Ten questions to ask a deep tech security startup before you invest

I sit on both sides of this conversation. As co-founder and CTO of Shorium, I answer investors’ questions. As an advisor, I sometimes help investors ask them.

Security startups are unusually hard to evaluate from a deck. The technology is specialised, the buyers are cautious, and the most important risks rarely appear on a slide. These are the questions I find most revealing. None of them requires being a cryptographer.

About the problem

1. Who loses what, and when, if this problem isn’t solved? Good security companies can name the person who carries the risk and the moment it becomes real: an audit, a regulation date, an incident, a customer requirement. “Everyone needs security” is not an answer.

2. What forces the purchase? Security budgets move when something makes them move: a regulation such as the Cyber Resilience Act, a contractual requirement, a published deadline such as NIST’s post-quantum timeline. Ask which forcing function the company is riding, and how sure that date is.

3. What do customers do today instead? Often the real competitor is a spreadsheet, a consultant or a team doing things by hand. That’s fine, but the startup should know exactly what it replaces.

About the technology

4. What is genuinely new, and what is integration? Both can be valuable. But the valuation, the defensibility and the hiring plan are very different. A clear answer is a good sign; a vague one is a warning.

5. How do you know it works? Ask for evidence that matches the stage: a pilot with measurable results, a third-party review, published research, a working demo on real customer data. Be wary of claims that only exist in the roadmap. I try to be explicit about this in my own writing: a technical vision is not a validated product.

6. What happens when the standard changes? In security, standards and threat models move. Products built around one algorithm, one protocol or one regulation can become obsolete quickly. Ask how the product adapts.

About the team

7. Who on the team has shipped security into production? Research skills and product skills are both needed, and they are different. Look for people who have dealt with real deployments, real incidents and real customers.

8. How do the founders make technical decisions they disagree on? Deep tech companies make expensive, hard-to-reverse choices early. You want to understand how those choices are made and documented, not just who has the final word.

About the path to customers

9. How long is the sales cycle, and who signs? Security sales into industrial and regulated companies can take many months and involve security, engineering, procurement and legal. The plan and the runway should reflect that.

10. What has to be true for the second customer to be faster than the first? The first deals are often custom. A company becomes scalable when repeatable parts appear: a standard deployment, a clear integration, a reference that convinces the next buyer.

A note on tone

The best answers to these questions are specific, include numbers where numbers exist, and admit what isn’t known yet. In a field built on trust, honesty about limits is itself a signal.

If you’re evaluating a startup in applied AI and want a second opinion on its product and UX, let’s talk.