How to start, grow & sell a cyber-security company
Synopsis
Between the two of us, we’ve started, scaled, and sold multiple cybersecurity consulting businesses across the Australian market. We’ve seen the full lifecycle—twice over. And today, we’re here to share the playbook: what actually works when building a cybersecurity consulting firm with real value, and how to get a return on the hard work.
While a large proportion of attendees at AISA CyberCon are consultants, some of whom are running their own business, many others wishing they were, along with cyber security start ups, there is relatively little content specifically for them. This will be the first time this presentation has been delivered, and will clearly talk through the challenges in building and selling cyber security businesses in Australia.
Mixed in will be some funny (and amazing) anecdotes of the crazy things that happen over 20 years running cyber security consulting firms, from being given USB drives by an Iranian officer, to presenting at conferences with an audience of one solitary person, to having major banks ask us to take over a botnet for testing purposes.
Topics will include:
This presentation is one-of-one. Nothing else on the AISA CyberCon agenda will be like it; and given our experience, nobody else is better placed to deliver it. Come and join us to learn how to start, build and sell a cyber security business in Australia.
Core Themes
- Start with the end in mind: design for an exit from day one.
- Clarity and credibility: prove differentiation with evidence, not slogans.
- Operational discipline: utilization, team shape, and clean back office drive valuation.
- Timing matters: sell into consolidation, on a growth trajectory.
- Human factors: talent, culture, and mental health are as critical as finance.
The speakers have sold businesses twice—first over 10 years, then again in 3.5 years—and share their learnings and insights, including mental health realities and market cycles.
Market Context: Tailwinds vs Headwinds
- Tailwinds: Cyber demand is booming; regulation drives spend; big‑four reputational issues; breaches sustain urgency.
- Headwinds: Funding is tight unless you say AI; crowded market; presence of charlatans; customers struggle to differentiate providers.
- Core implication: You need sharp positioning, clear differentiation, and a low‑risk buyer narrative.
Why You: Differentiation and Positioning
- Anyone can “start a company,” but few can answer why you.
- Differentiation examples: research pedigree, specialized labs/certifications, disruptive pricing/models, platforms (e.g., Security Colony).
- Make your choice defensible: ensure a client can explain to their board why you were the low‑risk provider.
Economics of consulting
- Simple inputs: people count × rate × utilization. Execution is hard.
- Utilization tradeoffs: research time is “borrowed revenue” repaid later via product/IP.
- Cost envelopes: employees often ~40–50% of revenue; contractors can push ~80%.
- Rate stagnation vs rising wages squeezes margins.
- Team shape: a “diamond” model with 3–5 year consultants as the engine room optimizes sellability and margin.
- Interesting excel spreadsheet showing gross margins. Their strategy was to have high rates so less sensitivity to utilisation
Product vs Consulting: Different Games
- Unicorn path demands venture funding, focus on growth over profit, and channel strategy.
- Hybrid models attract investor pressure to shut consulting to focus on product.
- If your goal is a sale in $10–100M range, optimize for resilient consulting economics and strategic fit.
Sales and Marketing
- Sales models: dedicated sales team vs consultant‑led selling; channels for product.
- Buyers often want to talk to consultants to define the actual solution.
- Messaging: tone must match your brand; edgy, informal language is harder but can attract the right talent and clients.
- Use deliberate language to magnetize the audience you want.
Talent Strategy
- Identify rough diamonds and under‑represented candidates; train and invest.
- Flexibility (e.g., return‑to‑work parents) unlocks high-caliber talent.
- Culture is lived behavior under stress, not swag or posters.
- Being different in hiring and hiring for culture was central to success.
- Looked for people who "gave a shit" about what they did - that sometimes meant meetings about what felt like small issues
Back Office, Metrics, and Culture
- Set up basics quickly; favor extensible tools over perfection.
- Metrics should guide where to look, not dictate behavior; avoid vanity metrics.
- Culture is how decisions are made in hard times and what people believe they’re building.
When and How to Sell
- Australian market cycles between consolidation and fragmentation; we’re near the top of consolidation—historically a good time to sell.
- Typical deal sizes: most cyber acquisitions are under $100M.
- Valuations: consulting often sells on EBITDA multiples (~5–8x); true SaaS sells on revenue multiples.
- Expect earn‑outs and retention periods; domestic buyers mix cash/script, international favor cash.
