Deepecon

GPT Injection: A Growing Cybersecurity Threat for AI-Dependent Startups

Philipp Omenitsch — Sat, 01 Apr 2023 14:10:28 GMT

The emergence of GPT, or Generative Pre-trained Transformer, as a powerful tool has revolutionised various industries with its potential to innovate and streamline processes. However, alongside these benefits, it brings along a significant security risk that needs to be addressed urgently: GPT Injection.

What is GPT Injection?

GPT Injection refers to the act of deliberately inputting malicious prompts or commands into GPT-based systems. This can result in unintended consequences such as data leaks or the abuse of the AI system's capabilities. The repercussions of this type of cyber attack can be far-reaching and devastating for businesses and users alike.

A Growing Hacking Community

As GPT continues to gain traction in the tech world, it is anticipated that a new hacking community will emerge, focusing primarily on GPT Injection. By exploiting the inherent vulnerabilities of GPT-based systems, these hackers can potentially compromise sensitive information or manipulate AI capabilities for nefarious purposes.

The Importance of Security

As businesses and individuals increasingly rely on the power of AI, it is crucial to remain vigilant about the potential risks associated with this technology. By proactively addressing potential threats, we can effectively mitigate the impact of GPT Injection and similar cyber attacks.

To combat this growing threat, organisations must prioritise the following:

Implementing robust security measures to protect their AI systems
Regularly updating and monitoring AI models to detect and address vulnerabilities
Educating employees about the risks associated with GPT Injection and other AI-related threats
Collaborating with other stakeholders, such as AI developers and cybersecurity experts, to share knowledge and best practices

Example in the Wild

Ideas on how to protect prompts

Double GPT Check: The easiest way is to create a prompt and let GPT validate the output you want to return to your user
Preflight Prompt Check: Perform a preflight check using a special prompt designed to detect user input manipulation. Use a randomly generated token to verify the integrity of the input.
Input Allow-listing: If the task requires specific formatting for user input, create an allow-list of accepted characters or patterns to minimize the chance of injection.
Input Deny-listing: If allow-listing is not feasible, create a deny-list to block specific characters or terms that could facilitate exploitation.
Input Length Restriction: Limit the maximum length of user input to reduce the chances of successful injection attacks.
Output Validation: Validate the format of the model's output to detect anomalies that could indicate a successful injection attack.
Monitoring and Audit: Authenticate and identify users of the service when possible, detect malicious accounts, and implement monitoring and incident response mechanisms.

Sources:

Conclusion

The rapid advancement of AI technologies such as GPT brings with it immense potential for innovation and growth. However, it also presents new cybersecurity challenges that must be addressed to ensure the safety and security of businesses and users. By acknowledging the risks of GPT Injection and taking proactive steps to safeguard against such threats, we can harness the power of AI while minimising the potential for harm.

How (not) to market an open source library

Philipp Omenitsch — Tue, 20 Dec 2022 17:36:53 GMT

Trending on HackerNews

More than a year ago my friend Thomas and I were looking for a good solution to digitally sign PDFs for NetzBeweis. However, we couldn't find a library that was easy to use and had a permissive open-source license so we could use it in a paid product. Sure, PDFbox would be an option, however, we didn't want to use a cannon to kill a fly. So we decided to create open-pdf-sign with the kind support of the Austrian internet foundation NetIdee.

After we were done, of course, we wanted people to use it. We asked a couple of friends, however, we realized that this was quite a specific product and we needed to get in touch with people outside our network.

Here is what we did

We posted on our own Linkedin accounts and Twitter. Launched on product hunt and did the obligatory "Show HN" post on the website HackerNews.

At the end of the day, we only had 17 stars on Github. We thought we had planted the seed, and over time more people would use it.

Then a friend had an idea, he said I should post on a news board for computing news, frequented by the open-source community. I posted our link there not expecting much. An hour later I checked our GitHub repository, and I saw that we had 70 stars. Frantically, I checked and refreshed the page, I thought this must be a bug or something.

