Building a successful startup is hard. Pulling the plug when you think the company won’t make it can be hard, too. Xconomy recently reported that Lexumo, a Boston-area cybersecurity startup that spun out of Draper Laboratory, called it quits in September. The two-year-old company had raised at least $4.9 million in venture funding from Accomplice, .406 Ventures, and Draper, the not-for-profit R&D center next to MIT. The startup was trying to commercialize software it said could help find and fix vulnerabilities in open-source software written for connected devices and embedded systems. Most startups fail, but not many talk about what happened. In an e-mail to Xconomy, former Lexumo CEO Dan McCall (pictured above) shared some candid takeaways from the experience that might be useful for others working on early-stage companies—lessons about building teams, negotiating deals, fending off competitors, and more. Here are the highlights of our exchange:
Xconomy: Why did you decide to shut Lexumo down? Dan McCall: Lexumo was a seed-funded company and, as such, it’s not uncommon for this type of company to run into issues. Seeds are designed to prove out technology or evaluate the pull of a market, and a variety of factors played into the board’s decision to shut down the company. I would break it down into three factors, with something akin to the domino effect:
1. Technology: The spun-out technology was essentially a clever algorithm that allowed us to get better results for finding open-source software vulnerabilities in C/C++ programs on Linux-based operating systems. This lent itself well to embedded systems and the proverbial “Internet of Things.” It was not, however, a functional product, and, as such, required a large effort to productize as a service. While it worked well for C/C++ on Linux, the technology did not extend easily, as was hoped, to other languages and frameworks. This resulted in a large hole in our product offering. 2. Market/competitive landscape:  The IoT/embedded market, while massive in reach, is fairly limited if one is selling to the manufacturers of these types of systems. With just hundreds of potential targets for the technology, it is a niche market measured in tens of millions of dollars. On top of that, at least five competitive companies emerged in our first year of operation with a significant lead in both technology and customer traction, and [they] also had much higher levels of funding. The biggest of these is/was the market leader, Black Duck, which was recently acquired for over half-a-billion dollars by Synopsys. 3. IP/Licensing: While the specific terms of the agreement are under [a non-disclosure agreement], we had, in my opinion, onerous terms on the [intellectual property]/licensing from the spinout, based on the value the IP delivered. Things like royalty payments or market restrictions are not uncommon, however, they become onerous when a young company needs to count every dollar and wants unrestricted access to markets and potential acquirers. The short version of the events leading up to our [shutdown] is that I recommended to our investors that we should expand beyond the IoT market and the original IP. This was well-received, and we had a term sheet to move forward, with one completely reasonable stipulation: As the IP that came with the spinout was not core to the company moving forward, we needed to renegotiate the terms of our IP/licensing agreement to conserve capital and make the company more attractive to future investors and potential acquirers. This entailed a significant effort that I’m sad to say did not succeed. [McCall wouldn’t confirm whom he was referring to, but Xconomy contacted Draper for a response, and a spokesman declined to comment.—Eds.] Without that success, I recommended to the board that we should transition our efforts to an orderly shutdown with a goal of taking care of our employees and customers to whatever degree possible. (We were close to out of money at that time). [McCall said nearly all of Lexumo’s 15 former employees have found new jobs.—Eds.] X: What sort of traction had the company gotten? DM: At the time we shut down, we had half a dozen customers, dozens of prospects, and a couple hundred thousand [dollars] in bookings. All were using the product for finding open-source vulnerabilities in embedded-type systems (both consumer products and industrial products). In an effort to keep our customers whole [after the shutdown], we reached out to Black Duck, who … Next Page »
Jeff Engel is a senior editor at Xconomy. Email: jengel@xconomy.com Follow @JeffEngelXcon

Startup Lessons: Lexumo CEO on Why the Cybersecurity Firm Shut Down

Boston-area cybersecurity startup Lexumo has shut down, a source close to the company confirmed to Xconomy. Lexumo spun out of Draper Laboratory—the not-for-profit R&D center next to MIT—two years ago, pitching software it said could help find and fix vulnerabilities in open-source software written for connected devices and embedded systems . The company’s “Internet of Things” security play attracted at least $4.9 million in venture funding from Accomplice, .406 Ventures, and Draper. In January, Lexumo CEO Dan McCall told Xconomy the company employed 15 people and had plans to double its staff. McCall (pictured above) was brought on that month to help boost Lexumo’s commercialization efforts. He took the reins from co-founder Brad Gaynor, who shifted into the role of chief technology officer, according to Gaynor’s LinkedIn profile . Lexumo also hired a chief revenue officer and vice president of operations in January. But the company apparently decided to shutter its operations less than a year later. Its website no longer works, and Gaynor took a job in September at Systems & Technology Research in Woburn, MA, according to his LinkedIn profile. Gaynor and McCall haven’t responded to LinkedIn and e-mail messages, respectively, from Xconomy seeking comment. Lexumo isn’t the only company that saw a business opportunity in securing connected devices, and it probably won’t be the last. Others working in this sector include Pwnie Express, another Boston-area startup that recently raised $8 million in venture funding and appointed a new CEO . Jeff Engel is a senior editor at Xconomy. Email: jengel@xconomy.com Follow @JeffEngelXcon

