Founder of Group-IB: “There are only two limited resources left in the world - time and health”

The Russian company Group-IB received investments from the funds of Altera and Run Capital. In exchange, each of the funds received 10% of the company. The Kommersant publication writes that Group-IB has been looking for buyers for a 20% stake in the company for more than a year.

Group-IB creates services for information security, helps law enforcement agencies in investigating incidents on the Internet, and also helps copyright holders to protect their copyright on brands and other data.

A year and a half ago, the company negotiated with the Internet Initiatives Development Fund (IIDF). In April 2015, FRIA expressed its willingness to invest 210 million rubles in the project. However, the transaction did not take place for several reasons: the devaluation of the ruble reduced the company's valuation, and the IIDF, moreover, demanded to “pack” the company's services into “boxed products”.



In the past interview with the founder and CEO of Group-IB, Ilya Sachkov told us how he managed to create a company that for 10 years has become a leader in the Russian information security market.

')

This time we talked with Ilya to learn more about the company's development plans with new investments, the specifics of the cybersecurity market and the investigation of high-tech crimes in the modern world.



1. Do you consider the cybersecurity market special in terms of seeking investment?



Only by the fact that there are few good experts on cyber security in the world, as well as expert funds or strategic funds less than, for example, for the mobile application market.

In Russia, such funds can be counted on the fingers of one hand. And this is despite the fact that information security in the new world has become an integral part of any business, a part of the life of any person.



2. "Ilya Sachkov calls the IIDF one of those strategists with whom Group-IB is friends and cooperates." Do you think that the terms of the deal with IIDF are an obstacle in your way? How should these conditions change to make life easier for Group-IB?



IIDF is one of the few funds not only in Russia, but also in Europe with an excellent expert team (both in the field of investment expertise and information security) and professional management. We continue to negotiate the terms of the transaction and in the near future we will have news on this topic.



3. What do you think about the overvaluation of Group-IB? What do you think: why did some experts have such an opinion?



I touched upon the experts a bit in the first question. In the information security market, there are 10 good investment experts in Russia. Most of them work in funds with which we have made a deal. In general, there is a classic problem that Kaneman described well in his Nobel work: people (including those who call themselves experts) tend to make erroneous judgments, relying on the amount of data insufficient for decision making.



For the last 7 years, we have been closely following the investment market in our direction and we can immodestly say that no one in Russia has such a deep analysis of similar transactions, competitors, or competitive technologies.



And in order to draw conclusions about whether the assessment is overestimated or not, you need to have answers to the following questions (otherwise, comments about the company's overestimation are the “answer to the sky with your finger”):



a) In which segment of the information security market does Group-IB operate? How fast is this segment growing and how much does the growth rate of this segment outpace the growth of the information security market as a whole?



b) How many transactions do you know about Russian companies in this segment that export products to the USA, Europe, Asia and the Middle East and continue to work in Russia and the CIS? What are the parameters of the transaction?



c) What transactions by company competitors can you name, for example, in the USA or Europe? By what assessment did these transactions take place and by what parameters? Why did they pass on such estimates?



(Look at the Return Path deals, Stroz Friedberg, Threatmetrix, Ovation, NetNames, Markmonitor, Seculert, Lifelock, Blueliv, Fox-IT, iSightPartners)



d) Which of the world companies is in the list of leaders in technology, for example, according to Gartner?



With our track record (both in services and products), the presence of popular and already sold technologies in the west, we consider the assessment adequate



Group-IB became known for investigating high-tech crimes — our ability to answer the question: why the incident occurred, who was to blame, and how to put together an evidence base for the trial. This is a difficult and very professional job.



Based on this expertise, we built a product line for the early detection of cyber threats and became the only Russian company included in the Gartner reports in the Threat Intelligence segment. It is not by chance that in the midst of the political crisis between Russia and the West, we sign an agreement with Europol, and our Bot-trek products are sold in the United States and Europe.



There are only two limited resources left in the world - time and health. With our Bot-trek technologies, we give our customers the most scarce resource - time (and in fact health, because we do not allow the incident), the opportunity to learn about the threat as early as possible and prepare for it, guided by our recommendations. Unlike the next software, time is a clear value for a manager: CISO, IO, TO, CEO, regardless of location and company profile. And this is confirmed by our customers from Europe, China, Australia and the USA.



Here are a few facts about Group-IB:



- We take part in the investigation of the most complex computer crimes and use the knowledge gained in our products. This combination of competencies (presence of an investigation unit, presence of a forensic laboratory, accredited CERT) is found in no more than 20 companies around the world. Now there are more than 150 people in the Group-IB team - developers, experts in forensic science, analytics, big data and world-class correlations.



- Even today, the Bot-Trek Intelligence cyber prospecting system is among the 7 best sources of Threat Intelligence according to Gartner.



- For 2 years of operation of the Bot-Trek TDS target attacks detection system in more than 100 banks and enterprises, we did not miss a single threat.



- Bot-Trek solutions have already prevented damage of at least $ 75 million. Our goal is to make the Bot-Trek global cyber threat system global. To do this, every year we increase the number of unique data sources in key regions of origin of threats, hire criminologists and analysts.



4. Who are your main competitors? What are the parameters of your technology ahead of competing?



FireEye (along with Isight partners and Mandiant), iDefence, Cyvelience, Markmonitor, BrandProtect, Stroz Friedberg, BlackCube, IBM and about 20-30 more interesting companies. Most of them - in the United States and Israel. With some of them we will be united in the near future. In some areas we still need to catch up with competitors, but we have no equal in the analysis of local threats. For example, the flagship product FireEye misses out on Russia some threats that Bot-trek easily catches.



5. What needs to be done to compete successfully in foreign markets: marketing, technology, business model?



In my opinion, the key to success is outstanding technologies “packaged” into a product that solves a real customer problem. And sharpened growth team structure. In security, marketing often assumes the function of generating first customer contact, brand support, but the decision to purchase is made primarily through the analysis of technology and teams.



After all, if an incident happens - to answer the buyer, and as we know from the statistics of recent years - computer crimes have become a real economic problem for modern business of any type.



Companies steal money, usurp their brand, steal intellectual property and customer bases, encrypt computers with valuable information. Therefore, technology, the people who make them and the speed of implementation, the response can compete well in any market.



*********



In Russia, Sberbank, Alfa-Bank, Rostec, Megafon and other large companies use the services of Group-IB.



In February 2015, when Group-IB managers bought 50% of the company's shares from the Leta Group fund, Ilya Sachkov spoke of plans to raise $ 20 million at an estimated $ 80-100 million for the entire company.







With new co-owners, the company receives “smart money”, Ilya Sachkov is sure. Altera Capital has expertise in the US information security market, and Run Capital “is well versed in how the financial industry works,” he explained earlier to Kommersant.



Investments will be directed to the development of analytical centers in the countries of the Middle East, Southeast Asia and Latin America, the hiring of local criminologists, as well as international sales, specified in Group-IB. In particular, in 2017, the company plans to open an analytical center in Thailand.