FI Cambridge with Poppy Gustafsson: Building a unicorn startup, growing as a leader, and more.

Hello, hello. Hi everyone, my name is Aaron. I'm just going to give a minute for Zoom to allow people to come in who may be waiting. I'm going to do a little bit of housekeeping, then I'm going to do introductions, and off we go. So hopefully everybody is comfortable and somewhere where they can enjoy a chat, which is essentially all we're going to do is just have a chat.

I'm very comfortable. I'm ready.

I put you on the least comfortable chair in the house. I'm sorry. These are not comfortable chairs. Poppy's being an amazing guest. Thank you. We have about an hour. And so what I'm hoping to achieve in an hour is we'll spend about 45, 50 minutes just having a chat. Got some questions to talk about. We'll do a Q&A and the Q&A will work in the following way. There's a button on the bottom of your Zoom window that says Q&A. You can upvote other people's questions. So if you see a great question, upvote that one instead of putting the same question in again. Then Peter will pass them through to me and we'll be able to— excuse me— we'll be able to discuss them, which would be brilliant. Mark, who's one of the other folks from Founder Institute here in Cambridge, is going to be putting information into the chat. So links and info and things that we talk about, we'll put into the chat so that you have access to that information there. We had planned to do a post-event networking session using Airmeet, which we won't be doing. I'm sorry. We decided that It's just a lot more fun to meet in person. And so we have a networking event here in Cambridge. I'll tell you more about it, and it's at the end of March, which would be brilliant. We hope you can join us for that. Our goal today is just to talk about experience going from zero to a FTSE 250 company and what leadership is and how product and culture and business changes through that journey, 'cause it's a huge journey. What we're not gonna talk about in terms of Darktrace is just what you can get from the news today. We're interested in what it is to be in this company over time so that other founders who are interested in scaling their businesses can lean into the same sets of questions and anticipate challenges and problems and learn from someone who has incredible experience as Poppy does. So really, we're here to help grow our local ecosystem. I am Aaron Johnston. I am one of the co-directors of Founder Institute. I'm joined by Peter Steadman, who's doing production, and Mark Rogers, who's going to be doing stuff into the chat. The 3 of us have established a new chapter of Founder Institute. Founder Institute currently has over 200 chapter cities. So one of the newest ones we launched about 4 weeks ago, which is very exciting. And we're joining an organization that has over 6,500 alumni companies who've been through the accelerator. We'll be offering an accelerator in the next couple of months. And we're in 95 countries, and there's over 25,000 mentors and advisors. So it's this amazing network that we wanted to bring to Cambridge and the network really is a very West Coast commercial, you know, get in, pivot, iterate, go hard. It isn't about helping people and nurturing, it's about sort of tough love. And we thought there may be a space for that. So we are specifically for pre-seed companies. So if you know anyone who has a tech business, then please let us know. We're gonna be talking about Darktrace, which is the Cambridge-based startup. And Darktrace has gone on to do some absolutely amazing things. As I said, it's a FTSE 250 company, meaning it's publicly listed and one of the 250 largest companies in the UK. It was named Time Magazine's most— one of Time Magazine's most influential companies in 2021. 8,000 customers around the world, 2,200 people working, 110 countries, 125 patents. It is a tech company galore. It delivers complete AI-powered solutions in its mission to free the world of cyber disruption.

Exactly that.

And so Poppy, who's with us, is the CEO. You're also an OBE. And so what is an OBE? For those who may not know, what's an OBE? And can you introduce us to yourself, a little bit about you?

Yes, of course. Well, let me start myself. So my name is Poppy. I am one of the founders at Darktrace and joined this group of founders sort of 10 years ago, and my role was very much— I'm a mathematician by background, so I studied maths at university and I was a chartered accountant, as all the coolest people are, I may just want to add. So 10 years ago, I had Jack Stockdale, who's my CTO, and he was building this incredible company, and he said, would you mind sort of coming and helping stitch it all together? And I said, yeah, why not, you know, I I was on maternity leave with my firstborn at the time, wasn't really doing anything else. I was like, yeah, let's give this a go, see where that goes. And now here I am 10 years later and it's just gone absolutely—

wait, literally it was a side hustle? Okay, good. But interesting people, like amazing, interesting people.

Like 10 years, the same, it feels like an entire lifetime ago and a blink of an eye simultaneously. So it's been a really exciting Exhilarating, frustrating, intense, emotional, but brilliant.

