriptions. Its land-and-expand model begins with an initial ACV and grows as customers deploy across more workloads, cloud environments, security modules, and monitoring use cases. Direct sales targets cloud and container platform leaders.

Sysdig reported more than fivefold ARR growth from Q3 2017 to Q3 2019. Some enterprise accounts expanded to seven to ten times their initial ACV within three to four years. The model should forecast deployment scope, cross-sell, renewal, churn, sales capacity, support, and NRR.

## What's included

- 5-year monthly revenue build with stage-appropriate growth assumptions
- Full P&L, headcount plan, and operating-expense schedule
- Cash-flow statement, runway, and burn-rate tracking
- Valuation via exit multiple with a DCF cross-check
- Returns analysis with MOIC and IRR
- Unit economics including CAC, LTV, payback, and cohort retention

## Product & value proposition

- Secure DevOps platform that converges security and monitoring functions across the cloud-native lifecycle: Build → Run → Respond.
- Core capabilities: image scanning, vulnerability management, runtime security (Falco OSS), infrastructure/application monitoring (Prometheus OSS), forensics/incident response, continuous compliance (PCI, NIST, CIS).
- Differentiation: kernel-level deep visibility via low-touch instrumentation; automatic Kubernetes/cloud metadata context; enterprise scale without data silos.
- Built on open-source foundations (Falco for runtime security, Prometheus for metrics) with commercial enterprise layer adding scale, workflow, K8s context.

## Market

- TAM: $20B+ total addressable market, broken into three adjacent segments:
  - $6B - Vulnerability management
  - $7.5B - Infrastructure monitoring & APM
  - $7.6B - Endpoint detection & response
- Adjacent market reference: IDC forecasts worldwide DevOps software tools market at $15B by 2023
- Market driver: 40% of enterprise companies running Kubernetes in production (CNCF survey, 2018); security and monitoring cited as top Kubernetes challenges

## Revenue model

- SaaS subscription (ARR-based); references to "initial ACV" and "ARR expansion" confirm annual contract / subscription model.
- Land-and-expand: initial deal (ACV) followed by expansion within enterprise accounts over time.
- Sales channel: enterprise direct sales targeting Cloud/Container Platform Teams (Director/VP/CTO-level buyers).

## Traction & metrics

- ARR growth: >5X from Q3CY17 to Q3CY19 - no absolute ARR figures disclosed.
- Enterprise ARR expansion pattern (scatter plot, slide 10): accounts plotted up to ~45 months post-initial deal; several accounts show current ARR at 7–10X+ initial ACV within 3–4 years.
- Qualitative: "large enterprise adoption," "proven land and expand model," "open source leaders endorse model."

## Competition / moat

- Existing tools (vulnerability management, APM, EDR) are "blind" to containers and Kubernetes - this is the stated wedge.
- Moat sources: kernel-level instrumentation (proprietary); open-source community around Falco and Prometheus (distribution flywheel); unified platform vs. point solutions; enterprise-grade scale.

## Team & funding ask / use of funds

---

## Recommended financial model

- **Archetype + why:** Enterprise SaaS ARR model with land-and-expand mechanics. Revenue is subscription/ARR-based, the defining growth motion is expansion within accounts (ACV → multi-year ARR ramp), and the buyer is an enterprise team on annual contracts. A 3-statement model is secondary; the core output is ARR waterfall (new logo ACV + expansion + churn) feeding an income statement.

- **Forecast horizon & granularity:** 5 years (Year 1–5), quarterly for Years 1–2, annual for Years 3–5. Quarterly granularity needed to model cohort expansion curves.

- **Key drivers & assumptions:**

| Driver | Value |
| -- | -- |
| Starting ARR (beginning of model) | Unknown - not disclosed |
| ARR growth rate (historical) | >5X over ~2 years (Q3CY17→Q3CY19) |
| Implied 2-yr CAGR (base) | ~124% |
| Forward ARR growth - Year 1 | 80% |
| Forward ARR growth - Year 2 | 60% |
| Forward ARR growth - Years 3–5 | 40% / 30% / 25% |
| Net Revenue Retention (NRR) | 130% |
| Gross margin | 70–75% |
| S&M as % of revenue | 45–55% |
| R&D as % of revenue | 20–25% |
| G&A as % of revenue | 8–10% |
| Rule of 40 target (Year 3+) | ~40 |

- **Scenarios (Base / Bull / Bear - which variables flex):**
  - **Base:** ARR growth per table above; NRR 130%; gross margin 72%.
  - **Bull:** ARR growth +15pp each year; NRR 140%; faster gross margin expansion to 75%.
  - **Bear:** ARR growth –15pp each year; NRR 115% (churn pressure); gross margin 68%.
  - Primary flex variables: forward ARR growth rate, NRR, new logo adds.

- **Required sheets / outputs:**
  1. Assumptions - all drivers, scenario toggle (Base/Bull/Bear)
  2. ARR Waterfall - beginning ARR, new logo ACV, expansion, churn/contraction, ending ARR (quarterly)
  3. Income Statement - revenue, gross profit, S&M, R&D, G&A, EBITDA, net income
  4. Cohort Model - optional but recommended: tracks per-cohort ARR ramp to validate NRR assumption against scatter plot data
  5. Cash Flow / Runway - simplified operating CF and cash burn
  6. KPI Summary - ARR, YoY growth, NRR, gross margin, Rule of 40, ARR/FTE
  7. Dashboard - ARR waterfall chart, margin bridge, Rule of 40 tracker

## Frequently asked questions

### Is the Sysdig financial model free?

Yes. The Sysdig model is a free Excel download with live formulas.

### Can I change the assumptions?

Yes. The workbook is editable and its live formulas recalculate when assumptions change.