Blood, Sweat, and Tears at Shadowscape
by Sharon Fisher
Many entrepreneurs will tell you how much they gave of themselves to start their companies, but James McCarter literally gave his own blood.
McCarter formed his security company, Shadowscape, three years ago, funding it largely by bootstrapping, such as taking out a home equity line of credit on his house. “We had some family members who believed in it and had a little bit of money,” he said. “There was some revenue through training. But we were on a shoestring budget. I had little jobs here and there on the side, we rented out our trailer, I play music every couple weekends at bars for a few hundred bucks here and there. I gave plasma a few times to pay the bills.”
But at Boise Entrepreneur Week, Shadowscape won the $100,000 Connetic Ventures equity seed award, which is helping jumpstart the company’s fundraising.
“There’s been a lot of risk and a lot of hard work and scrapping and fighting to get here,” McCarter said.
How Shadowscape came about
McCarter served in signal intelligence in the Marines. “When I got in, I was a Korean cryptologic linguist,” he said. “I focused on signal theory, which got me into cellphone forensics.” When he got out of the Marines, he got a job teaching NATO Special Operations Forces. He became the team lead teaching intelligence-driven operations such as sensitive site exploitation, digital data triage, cellphone forensics, and biometrics.
At that point, his director decided to start a cyber company, which became Root9b, in Colorad, and invited McCarter. The company grew to about 150 employees and went public. “I rang the bell at Nasdaq,” he said, eventually rising to vice president of cyber training and the director of threat intelligence.
“I’ve always considered myself an intelligence guy more than a cyber guy, and I approached cybersecurity from that vantage point,” McCarter said. “It’s a different way of going about articulating cyber threats and what to do with them. I drew on my experience of what I’d been teaching in the intelligence community – how to aggregate an action to reduce uncertainty to make better decisions. The most important aspect is that it’s actionable, not just information. Our clients responded very well to it.”
In 2014, McCarter and his wife, who served with the Idaho National Guard, moved to Idaho to raise their family. “We did the remote thing before the rest of the world was doing it.” And then in 2019, he left Root9b to start Shadowscape. “I thought I ought to operationalize the methodology rather than provide the service,” he said.
Unfortunately, McCarter started the company just before COVID. “To get us through COVID, I focused on cybertraining, whatever, to keep the lights on,” he said. About a year ago, “when the world started waking up again,” he started work on the Shadowscape platform.
How is Shadowscape different?
Shadowscape interface. Image courtesy Shadowscape.
There’s a lot of cybersecurity companies, but the Shadowscape platform puts the security risk assessment into business terms. “What we do is we take an in-depth assessment of the network and determine what different impacts would cost an organization in actual dollar amounts,” McCarter said. “Once we’ve done that assessment, we do a likelihood, in terms of a percentage, to quantify cyber risks. We communicate to the decisionmakers and budget makers why their investment into security is so important. ‘You have a million-dollar event here. Based on your current infrastructure, there’s a 75% likelihood, so that’s a $750,000 risk.’”
McCarter does this by enumerating where his data comes from and how the system comes up with those numbers. “A ransomwhere event is different financially from exfiltration of proprietary data,” he explained. He looks at the different financial impacts from each of those scenarios, such as availability, integrity, and the cost to respond to an attack. “Then, when we show the likelihood, it’s ‘This is how they’re going to attack you,’ and show what you do and don’t have that led to that likelihood percentage.”
Shadowscape goes further by quantifying the value of potential solutions. “Then we show the [return on investment] for each of those security controls in detail. ‘This mitigates $250,000 in risk, and costs you $10,000 to implement,’” McCarter said. “That’s pretty good ROI.”
Looking at security this way means that companies are looking at their security proactively. “We’re very threat-intelligence focused,” McCarter said. “By going through and assessing the assets that are in a network, we can watch out for those in the ‘dark web,’ ongoing data breaches, on a holistic level. We’re not only constantly looking to see whether information is compromised, but are maturing the systems over time, as opposed to being reactive and focusing on detections after the threat.”