Yes, absolutely. And you are— and you had, in terms of company formation, you were minus one. There was no company, literally.

Exactly. So I, I created the legal entity that was Darktrace Limited. And when you go in, say it's on Companies House, you have to set up this sort of legal structure and there's an option that says you can do it and it takes 3 days and it's free. Or you can pay, I think it's £15 and you do it the same day. And I was like, I've got a good feeling about this. I'm going to pay the £15.

Doubling down on this one.

Get it done in 24 hours.

Absolutely. But I mean, that energy probably infused the company all the way through. If you started the company that way, you're like, now, now, now, today.

I think, and I think like today I'm notorious as well for being like the most deeply impatient person. But I suspect that it's something that founders have in common. It's just this desire to— why wait? Just get it done. Just get it done.

Yeah.

So, well, for—

we have people who may be joining who aren't Cambridge-based, and there is another Cambridge in the United States. It's not the original. We are the original, the OG. But like, where in the world are we right now?

So first of all, so Cambridge, you say Cambridge, first thing you think of with this course is University of Cambridge, right? And so what does the city offer? Amazing people, incredible talent. And a lot of them have come in from all over the world, whether it's for university or whatever other reasons. So you get this melting pot of very clever, very diverse people that have studied a whole range of sort of different areas and topics, and you stick them all together in a city that is still fairly small. Yeah, it is quite sort of intense, uh, area. And you get some amazing businesses popping out the other end. I like to think Darktrace is a great example, but there are many others. I look at Arm as well, another huge technology company that was incorporated here. So I think that is something that Cambridge is known for, is a real deep technological expertise, and you see it, you know, Microsoft have got their research centers there.

Apple's from here.

Yeah, exactly. So a lot of big global businesses put their research hubs here in Cambridge because there's so much talent.

Including pharma. There's an awful lot of pharma.

Yes, yes, yes, exactly.

So we're surrounded by science parks, which are amazing. So these hubs and places where people go, we've got a great WeWork, which is dynamic and interesting. We've got all of the colleges.

And there's cows.

We have the commons. Yeah, places where you can still bring your cow during the summer, or your cows, and they can graze, and then you can move them off again. And so you'll get students on bikes riding through parks and going through cow paddies, and, and the cows are all out there, and it's, it's a great place to be. It's rowing. Yeah, no, it really is. So why was Cambridge the ideal place to start? I mean, London's an hour, less than an hour away. Why Cambridge for the first place?

Got a— so the core piece of technology that our business sort of was built around. And that first map of an idea way back when was a particular piece of sort of unsupervised machine learning that came out of one of the postdoc groups from the university. So it wasn't— none of the IP belongs to university, but it was a— it was being— there was an intense period from the university where a lot of this was being studied, and it was a sort of consequence of that. So there's a lot of really good expertise in Cambridge around the area of unsupervised machine learning that we were that we were built around. So it's where the people were, it's where Jack was. I happened to be here. You create this small spark of an idea and it just snowballs into something. And today we've got hundreds of people that in our R&D center that's still based here in Cambridge.

Right, right. And you now have London offices as well.

London offices as well.

What's the dynamic between Cambridge and London? Is there—

Oh, it's like chalk and cheese. And I've been massively privileged. I get the joy of having a foot in both camps, but We've got all of our R&D here in Cambridge, so a lot of deeply capable people. And you go and you walk past their screens, there's lots of monitors and it's all really clever, interesting tech work that's coming out of there. London is a lot of the execs, a lot of sales and marketing, a lot of investors we speak to are going to be based in London. So all the teams that are supporting them, very, very different vibe. So a lot of very, you know, polish, you know, customer-facing and very much a different energy that comes out of London. And that's, you know, what a business is. You have a product and you've got your customer-facing teams and it just so happens that in our business they tend to be sort of geographically based across those two locations.

And so is there in the, in the journey of developing a product in Cambridge, so it may be called deep tech. AI is, I think, how how Darktrace labels itself under AI, and you've said unsupervised machine learning. So all of these sort of technical things are happening. How are you getting to the market and the product and the, where, how do these pieces start fitting together in terms of what was the journey of getting a product market fit?

Running deep tech is a really interesting area because one, you want to showcase how deep your tech is, but secondly, you need to be able to explain what you do and why it's useful and why it's relevant.

It's deep. It's very deep. It is so deep. This is super deep.

