CyberSmart raises $15 million for an all-in-one cybersecurity and insurance solution targeting SMBs

Cybersecurity continues to be a major investment area for businesses, and today, a startup developing solutions for small businesses is announcing a funding round to meet that demand. CyberSmart – a UK startup that has built an all-in-one platform providing cybersecurity technology for small and medium-sized businesses, and cyber insurance if things go wrong anyway – closed a Series B of 12, £75 million ($15.4 million).

CyberSmart currently has 4,000 customers in the UK, 1,800 of whom also take out the company’s insurance policies – the tip of the iceberg in a market of 5.5 million small and medium-sized enterprises (SMEs) in total – but Jamie Akhtar, the co-founder and CEO, said there’s a lot of interest and it’s about meeting that demand right now, so the plan is to use the funding to keep going to develop its product, to eventually make acquisitions and to expand its distribution partners and customers, in its home market as well as further afield in Europe, Australia and New Zealand.

The funding is led by Oxx – the European VC that focuses on growth cycles for SaaS startups – with participation from strategic and interesting backers. These include British Patient Capital (commercial subsidiary of the UK government’s British Business Bank), Legal & General Capital (affiliate with the insurance giant) and Solano Partners; Previous backers IQ Capital, Eos Venture Partners, Winton Ventures and Seedcamp are also participating. The company previously raised £8m and is not disclosing its valuation with this round, but Akhtar said it was oversubscribed.

Investor and customer interest in a company like CyberSmart speaks to a bigger shift we’ve seen in the marketplace. Small and medium-sized businesses were once overlooked when it came to cybersecurity. This was for a combination of reasons: criminals typically focused their attention on the biggest targets like the biggest prizes, SMBs aren’t known to be big spenders on IT, and for these reasons, companies are building the most interesting cybersecurity technology. didn’t focus on them as use cases and target customers.

This has changed a lot over time. Not only do cybercrime incidents continue to grow – up 38% in 2022 globally, Checkpoint Research estimates – but SMBs have become a prime target for these attacks, accounting for 58% of them, according to a study by 2019 from the Global Cyber ​​Alliance.

Consequently, the small and medium business segment has increasingly become a target for those building cybersecurity solutions. This includes others like Cowbell and Guardz that mix security and assurance propositions, as well as those focused purely on technology, and specifically on types of security incidents, like ActZero and its focus on ransomware in particular. .

“SMBs are notoriously underprotected against the growing cyber threat, and existing cybersecurity and insurance proposals are neither fit for purpose nor affordable,” Phil Edmondson-Jones, partner at Oxx, said in a statement. “We spent a lot of time looking for the right business model that can bring about a step change in this important and huge market. CyberSmart’s leading small business security product; combined with its unique ability to collect “backside” data on real-time risk indicators, will propel the company to become a central part of the cyber protection and insurance infrastructure. We are excited to support CyberSmart and its exceptional team in driving urgent market adoption and rapid international expansion. He also joins the board with this round.

Many activities may be new, but CyberSmart itself is not: the company is actually six years old and therefore is somewhat of an early adopter of identifying and targeting SMEs with the technology. of cybersecurity. The startup was first incubated in an accelerator run by GCHQ, the UK’s equivalent of the NSA, Akhtar built the company from his own experience after working for more than a decade in cybersecurity in d other companies.

“I could see that SMB security was broken,” he said. “Many of them were unaware of the cyber risks, and they didn’t have the tools and resources to deal with them anyway. We approached the problem from this angle.

The product is aimed directly at the ‘S’ end of SMEs (or SME as it is commonly referred to in the UK), with average customer sizes between 10 and 50 employees, and no plans to expand to much larger companies, the middle market, or whatever. And its main sales route matches the market that CyberSmart has identified and understands: it sells primarily through channel partners, who consult small businesses on their overall IT needs, sell them hardware and software packages in As part of this, CyberSmart supports the security element of this offering.

“As cyberattacks become increasingly sophisticated, so must the technology needed to protect against them. For many SMBs, this is a difficult challenge to overcome, either due to financial constraints or due to a lack of in-house expertise,” added Catherine Lewis La Torre, CEO of British Patient Capital. “CyberSmart was created to solve this problem, providing not only affordable and easy-to-use cyber protection, but also training, certification and insurance.We are delighted to support such a dynamic and ambitious company in its growth journey.

This security element comes in the form of its flagship product Active Protect, which Akhtar describes as a “basic” security tool that can be installed and used without the need for IT experts to integrate or install it. manage. Active Protect is distributed to staff via a link, which can be downloaded to any device used on a company’s network, and after installation provides continuous monitoring, with proactive information and guidance when it is detects any type of suspicious activity, urges people to undergo training to be more aware and vigilant of typical attack vectors (e-mail phishing being one of the most common that occurs, for example) boils down to humans making audio calls). It describes its focus as “most common” vulnerabilities.

At the same time, CyberSmart has developed an insurance product in partnership with Aviva and Superscript. It comes with Active Protect, but it only takes effect once a user has followed all instructions to secure devices, address security issues when identified, and complete training when recommended .

The goal here is twofold: Akhtar believes that many SMBs typically don’t buy cyber insurance because of the premiums, so offering something as a free add-on will entice more people to sign up for its security product. But in addition to cost, Akhtar believes that many cyber insurances aimed at the SMB market are a tough sell due to the relatively strict parameters that must be met for support. Tying it directly to how a security policy is managed makes the most sense. (Those are probably two big reasons why we see a number of other companies also bundling cybersecurity solutions with insurance.)

Notably, Akhtar tells me that since the company launched the insurance product over a year ago, there hasn’t been a single claim against it – a sign, he says, that the insurance formula his startup is working as it should.

Yet there are gaps in what CyberSmart offers the market – for example, if the most common vulnerabilities are patched, isn’t it just a matter of time before hackers start attacking SMBs with increasingly sophisticated approaches? And if the primary approach to remediation currently is to provide guidance to a company’s team of human employees, is it possible to complement this as well with more automated approaches or technologies capable of countering more sophisticated attacks? ? These are areas where CyberSmart will likely build more technology itself or bring additional functionality through acquisitions.

On the acquisitions front, Akhtar noted that his own fundraising journey this time around really laid bare the state of the market right now. “I spoke to hundreds of VCs over nine months,” he told me (and if I was asked to use one emoji to describe his expression at the time, it would be the face with the slightly worried smile and the bead of sweat running down the side: ).

In the case of CyberSmart, he said part of that was also down to him and his team being selective and looking for partners who could help grow the business, not just bank account growth. . But more generally, it underscores how difficult it is currently to close rounds for many companies, and there will be up-and-coming technologists who lack leads or receive poor funding offers, who might be willing to sell instead. at a lower price and team up with a partner to develop something together.

Even further, the plan will be to raise a larger Series C to enter the United States, Akhtar said.