The Logic of Sumo Logic’s IPO (Whiteboard Confessional)

Over the course of my career, I’ve worn many different hats in the tech world: systems administrator, systems engineer, director of technical operations, and director of DevOps, to name a few. Today, I’m a cloud economist at The Duckbill Group, the author of the weekly Last Week in AWS newsletter, and the host of two podcasts: Screaming in the Cloud and, you guessed it, AWS Morning Brief, which you’re about to listen to.

Corey: This episode is brought to you by Trend Micro Cloud One™. A security services platform for organizations building in the Cloud. I know you're thinking that that's a mouthful because it is, but what's easier to say? “I'm glad we have Trend Micro Cloud One™, a security services platform for organizations building in the Cloud,” or, “Hey, bad news. It's going to be a few more weeks. I kind of forgot about that security thing.” I thought so. Trend Micro Cloud One™ is an automated, flexible all-in-one solution that protects your workflows and containers with cloud-native security. Identify and resolve security issues earlier in the pipeline, and access your cloud environments sooner, with full visibility, so you can get back to what you do best, which is generally building great applications. Discover Trend Micro Cloud One™ a security services platform for organizations building in the Cloud. Whew. At trendmicro.com/screaming.

Corey: Welcome to the AWS Morning Brief, what is normally the Whiteboard Confessional slot, but lately, I had such a good time speaking last week with my colleague Pete Cheslock that we're back again today. Say hello, Pete.

Pete: Hello.

Corey: So, as of the day we are recording this, earlier in the week, the Sumo Logic S-1 has been released, which means that Sumo Logic—motto, “We do logs, too.”—also is going public, which seems to be a bit of a flurry lately of companies deciding to, well, to be uncharitable, inflict themselves on the public markets.

Pete: Yeah, it turns out when you take venture capital money, eventually those venture capitalists, they would like to see a return. So, kind of make sense in a little ways, but at the same time, it's just, I guess, another location to raise money.

Corey: One of the problems that I've run into across the monitoring space, as these companies go public is—let's ignore the fact that it seems like none of them seem to be making money in a profitable basis. I mean, I haven't looked at the details yet, but Sumo is losing money, correct?

Pete: Oh, yeah. Yeah, absolutely. Although let's be really honest, that's not really a dig at Sumo. I mean, they all lose money. [laughs].

Corey: And to be fair, they also raised only—quote-unquote, “only”—$340 million while they were private. But there's a strange inflection here around how monitoring companies seem to work in this space. I don't know who sponsors any given episode of this show until after I've already recorded it, so I'm really hoping it's not them, but if it is, our goal is to be authentic. And it seems to me that there's very little differentiation in all of these companies that offer log analysis, for the most part. I mean, ChaosSearch, where you used to work, had something actually innovative in this space where the data lives in S3 and you can query it without having to pay the same extortionate rates that everything else did. But by and large, most of the rest of the players in this space, it seems the differentiator is starting to be marketing. Am I missing something stupendous?

Pete: No, I think you're spot on there, and you can normally see it when you look at a company's S-1. So, that S-1 includes a lot of information within there, but some of the key points are—at least that I kind of look at—are some of their financial statements; I'm just curious what their revenue is, what it costs to bring in that revenue, profit and everything else. But these companies, they break out their operating expenditures across things like research and development, sales and marketing, and for a lot of these marketing companies, you'll find their spend in sales and marketing to be just huge. In many ways, their spend is nearly their revenue. And let's not forget you still have engineers and your Amazon bill that you have to pay for as well. So, they seem to be very marketing-centric because it's a knife fight out there in the monitoring space, monitoring and logging. It seems like every day, there’s a new logging and monitoring company popping up with just a different way of doing things.