Lexumo, an Internet of Things Security Startup, Calls It Quits

Reprints
Dan McCall thinks the timing is right for Lexumo, a Boston-area startup aiming to help secure the world’s rapidly growing collection of Internet-connected devices and embedded systems. And Lexumo’s leaders think McCall is the right person to take the two-year-old company to the next level. Last week, Lexumo announced it hired McCall as CEO. He took over for co-founder Brad Gaynor, who shifted into the role of chief technology officer, according to Gaynor’s LinkedIn profile . McCall (pictured above) has spent 30-plus years in the technology industry, working in cybersecurity, computer networking, data storage, and other areas. He previously co-founded Guardent, a managed security services provider acquired by Verisign in 2004 for $145 million, according to his LinkedIn profile . McCall served as Verisign’s vice president of corporate development for two years before getting the startup itch again and founding Virtual Computer, which managed mobile and distributed computers on enterprise networks. He led that company for five years before selling it in 2012 to Citrix Systems, which named him a vice president and manager of its desktop and apps product unit. Now, McCall is back at the helm of a small, young company. Lexumo spun out of Draper Laboratory —the not-for-profit R&D center next to MIT—to commercialize software that uses an automated process to sniff out vulnerabilities in open-source software written for connected devices and embedded systems. The technology was developed by Gaynor, Nathan Shnidman, and Richard Carback, who are PhDs with expertise in cybersecurity, big-data analytics, and machine learning. Lexumo has raised nearly $5 million in venture funding from Accomplice, .406 Ventures, and Draper. The company currently has 15 employees and plans to double its staff in the next year, McCall says in an e-mail message. Lexumo will soon relocate from Accomplice’s offices in Cambridge, MA, to a nearly 5,000-square-foot space in nearby Burlington, MA, he adds. Xconomy talked with McCall about his thoughts on Lexumo’s potential, his approach to building startups, the government’s role in advancing cybersecurity, what the security industry could be doing better, and more. The following is a lightly edited transcript of our e-mail exchange. Xconomy: What drew you to Lexumo? What intrigues you about the company? Dan McCall: There were really three things that made this decision easy:
1. The timing for a Lexumo is perfect. Open source is consuming the world of software, and [the number of] Internet-connected devices (consumer IoT, industrial IoT, and embedded systems) will soon eclipse mobile phones and computers combined. IoT devices are predominantly built on open-source software, which will make them the largest attack surface in the world. 2. Most of the time you look for a single, brilliant, and inspirational founder to partner with to build an early-stage company. In Lexumo’s case, I found three, all with PhDs and offering unique leverage and value to the company. 3. The approach, which was spun out of the prestigious Draper Labs and DARPA, is unique in our industry. Using big-data analytics and machine learning to understand software and replace the tedious and error-prone process that companies use today to secure their use of open-source software is a winner. X: Any big lessons from your past companies that you will apply to your new role leading Lexumo? DM: After spending time in both large and small companies, I think the most important thing to realize is that small companies succeed where large companies fail nearly every time because larger companies get so much LESS done in a week and generally do it with three to four times as many people. What that means to a smaller company like Lexumo is that we need to focus on execution every day because that’s our competitive advantage. The second big lesson is making sure we keep our hiring practices at the highest level. Startups often make the mistake of a few mediocre hires because of the amount of work they have to do. When everyone is working 60-70 hours/week the desire to just get anyone to help becomes overwhelming. And it’s a mistake every time and actually detracts from productivity. This is doubly hard while we are working down in Boston/Cambridge with the land grab for talent that’s going on. I’m proud to say that today we’re a great team, to a person, and when we move from Cambridge to Burlington in a couple of months, we’ll open up a whole new pool of talent we can grow with. X: What’s one widely held opinion/idea/prediction in the cybersecurity industry that you think people have got wrong? DM: I think most people are missing the role the U.S. government is going to play in protecting our security interests. First is regulatory. While government regulatory requirements (or the threat of them) has created a great deal of new expenses for certain industries, can you imagine a world without HIPAA, when a healthcare record is worth 10 times more than a credit card? The next frontier is going to be … Next Page »
Single Page Currently on Page: 1 2
Jeff Engel is a senior editor at Xconomy. Email: jengel@xconomy.com Follow @JeffEngelXcon


