Vulnerable U

What Vulnerable U does

Vulnerable U (DBA: VulnU) is a cybersecurity-focused media company built around a weekly newsletter authored and curated by founder Matt Johansen. Founded in 2021 and operating from Austin, Texas with a five-person team, the company distributes curated security news, vulnerability disclosures, tool reviews, and industry analysis to over 32,000 email subscribers and 270,000 combined social followers across Twitter, LinkedIn, Instagram, TikTok, and YouTube. The newsletter is built on the beehiiv publishing platform and reports engagement metrics that materially exceed industry baselines (44% open rate vs. 20-25% industry average; 10-12% click-through rate). The audience is concentrated in the cybersecurity practitioner and executive community, spanning CISOs, startup founders, security engineers, and ethical hackers.

The product portfolio centers on the Vulnerable U newsletter as the core product, with two recently added or expanded offerings: 'The Low Down' podcast co-produced with Low Level TV (launched 2026), and a sponsored video content service where Matt Johansen records product demos and announcements for distribution across his personal social accounts. The company's competitive positioning rests on Johansen's 20+ years of cybersecurity experience, ongoing conference presence at BlackHat and DEFCON, and a curated editorial voice that has produced 180+ newsletter editions.

Vulnerable U is bootstrapped and founder-owned, with no disclosed institutional funding, venture capital, or external investment. The business model is entirely sponsorship-driven: revenue derives from primary and secondary newsletter ad placements and sponsored video content, with bulk sponsorship discounts available. Customers are B2B cybersecurity vendors (Intruder, Root Evidence, Kusari, Opal Security, Varonis, Secure Agentics, Databricks, Maze) that purchase access to the engaged subscriber and social audience. The subscriber base is free; the company does not charge readers and does not offer standalone software products, APIs, or AI-powered features.

Name

Vulnerable U

Legal name

Vulnerable U

Website

https://vulnu.com

Company type

Private

Founded year

2021

Operating status

Operating

Headcount range

1–10 employees

Short description

Vulnerable U (VulnU) is a bootstrapped cybersecurity media company operating a weekly newsletter and podcast authored by founder Matt Johansen, serving 32,000+ CISOs, security practitioners, and founders with curated news, vulnerability analysis, and sponsored video content.

Ownership category

akta.pro rank

Headquarters

HQ city

Austin, Texas

HQ country

United States

HQ region

North America

Markets served

GTM type

B2C

Offering type

Digital Commerce or Content

Cost components

Personnel, Marketing or Sales, Technology or R&D, Operations

Revenue model

1. Newsletter Sponsorships: Primary and secondary sponsorship slots within the weekly newsletter. Primary sponsors receive logo placement at the top, a 'brought to you by' mention, native ad in the News section, 400-600 character copy with inline link, and social promotion. Secondary sponsors receive shorter 200-400 character blurbs placed later in the News section with only a title link.
2. Sponsored Video Content: Matt Johansen creates sponsored video content featuring product announcements or demos, distributed across his personal Instagram, TikTok, and YouTube accounts. Sponsors can share reports, announce events, publish open positions, or other promotional content to the engaged audience.

Pricing tiers

Go-to-market motion1 record

Distribution channels1 record

Marketing channels8 records

Core offering

Vulnerable U publishes a free weekly cybersecurity newsletter covering news, vulnerability disclosures, tools, and industry analysis for CISOs, founders, and security practitioners, distributed via the beehiiv platform to 32,000+ subscribers. The business is monetized through newsletter sponsorships (primary and secondary ad slots) and sponsored video content featuring product demos distributed across the founder's personal social media accounts, alongside a co-hosted podcast called The Low Down with Low Level TV.

Product overview

Vulnerable U is a cybersecurity newsletter and media company built around a single core product: the weekly Vulnerable U Newsletter written by Matt Johansen. The portfolio consists of the newsletter itself (distributed to 34,000+ subscribers and promoted across 270K social followers), The Low Down podcast co-hosted with Low Level TV, and sponsorship-based monetization through newsletter ads and sponsored video content. The newsletter covers breaking security news, vulnerability disclosures, and industry analysis, serving CISOs, founders, and security professionals. The company operates on the beehiiv platform and does not offer standalone software products, APIs, or AI-powered features.

Differentiator

Problem solved

Functional benefit

Products and services

• Vulnerable U Newsletter Free weekly cybersecurity newsletter covering breaking security news, vulnerability disclosures, tool reviews, and industry analysis for CISOs, founders, change-makers, and security professionals. Distributed via the beehiiv platform to over 32,000 subscribers with a 44% open rate and 10-12% click rate.
• The Low Down Podcast Weekly podcast co-hosted by Matt Johansen with Low Level TV covering cybersecurity topics, featuring interviews with industry experts and live recordings at events such as BlackHat and DEFCON. Distributed on YouTube, Apple Podcasts, and Spotify.
• Newsletter Sponsorships Paid sponsorship slots inside the weekly Vulnerable U newsletter sold to cybersecurity vendors and service providers. Includes Primary Sponsorship (logo at top, 400-600 character copy body, inline CTA link, social promotion on VulnU announcements) and Secondary Sponsorship (200-400 character copy body, title link only, no social promotion), with discounts available for bulk and multi-year contracts.
• Sponsored Video Content Custom video content production service where Matt Johansen walks through a sponsor's product announcement or demo to an audience of 180,000+ security enthusiasts, distributed across his personal Instagram, TikTok, and YouTube accounts. Sponsors can share reports, announce events, publish open positions, or distribute other promotional content. Average views/impressions of 17,300 and average interactions of 1,000 per piece.