What I found out only later is, that someone had 1:1 taken our post and put it on hacker news and we were on the front page.

https://hnrankings.info/34051652/

This resulted in more than 10.000 page hits on our GitHub repository and hundreds of stars.

For people interested in graphs, this is what our star graph looks like.

Useless graph showing growth of stars on GitHub of open-pdf-sign

Learnings

We posted to Hacker News two times. Both as Show HN and here, linking to the project page.

However, the submission that got to the frontpage was posted by one the power users of HN with 100k+ karma. (See here) Also, he submitted the link to the GitHub repo directly, which might have made the difference.

Producthunt, while a good channel for product launches, might not have a technical enough audience for open source libraries.

In conclusion, there is no clear way to market your open source product, however, trying different channels and thinking hard how to reach your potential users might improve your odds of getting the attention your project deserves.

How to syndicate angel investments in Europe?

Philipp Omenitsch — Wed, 09 Nov 2022 10:39:23 GMT

This is a question that took a long time for me to answer. Being very interested in angel investing early on, but lacking the proper capital, I was always wondering how to get into deals. Coming from Austria, a small country in Europe, I tried to invest locally first. I went the route of asking many angels here how to go about this, and the answer I got more often than not was: It doesn't make sense to write checks below 50k per investment. Those "small" checks could then be syndicated through contracts and shares be held by one investor as a trustee. I was quite disappointed but kept on looking for better ways to invest small checks as I believe investing a little in many startups will give better returns than going big with just a few, there is also data about that here. Enter SPV Providers.

SPV Providers

Angellist.com allows investors to syndicate their investments in a Special purpose vehicle (SPV) while taking care of the administrative (boring) stuff. This was a few years ago, and no similar solutions existed for Europe. Until recently, the "cambrian explosion" of SPV providers happened. You can find more about all of them on this website (which I created) and compare them: https://spvproviders.com/

What I learned from this is the gist of this article: It is possible to use an SPV to wrap up many small investments with the help of any of those services.

Since then, I have recommended many founders to use such a service to be able to accept also smaller tickets for their fundraising. From a founder perspective, it makes total sense in my eyes to have many small checks onboard, as quite early on you can have dozens of people rooting for you and also help with marketing, sales, and connections.

2021 in review. Predictions for the year ahead.

Philipp Omenitsch — Tue, 04 Jan 2022 07:52:32 GMT

The rally in the financial markets in the last year was mostly caused by extremely low-interest rates and quantitative easing by central banks. In the coming year, 2022, fluctuations in the financial markets will mostly be dependent on inflation and, in particular, changes in interest rates. Before I move on to a discussion of the year ahead, let’s take some time to review the year that has just ended: 2021.

Supply chains and bottlenecks

When we look back at 2021 some problems have been way more persistent than we thought. While Covid-19 came down like the sword of Damocles upon us, crushing stock markets and any positive outlook, we quickly saw a rebound after a couple of months. This unprecedented variation in demand had a huge impact on global supply chains. Pre-covid our world and especially our supply chains were not optimal. However, for the most part, they were predictable. If the economy took a plunge, car dealers or car manufacturers, for example, could feel that change weeks (if not months) in advance via fewer orders. Thus, they could plan their production accordingly.

Covid-19 was completely different. On the one hand, some industries saw declines in their orders of 20%, 50%, or more within days or weeks. On the other hand, the uptick in sales was just as sudden and surprising when the economy began to restart, 2020 and 2021.

After the first big shock of 2020 — with help of fiscal and monetary stimulus packages and the central banks offering record-low interest rates—people began to catch up on the expenditures they had put off. This included purchases like the TV they didn't buy, but still needed or wanted, because shops were closed. There was also an unprecedented demand for home office equipment. Let’s not forget the car they held off on buying until the economic climate turned more positive. With record-low interest rates, it suddenly seemed like the perfect time to make that large purchase. There are many more similar examples. This led to orders overshooting what manufacturers were able to produce, especially with little lead time.

With long supply chains, it takes time for this sudden increase in demand from the consumer to reach a manufacturer on the other side of the world.