When— this is a little bit of a sidebar, so I apologize, but I will come back to product-market fit. But When I studied maths, everyone always says, oh, I can't do maths. Your brain must have just worked out, I can never do maths. And you think, of course you can do maths. Maths is just logic and reason. Vast majority of people are capable of logic and reason. And I studied this brilliant lecture, or I was with this brilliant lecturer who's talking about, who's doing history of maths or something. And he was talking about a visual proof of Pythagoras' theorem. So Pythagoras' theorem, you know, you've got your triangle on two sides of a triangle and you can prove, and normally it's your a squared plus b squared equals c squared. That was c². They didn't use any algebra at all, no squares, or— so it was just moving triangles and squares around on a whiteboard and said, "Ta-da! Therefore you can see that it's obvious that this would work." And you think, "Yeah, it makes complete sense." Right. And it was a great example for me to think that most people feel like they don't— can't do maths because they don't speak a mathematical language, they don't understand algebra, and it feels very impenetrable if you've not paid attention when you're 14 and suddenly you don't get it.

Right.

But they could absolutely understand reason and logic when you describe it in a different language. That way it was visual. And so we worked really hard at the early stages of Darktrace to say, we have this really incredible, deeply technical expertise in unsupervised machine learning, but how do we go and talk to our customers and prospects and not just be stuck drawing mathematical algorithms on a board? But instead say, let's show, let's show the real problem for you and real data and use a different language. And the language that we used was visual. And one of the other businesses that were in Cambridge that were sort of, it was very popular at the time was a lot of computer gaming. And we hired this brilliant games console designer who did this brilliant UI that illustrated the way the technology works. So there was no conversation about maps. It just said, look, this is what we've seen happening in your organization, right? That goes to that. That looks a bit weird. That's a spot of that, right? We fix it. And it became a really good visual way, right? So early on, we realized we couldn't be stuck in a situation where we're describing what we were doing. We had to be showing what we were doing.

Did you have the market? Did you start with cyber, or, or was it a little bit of, we got a bat, we got a hammer, we got a hammer, where's the nail?

Where there's started with this, with this unsupervised learning that was able to go into a technology system and learn normal behavior for that environment, right? And we thought a great application for that could be cybersecurity, right? So let's go out and give that a go. And how do we illustrate what we are capable of with this technology to the next business? We realized early on that sales pitch is very reliant on actually proving it. And we sold the first product in November of the first year. So that must be 2013 now. And then suddenly that's when we thought, we've got something here, right? And we know it works and a customer is willing to pay money for it.

Yeah.

And it's suddenly solving real problems. And that was a really big moment.

So was the capability developed and then offered to a customer, or did you partner with a customer who could help you iterate the capability? In that it sounds like you'd be dependent on a system to show what it does.

It's—

can I, can I, can I get at your system to show what it does?

It's both. Like, your product in those days is fairly conceptual.

Yeah.

And you are a little bit reliant on having a real-world business and customer.

Yes.

In order to improve and enhance it. So there is, there is a collaborative relationship with those customers in the early days when you are solving real problems with them, but they're also feeding back to you and saying, really good if you're able to, or this UI is a bit clumsy here, can you— and so there is a really deep relationship with those early customers. And that customer is still a close customer of ours today, and it's not something that we still work with. And whenever we bring out new products, we really work with them to get their feedback. And those relationships, particularly in early days, are super important.

And so do you keep a group of partners or customers close to sort of try things out with and to show what you're capable of doing?

And it's—

yeah, because I imagine at the size that the company is now, it's hard to do and fail and learn and pivot. You need to be getting it right most of the time, or working in a trusted situation where you're like, We're going to give it a go and we'll see what the system comes back with, what the model shows us.

So 12, 13 products now. And with all of those products, we will go through a phase of one, like, work, like we will test it out internally and sort of in controlled environments. Then you're going out and pitching the concepts to customers and saying, we're thinking about this and this is what it looks like. This is kind of what the problems we still have. And they'll say, oh, you know, I'm not really worried about that. Or actually, that would be really useful, especially if you layered that on. So you get a lot of feedback through that process. Then you, you go to your early adopter customers and say, you know, here it is in beta, what do you think? And that's when they're saying yes, you know, putting it really sort of testing it through its paces in the real world. And then it eventually becomes GA. Yeah, generally available.

And then that's when it's a real product, it's out there and you can put a label on it and it's on the menu and you can check a box and you can get it.

But even then you're constantly evolving it and building it, right? And enhancing it.

