Hex Security: $1M ARR in 8 Weeks

Miles: Okay, so here's the thing. Fourteen companies in a single YC batch hit a million in ARR before Demo Day even ended. Grant: Three times more than the last winter Miles: Wow. Grant: batch. Miles: Grant: That number stopped me cold when I saw it. Miles: Right? And Garry Tan posted it himself. According to his post on X, the W26 batch also clocked the fastest revenue growth rate in YC history, Fourteen% week over week across nearly 200 startups. Grant: Come on, that's wild, right? So today we're pulling one company out of that batch and really pressing on it. Miles: Hex Security, eight weeks to a million ARR. They're running AI agents that do continuous penetration testing, and their first customers were basically other companies in the same YC batch. Grant: Which is either genius or a thing that only works inside the YC bubble. That's exactly what we're going to push on. Miles: And after the founder breakdown, we zoom out. The full W26 batch has some structural stuff going on. 56 AI-native service companies, 15 repeat founders. and a finding that kind of surprised me. Grant: The fastest growing ones didn't pivot, they held course. Miles: Exactly. Then we get into valuations. The default W26 round is sitting at $4 million on $40 million post money. That's double what W23 commanded. Grant: Whether that's earned or vesting trap before the Series A, we're not going to hand you a clean answer. That's the whole conversation. Miles: Alright, let's get into it, starting with that Garry Tan stat. that and what it actually costs to hit a million before Demo Day. The dashboard just sat there. A million dollars. I kept refreshing it like it was going to change. Grant: That's the code open, right there. Miles: Garry Tan posted on X during Demo Day for YC's W26 batch. Fourteen companies hit a million dollars in ARR before they even pitched. According to Tremendous, that's the highest number ever recorded in YC history. Speaker 3: Fourteen out of almost two hundred! Miles: Three times more than W25! One batch cycle! That's wild, right? Speaker 3: I mean, when I first saw a million ARR on a seed stage company like a decade ago, that was a Series A signal—you'd go tell your partners! Now it's the YC admission bar for elite. Miles: And Foundevo reported on the old benchmark used to be 150K to 500K ARR to be considered top tier at Demo Day. That bar more than doubled in a single cycle. Speaker 3: More than doubled. So what does that do to every founder who's tracking the wrong number? Miles: Right, and here's the thing—Rebel Fund, which has been scoring every YC batch since 2013 with a machine learning algorithm, published their read before a single pitch was delivered. According to their analysis, reported by Foundevo, 35% of W26 companies scored in the top 20% of all YC companies ever evaluated. Speaker 3: No previous batch came close to that. Miles: Not even close. So you've got two independent signals pointing the same direction: the revenue numbers and a predictive algorithm that's never seen a batch this strong. Speaker 3: I want to believe that, but I've seen enough Demo Days where the framing does a lot of work that traction can't. What does it actually cost to get to a million in 90 days? Miles: That's exactly the question. Grant: Because the compression is real, AI tools cut build time down to weeks, but the decisions you make at that speed, the things you don't build, the customers you say no to, those are the ones that come back. Miles: Or they don't come back, and that's its own answer. Grant: Yeah, Exactly. The number is impressive. The story behind the number is the whole thing. Miles: Garry also posted that average weekly revenue growth across the nearly 200 company cohort was 14%, the fastest ever across a full batch. Speaker 3: Batch-wide? Miles: Not the top handful, All of them. Speaker 3: Alright, so I want to hear from someone who actually lived inside that number. What did the sprint look like? What got cut? And what breaks when you grow that fast inside a 90-day program? Miles: There's a founder from this batch who can answer that, and the answer is a little uncomfortable. Okay, so one company from W26 that kept coming up when I talked to people was Hex Security. Three founders, Huzaifa Ahmad, Khan, and Prama Yudhistira hit 1 million ARR in eight weeks. Speaker 3: Eight weeks. Walk through what they actually built. Miles: AI agents that run continuous penetration tests, not a scanner. The agents find vulnerabilities, chain exploits together, write up the findings. And the core pitch is almost insultingly simple: companies pen test once a year; attackers are probing 24x7. Speaker 3: So the CISO already knows the problem. Miles: Right, that's the thing. You know what I mean? No education required. The buyer walks in already in pain. Speaker 3: Okay, but Cynic- Grant: It's Cobalt, Pentera, NodeZero; that space has money in it. Miles: It does; so I'd push on that; what did they not build, because to close one million in eight weeks you're not building everything, you're cutting. Grant: You're cutting and you're pricing fast, yeah. Speaker 3: M. Miles: Here's what's interesting about the founding team, whose CFA came out of AWS and PlayAI; Ahmad Khan had an OpenAI internship and robotics at OpenMind; Prama did a stint at Codegen, which got acquired by ClickUp. These are not first-time operators guessing at what security teams want. Grant: And they were inside YC, surrounded by other W26 companies who needed exactly what they were building. That's where the first