Because it is difficult to scale up physical production facilities (like we saw with face masks at the beginning of the pandemic), producers can’t adapt quickly to unpredicted increases in demand. This is especially evident in industries where scaling up takes years or lead times are long (such as computer chip manufacturing). Furthermore, it simply might not make sense for many producers to increase production. Firstly, they can charge more for their product now that demand is high and supply is limited, and secondly, they are familiar with what steady demand looks like from pre-Covid times, so they might not want to increase their production levels today and have a surplus and idle production capabilities two or three years from now.

I like to think of this effect like the pendulum in a clock. It usually swings left and right with very little variance; however, if you push the pendulum further to one side, it will swing back harder to the other side. This is similar to how Howard Marks, in his great book Mastering the Market Cycle, (and Ray Dalio has also touted this) describes cycle swings, but it’s a little different in this case.

Russian Chicken Farms

Since this is all very abstract and global supply chains are a very complex system, I would like to share with you an example I’m aware of from a Russian chicken farmer. It perfectly illustrates how difficult it is for markets to regulate production capabilities, even for “simple” supply chains. The local market price for chicken meat in Russia is free-floating; thus, it is also subject to variations in its price. The market knows roughly how much meat is needed at any given time. For example, it is understood that more chicken will be needed before the holidays. You would imagine that the price is therefore not subject to much change. Since it takes roughly 35 days to raise a chickling to a proper size, a chicken farmer needs to estimate how much demand there will be for chicken 35 days from now, so he or she can decide how much chicken to raise in each batch. And now for the interesting part: there are, of course, multiple large chicken producers, and every producer wants to maximize their profits. So, ideally, they must all grow as much chicken as they can sell at a profit, ideally when the price is high, and less so when the price is low. But what is the best way to estimate this?

It turns out, one can not accurately predict the market price without knowing exactly how much your competition will produce. If you think about it, the best indicator for the price in 35 days is the price today. Game theory tells us it would be best if all market participants shared information. However, this would probably manifest as a cartel. So what happens is, when the price is high, everybody grows lots of chicken, thus crashing the price in 35 days and causing price swings of about 30%! When I first heard about this, I couldn’t believe it. It’s crazy but it’s true.

In my opinion, this is EXACTLY what's going on in the general economy today. Production with large lead times, monopolies or oligopolies, and highly protected markets are the most affected by unforeseen changes in demand. And to some extent, we have witnessed this with chip manufacturers, but also with airplane producers, ship producers, and other industries that had their logistics disrupted by Covid-19.

My prediction is that over time, we will get back to the same level of predictability of supply that we experienced pre-Covid, even for inelastic industries with long lead times. Most likely, chip manufacturers will be affected for a longer time still, but this is also due to ASML having a de facto monopoly and producing almost all the EUV lithography machines needed to scale up modern IC production.

All of this, demand overshooting supply, and low-interest rates, have led to a rate of inflation not seen in the US since 1982.

It will be interesting to see if, how hard, and when the pendulum swings back.

Interest rates

The above explanation of inflation nicely aligns with the FEDs (American central bank) stance on “transitory inflation” and their interest rate policy. Over a long enough timeframe, the pendulum should swing back and cancel out any price increases. However, the pendulum is also swinging slower than many would have expected because the pandemic is still ongoing and lasting much longer than expected. Since inflation has now been high for an extended period of time, it is starting to have a ripple effect. People who had been waiting for prices to normalize may now think they have been waiting too long. Believing that their money is devaluing, they feel compelled to spend it. Better buy that house now since inflation is high and interest is low. There might not come a better time!

Thus, the FED is forced to make a tough decision about increasing interest rates. In my opinion, it is not clear that inflation will immediately react to this because the fundamentals of supply will not change. In fact, on the contrary, it might even stifle investments. However, it will have an effect on assets being purchased on credit, because credit gets more expensive with higher interest rates. Personally, I am expecting the FED to hike rates quite aggressively, more so than many people think and they themselves predict, but also lower them again quickly when the pendulum swings back.

As for Europe, I think they are in a better position because people are less aggressively taking advantage of the low-interest rates. Consequently, there is less inflation pressure from asset purchases on credit and leverage.