And so in that first customer sort of scenario, is sales and marketing and product and tech and founders and finance— is everyone sort of in the same room? Or at that point, was the company already creating satellites? Or— because there's been, there's been an expansion in the company where there's always this, there's always a healthy tension.

And I think your healthiest tension becomes between sales and marketing. And dev, because your dev team will want to lock themselves in a room, build a perfect product, and come out 2 years later only to find the world has changed. No one wants that product anymore. Uh, the marketing team will want to say it does all these amazing things that perhaps it doesn't yet do, and the sales team will want to sell it before it's built, right? Yeah, there's a— they've all got different, right, direct to motors, and there is a sort of bit of a healthy tension that works between those. And you do need that because that's coming back to that impatience. Like you do need that product out and ready, but you do need them all slightly siloed from each other to keep it in balance.

And so that sounds like a leadership point. Where, where are you in that equation? Because you've got competing priorities and you have other customers, you've not only customer customers, but you've got shareholders and, you know, the employees' own ambitions and agendas. How do you work in that environment of tension? What's your role?

It's a total feedback loop. And I, the way our business runs is those, they are fairly siloed functions apart from at the top of the business where it all comes together and you see into it. And that's intentional.

Okay.

Because you don't want a junior salesperson understanding what's on the product roadmap because they're gonna sell it before it's ready. So you do intentionally control the information flows that happens between those teams and it comes together. At the top, and that's where you've got a much better satellite view of how, right, that information feeds into each other. Um, and then it iterates from there. But then again, some of the best information and intelligence you'll get about what your customer wants is from those junior salespeople as well. So it's, it's about getting that balance right.

And so those coming together, is that in terms of size of company? You know, I, I know founders who, like, there's 3 guys and, and they live under a desk somewhere, and they sort of like sweat and code and eat pizza and sort of emerge Where, where is that? When does the structuring take place in the process of scaling?

Oh, it's so—

or maybe were there milestones where you're like, this is an important milestone where we can move from—

to far more of a natural evolution. So whenever your business will grow and you will come up against problems, and then you put a structure and a process around that to stop that problem happening again, and then the problem will occur somewhere else, and then you put a structure and process around that, and it just gradually iterates and builds based on wherever the latest problem is. And I think some of the advice I gave to some, uh, early-stage founders in the past is that there's— whenever you found a business, there's always that one person in the business that's always really useful at everything. Like the printer doesn't work, the printer fixed, yeah, the coffee machine runs out of coffee, they make sure there's enough coffee, they know the pitch deck better than anyone. It's just always that person that knows everything. And your job as a leader of an organization is to find that person and then sort of chase them through the business, replacing them with structure and process, like to almost make—

oh, lovely—

make them redundant, right, in the then role. Because if you're not careful, when you scale quickly suddenly that one person is so important and everything becomes a real bottleneck, right? And you become dependent on that person. Yeah. And they go on holiday or they're sick or just having an off day, and then suddenly everything grinds to a halt. So there's always that person in your organization. Spot them and then just chase them through the business, constantly making them redundant in whichever little role they are by building process and structure around them. Yeah. And then they'll go off and find the next problem in your business to fix, and then you'll put process and structure around that. And then that's how your team will eventually evolve.

Yeah. And then—

But it's much more fluid. It's never a—

Today is Tuesday.

Yeah.

We're doing this. Okay. Yeah. It's responding to the condition of the company and the people in the company. So in this process of growth, we're in Cambridge, the business is in the process of expanding, first customer product market fit, it's working. How are you growing the team? So are all resources that are required available here in Cambridge, or where, where would you go for customers or for scale or for investors or for profile?

It's a, it's a balance between energy and experience, I think. Like, you need— and in the early days, it's much more about energy than it is experience. Like, a lot can be done just through force of will because people are really passionate and ambition and like a bit of graft and you can achieve most things. But as your business grows, you start coming up against challenges that you haven't necessarily seen before, but a different business would have seen before. And there is a benefit from having experience of thinking, I know how to solve— I'm not going to have to reinvent the wheel, that this is a problem that has been solved before and we can do that.

And this person is expert. Yeah, they are expert at solving this problem.