customers came from. Miles: Fellow Batch companies. According to their YC launch, their agents found critical vulnerabilities in dozens of YC companies. SQL injection exposing Speaker 3: Wow. Miles: billions of records demonstrated network worms full code base access. Grant: Wait, their customers were essentially letting them hack them during the batch? Miles: That's exactly it. Low friction, high trust. You know the founder, you're both in YC, you let them run the agent on your infrastructure. Grant: Okay, but I want to pull on the valuation side of this, because that's where things get interesting to me. Eight weeks of revenue and they're reportedly at over $100 million in estimated valuation. How much of what investors are buying is traction versus story? Miles: I mean, I'd ask them directly, because the traction is real, the number is there, but one million ARR in eight weeks on a recurring security contract is different from one million ARR in one-time project fees. Grant: That's the question. What's the contract structure? Is it sticky or did a dozen batch companies sign six month pilots that don't renew? Miles: Right, because there's a version of this story where the box was just a perfect petri dish that doesn't replicate outside of it. Grant: And there's the version where they crack distribution first and the product catches up. Both are possible. Miles: Both are possible, and honestly, that tension, distribution first versus product first, you see it all over this batch, which is where things get really interesting when you zoom out from one company to the whole cohort. Court." Flipped out around for a second. Hacks worked partly because of where it sat inside the batch, trusted network, fast feedback, peer customers. So what does the rest of W26 actually look like? Grant: Well, the structure of the batch itself is worth paying attention to. According to Extruct AI's breakdown, 56 companies were building fully autonomous AI-native services. That's the single largest category, and the VC Corner tracked 15 repeat YC founders in the cohort. Miles: Fifteen—that matters. Grant: It does, because those founders walked in already knowing what office hours are for, already knowing which part to push back on, and which advice to take. They compressed the first month learning curve before the batch even started. Miles: And you can see it in how they positioned early; they didn't spend week three figuring out who their customer was. Grant: Right. Now the AI angle, I don't want to just say it was an AI batch and move on. Because that's too easy. What the extracted data shows is that the companies getting traction weren't general tools. They were vertical plays, healthcare, legal, security, narrow high stakes categories where being wrong costs someone real money. Miles: That's the pattern I kept seeing too. When the cost of failure is high, like a missed prior authorization or a security breach, customers don't need much convincing to buy. The sales cycle collapses. because the pain is already felt. Exactly. And the companies that struggled, I'd bet most of them were chasing broader problems where the buyer could always wait another quarter. Grant: So here's the counterintuitive piece from the VC corner data. Four companies pivoted mid-batch entirely, but the ones that hit a million in ARR mostly did not pivot. They found the customer before the product was finished and just kept going. Miles: Wait, so the lesson isn't be willing to pivot, it's... It's almost the opposite? Grant: I know, right? The Pivot story is the romantic version of startups. The W26 data says the fastest companies locked onto something real early and refused to let go of it. Miles: Which is harder than pivoting, honestly. Staying the course when everything feels uncertain, that takes a different kind of nerve. Grant: And that's the thing you can't see from the outside. We can read the traction numbers, Miles: Yeah. Grant: look at the founder backgrounds, but what we can't know is who actually gave these companies that. Miles: That clarity. Todd Lec, the partners, that's who knows. Grant: The people sitting in a room for ten weeks watching who panicked and who didn't, what do they think separates the Fourteen from the one eighty? Miles: And that's exactly who we're going to next. So, the partner read is what does a one million dollar ARR company actually do in week one versus everyone else? Grant: Speed the first dollar. That's it. The tremendous piece nailed it. The bar used to be 100K ARR at Demo Day. Not anymore. The 14 who hit a million weren't waiting for the product to be finished. Miles: Right, they were selling before the product could politely say no. Grant: Exactly. And look, the pattern partners see Batch after Batch. Founder Market Fit gets you to the first call, but the willingness to close an awkward half big deal in week three-that separates the Fourteen from the one eighty. Miles: That's the thing nobody wants to admit: the uncomfortable sell. You don't have logs yet, you barely have a dashboard, and you're asking someone to wire money. Grant: Yep. Miles: Okay, but here's where I want to push on something. Foundevo flagged that the default W26 round is 4M dollars on a F Speaker 4: - Miles: On a 40M post money. Three years ago in W23, that was 2M on 20M. Entry prices doubled in 36 months. Grant: And the top end hit 200M post money. That's the highest single company Demo Day valuation in six years of tracking, according to Foundevo. Miles: So, and this is the uncomfortable question, are founders locking themselves into