New Lexumo CEO on IoT, Startups & Government’s Role in Cybersecurity

Lexumo Analytics Platform Alerts Customers to Vulnerability Discovered by Akamai in 2 Million IoT Devices
Posted: October 15, 2016 1:15 am (UTC) FNeditor
print
Tweet
CAMBRIDGE, Mass., Oct. 14, 2016 /PRNewswire/ — Lexumo , developer of the world’s first automated service for continuously monitoring Internet of Things (IoT) code for critical open source vulnerabilities, today announced that its cloud-based platform has been constantly protecting customers from the SSHowDowN vulnerability ( CVE-2004-1653 ) – well prior to Akamai’s recent announcement . Logo – http://photos.prnewswire.com/prnh/20161014/428971LOGO
Akamai reports that hackers are now exploiting the 12-year old OpenSSH vulnerability to mount mass-scale attacks from millions of compromised IoT devices, including routers, cable modems, satellite TV equipment, and IP-connected cameras, DVRs and NAS (Network Attached Storage) devices. The attacks create unauthorized SSH tunnels which are then used to route malicious traffic against victim sites while hiding the attackers’ identities. Attackers also use the devices as beachheads to launch internal attacks against corporate networks. Lexumo uses graph analytics and machine learning developed for DARPA to precisely identify public vulnerabilities such as Heartbleed, Shellshock (Bashdoor), and SSHowDowN in IoT code. The platform also provides detailed instructions for remediating vulnerabilities in order to avoid their exploitation by cyberattackers. The company was recently recognized as an IoT Company to Watch and a Machine Learning Startup to Watch. “Cyberattackers look for the path of least resistance – and vulnerabilities that have been around for years are a great place to start,” said Richard Carback, PhD, co-founder and Chief Architect at Lexumo. “Unlike with zero days, information about public open source vulnerabilities is broadly available via public message boards and email lists. Many IoT devices are particularly vulnerable because they haven’t been designed with security in mind, so there’s a good chance this type of attacker technique will become significantly more popular in the future. It would seem like a minimum standard of due care for manufacturers to use automation to ensure they’re not shipping devices with vulnerabilities like SSHowDowN.”
The impact of shipping insecure IoT devices was also illustrated a few weeks ago when cyberattackers exploited vulnerabilities in 1.5 million IoT devices to generate the world’s most powerful Distributed Denial of Service (DDoS) attack to date. The unprecedented attack successfully disabled the website of well-known security researcher Brian Krebs. Cyberattackers also leveraged their massive botnet army to launch a separate DDoS attack on European ISP OVH that reached nearly one terabit per second (Tbps). Brad Gaynor, Lexumo Co-Founder and CTO, will be speaking about these topics at the IoT Security Summit in Boston next week. His talks include Balancing Security and Technology Spending in the Industrial IoT (October 19, 2:40-3:20pm) and The Next Generation of Embedded Security (October 20, 2:40-3:20pm). Lexumo will also be demonstrating its innovative code security solution in Booth #202, where attendees can meet the company’s founders and discuss IoT cybersecurity with Lexumo’s experts. About Lexumo
Lexumo secures the world’s open source software. Our cloud-based service enables developers to securely adopt the best open source available — so they can ship great products faster. Lexumo uses “Big Code” analytics to precisely identify critical vulnerabilities without the inaccuracies associated with legacy open source software (OSS) governance solutions, even when code has previously been modified or patched. Built on a massively-scalable, AWS-based cloud stack, Lexumo’s service integrates with existing developer workflows (Jenkins, Jira, etc. ); provides actionable information in the form of detailed patching instructions; and continuously monitors your code for vulnerabilities without requiring any developer interaction. For more information, visit https://www.lexumo.com . Media Contact:


Lexumo Analytics Platform Alerts Customers to Vulnerability Discovered by Akamai in 2 Million IoT Devices