Exactly. And that's when you bring that in. But it is a it's a soft fade from sort of energy through to experience. And there's different teams that will lead with that. So for example, then you want lots of experience in like your legal and your finance teams and all of that side, right? And then bringing in that experience is sort of important as a business, as a business expands and grows. So that's one of the things that's been on my mind as the business grows, is where do you— like, the energy is so important, it's so cultural defining, and such a— goes to the heart of who you are as a business, but how would you bolster that with sort of experiencing right places in the organization?

And how do you hold— and this is a question a lot of people address in different ways, but from your perspective and your experience, how do you hold culture through growth and change? Are there red lines with red threads, if you know what I mean? Are there things that are always true regardless of where you are or what the company is or what's being established in a satellite office? How do you hold on to and capture those core values?

I think it's the recruitment is a really important piece and who you bring into your organization. And that's one that we sort of hold quite close and deeply, and we do recruit right people that are ambitious and have energy. And I think that sort of really helps cement the culture, but also culture is quite— can be quite regional as well. And you have to allow businesses or satellite offices to identify with their own culture. And they feel like, you know, I'm part of the Singapore office and we don't— we have our own parties that celebrate their particular events and they have their own identity and you celebrate them as the Singapore office, but they still feel part of our business as a whole. And that's quite hard to do sometimes because you sometimes think, oh, they're doing a great thing in Ainbridge with free pizza on a Friday, let's roll that out globally. And then people are like, I don't want free pizza on a Friday, I'd much rather have this. So it's how do you give that agency and have those sort of cultural leaders in each of those regions that will do something that's appropriate, but comes back to still celebrating the business as well.

And do you create processes or structures around that? Is there like an internal dynamic energy team around culture or is it autonomous and distributed and people can—

We haven't historically had a a separate sort of cultural function. And it's not been something, because I sort of feel like it's such an important job that belongs across the entirety of the leadership team. And to feel that there's a separate function, like my nervousness is then you feel like you've delegated that and it's someone else's problem when really it's all of us and it's all of our day jobs to make sure that culture is appropriate and, and is something that we would be proud of and proud to represent. But increasingly now there's so much good initiatives that are coming from within the organization that you don't necessarily hear. We are starting to think about, well, how do we make sure we're spotting that and celebrating that and pulling that up and incorporating it? And for that you do need separate team who's really plugged into understanding and knowing.

I understand. And, and this is almost tomorrow, I think is the 1-year anniversary of an acquisition that Darktrace made of Cyber Sprint. A Dutch company. So this is not Darktrace. They are a Dutch company that came— I don't know the nature of the background to it, but in the product development that you've been doing, you've probably been able to buy, or was this your first acquisition?

It was the first acquisition. Okay.

And so how do you get to these questions of culture and, you know, integration and technology and all these things with an acquisition where maybe you've been doing it organically until that point? Or key partners?

I— it went really well. And like, the team now are a really important part of the R&D. I think we were fortunate though, in that we saw a lot of ourselves reflected back at us when we looked into this business. Like, there were people like us, right? Like, sort of very techie, right? Very— they were open-minded, but we're in the same business, right? We're all in the cybersecurity business. We're on the same side, the goodies, wanting to do something meaningful. Society, and they were, were really proud of their tech and deeply techie. And that really— there's good connection between them and our technology teams, right? And now there's a whole bunch of cross-pollination and collaboration between those two, so it definitely feels like one team. But we worked hard at that in the early years, and I just thought if that It must be hard to have your company acquired. Like, it must be quite unsettling. How would that feel? And how do you make people feel welcome and celebrated? And every office has their own little nuances and rituals.

Rituals. I call them rituals.

Yeah, exactly. And like, if you're not aware of those, how do you feel like you're fitting in? So we did quite a lot of making sure that they were— they came to our office and spent a lot of time there. We went to theirs, understood their rituals. Sent them little welcome packs with a lovely, very Cambridge-centric goodie.

Big rowing oars or something. Sweatshirts.

Pictures of cows.

Pictures of cows. Yeah, exactly.

Lots of books of maths that we thought they might find interesting and just try to do little gestures that said, it's really important to us that you feel welcome in this business. And hopefully that worked.

And that's because you intended to keep the team.

Absolutely. Yeah.

And so both the product and the team were accretive to your existing product and team, must be. How, how How do you make the decision about what to find for acquisition? What, what was the process you had in saying this is the right opportunity for us?