a cap table problem before they even have a Series A conversation? Grant: Yeah, I mean, I get the appeal. Less dilution, stronger position. But if you take 40 million as your baseline and your Series A round isn't dramatically better, you are having a down round conversation. Miles: Or a flat round, which is basically the same conversation with nicer lighting. Grant: Right. And Tremendous actually flagged something weird. The companies with the most revenue weren't raising at the highest valuations. Deep tech was, which means some of the riskiest bets in the batch got the most expensive terms. Miles: Wait, really? Grant: Yeah. So you've got this inversion where traction doesn't necessarily equal valuation. Partners are pricing story and defensibility, not just ARR. Miles: Which is fine until the story needs to become a business. Grant: Exactly. And the exit math gets brutal fast. You need a $400 million to $500 million outcome, just to make a $40 million post-money seed look like a good return for early investors. Statistically, most companies Miles: Yeah. Grant: never get there. Miles: So the question partners are wrestling with, and I don't think there's a clean answer, is whether the new speed baseline creates as many traps as it removes. Grant: Yeah. You move fast, you close before the product's ready, you raise it a number that assumes... Sometimes everything goes right and most of these founding teams are still three people and Miles: Three people who just ran the fastest ninety days of their lives. Grant: And the next ninety are a completely different race. Miles: So Demo Day was five weeks ago. Some rounds close fast, most are still in process. Grant: That's the part nobody talks about, right? The pitch goes great, the FOMO is real, and then you wake up the next morning and the math doesn't move. Miles: Yeah, the term sheets were flying the first week. Week three, you're refreshing your inbox. Grant: And that's actually the normal pattern. Weeks two through four post-Demo Day, the companies that close are closing. Everyone else is negotiating or just sitting in limbo. Miles: Here's the thing though, the companies we've been talking about all episode, the ones who hit a million ARR with a three-person team in 90 days, they've got a different problem now. Grant: Right, because that spread is over and now they have to figure out like who's the fourth person. Miles: Noting the first hire, the first enterprise contract that didn't come through a YC connection, the first real sales motion. Grant: That's where most of these companies actually star. And I've watched enough post-Demo Day cohorts to call it. The fundraising was the easy part. Running the company after? That's different. Miles: After, the round closes and suddenly you're running a company instead of a pitch. Grant: And the spreadsheet gets tight fast. You've got a team of three. You just raised that $40, $50 million post money on a sprint everyone can see. Now you need to justify that number to a Series A. a partner while you're still figuring out who's building versus who's selling. Miles: That's the trap, yeah. The speed that got you to Demo Day is not the speed that gets you through year two. Grant: So, here's what I keep coming back to. The data is real. Miles: Fourteen companies hit a million, W26 scored in the 95th percentile, but I've seen enough strong starts turn into flat Series A conversations to know that inversion is possible. The question is, does batch strength actually move the survival rate? And the Rebel Fund algorithm flagged 35% of the batch in the top 20% of all time before a single pitch. So the inputs are better than ever, but does the post-Demo Day survival rate actually move? Move. I genuinely don't know, and I think that's the honest answer. Because the first 90 days and the next 270 are completely different races. Zero to 1 million is momentum and finding customers who know you. 1 million to 5, 10 million, that's when you need systems, retention, and people who don't have founder equity forcing them to stay. Grant: First sales rep who doesn't know the product the way you do. Miles: Yeah, and that's not a Batch quality question. That's a... That's a company building question. Batch quality doesn't solve that. Grant: So the new baseline is real. The bar for what elite looks like at Demo Day has genuinely moved, but whether that translates to different outcomes a year from now. Miles: We're not going to know for another 12 to 18 months. Grant: And honestly, most of these rounds aren't even closed yet, so we're still at the beginning of finding out. Alright, that's a wrap on this one. Grant, what's the one thing you're still chewing on? Miles: Honestly, that cost of speed framing, like the 1M ARR number is real, but the decisions you didn't make to get there, those come back. That stuck with me. Grant: Yeah, and for me, it was the buyer already in pain point with Hex Security. No education cycle, no convincing, just here's your solution. That's rare. Miles: Right. And the bigger question we're sitting with. Record Batch, record ARR accounts. But the survival rate doesn't automatically follow. The hard stuff is still ahead. Grant: The hard stuff is still ahead for every one of those three-person teams. That's the show. Miles: If you know a YC founder in their first year who tell their story honestly, send them our way. YearOne at HeyMato.com Grant: And if this episode helped you see startups differently, leave a review. Seriously, it matters. Miles: Thanks for listening. We'll see you next time. Grant: See you then.