Maximizing Value
- Ownership concentration matters; employee base valued over contractors.
- Bigger, more resilient revenue and diversified client concentration improve value.
- Sell on the upswing with consistent multi‑year growth; “hockey stick” forecasts are hard to defend.
- Due diligence is exhaustive—keep cap table clean, agreements in order, and records tight.
Post‑Sale Realities
- Emotional rollercoaster is real; mundane life continues despite the milestone.
- Acquirer changes (logos, budgets, culture) can feel personal; core culture will evolve.
- Recognize the founder’s dilemma early to protect mental health.
Core Themes
- Start with the end in mind: design for an exit from day one.
- Clarity and credibility: prove differentiation with evidence, not slogans.
- Operational discipline: utilization, team shape, and clean back office drive valuation.
- Timing matters: sell into consolidation, on a growth trajectory.
- Human factors: talent, culture, and mental health are as critical as finance.
The speakers have sold businesses twice—first over 10 years, then again in 3.5 years—and share their learnings and insights, including mental health realities and market cycles.
Market Context: Tailwinds vs Headwinds
- Tailwinds: Cyber demand is booming; regulation drives spend; big‑four reputational issues; breaches sustain urgency.
- Headwinds: Funding is tight unless you say AI; crowded market; presence of charlatans; customers struggle to differentiate providers.
- Core implication: You need sharp positioning, clear differentiation, and a low‑risk buyer narrative.
Why You: Differentiation and Positioning
- Anyone can “start a company,” but few can answer why you.
- Differentiation examples: research pedigree, specialized labs/certifications, disruptive pricing/models, platforms (e.g., Security Colony).
- Make your choice defensible: ensure a client can explain to their board why you were the low‑risk provider.
Economics of consulting
- Simple inputs: people count × rate × utilization. Execution is hard.
- Utilization tradeoffs: research time is “borrowed revenue” repaid later via product/IP.
- Cost envelopes: employees often ~40–50% of revenue; contractors can push ~80%.
- Rate stagnation vs rising wages squeezes margins.
- Team shape: a “diamond” model with 3–5 year consultants as the engine room optimizes sellability and margin.
- Interesting excel spreadsheet showing gross margins. Their strategy was to have high rates so less sensitivity to utilisation
Product vs Consulting: Different Games
- Unicorn path demands venture funding, focus on growth over profit, and channel strategy.
- Hybrid models attract investor pressure to shut consulting to focus on product.
- If your goal is a sale in $10–100M range, optimize for resilient consulting economics and strategic fit.
Sales and Marketing
- Sales models: dedicated sales team vs consultant‑led selling; channels for product.
- Buyers often want to talk to consultants to define the actual solution.
- Messaging: tone must match your brand; edgy, informal language is harder but can attract the right talent and clients.
- Use deliberate language to magnetize the audience you want.
Talent Strategy
- Identify rough diamonds and under‑represented candidates; train and invest.
- Flexibility (e.g., return‑to‑work parents) unlocks high-caliber talent.
- Culture is lived behavior under stress, not swag or posters.
- Being different in hiring and hiring for culture was central to success.
- Looked for people who "gave a shit" about what they did - that sometimes meant meetings about what felt like small issues
Back Office, Metrics, and Culture
- Set up basics quickly; favor extensible tools over perfection.
- Metrics should guide where to look, not dictate behavior; avoid vanity metrics.
- Culture is how decisions are made in hard times and what people believe they’re building.
When and How to Sell
- Australian market cycles between consolidation and fragmentation; we’re near the top of consolidation—historically a good time to sell.
- Typical deal sizes: most cyber acquisitions are under $100M.
- Valuations: consulting often sells on EBITDA multiples (~5–8x); true SaaS sells on revenue multiples.
- Expect earn‑outs and retention periods; domestic buyers mix cash/script, international favor cash.
Maximizing Value
- Ownership concentration matters; employee base valued over contractors.
- Bigger, more resilient revenue and diversified client concentration improve value.
- Sell on the upswing with consistent multi‑year growth; “hockey stick” forecasts are hard to defend.
- Due diligence is exhaustive—keep cap table clean, agreements in order, and records tight.
Post‑Sale Realities
- Emotional rollercoaster is real; mundane life continues despite the milestone.
- Acquirer changes (logos, budgets, culture) can feel personal; core culture will evolve.
- Recognize the founder’s dilemma early to protect mental health.