I think what did it do for what you're trying to achieve and what's on your product roadmap? And with any of these, you're thinking, are we gonna get there faster through this acquisition, or are we gonna get there faster building it ourselves. And we've looked at a lot over the years, a lot of potential acquisitions, and we've seen a lot of amazing technologies, but it's not been quite what we wanted, or it's the stance that we want, or the direction we wanted to head. Whereas Cybersprint was a really good fit and was genuinely allowing us to accelerate where we were heading. And we were able to make some shortcuts by, by acquiring Cybersprint as well, as well as bolstering the capabilities within our own internal team, the skills that they had in their, in their team. So it was the right decision for us.

When, if I understand the, their offering, it sounded like you had an internal view of an organization and they complemented that with an outside-in view.

Yeah.

And, and then by putting those two things together, you were able to create exactly that.

So we've got a really good understanding of you and your business and what happens within your organization. What they had a really good view was, is you're standing outside the business and looking in like you were sitting through the lens of a cyber attacker, for example. What would they see? Like they'd be peering around thinking, well, that looks a bit soft around that corner. That would probably be a good place for me to try and get in.

Right.

It's that view. And when you pair that with our understanding of, okay, well, you know, if they were to get in there, is that vulnerability where they get to? Do they end up at the crown jewels, or do they end up in the stationery cupboard? That's really useful coming together of two perspectives that makes the business more resilient.

It's like 1 1 is more than 2 in that case. Amazing. Amazing. Well, and I've heard you speak— so I'm just going to do a plug. We're coming up to Q&A soon. If you have questions for the Q&A, please, would you put them in? Any reflections that you have or questions, make sure you put them in. And if you like someone's question, upvote it. And I'll see some of those questions from Peter, I think, in the next little bit. When I've heard you speak about sort of 10 employees, 100 employees, and 1,000 employees plus, and what was really powerful about that is you were speaking from your perspective as a leader in those three sort of spaces. And I wondered if you could sort of just reflect on that, because very few of us will have the experience. Of going from 10 to 2,000, more than 2,000 people in 95 countries. And where are you in that? How do you manage your own growth and development? Yeah, to support the business.

It's, it's, it's really interesting. I found it harder transitioning around the sort of 200 people, um, because when the business is small, you know who everyone is. You know what everyone's doing, right? Like, you know if they're having a bad day or a good day, and you know what they're there to achieve. And you can be fairly open. So really early days, you're saying, right, we're gonna give this a try. If it works, it'll look like this. If it doesn't work, we'll probably spot it here. We'll try and get it done on Thursday, and let's see what happens. Uh, and then as you get bigger and bigger, you you can't be as collaborative in your communication. Like, you can't allow any sense of, no, we are going to do this and it will be done and it's going to happen on Thursday. You have to be super black and white because suddenly you're not talking to everyone. Not everyone's in the room when you're 200 plus. They're getting their information from their line managers and from other people in the organization. And there's a little bit of that sort of whispering and transfer of information that you're not in control of. So you have to be really meticulous and direct in your communication so it doesn't get lost as that gets passed around the organization. So you have to be really clear and directed.

One of those whispers things that each time it passes along, it changes a little bit.

Okay, so you have to be really careful about that. And then now my messaging is much more who are we and why are we here and what is our purpose And it's much more purpose-led communications rather than tactical, you know, let's go to— we need to— agency. So it does shift. It does shift.

And what I've always appreciated about some of the people that have been inspirational leaders is where on the event horizon they can see, if you know what I mean. So if I'm in a use case and I'm developing, you know, and we're code, code, code, you know, we can really kind of see our feet, just past our shoes. People that are sort of going, OK, well, here's how the pieces come together, see a little further out. Leaders see a little bit further out. How far out is your view currently for an organization of this size?

I think it's quite far in the long term and not very far in the medium term. Is that— let me explain.

Tell me more. Tell me more. So I was gonna say no, I don't know. No, no, no, no, no, no, no.

