Bastionway Series A
Cybersecurity pitch deck example with response time and ARR
A security buyer tests one claim and ignores the rest, and that claim is how long it takes somebody to act at three in the morning. Bastionway is invented, and its eleven slides put a 4.1 minute median on the cover and then cost the alternative line by line.
Every slide, in order
The whole deck as it renders, one slide after another. Read it the way the audience would.
The structure
What each slide is doing, so you can reuse the order even with different content.
- Slide 1cover
- Put the response time on the cover, since it is the only claim a security buyer tests.
- Slide 2intro
- Why a mid size firm cannot staff this, argued from the roster rather than from fear.
- Slide 3pillars
- Detect, contain, report, because the middle word is the one competitors leave out.
- Slide 4metrics
- Six numbers that answer the six questions a security buyer asks in the first meeting.
- Slide 5metrics
- Incidents contained per month, with the four things the shape of the bars actually says.
- Slide 6comparison
- The build against the buy, costed line by line, because this is the whole commercial argument.
- Slide 7process
- What happens in the first four minutes, named step by step so the median is checkable.
- Slide 8content
- Six words the buyer will hear this month, defined so the comparison is fair.
- Slide 9pricing
- Four endpoint bands, priced monthly, so the 96,000 dollar figure on slide six can be checked.
- Slide 10investment
- Twelve million in four cards, with the analyst roster as the largest single line.
- Slide 11closing
- Close on the one thing a buyer can verify before signing anything.
Slide by slide
Slide one puts the median response time on a dark cover. Slide two argues why 168 hours a week cannot be staffed by a mid size firm. Slide three is detect, contain and report as three panels. Slide four is six service numbers including false isolations. Slide five is incidents contained per month with four takeaways beside the bars. Slide six costs an in house team against the service. Slide seven walks the first four minutes in five timed steps. Slide eight defines six words the buyer will hear from every vendor. Slide nine is four price bands by endpoint. Slide ten splits twelve million four ways. Slide eleven asks for the containment authority document to be requested.
How to adapt this deck
A product rather than a service removes the roster argument entirely and replaces the in house cost slide with a tool consolidation slide, because the buying question changes from who is awake to how many consoles are open. A company selling to enterprises with their own security team reframes the service as augmentation and moves the glossary forward, since an internal team will define the terms differently. A deck for a compliance driven buyer such as a regulated lender adds an evidence slide after the reporting panel, because the artefact that matters there is the timeline an auditor can read.
What this audience asks for
The Australian Signals Directorate publishes the Essential Eight, which is the baseline most mid market buyers in this region are measured against, and the American standards institute publishes the cybersecurity framework that larger buyers map their controls to. Both describe response as a function with an owner and a time, not as a piece of software, which is the distinction this deck is built on. A security deck that quotes detection coverage without saying who acts on an alert has answered the easy half of the framework and left the half the buyer is audited on blank.
What makes this deck work
The cost comparison shows its own arithmetic
Slide six puts 820,000 dollars of in house cost against a 96,000 dollar service and then explains, in the callout beside the table, why the roster needs five analysts rather than three. The number that usually gets argued with is the headcount, so the callout answers it before the table is read.
Response time is defined, not just quoted
Slide four says 4.1 minutes is measured from alert to the first containing action, and slide seven breaks those minutes into five steps with the containment authority named as the reason no approval call is needed. Most response times in this market are measured to the first email, which is a different number entirely.
A glossary slide makes the comparison fair
Slide eight defines detection, response, containment authority, mean time to respond, coverage and escalation in one line each. It is the slide a buyer takes into the next vendor meeting, and it quietly makes every rival answer the same six questions.
Questions people ask
What goes in a cybersecurity pitch deck?
The staffing problem, what the service actually does, the response time with its definition, incident volume, the cost of building it in house, the first minutes of an incident, the pricing and the ask. This example uses eleven slides and defines its own terms on one of them.
How do I present response time credibly?
State what the clock starts and stops on. This deck measures alert to first containing action, not alert to notification, and breaks the median into five timed steps. A response time with no definition is the easiest number in security to inflate and buyers know it.
Should the deck compare against building in house?
For a mid market security service, yes, because that is the real alternative. This example costs analysts, a lead, tooling and log storage at market rates and lands on 820,000 dollars against a 96,000 dollar fee for the same coverage.
How do I price a security service in a deck?
By the thing that drives the work, which is usually endpoints, in bands. This deck uses four bands from 1,200 to 12,500 dollars a month and keeps coverage, authority and reporting identical across all of them, so the bands are about scale rather than about withholding features.
What do security investors ask that others do not?
Whether the response time holds as the customer count grows. This deck answers it in the ask, by spending 30 percent on operations so the roster grows before the customer count does. A security business that scales revenue ahead of analysts breaks the only promise it made.
How many slides should a cybersecurity deck be?
Ten to twelve. This one is eleven. Threat landscape slides are the usual filler, and they tell the buyer nothing they do not already believe. The space is better spent on the incident timeline and on defining what the service is contracted to do.
Build your own in about a minute
The button below opens the generator with this use case already described. Change the wording to match your own, generate, then edit anything you like.
Make one like thisOther presentation examples
HRtech pitch deck example built around retention numbers
An HR software buyer is measured on one number every quarter, and a deck that does not move it is a deck about features. Tenure is invented, and its eleven slides are organised around 90 day attrition, with the buyer described before any of the metrics appear.
Proptech pitch deck example for a rental platform
A proptech investor wants to know whether the saving is real and whether the sale repeats. Tenvale is invented, and its eleven slides prove the first with a paired study on the same properties and the second with a monthly line of active agencies.
A spacetech pitch deck with a launch timeline
A spacetech pitch deck has to prove that customers will pay for the data before the hardware is in orbit, and that the launch dates are fixed rather than hoped for. Orbitfarm, an invented earth observation company for cropping, does both with 2.2 million dollars of signed data contracts and a five date timeline.
Want the steps in the builder? Read Make a pitch presentation with AI, then Add charts, maps and diagrams to slides. For everything this generator can do, see the presentation maker.
Written and checked by the OneCraft team. Last checked .