Like getting your smog checked, Shadowscape doesn’t necessarily actually do the repair having diagnosed the potential problems, McCarter said. However, unlike getting your smog checked, it can. “We do have the ability to do the fix,” he said. “We try to stay agnostic. Our motivation is not to push services. When we provide recommendations, we do have customers who say, ‘can you fix it for us.’ But if they have an existing managed IT services provider, we’ll always consult with them first to see if they can meet those recommendations.”
In fact, managed IT service providers or cyber insurance carriers may be the ones using the platform, McCarter said. “We provide both services for organizations that aren’t able to do this type of risk analysis themselves,” he said. “For organizations that do have this, they can use the platform themselves.”
Shadowscape’s current situation
Currently, Shadowscape is in the beta testing phase right now, and McCarter said he hopes the company will be able to ship product in a month or two. “It depends on how much funding we raise,” he said. “We’re still in the middle of a raise. The more that we raise, the quicker we’ll get the platform to a commercial market.”
McCarter hopes to raise $500,000, and received $100,000 through the Connetic Ventures award at BEW. In addition, the company also received an additional amount, which he wouldn’t specify, from Capital 11 after its win. All told, “we’re about halfway there,” he said. The company expects to use the funding to grow its team, focusing on customer acquisition ad brand awareness marketing, he said.
Currently, Shadowscape has three employees and one part-time – McCarter’s director is in Colorado ad he has a developer in India, he said. In addition, he is about to hire two more employees in Idaho, he said.
McCarter admitted that raising money in the current economic environment is a challenge. “It’s been tough,” he said. “You’ve got to get used to some level of rejection. I’ve heard the startup venture firms are about 80% less likely to fund this year than last. Last year would have been a better time to raise, for sure.”
But at this point, Cybersecape has runway, McCarter said. The funding is to “help us hit the milestones that additional larger scale VCs have said they want to see, who are very interested,” he said. The company has also received a cybertraining company with a Washington, D.C.-based conglomerate he couldn’t name for 2023, he added.
Exit strategy
McCarter is looking to either sell the company in five to 10 years – “hopefully closer to five than 10” – or going public. “If it ends up going IPO, that would be poetic justice for me,” he said. “That’d be quite the vindication and pretty rewarding.”
McCarter has been to NASDAQ and rung the bell and held his previous company’s trophy, he said. “That was the proudest moment of my professional career” up until that point, he said. But in some ways, winning the Connetic Ventures award at BEW was better, he said. “We were in some trouble in October,” he said. “$100,000 is great, but it’s not a life-changing amount when you start a company.” But it meant more to him because he went from a low point to a high point in such a short period of time.
“All I can say is, you never give up,” McCarter said. “I told my wife when I started, ‘I can’t promise I won’t fail, but I won’t quit and I won’t leave anything out on the field.’ There’s a lot of time when I’ve almost wanted it to come to an end, one way or another, but I made that commitment to keep going.”
That was particularly true after some of his family and friends invested in Shadowscape. “That’s why I’m committed on not quitting,” McCarter said. “When someone else believes in you, I have a hard time letting people down who have faith in me.”
“The odds are against us to start a business,” McCarter said, noting that only 5% of startups make it beyond five years. And the pandemic and its associated economic downturn made it particularly tough. “By no means are we on Easy Street, but things are trending in the right direction,” he said. “I’m not going to waste the momentum. I can’t control the market, I can’t control trends, but I can control myself. You can believe what you’re doing makes sense, and you just grind on and hope everything stays together that’s beyond your control. You don’t know what’s around the corner, and if you keep grinding and keep learning, it’ll come around. Stay relevant, stay alive, and believe. When everything else doesn’t make sense, the only thing left in the tank is the faith you have in yourself, that somebody wants this, it’s just a matter of finding out who.”
And that makes successes like winning the Connetic Ventures award all the sweeter. “This is based on what I built,” McCarter said. “The company name, the product, the whole thing. I have the support of my family and friends who believed in it. It meant a lot more to me than I thought it would. Even if, somewhere down the road, someone gives us $10 million, this’ll mean more to me in the long run.”