Corey: I get that it's a hard space and these problems are incredibly challenging. The challenge that I run into though is, in many cases, I just want a centralized place where I can effectively look at the logs in real-time as events happen, and start looking for specific patterns with various filters, and that's about it. And it seems like that is a somewhat naive use case—which I get—but then every company out there is chasing Splunk in one form or another. Because Splunk was the first company that really did this right, and they charged the appropriately high ransom in order to make that happen, and then everyone else seemed to go through a generation of, “We’re like Splunk, only not horribly expensive.” And then it became increasingly complex and down this entire path to a point where now, I'm looking at any of these tools and it turns out I need to take a class before I'm able to use them effectively, to learn their own variants of SQL, or how to wind up pointing it at some esoteric data source I'd forgotten.

Pete: Yeah, I think—and I've actually had a bunch of conversations with—as you would expect from spending some time at a logging data analytics company—but there's almost like multiple waves of logging that has happened. And Splunk was kind of the first in many ways. They created a revolutionary way of storing data. That was what they built. That was the core technology way earlier than a lot of other people were dealing with this problem. 

They also focused a lot in the SIM/SIEM—that's security, information, event management. So, they sold in a lot of ways to these security companies. And then you had companies that started to pop up that were in the more of the monitoring space, like the Datadog and the New Relics of the world. Datadog and New Relic were getting the requests, “Well, we want logging, too. Like, we're paying for this.” And so then they started consolidating on logging. 

And then you had kind of the next generation was like, well, it costs too much money to use these hosted vendors, and the reason it costs so much is because they're using these open source technologies to store this log data, so there's no real innovation there, and this next wave of logging companies that exist out there are all like the, “Well, what if you didn't index your data? What if you just tagged it really, really well?” And that's this third wave we're into now, where people are just like, “I can't keep spending the GDP of a small European country on my logging every month.”

Corey: It also appears that they are the leader in ‘Continuous Intelligence,’ which is a term that they of course, invented. It turns out it's super easy to be the leader in an area that you invent. They claim there are five pillars to it. And one of them is multi-cloud adoption, which anyone who's listened to anything I've said on the topic understands that I kind of disagree with that entire premise. The challenge though is that in this S-1 reading about multi-cloud adoption as being an imperative for modern businesses, yeah, the sentences that they put after that don't actually talk about multi-cloud at all. They talk about, “As you continue to sprawl, you need to be able to gather logs from everywhere.” Well, duh. What's your point here? In fact, you talk about multi-cloud being this incredibly important thing that everyone is going to embrace, but I scroll down to their risk section, and they say, and I quote, “We outsource substantially all of the infrastructure relating to our cloud-native platform to AWS.” So, which is it?

Pete: [laughs]. Yeah, it's a extremely good point. And what's also interesting is how many of these companies—you know, Sumo Logic, remember, they were just a logging company to start with. New Relic was just APM to start with. Datadog was just a host-based monitoring to start with. 

Watching them all move into each other's territories, but kind of solving what the other one is good about poorly in a way that just you start using more of it—I'm old enough to remember when everyone was like, “Datadog is the best monitoring system that's ever been created, ever,” and I am actually shocked to see more and more people online completely bashing Datadog, completely bashing Sumo, I mean, these bigger companies. It's like, they try to do more, and in the end, obviously, their focus gets shifted, and the thing that made them great, you know, you have these upstarts that will come and take it over again because they've lost their focus.

Corey: It really tends to surprise me just seeing how everyone is chasing Datadog. That’s one of my biggest problems with the monitoring space if I'm being direct. You have these companies that are very good at a particular niche or a particular area of this where, oh, great Sumo Logic. I've been a Sumo Logic customer and a happy one. Please don't think this is me dunking on a company that I have no affection for, or dunking on them at all, but at some point, there's this entire shift. 

I don't know if it's driven by investors. I don't know if it's customer demand, but they always succumb to the Datadog problem of, “All right, now that we've handled logs or application performance monitoring or insert whatever thing that they've become known for, now we're going to effectively do all of the monitoring pieces and become the next Datadog.” Why? Is that something that people actually want or need? I don't think it is.