Predictions

Stocks

For stocks, I want to outline one observation that in my eyes is often overlooked. A fundamental effect that tricks our brains.

Prices grow exponential when yields are low

In the chart above, I’ve tried to demonstrate why even a small increase in interest rates can have a dramatic impact on asset prices at the current level. I’ve calculated the price of a fictional stock with constant earnings for different yields, because a stock, in my opinion (Warren Buffet agrees), can be seen as a yield earning asset with a risk premium compared to bonds. A small interest rate increase at very low rates has a much higher impact than at higher yields. This is what math tells us.

Stocks will behave differently depending on the industry. Technology stocks, in my view, are especially inflated because of low-interest rates, so I definitely see them losing ground in the year ahead. In contrast, value stocks profiting from the high prices and low supply will benefit. It is easier to justify high future revenues for high margin businesses with little capital expense than for capital intensive businesses. High Tech company valuations often come from investors valuing them with Discounted Future Cashflow and this method strongly depends on the discount (interest) rate.

Real estate

For real estate purchases, interest rates are a driving factor, but other components include investor appetite for real estate, population growth, and supply. The last factor, supply, is particularly cyclical and highly dependent on the region in question.

In general, though, driven by the first and most important factor, debt, I think real estate will suffer as a result of increasing interest rates. It is unlikely that we will see a huge, sudden drop, but I can see prices stabilizing or dropping slightly when interest rates rise.

Crypto

Crypto is very interesting to look at and the most difficult asset to predict. This is because of its huge value fluctuations in the past and because of a lack of fundamentals. It is often touted as a hedge against inflation, and I largely agree with this for the blue-chips (Bitcoin, Ethereum, etc.). In any case, a higher interest rate will certainly hurt cryptocurrencies because they don't provide any yield and they are competing with higher-yielding assets, like bonds and stocks even more so with rising interest rates. Many DeFi products do promise yield, and it will be very interesting to see how they behave in the event of a larger downswing. I see many (not all, though) of them as very risky, but some even see them as highly complex financial instruments.

Startup valuations

Over the last decade, we have witnessed a focused pursuit of yields. Pension funds and investors— because of the low-interest-rate environment—have been driven to pursue riskier assets, especially when compared to purchasing bonds that yield a return that is satisfactory to their needs. To maintain their previous levels of yield, investors have now piled into equities and, increasingly, into private equity and earlier stages of company funding. From creation to private fundraising, to IPO. Investors are now trying to capture higher yields by entering deals earlier (as opposed to IPO or post-IPO). Thus, we’re witnessing a dramatic increase in venture funding (investment before profits are made) and startups staying private for longer because they can (financing exists that enables it). Another point is the rise of SPACs, which allow companies to go public earlier through some clever tricks (often even pre-revenue).

I’ve already covered how inflation is most likely leading us to rising interest rates. Now, I want to quickly discuss what impacts this will have on startup funding. Current valuations are historically high and have been accelerating at an astonishing rate.

IPOs are happening later in terms of company size

One reason for this dramatic rise is that returns have been higher in private markets for some time. Now, investors are trying to get those returns by increasingly entering private markets. This has allowed companies to stay private for longer and go public later.

Why am I bringing this up? As can be seen in the chart above, this has caused investments to become more and more illiquid, even though there is now a huge shadow market where shares in private companies can be traded (i.e., EquityZen) and a range of investment platforms to invest in companies at earlier stages easier (i.e., AngelList, Republic, etc.).

If interest rates rise, I expect at least some of those high startup valuations to decrease. Or rather, I predict fewer funding rounds for startups that are bleeding money, which could lead to more defaults. However, because those assets are inherently illiquid, those effects will be magnified.

Thus, I recommend being very careful when dealing with startups with high valuations, when interest rates rise, those might be deflated one way or the other.

Closing Thoughts

Covid-19 has changed the world and its effects will long be felt throughout the world. I hope that supply chains will become more robust as one outcome of this. It will be interesting to observe if getting out of the lowest interest rate environment in decades without hurting economies will be possible. I am optimistic that we will adapt to the environment, I am positioning for rising interest rates, they will come sooner or later.

