Most security companies seem to fall in one of two categories: - consulting - appliances (aka blinky boxes)

Consulting seldom requires venture capital and cannot scale at the level VCs expect.

Blinky boxes can, but customers are slowly catching on to the fact that adding another blinky box to the network is really not improving their resilience all that much.

On top of that, it's not always easy to identify the real economic buyer in an organisation, and e.g. a CISO might not have the authority to decide on installing new appliances but needs to collaborate with e.g. IT. It all makes for convoluted and longer sales cycles.