Pete: Right. I think it's just a following the market. Using kind of your ecosystem—so if you're a Datadog, and you've got this agent, you're doing all this great host-based monitoring, conceptually, adding logging, if you already have the agent in place, should be a really easy way to convert those customers and increase the average deal size. I remember looking at the Datadog S-1 when it came out—because I'm a total nerd when it comes to reading these things, understanding how businesses work—and what was shocking was actually how little net loss they had. 

Like, of course they lost money because they were plowing every dollar into growth, and it's showed; they were doubling their revenue year over year, which when you're doing a $350 million run rate, that's pretty big if you're continually doubling every year. And their loss was something like $1 million of net loss. It was, like, nothing. And comparatively, the Sumo Logic net loss is somewhere, from 2019 to 2020, they went from $50 million in loss to nearly $100 million in loss, so you kind of look at it and you go, “Wow, that's a pretty big difference from the Datadog one,” which, again, my guess is, is that Sumo Logic is going to be compared to Datadog when they go to the public markets, So, I think it'll be interesting to watch.

This episode is sponsored in part by our good friends over a ChaosSearch, which is a fully managed log analytics platform that leverages your S3 buckets as a data store with no further data movement required. If you're looking to either process multiple terabytes in a petabyte-scale of data a day or a few hundred gigabytes, this is still economical and worth looking into. You don't have to manage Elasticsearch yourself. If your ELK stack is falling over, take a look at using ChaosSearch for log analytics. Now, if you do a direct cost comparison, you're going to say, “Yeah, 70 to 80 percent on the infrastructure costs,” which does not include the actual expense of paying infrastructure people to mess around with running Elasticsearch themselves. You can take it from me or you can take it from many of their happy customers, but visit chaossearch.io today to learn more.

Corey: For what it's worth, I find that I want to have the logs live in a particular place. I want to have, in an ideal world, a single dashboard that shows me the status of everything I care about. Unfortunately, I live in reality, and I know that it never works out that way. Single pane of glass is incredibly single painful, and I don't think there's any way you get over that. But I really wish that when I go to a particular vendor for the one thing that they're good at and great at solving, that they don't try and shove an entire boatload of other things down my throat, in which they are clearly second-tier at best.

Pete: Yeah, one thing I think on this S-1 that I thought was curious—and I know you read a lot of S-1s as well, especially for these tech companies that have popped up more recently—

Corey: I have super bad habits and no life.

Pete: [laughs]. But I feel like I've read some S-1s that have come out that have been much more explicit, in the company that was filing, in the commitment to Amazon. The Enterprise Discount Program, the EDP program where you have to make $50 or $100 million commitment over a certain number of years. There are companies that go public and they get blasted about how, oh, so and so has a $400 million commitment to Amazon, as if that's huge when they're revenues and their usage is so high. But in this S-1, I barely saw any reference to Amazon other than a couple of call-outs and just a generic like, “Hey, we have this hosting commitment of $40 million.”

Corey: Yeah, 36.9 for 2021 and 27.29 for 2022. They've already said most of their—effectively all their hosting is on AWS, so yeah, maybe they're completely overshooting their commitments. Maybe they had a much larger commitment that they’ve then powered through. And again, that's fine. I have no problem with any of the numbers that I'm seeing here. It's nice that they don't have commitments that are more than their revenue, which we've seen a few times now. I don't see any problem here as far as what I can deduce from the tea leaves that are their commitments. I really don't find too much that’s objectionable in this space, which is a welcome change.

Pete: [laughs]. That is very true.

Corey: One thing I've also noticed is that if we look at the year 2020—sorry, the year ended—their fiscal 2020 apparently ended January 31. Great. Good for them—where they paid their CEO $3.7 million in terms of all stuff together. Okay, great. Their CFO made a bit under half a million for the year. Okay… I don't know what the backstory is there and their chief revenue officer made a bit over three-quarters of a million. None of that is egregious, as opposed to, you know, Rackspace’s S-1 somewhat recently, where it was disclosed that they were losing $100 million a year—net loss last year—and a third of that was compensation to their CEO.