Photo by Rinson Chory on Unsplash
Photo by Jan Baborák on Unsplash

How to migrate your firebase project from US to EU for mobile apps

Philipp Omenitsch — Tue, 29 Jun 2021 11:31:27 GMT

When we started Stresscoach in 2019, we chose to host all our data in the US. As I set up the Firebase project needed for our react native mobile app, I didn't give too much thought to the range of options I was presented with. Amongst other things, a user has to choose where their servers will be located for the project. Our users would mostly be located in the US—or so we thought at the time—so hosting our data there made perfect sense. I recommend that you closely examine where your service will be located before you create a project. You can find more detailed information about setting your location here.

Two years later, we decided to focus much more on the German-speaking DACH area (Germany, Austria, and Switzerland). For a range of legal reasons, including the recent privacy shield judgment, and with data privacy laws being much more strict in the DACH area, we decided to also move our data to servers based in Europe.

Initially, I thought this would be relatively simple. I’d probably just need to flick a switch somewhere in the project settings.

https://firebase.google.com/docs/projects/locations

However, when I examined these settings more closely, I didn't find anything. Then I stumbled upon this:

It was bad news. As it turns out, you can’t change the location on your Firebase Firestore and other default locations once they are set.

I immediately contacted the Firebase support team, who informed me that the best course of action was to create a new project with the new location and then migrate over all my services. Oh boy!

We were running our app and using a whole bunch of Firebase services, including:

Notifications (Firebase Cloud Messaging)
Database (Firestore)
Authentication
Cloud Functions
Hosting

After some thought and tinkering, we developed a plan to migrate over all our services with limited disruption to our users. If you find yourself in the same situation, here are the four steps we took to make the transition as seamless as possible.

Step 1 - Create a new project with the correct settings

When you set up your new project, pay close attention to the settings and locations you select. Remember, you will not be able to change the location, later on, so make sure you choose the right one this time.

Step 2 - Get your app up and running with the new project

Getting your app up and running involves migrating all of your Firebase services and data. Here is how we did it:

Cloud Functions

If you are using cloud functions, don’t forget to deploy them to your new project. If you are deploying them from your computer via console, you will need to change your private key file. You can download it from Project Settings > Service accounts > Firebase Admin SDK

Firebase Keys

Change your Firebase keys the App is using itself

For Android download the new google-services.json from the project settings page

For iOs download the GoogleService.plist from the project settings page

Download the GoogleService-Info.plist file for iOS and add it to your App

Notifications

For iOS, simply add the Auth key you used for your old project.

For Android, this will be a little bit more tricky because only one project can be connected to your app at any given time. Don’t worry, I’ll show you exactly how to handle this later in this post.

Authentication

If you also want to move authentication (which I strongly recommend as it will mean you have all of your services in one project), the only practical solution we could find was to use the Google-provided CLI tool for exporting your authenticated users from one database and importing them to the other.

We did all of this before we made the app live and once again a day later to catch users who downloaded our old app but only registered after we did the first migration.

Step 3 - Create a cloud function that syncs user data

One problem you will certainly run into is that, at some point, all of your users will still be on the old database, but if you copy them over just once to the new database, users, who used the app between you copying the old to the new database, will lose data or encounter inconsistency when they update their app (which works with the new database)

Here is the solution that worked for us: We created a cloud function that connected to the old project and synced all of our user data to the new project. This cloud function was triggered one time when the user first opened the new version of the app, which already works with your new Firebase project.