I like— I love that core technology that we created 10 years ago and this idea that you can have a system that completely understands your digital business and what that normal looks like. And today we're using that for cybersecurity. But I love the idea of this mathematical system that knows your business so well that it can make these changes and automatically shift the digital position of a business to respond to risk. So for example, we do that today. If there's a big cyber attack happening with an organization, Dumtree will spot it and it will stop it. So it will make— it will see it, it will understand that that's happening because it knows you, and then it will make a change automatically to stop that attack happening with the organization. It's amazing, and it's maths doing that. But essentially what it's doing is it's changing your digital setup to mitigate a risk, and this is a sub-risk, but there's a whole bunch of other risks that businesses face. And it could be about sort of compliance, or it could be thinking about, you know, understanding how do people in your business operate and what that normal behavior looks like, and has that changed? Is your collaborating in the same way as you always have? Are people complying with regulations that's specific to their industry? Are they, um, their it infrastructure is a particular cloud environment running hotter than normal or not? And the idea that it becomes, as they say, morphous shifting digital posture that can constantly shift in its seat to avoid a changing shift of risk environments in the external world, I love that. And it's all maths, having this deep understanding and being able to make these constant micro-decisions and then reassess those decisions and thinking, I did that and that was right then, but is it still right now? Do I shift and change that posture? I think that's really exciting. I love the idea of this sort of mathematical brain in the middle of our businesses that's able to do that day-to-day risk assessment. But do I know what product's going to pop out of that in the near term? No, I don't. But I find that quite joyful. Like, I find I'd hate to have the next 10 years mapped out. I like being uncertain about where that's going to be. Do I know what next 12 months looks like? Yeah, of course I do. I know what that product rollout map is going to look like, and I know what's going to be delivered when. I know what problems it's going to be solving. But I don't know what's happening in the medium term, and I wouldn't want to, because part of the joy is going out and talking to customers and exploring what we can do with that.

Well, and I'm just thinking about how quickly the world is changing too. I mean, the discussion of AI in 9 months ago, totally different from ChatGPT and what AI is doing literally right now. A friend shared, uh, and everyone will have seen it, it's a conversation with Bing where someone asks about Avatar 2 and just gets into this insane conversation with this. I'm like, this is a really— it sounds really emotionally intelligent. Like, I don't know if this thing sent me an email that I would know that it wasn't real. So like, the attack vectors and the sophistication is changing really quickly. So I'm not asking a question, I mean to, but that sort of observation about where the middle term is, does it leave you the flexibility to respond to things that are changing?

Absolutely. And ChatGPT is a great thing to, to respond to. Like we were chatting earlier, and what we've seen from a cybersecurity perspective is often you'll get a lot of phishing emails saying click this link or download this attachment and it's malware. What we've seen since the advent of ChatGPT is that the volume of those emails have come down. Suddenly you're not having these mass at-scale generic emails to such the extent that we have been, but the sophistication of them has gone up enormously. Like suddenly you're seeing really seemingly tailored, very targeted specific communications directed at you. And that's really interesting to try and sort of understand how that sort of changes your sort of risk from people, employees, humans clicking on those things they wouldn't otherwise have done. But I do love the technology, how quickly it evolves. And I just think, you know, my daughter is 7 and she's going to be as old as us one day and the oldest, most antiquated piece of technology that she can cast her mind back and be chatting with her mates. Do you remember when we were young? And it was ChatGPT.

Yeah.

Old-fashioned piece of tech that she can imagine when she's old. And I think that's really exciting.

Enormously exciting. The world will be so different. Yeah. And it's going to move really quickly. So the company— last minute to get some questions in the Q&A. Just sort of one final thing I thought we might sort of shine a light on. That you've been from founding Papers to big company, big trends. So the company, I assume, has gone through Series A and Series B and did that sort of stuff. You've had different kinds of shareholders and funds and all sorts of things that you'll have gone through. But the big threshold, it seems to me, would be going public. Is that— it was the going public process sort of that bit leading up to it different from what the company had been doing before? And did it cause any changes in your approach or your considerations or your—

Going public is just a corporate exercise. Like it's not, it's not success or an outcome for the business. It's not a product. You're not creating anything. You've just gone through a corporate exercise. So it feels very different. And it's not necessarily something— it's never your purpose. You, you don't set up a business saying, I want to IPO it. You think, I want to release products, right? Going through an IPO is a great way to achieve those other goals, and that's what it was for us. But you do— you find yourself in the year before your IPO, suddenly you're spending a lot of time and energy on this, and you're not spending a lot of time and energy in thinking about your day-to-day job of going out and building cybersecurity software and making sure you're talking to prospects about it. So the business has to be in a place where it can run itself without you being there to peddle it day to day in perhaps quite the same way that you are when it's much earlier on in its, in its lifecycle. And you need to have a really good sense of what the numbers are going to be. They need to be really reliable and predictable and have good oversight of that. And then just knowing that you can go off and focus on spending your time in a virtual room pitching your business to investors for the roadshow for months and months and months and know that the wheels won't come off. Yeah, having a really good team is an essential part of that. But, you know, here we are on the other side and honestly, the IPO process, like, it's intense, right? You're— it's long days of just relentless pitching, but it's also quite a useful exercise. Like, you're going through this, like, you're listening to yourself pitch.