Pete: Yeah, I mean, when you look at those types of numbers for a company, where just such a huge amount is some sort of strange stock-based compensation. Obviously, that's where WeWork—kind of the beginning of the end of WeWork, when people started seeing all these strange compensations. It's a pretty big red flag out there, that's for sure. I think the other place that I always like to look at, too, is the section that talks about that principal stockholders. Mostly out of just, kind of, morbid curiosity of, for a company like this, so Sumo Logic that has been around for quite a while, so according—I'm on Crunchbase right now—so they've taken all the way up through Series G, they’ve raised $300 and something million, they've been around—I’m trying to find when their first year was, but, you know, long enough to raise a Series G round, you have to imagine that for a founder of this company, your original equity stake, right, if it's you and a partner is 50/50, how much do you actually have at the end?

And interestingly enough, the actual percentage held by any individual person within the company, CEO is about 4.7%. Some of the other people that are listed here, either, like, co-founder is, like, 3.4%. Admittedly, this is actually pretty low, and I do remember from the Datadog S-1 that the founders there—that was kind of considered a runaway success—the founders there had at least 10% or more, so kind of speaks for some headwinds they might have ran into during some of those fundraising rounds. But—

Corey: Let's also point out that early in those days before they'd raised a bunch of those rounds, they were giving probably what, if they're like other companies, somewhere between 0.1 and 0.25% of equity to employees as a sweetener to, “Hey, come work here.” If the CEO and founder was diluted down to 4.7% when they presumably were starting with, what, 50% then it kind of makes you wonder what the employee story on this is. Is this one of those outcomes where the founder gets to buy a boat, and the employees get to buy a used Toyota?

Pete: Right. And honestly, in many of the cases, that's usually how it ends up. I think the other thing, too, that I hadn't gotten through it because usually it's probably buried away in some of the small wording, but oftentimes, too, it'll list out kind of secondary market sales of shares, so there's no telling that at one of these big rounds, I'm sure that there was an opportunity. Yeah.

Corey: Oh, you can't tell what happened to employees on this, but it’s one of those areas where whenever I see people at early-stage startups talking about how their equity is going to make them a millionaire, it's, “I don't know about that.” There's a lot that can happen between the founding of the company and going public that looks a lot like dilution. You're required on some level to assume that your founders are going to be at least passable a negotiator as the people across the table who do this every week; that they're going to, in some cases, put their personal interests behind those of their staff. It's an interesting problem. You have an MBA—sorry to out you on that one—you've seen a lot of stories like this, probably more than I have and can do an actual analysis rather than me just flapping my gums in the breeze, but I'm curious to know what your thoughts are on this.

Pete: Like I said, I go to this section because as a person who's done just a million different startups and have always had that same thought in my head of, “Oh, this is where I'm going to go make all this money or whatever else.” The reality is, by looking at these you have to see just how long it takes to get this kind of percentage of your startup, and like you just said, Corey, you have to survive through so many different things just to get there, just to get to the point where you IPO. Recent companies like Elastic and Datadog, now Sumo Logic that have been around for what, eight to ten years. You have to survive a lot to get eight or ten years as a founder of a place, to not be completely ousted by your board, you know, who knows what would happen? There's just so many scenarios that could go down. But meanwhile, it's a company that is growing. Their revenue is growing, their top line is growing, and they believe that public markets are the most inexpensive way to raise additional money, so kudos to them because it's a huge accomplishment and I always hope, I hope the employees get to share in that and get a little bit of a payday and hopefully do something nice with that money.

Corey: Yeah, hopefully so. Thank you for taking the time once again to rant about industry news with me, Pete. It's appreciated.

Pete: Always fun to flex very lame MBA muscle.

Corey: Excellent. This has been the AWS Morning Brief. If you've enjoyed this podcast, please leave a five-star review on Apple Podcasts, whereas if you've hated it, please leave a five-star review on Apple Podcasts anyway.

Announcer: This has been a HumblePod production. Stay humble.