Lexumo Received a $4.89 Million Seed Funding From Three Investors
(Credit: Bill Hinton/Getty Images) Computer hacker silhouette. Green binary code background
February 2
by Staff Writer 
Source code security service provider, Lexumo received seed funding from three investors. Accomplice, DFJ Venture Capital and .406 Ventures provided $4.89 million seed funding to the company on Monday. Lexumo was founded in March 2015 in Massachussets by trio Brad Graynor, Richard Carback, and Nathan Shnidman. The company has built a unique platform to identify and remediate software security vulnerabilities from source code used in embedded, enterprise, and cloud products. The company provide a continuous security check to source code listed as open source. In order to do that, the company indexes all available open source code in the world and check the source code for all known security vulerabilities. The result of its security check is listed in its cloud-based security service. Advertisement
Its service is very valuable for companies that plan to use a certain code inside their system, whether embedded system or enterprise software. Companies can submit the code to service provided by Lexumo, that will conduct a continuous monitoring for updates. Lexumo's analytics perform automatic massive-scalable, incredibly-fast software analysis to identify security vulnerabilities. The founders of Lexumo, five years ago realized that open source community need an index of all open source code, so they started to build one. CEO Brad Graynor told Tech Crunch , "At that point, we had this ability to analyze the world's open source software. We iterated a lot with that. We were sitting with a hammer looking for a nail. "
"It's indicative that this large market is underserved. Our technology and business model addresses an unmet need in embedded systems," Gaynor added. Advertisement
PR Business Wire reported that according to industry analysts, open source software (OSS) is now used for mission-critical IT by 95% of all mainstream IT organizations, as well as in 85% of all commercial software packages. However, many vulnerable components from the Central Repository were found, which supplies widely-used shareable components of enterprise software. In 2014, a 52 millions download of those vulnerable components were reported. Lexumo created its unique approach by combining big data analytics with software analysis techniques for the first time. This Big Code technology continuously scans hundreds of millions of lines in open source code. Regarding Lexumo unique approach, general Partner at Accomplice Jeff Fagnan told PE Hub Network , "The Lexumo platform makes it incredibly simple for software developers to securely use open source software, raising the bar for application security. "
Meanwhile Maria Cirino, Managing Partner at .406 Ventures said,  "Recent research cites that security solutions for IoT are at least two years away, but Lexumo has the right technology and business model to tackle this problem today. "
Lexumo will continue to expand its top-notch platform following the seed funding. Three investors has provided $4.89 million seed funding to the company. Advertisement
© 2016 VCPOST, All rights reserved. Do not reproduce without permission. Advertisement


Lexumo Received a $4.89 Million Seed Funding From Three Investors

Code + Mortar, fka Norex, is a provider of logo design, user research, web and product development, and more.

Code + Mortar

`` This is a tremendous opportunity for the University of New Brunswick that fits well with our proud and productive partnership with IBM , '' said UNB President Eddy Campbell in a statement .

Canadian VC Has Record 1st Quarter

Citrix Systems

Virtual Computer

VeriSign

Guardent

I-Cube

Razorfish

Shiva Corporation

This collection includes startups selling AI SaaS, using AI algorithms to develop their core products, and those developing hardware to support AI workloads.

Artificial Intelligence

Cybersecurity

Incubator/Accelerator

Lexumo provides a cloud-based service that combines big data analytics with software analysis techniques to continuously search and index software to immediately identify publicly-known open source vulnerabilities that can cause theft of sensitive data, failure of critical systems, and brand damage. It integrates with existing software development workflows, does not require access to source code, and provides specific, actionable.

Date	Round	Amount	Investors	Revenue	Sources
12/6/2017	Dead		Dead	0 FY undefined	1
9/27/2016	Incubator/Accelerator		Subscribe to see more	0 FY undefined	10
2/1/2016	Seed VC	$99M	Subscribe to see more	0 FY undefined	10

Date	12/6/2017	9/27/2016	2/1/2016
Round	Dead	Incubator/Accelerator	Seed VC
Amount			$99M
Investors	Dead	Subscribe to see more	Subscribe to see more
Valuation
Revenue	0 FY undefined	0 FY undefined	0 FY undefined
Sources	1	10	10

First funding	Last Funding	Investor	Rounds	Type	Location
9/27/2016	9/27/2016	STEX25	1 Incubator/Accelerator	Incubator/Accelerator	Massachusetts
00/00/0000	00/00/0000	.406 Ventures	Subscribe to see more	Venture Capital	Massachusetts
00/00/0000	00/00/0000	Draper Laboratory	Subscribe to see more	Corporation	Massachusetts
00/00/0000	00/00/0000	Accomplice	Subscribe to see more	Venture Capital	Massachusetts

First funding	9/27/2016	00/00/0000	00/00/0000	00/00/0000
Last Funding	9/27/2016	00/00/0000	00/00/0000	00/00/0000
Investor	STEX25	.406 Ventures	Draper Laboratory	Accomplice
Rounds	1 Incubator/Accelerator	Subscribe to see more	Subscribe to see more	Subscribe to see more
Board Seats
Type	Incubator/Accelerator	Venture Capital	Corporation	Venture Capital
Location	Massachusetts	Massachusetts	Massachusetts	Massachusetts

Wells Fargo Success Story

3M Success Story

Platform Overview

Lexumo

Total Raised

Investors Count

Lexumo Funding, Lexumo Valuation & Lexumo Revenue

Lexumo Investors

Discover the right solution for your team