Step 4 - Make the switch

Another problem we ran into was notifications. As I mentioned earlier, for Android apps, a key can only be used for one project at a time. We solved this by releasing the Android app, waiting one day, and then removing the key from SHA certificate fingerprints in the old project settings. We then added the SHA certificate fingerprints of the android app to the other (new) project. This way users might not receive notifications for one day, so if this is business-critical for your App we recommend you explore other options. We contacted Google, and this was the way they recommended us to handle it, so I am not sure if there is a better way to do this, with less impact on notifications

Here is the place where you can add you SHA certificates

Conclusion

By the time we had completed these steps, it was clear that the process of migrating data isn’t as daunting as it may appear from the outset. Once we created a plan and broke it down into several steps, we were able to migrate our data relatively quickly and easily. I do, however, recommend that you carry out extensive testing of your solution afterward, especially edge cases like registering and logging in. We were able to complete this migration within two weeks, and although we did have a handful of customers contact us about problems, it was a very small percentage. One option to decrease the impact, even more, would be to export and import users from step two several times (i.e., every day for a week). Overall, we’re happy with how quick and easy this Firebase migration process was for us at Stresscoach, and we’ll certainly pay closer attention to the project setup options next time!

How to change gradle version in Android Studio with ejected Expo app

Philipp Omenitsch — Tue, 01 Oct 2019 09:48:08 GMT

TLDR: set the distributionUrl in android\gradle\wrapper\gradle-wrapper.properties correctly

I am using expo to build our app Pocketcoach (https://www.pocketcoach.co)

A new feature needed us to eject from expo. The process is pretty straight forward you can check in their documentation here https://docs.expo.io/versions/v35.0.0/bare/customizing/

However when I tried to build our app for android, I encountered a strange error:

"Cannot add task 'wrapper' as a task with that name already exists"

After a bit of googling I discovered that this is likely due to expo using gradle 4.7 at the moment (SDK 35)

You can check this by looking at the build.gradle script for the project in android\build.gradle und wrapper where it says: gradleVersion = '4.7'

In order to fix your error you need to go to android\gradle\wrapper\gradle-wrapper.properties and set the distributionUrl to the correct version, you can find it here:

https://gradle.org/releases/

Hope this helps someone

How venture capital works part II

Philipp Omenitsch — Sat, 11 Nov 2017 12:11:28 GMT

Venture capital and fundraising

In this part I will try to explain what I learned about raising money, angel investors, venture capital funds, private equity, how they operate, which functions they fulfil.

Angel investors

They are rich individuals, people who have built successful companies and sold them off and who want to actively manage their own money. They also can be former managers who are looking for new challenges. Often they have a very specialized knowledge in one domain. They can be good fit, because they have often have experience in the sector they are investing in, though often their capabilities are limited (looking at raising new rounds or helping you hire new people). Be careful, some of them just want to invest money but have no idea of how business really works (think rich dentist).

Venture Capital Funds

A venture capital firm invests money in startups for equity. Usually a venture capital firm raises money from multiple institutional investors for a fund and then invests in multiple startups with this money. I will explain in detail how they work, so it becomes clear which motives they have. The most common model is the 220. The management company takes 2% management fee per year, and 20 percent of the profit, the “carry”, at the end of the fund which typically lasts 10 years. They are expected to perform at a rate of 4 to 5 times net of the invested money.

Ok, let's pause for a moment, what does this timeframe mean for the venture firm? Within 10 years, they have to go through the process of getting stakes in valuable companies, hold them for some time and sell off their shares before the 10 years are over, so they can return the money to the investors.
These funds can have different sizes, ranging from 20 million to the lower billions.
Often they also invest focused on an industry sector and depending on the size of the fund also focused on the company stage (Series A, B, C).
Typically a fund is invested in around 20 companies with different but similar investments. The fund is run by it's partners, they share the profits of the fund and vote on which investments should be made.

By Urbanrenewal (Own work) [Public domain], via Wikimedia Commons

Example

We opened a 220 venture capital fund and raised 100 million with a 10 year runtime. A return of 5 times is expected. How much money do we have to generate in order to satisfy our investors?
2% are 2 million per year for ten years are 20 million. Additionally, 20% "carry" of the prospected 500 million go to the managers at the fund's end. That's are a hundred million, but we have to return 5 times net to our investors, so we need to earn more money. In total we have to earn 620 million. Half of all startups of the portfolio in a fund usually fail, so a company now has to make 12x to to be profitable for the fund. Or at least it must have the potential to make it. So if I, as a manager, invest 5 million in exchange for 30% shares (I am making numbers up now), then it has to be able to return me 60 million after a maximum of 10 years, the faster the better. If a company grows that fast, it needs money, a lot. That means another investor will come on board and thus dilute my shares, so I will end up with around 10-15% of the company. Let's assume 10% for the sake of the argument. So I invested 5 million and I expect 60 million return. If I own 10% at the time of sale, the valuation of the company should be around 600 million.

