Publications

Books by Atul Tiwary

Two books from the practice — the business of cybersecurity, and what autonomous agents do to M&A. Below them, the reading list the practice works from.

The books, papers and data sources this practice works from, in five groups. Each link goes to the publisher or the work itself.

• Why Software Is Eating the World (Marc Andreessen, 2011) — Named the shift that made software the asset buyers pay for — the premise under most security platform deals since.
• Fatal System Error (Joseph Menn, 2010) — Cybercrime run as a business, including the Russian Business Network — the attacker-side demand the security market sells against.
• The Cuckoo's Egg (Clifford Stoll, 1989) — Tracing one intruder through system logs — the origin of incident response as a discipline buyers now pay for.
• Dark Territory: The Secret History of Cyber War (Fred Kaplan, 2016) — How US cyber policy and offensive capability were built in Washington — the largest single buyer behind much of the sector's federal demand.

• SaaS Metrics 2.0 (David Skok, 2013) — Retention, CAC, LTV and payback — the metrics every security SaaS valuation rests on.
• The Hard Thing About Hard Things (Ben Horowitz, 2014) — An operator's account of the decisions that matter when a company is under pressure: layoffs, pricing, leadership changes.
• Crossing the Chasm (Geoffrey Moore, 1991) — Why security products that win early adopters stall before mainstream buyers — where many sales cycles end.
• Secure by Design (Dan Bergh Johnsson, Daniel Deogun and Daniel Sawano, 2019) — Security built into design costs less than security patched in later — the logic behind product-security spend.

• Damodaran Online datasets (Aswath Damodaran, updated each January) — Free industry-level multiples, margins and firm counts — the baseline check on any valuation claim.
• Clouded Judgement (Jamin Ball, weekly) — Weekly public SaaS multiples on EV to next-twelve-months revenue — the reference point for pricing private software.
• The Little Book of Valuation (Aswath Damodaran, updated edition 2024) — The method behind the multiples, so you can see which assumptions drive a price.
• Barbarians at the Gate (Bryan Burrough and John Helyar, 1989) — How leveraged buyouts were financed and fought over — the mechanics behind private equity ownership of security companies.
• Venture Deals (Brad Feld and Jason Mendelson, 4th edition 2019) — The term sheet, preferences and dilution that decide who gets paid at exit — relevant to every funded security startup.
• Investment Banking: Valuation, LBOs, M&A, and IPOs (Joshua Rosenbaum and Joshua Pearl, 3rd edition 2022) — The working reference for comparable companies, precedent transactions, LBO and sell-side process mechanics.

• NIST SP 800-207, Zero Trust Architecture (NIST, 2020) — Zero trust turned from a slogan into components a buyer can specify — the document most procurement teams now cite.
• BeyondCorp: A New Approach to Enterprise Security (Rory Ward and colleagues, Google, 2014) — Google's account of dropping the VPN as the basis for access — the proof point that made network-free access a product requirement.
• No More Chewy Centers (John Kindervag, Forrester, 2010) — The original zero trust paper. Read it to separate the idea from the relabeling that followed.
• Data Breach Investigations Report (Verizon, annual) — The breach-cause dataset the industry plans around, built from tens of thousands of incidents a year.
• Cost of a Data Breach Report (IBM and Ponemon Institute, annual) — The cost benchmark most budget conversations reference: 2025 global average $4.44M, US average $10.22M.
• MITRE ATT&CK (MITRE Corporation, continuously updated) — The shared vocabulary for attacker behavior; buyers now ask vendors to map their coverage to it.
• Sandworm (Andy Greenberg, 2019) — State attacks on critical infrastructure, moving cyber spending from IT budgets into national and infrastructure budgets.
• The Hacker and the State (Ben Buchanan, 2020) — State hacking as continuous competition, which keeps defense demand structural rather than cyclical.

• Fighting Viruses, Defending the Net (Mikko Hyppönen, TEDGlobal 2011) — Malware as organized crime with a revenue model — the economics behind endpoint security.
• Cybersecurity as Realpolitik (Dan Geer, Black Hat USA 2014 keynote) — Security as a question of policy, liability and power — and how breach reporting rules shape the market.
• Zero Trust Turns 10 (John Kindervag, interview, Information Security Media Group) — The creator of zero trust on what the model means and where vendors misuse it — useful for filtering pitches.