Poppy Gustafsson, the cybersecurity chief with a human dilemma
Speaking to a group of investors last year, Poppy Gustafsson said: “An attack, once foiled, must eliminate all tendrils of infection.”
“This is a human-intensive task that is prone to human error and insufficient vigilance,” added the chief executive of cybersecurity group Darktrace, one of the best-known start-ups in the world. UK.
The news this week that tech-focused private equity group Thoma Bravo is considering a bid to take Darktrace private is a vote of confidence in a company that is struggling with some skepticism about its growth prospects as well as the risks. for his reputation, the tendrils of which proved difficult to remove.
Two of its founding investors have been discovered to have fraudulently inflated the value of their company in the biggest such deal in British history.
Mike Lynch and Sushovan Hussain were accused of falsifying facts and financial documents in preparation for an $11 billion sale of Lynch’s software company, Autonomy, to Hewlett-Packard in 2011. Hussain was convicted and sentenced to five years in prison in the United States.
In January, Lynch lost a high-profile civil lawsuit brought by Hewlett Packard Enterprise, with the judge finding civil fraud against him and Hussain. UK Home Secretary Priti Patel has approved the extradition of Lynch – who denies any wrongdoing – to the US to face charges.
Gustafsson charted a course between defending her former colleagues while working to distance herself and the company from Autonomy’s founder and the potential reputational fallout for the association.
She offered written testimony and was cross-examined at Lynch’s civil fraud trial, and she wrote a letter to the judge in defense of Hussain, describing him as a close friend. Darktrace did not respond to a request for comment on its defense.
Lynch, who was director of Darktrace until 2018 and adviser until 2021, still has around £158m in stock.
Tech investor Michael Dimelow said he believed Darktrace’s association with a fraud-tainted framework was “a drag” on the company’s reputation and investor confidence. But he added that Gustafsson was “a solid person” and “seems to have played”.
A career in cybersecurity and a rapid rise through the ranks of British tech was not the obvious destination for Gustafsson. The 39-year-old grew up in Cambridgeshire where her father ran an agricultural sales business and her mother worked as a journalist for Farmers Weekly. After studying mathematics at the University of Sheffield, she trained in accounting at Deloitte.
But it was his next job that would shape his career – a three-year stint as a controller at Autonomy.
Hussain and Lynch and a number of other former Autonomy executives founded Invoke Capital in the summer of 2012, a year after Autonomy’s ill-fated sale to HP. Darktrace was formed the following year by a number of British mathematicians and spies from MI5 and GCHQ. Invoke funded the company and helped bring in former Autonomy employees to run the show.
Hired to be chief financial officer of the fledgling start-up at the age of 30, she was quickly promoted to co-chief executive of Darktrace in 2016, then chief executive in 2020. She received an OBE in 2019 and guided the company thanks to its successful IPO in April last year.
Founded in Cambridge, Darktrace commonly uses the immune system as an analogy to describe its cybersecurity software, which uses artificial intelligence to identify and defeat new threats. The company, whose customers include Rolls-Royce, Drax, the city of Las Vegas and the UK’s NHS, has capitalized on a booming cybersecurity market in recent years.
A former Darktrace employee said Gustafsson “doesn’t believe in hearing about obstacles and then giving up on things.”
A long-time investor in the company described her as “very calculating,” adding, “Poppy isn’t very aggressive — she’s sweet. . . but she ran that sales machine to make it work incredibly well.
Darktrace has seen strong growth over the past five years, with revenue growing from $79.4 million in 2018 to $417 million last year. It now has approximately 7,400 customers, most of which are small and medium-sized businesses.
But not everyone is convinced. Last October, the stock fell after brokerage firm Peel Hunt issued a note saying the company was worth half its market capitalization because the potential market it was targeting was not as big as the company. claimed so.
The news of the preliminary discussions with Thoma Bravo helped her recover. The shares are up 28% since then, while the stock is up 64% since its IPO.
Some remain skeptical. UK hedge fund ShadowFall, which has a short position in the company, also believes that Gustafsson continues to overestimate Darktrace’s potential customer base. Last year, she claimed that more than 150,000 companies would benefit from Darktrace’s Immune System AI software.
“We struggle to make sure Darktrace is investment grade,” said Matt Earl, managing partner at ShadowFall.
Some former employees have criticized what they claim is an aggressive marketing and sales strategy. ShadowFall and its competitors have also questioned why Darktrace spends so much less on research and development than some of its peers.
Rival cybersecurity firm Vectra taunted Darktrace last year in a now-deleted webpage which claimed that “instead of investing in innovation, Darktrace spends on F1 sponsorships and shrewd marketing campaigns”. He added that Vectra spends about 40% of its revenue on R&D, compared to 10% for Darktrace.
A person close to Darktrace noted that the nature of the company’s AI meant it didn’t require a large and expensive group of engineers.
The investor argued that “fuddy duddy UK investors” rarely price tech stocks accurately and that Darktrace was undervalued by the market. They added, “Hopefully the Thoma Bravo thing doesn’t happen because I think there’s more upside, but at least it would wipe their Autonomy slate clean.”