Founder of Group-IB: “Only two limited resources remain in the world - time and health”

The Russian company Group-IB received investments from Altera and Run Capital funds. In exchange, each of the funds received 10% of the company. The Kommersant publication writes that Group-IB has been looking for buyers for a stake in 20% of the company for more than a year.

Group-IB creates services for information security, helps law enforcement agencies investigate incidents on the Internet, and helps copyright holders protect their copyrights for brands and other data.

A year and a half ago, the company negotiated with the Internet Initiatives Development Fund (IIDF). In April 2015, the IIDF expressed its willingness to invest 210 million rubles in the project. However, the transaction did not take place for several reasons: the devaluation of the ruble reduced the company's valuation, and IIDF, moreover, demanded to “pack” the company's services in “boxed products”.

In a previous interview, the founder and CEO of Group-IB, Ilya Sachkov, told us how he managed to create a company that in 10 years has become a leader in the Russian information security market.

This time we talked with Ilya to learn more about the development plans of the company with new investments, the specifics of the cybersecurity market and the investigation of high-tech crimes in the modern world.

1. Do you find the cybersecurity market special in terms of seeking investment?

Just because there are few good cybersecurity experts in the world, there are fewer expert funds or strategic funds than, for example, for the mobile application market.
In Russia, such funds can be counted on the fingers of one hand. And this despite the fact that information security in the new world has become an integral element of any business, part of the life of any person.

2. "Ilya Sachkov calls IIDF one of those strategists with whom Group-IB is friends and collaborates." Do you think that the terms of the deal with IIDF are an obstacle in your way? How should these conditions change in order to “make life easier” for Group-IB?

IIDF is one of the few funds not only in Russia but also in Europe with an excellent expert team (both in the field of investment expertise and information security) and professional management. We continue to negotiate the terms of the transaction and in the near future we will have news on this topic.

3. What do you think of Group-IB over pricing? What do you think: why did some experts have such an opinion?

I touched a little experts in the first question. There are about 10 good investment experts in Russia in the information security market. Most of them work in the funds with which we made a deal. In general, there is a classical problem that is well described by Kahneman in his Nobel work: people (including those who call themselves experts) tend to make erroneous judgments based on insufficient data to make a decision.

Over the past 7 years, we have been closely following the investment market in our area and we can immodestly say that no one in Russia has such an in-depth analysis of similar transactions, competitors, and competitive technologies.

And in order to draw conclusions about whether the rating is overestimated or not, you need to have answers to the following questions (otherwise, comments about the overestimation of the company are “answer with your finger in the sky”):

a) In which segment of the information security market does Group-IB operate? How fast is this segment growing and how much is the growth rate of this segment ahead of the growth of the information security market as a whole?

b) How many transactions do you know about Russian companies in this segment that export products to the USA, Europe, Asia and the Middle East and continue to operate in Russia and the CIS? What were the parameters of the transaction?

c) What transactions for competing companies can you name, for example, in the USA or Europe? What was the assessment of these transactions and by what parameters? Why did they pass on such estimates?

(Look at the deals Return Path, Stroz Friedberg, Threatmetrix, Ovation, NetNames, Markmonitor, Seculert, Lifelock, Blueliv, Fox-IT, iSightPartners)

d) Which of the world's companies are in the list of technology leaders, for example, according to Gartner?

With our track record (both for services and products), the presence of popular and already-sold technologies in the West, we consider the rating to be adequate.

Group-IB became known thanks to high-tech crime investigations - our ability to answer the question: why did the incident happen, who is to blame and how to gather evidence for a court. This is a difficult and very professional job.

Based on this expertise, we built a line of products for the early detection of cyberthreats and became the only Russian company included in the Gartner reports in the Threat Intelligence segment. It is no coincidence that at the very height of the political crisis between Russia and the West, we are signing an agreement with Europol, and our Bot-trek products are sold in the USA and Europe.

Only two limited resources remain in the world - time and health. With our Bot-trek technologies, we give customers the most scarce resource - time (and in fact health, because we don’t allow an incident), the opportunity to learn about the threat as early as possible and prepare for it, guided by our recommendations. Unlike regular software, time is an understandable value for a manager: CISO, CIO, CTO, CEO, regardless of location and company profile. And this is confirmed by our customers from Europe, China, Australia and the USA.

Here are just a few facts about Group-IB:

- We take part in the investigation of the most complex computer crimes and use the knowledge gained in our products. This combination of competencies (the presence of an investigation unit, the presence of a forensic laboratory, the presence of an accredited CERT) is found in no more than 20 companies around the world. Now the Group-IB team has more than 150 people - developers, forensic experts, analysts, big data and world-class correlations.

- Already today, the Bot-Trek Intelligence cyber intelligence system is among the 7 best sources of Threat Intelligence according to Gartner.

- Over 2 years of the Bot-Trek TDS targeted attack detection system in more than 100 banks and enterprises, we have not missed a single threat.

- Bot-Trek solutions have already prevented damage of at least $ 75 million. Our goal is to make the Bot-Trek cyber threat prevention system global. To do this, every year we increase the number of unique data sources in key regions of the origin of threats, we hire forensic experts and analysts.

4. Who are your main competitors? By what parameters are your technologies ahead of competing?

FireEye (along with Isight partners and Mandiant), iDefence, Cyvelience, Markmonitor, BrandProtect, Stroz Friedberg, BlackCube, IBM and about 20-30 interesting companies. Most of which are in the USA and Israel. With some of them we will unite in the near future. In some areas, we still need to catch up with competitors, but we have no equal in the analysis of local threats. For example, the flagship product FireEye in Russia misses some threats that Bot-trek easily catches.

5. What needs to be emphasized in order to successfully compete in foreign markets: marketing, technology, business model?

In my opinion, the key to success is outstanding technologies, “packaged” into a product that solves the real problem of the client. And the team structured for growth. In security, marketing often takes on the function of generating the first contact with the customer, brand support, but the decision to purchase is made primarily through the analysis of technologies and teams.

After all, if an incident occurs - the buyer should answer, and as we know from the statistics of recent years - computer crimes have become a real economic problem for any type of modern business.

Companies steal money from companies, usurp their brand, steal intellectual property and customer bases, encrypt computers with valuable information. Therefore, technologies, those people who make them and the speed of implementation, response allow you to compete well in any market.

*********

In Russia, Sberbank, Alfa-Bank, Rostec, Megafon and other large companies use the services of Group-IB.

In February 2015, when Group-IB managers bought out a 50% stake in the company from the Leta Group fund, Ilya Sachkov spoke about plans to raise $ 20 million, estimated at $ 80-100 million for the whole company.



With new co-owners, the company receives "smart money", Ilya Sachkov is sure. Altera Capital has expertise in the US information security market, and Run Capital “is well versed in how the financial industry works,” he previously explained to Kommersant.

Investments will be directed to the development of analytical centers in the Middle East, Southeast Asia and Latin America, the hiring of local forensics, as well as international sales, specified in Group-IB. In particular, in 2017, the company plans to open an analytical center in Thailand.