How VCs select companies

This is highly subjective and are more thoughts of how I think things work than empiric evidence. What I heard from one venture capital partner was this: First of course, checksize, sector, stage and geographic location preferences of a fund and a company must align, but after that there are some simple truths. The team is more important than the idea. If the people behind a project are not 100% motivated and committed to the company, there is 0 chance a VC will invest. They have to like you and get along with you, you will be working with them intensively for a couple of years, so this makes perfect sense to me. Also, the company should have some traction, paying customers and a viable product. As mentioned before the market has to be big enough to be able to create a multimillion dollar company, otherwise the investments makes no sense for the fund.

What are they good for?

VC funds are no charities, if they will give you money, they will make sure to get the most out of it from you. In my eyes th is a crucial thing to keep in mind when dealing with them. What will I really get from them, if it is only money, it is probably not a good deal. They have been in this game, the startup world, far longer than you. They know every trick and have dealt with situations, which are completely new to you multiple times. They know how to handle them and how to handle them in a way that is advantageous to them. I don't want to paint a picture of greedy gruel capitalists, but on the other hand: Money makes the world go round. They will vote you out of your own company if the have to and they will make sure they have the power to do it.

So what's good about them then?

Of course they have their legitimation and there are extremely good reasons to take money from them. First and foremost, money enables growth, a small stake of a bigger pie is always nice than a big piece of a small pie. VCs have extensive networks, and once they are invested in you and you can show progress, once the next round comes up to raise, it will be easy, they have a lot of contacts and access to people which can help you. They can also help you with recruiting

Private Equity

Here come the big players. They take money from superrich individuals and huge corporations and invest it. Their customers have one big problem, they have so much money, that it is difficult to put it to work, they need to employ people to actively manage their money, thus private equity. They make up the top of the elite of professional investors, they have all the right tools and people. They are able to bring in right people for key C-letter (i.e. CEO) positions. Depending on their incentives they will either lead very big rounds and get you ready for IPOs or sell you off to large companies, if you fit in their portfolio.

Conclusions

As one can see there are multiple ways of getting funding for a company. Each of them is definitely stage specific and bears it's advantages and disadvantages. Next time I will try to explain how the process of selling a company works and how to value a company.

How venture capital works part I

Philipp Omenitsch — Sat, 11 Nov 2017 12:10:57 GMT

Intro

Last week I had a great lecturer at my university's startup course, an investment banker.
He has an extraordinary personality, smart, charming and always right.
If you don't know him don't worry, just take away this: He is one of those guys,
who really knows how the game of investment banking is played.
Think of what Albert Einstein said "You have to learn the rules of the game. And then you have to play better than anyone else". He manages a Venture Capital (VC) fund and has a great track record.

I will try to summarize some lessons learned about VC and companies in general.
My assumptions are based on corporate law in the U.S., but can be applied to great extent all over the world.

The Fundamentals

A company is owned by its shareholders
A company's primarily goal is to bring value to its shareholders

Definition of Terms

pre money valuation: the valuation of a company that determines how many shares an investor will get for his investment
post money valuation: pre money valuation + invested money (after the investor invested the company is worth more, because the assets of the company grow, through the investment)

What Forms of Equity Ownership Are There?

Often many parties own one company, this reduces risk for the individual investor. Company ownership is distributed by issuing "shares", one share represents an equal part of the company.
To protect investors different, forms of ownership exist. Each form has different rights associated with them. If it's not too clear why all this is needed, I will provide an example where things should come together.

Common Stock

Common stock is the most basic unit of ownership. Owners have voting rights, common stock has the lowest preference in a liquidation event (when the company is sold or goes bankrupt).

