There is rumbling afoot of a series of articles coming that will be targeting and possibly even naming and shaming both CISOs and VCs. Without naming my sources and not that it's important to do so anyway, because the following article does a good job of giving a high level lay of the land, there is supposedly a number of articles coming from big-name publications that are starting to out CISOs who are on the take from VCs. It has been dubbed by others, the 'Gili Ra’anan model'. Here are some of the quotable quotes, "CISOs (chief information security officers), are as committed to Gili Ra'anan as they are to the organization that pays them, sometimes even more." “With a seemingly small purchase of $100,000-$200,000, a CISO increases a startup's value by dozens of times.” "It is difficult to predict the performance of the fund, but according to our forecast, the points you have accumulated so far are valued at X dollars. You can expect additional allocations in these funds in the coming years and in the new funds we will raise later." "Calcalist saw an Excel file with a list of 82 CISOs, the score of each one, the percentage of their holding in the fund, and the cumulative payments they received as a result of liquidation events in the fund." Ouch. This may be why so many companies are confusingly picking the wrong/stupid products. If you are a vendor, there is a good chance they never even seriously looked at your product if they picked one of the portfolio companies in question. Companies are spending in areas that don't matter because the CISO is paid to buy whatever random thing the VC wants them to. This is likely to start a wave of internal audits to make sure the CISOs are not incentivized to buy these products, and if they are, I would not be shocked to see a wave of unceremonious terminations of the most powerful security executives in the world. This is doubly true for regulated industries, like publicly traded companies and banking. Either way, it should be interesting.