Quantifiable outcome

• 44% email open rate (industry average for newsletters is typically 20-25%)
• +2 more outcomes

Segments4 records

Ideal customer profiles2 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Partnerships

Nine partnerships are on record, tiered regular, flagship and launch_partner.

• IntruderregularGTM or Marketing PartnerCybersecurity company providing sponsored content about cloud security topics. Their sponsored posts appear in Vulnerable U newsletter editions covering cloud security index and AI's impact on defender tools.
• Root EvidenceregularGTM or Marketing PartnerSponsor providing content about evidence-based security decisions and vulnerability management platform. Featured in newsletter editions discussing cyber insurance and breach data.
• KusariregularGTM or Marketing PartnerSoftware supply chain security company (creator of Chainguard). Sponsor providing case study content about healthcare payer zero-day response.
• Opal SecurityregularGTM or Marketing PartnerIdentity security company providing sponsored content about access reviews and privileged access management. Multiple sponsored placements across newsletter editions.
• VaronisregularGTM or Marketing PartnerData security company sponsoring CTF (Capture The Flag) challenges and threat hunting content, including 'Breach at the Beach' campaign.
• Secure AgenticsregularGTM or Marketing PartnerLondon-based AI security startup offering Adrian, an open-source runtime security harness for AI agents. Featured as sponsor discussing prompt injection and agent security.
• DatabricksregularGTM or Marketing PartnerData and AI company sponsoring content about eliminating standing access for engineers. Case study featured on how Databricks scaled identity management.
• Low Level TVflagshipStrategic or Co-development PartnerMedia partnership for 'The Low Down' podcast co-hosted by Matt Johansen and Low Level. Weekly podcast with occasional guest interviews, filmed for YouTube and available on major podcast platforms.
• Mazelaunch_partnerGTM or Marketing PartnerAI security company serving as launch partner for The Low Down podcast. Featured sponsor supporting the new podcast venture.

Scale indicators6 records

Recent moves5 records

Expansion highlights5 records

Direct peers

• Risky Bulletin: Weekly cybersecurity news bulletin tied to the Risky Business podcast, covering enterprise security news and analysis. Closely comparable in format (weekly curated briefing), audience (security leaders), and sponsorship-supported model.
• tl;dr sec: Weekly curated security newsletter aggregating the most important practitioner-focused content. Most comparable peer in terms of format, audience (security engineers), and one-person operator scale.
• Darknet Diaries: Cybersecurity-focused podcast hosted by Jack Rhysider covering hacks, threat actors, and security culture. Comparable as a personal-brand-driven security media property with similar content style and conference-circuit (BlackHat/DEFCON) overlap.
• Krebs on Security: Investigative cybersecurity blog and newsletter by Brian Krebs, run as a personal brand covering breaches, cybercrime, and security research. Closely comparable as a solo-practitioner cybersecurity media property built on personal credibility.
• SANS NewsBites: Bi-weekly curated security news digest from the SANS Institute, targeting security professionals with summaries of major incidents and vulnerabilities. Comparable in curated newsletter format and security professional audience, though backed by a large institution.
• The CyberWire: Daily cybersecurity podcast and newsletter network delivering curated security news to practitioners and executives. Direct competitor in the same content format, audience segment, and sponsorship-driven monetization model.

Broad incumbents

• The Hacker News: Major cybersecurity news portal covering breaches, vulnerabilities, and cyber threats with global audience reach. Competitor for cybersecurity vendor sponsorship dollars though broader and less curated than Vulnerable U.
• SecurityWeek: Long-running cybersecurity news site covering breaches, vulnerabilities, and industry developments with broad executive and practitioner readership. Overlaps in audience and advertiser base but operates at much larger scale.
• Bleeping Computer: Cybersecurity news and technical support site covering vulnerabilities, malware, and breach analysis. Operates a newsletter product targeting security professionals, comparable in audience and content scope though much larger in staff and scope.
• Dark Reading: Established cybersecurity news and analysis site with deep practitioner reach, operated by Informa Tech. Competes for the same audience and sponsor attention but as part of a much larger media portfolio.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xtwitter.com/mattjay
• YouTubeyoutube.com/@lowdownpod
• LinkedInlinkedin.com/company/vulnerable-u
• Instagraminstagram.com/vulnu
• TikToktiktok.com/@mattjay

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Vulnerable U