Example

Two people found a company, they agree to own half of the company each, which is turned into common stock.

Preferred Stock

Preferred stock has all rights common stock has. In a case of liquidation, money from the sale of assets is first distributed to preferred stockholders, only then to common stockholders, thus preferred. It can also be agreed upon that preferred stock has to be paid back at a multiple of the proceeds, or with a discount rate (i.e. each year the amount that has to be paid back increases by 20%).

Furthermore, there is the class of participating preferred shares, which means that when a company is liquidated, first the preferred shares are paid back. In the next step the remaining money is split among all other investors, including common stock owners and preferred stock owners, thus they participate.

Example

Let's consider the last example, the founders own the company to 100%. They need money and decide to raise capital from two investors, 1 million each at each 12.5%. This sets the pre money valuation to 6 million and the post money valuation to 8 million, 6 + 2. Investor Alice gets preferred shares and investor Bob gets preferred shares with 2x participation.
Let's consider the company shuts down and 4 million are left in the company. The preferred stock owners, Alice and Bob will get back their money back first. Bob will get 2 million because he has a 2x multiple, Alice will get 1 million. After that, the founders will split the remaining 1 million with Bob, because he is participating with his 12.5%. So even though the founders have each have 37.5% of shares, would each get only 437 thousand. As you can see preferred shares make sense because they protect the investors, on the other hand multiples are hidden costs for the company and extra insurance for the investor.
.

Stock Options

A stock option admits the owner the right to buy common stock at an agreed upon price, the strike price. One option for one share. Usually, they are used for incentive and safeguard. Founders and key figures of a company will get options which they can turn into common shares at a later point. The strike price can be negotiated, usually for employees who receive stock options, it is determined at the latest valuation event (i.e. when a round was raised).

Vesting

Vesting is another term tightly coupled with options. If a startup launches and it is going well, people might have the incentive to just leave the company and work on something else, because they already own shares or options in a company. That is why vesting is important. With this mode a certain total amount of options is agreed upon founding a company or signing a contract to work for the company. The quintessence is that only after a certain amount of time the options are distributed to the employee or founder and they can be sold, this is the vesting schedule. There are different types of vesting schedules. Often it is agreed upon that every six months the employee will get ⅛ of all his outstanding options, so the total vesting period will be 4 years. This will protect investors from founders and other option holder that leave on bad terms, but would continue to own shares.

Convertible Notes

A convertible note is an instrument that is often used in early stages of startup funding. It is used when investors and the company's principals can’t or don't want to set a valuation for the investment but want to defer it to the next valuation event (i.e. capital injection). It has three parameters: A maximum runtime (e.g. 24 months), a discount rate (e.g. 20 % a year) and a cap (e.g. investor will get at least 10 % of shares). These are used to limit the flexibility.

Example

Like in the first example, two founders own the company. They raise 1 million, but can not agree with the investors how many preferred shares the investors should get. Instead, they agree on a convertible note with 20% discount, a 15 % cap and 24 months runtime, after which the note would be converted automatically to 25% share stake. Everybody is happy, after 12 months they raise the next round, 5 million at a pre money valuation of 20 million. The last investor would now get shares equivalent to 1.2 million of the 20 million pre money valuation, which is 6%.

Dilution

Dilution is not a form of ownership, it is exactly the opposite so to say. It means that if I have shares in a company and a new investor comes in, he will get new shares, making me own less of the total amount of shares.

Example

A company has 100 shares. Investor A holds 20 of those shares. Investor B comes in and for his investment another 20 shares are issued (Investor A does not have to give away any of his). Before, A held 20 / 100 = 20% of the shares, after Investor B gets his shares, A only owns 20/120 = 16.6% of the company with the same amount of shares.

Conclusions

I tried to give a small overview over important types and differences of ownerships, relevant especially for prospective founder or people working in startups. It is fundamental to understand that different types of ownership exist, which legitimation they have and what the differences are.

In the next post I will talk about the possibilities to put a price tag on a company and the different forms of valuation investment bankers use. Additionally, I will explain how VC funds work and get a bit into their motivations.