Yeah.

And you start thinking, I'm not sure that's such a good idea. I might change that, change the strategy slightly to tweak that, because the more times I'm saying it, the less I like it. And then sometimes investors will come in and say, well, why do you do it like that? And why don't you do it like this? Which is what normal companies that I see do. Yeah. And for 10 out, they'll give you 10 reasons why you look different to other companies that they've put in their spreadsheets before you. And, you know, 9 of those reasons are other things that make you special and you're proud of, and you sort of think, that's why we are just seeing the success that we are, is because of those things. But one of the things you think, why do we do it like that? That's a really good point. And then you're back on the phone to the team saying, I've got a great idea. There was like, oh God. Just leave it to it. But so you do get that really useful feedback.

Well, and for founders that are sort of looking at fundraising, it could be an uncle that someone that you, in your friends and family, in your first round, you're sort of raising your SEIS round, for example. And this is what I intend to do. And someone's going to give you some advice. And then you'll get to your EIS round, you may be raising up to $2 or $3 or $4 million. Someone's going to give you advice. Then you're going to start talking to private offices, you're going to talk to VCs, they're going to give you some advice. And now you're in this much larger sort of forum. Is there any advice you can share with people who are going to be getting that, you need to be doing this, which is a really good idea and I'd really like the money?

Yeah, it's a really good point.

Where, where, how do you say that?

You get a lot of advice.

Oh gosh, I can't even imagine.

I think it's You gotta— not all advice is created equal.

Tell me, what does that mean?

You will get a lot of generic, I don't know anything about your situation or anything that you're in, but what I would suggest you do is— and just knowing when to file that in an inbox for unasked for advice versus genuine.

How big is that box?

Versus genuinely people that have been in similar situation and can have navigated through these and know the difference between— know the reality that's required to deliver something. So for example, you've got a spreadsheet and it says that your growth is going to be A or B, your profitability is going to be whatever it is, and someone says, oh, well, I think you should double that number. And people that run a business realize this, that there's human beings on the other side of that spreadsheet, right? And to double that number you've got to go make a call to a particular individual who might already be at the end of their tether. Like, how will that respond? Is it going to break something? Like, is it physically possible knowing the people and the structure and the relationships that are involved in actually running a business, understanding the reality between what can and can't be achieved? And you need people that have run a business to know that as well.

So, and I think there's, in my experience with different founders, there's a sense not of loneliness, but there's an emotional aspect of isolation in that, in providing that filter and not going back to the team and saying, hey, here are the 5 things that I heard we should do. And if you're doing the filtering, you're not passing that information along, you're not letting them know some of the feedback that's been sort of pointed at the company. So acting as a filter for that, but it leaves you in a situation where you're the only one who has that. You're the only one who has that advice from that person. Yeah, exactly. You put it in the bucket and off you go. Does that Is that an intrinsic role? Is it something that can be shared across the team? Is it—

I'm a natural sharer. So, the way I— it's very collaborative at the top of Darktrace, and I've got a team around me that I rely on very heavily, and we all rely on each other, and we're all really open with each other. And I always think my number one obligation is just to be honest. And if I think it, I'm probably gonna say it. And then people know that there is no, oh, just probably think I've done a really bad job here, because if they've done a really bad job, I'll just say that you've done a really bad job. Like, I'm not gonna protect people from it. So I think if there's ever that situation where you are getting consistent advice that says you really need to address your go-to-market or something, and that's happening again and again and again, I will be bringing that to the team. Bringing it up.

Yeah.

And saying, I don't necessarily agree, but this is what I'm hearing. What do we think?

Right.

Because No one knows all the right answers. And if you've got enough people that are saying, oh, you know, I think this might be, that could be something you do need to look at.

Amazing. Well, I'd like to turn if we can.

Wow.

And I'm pretty good on time, I think, to some of the questions we've had in the Q&A. So with such a groundbreaking piece of security software, particularly one that involves deep tech, did you find it hard to price? Before the first customer paid?

Really hard. Really hard. And pricing is really difficult because one of the challenges in the first— in the early days is that you're doing something completely different and it's new. And I'm saying to you, come and see this, let me come and show you my software working in your environment, show what it can do. And you'll say, well, how much does it cost? And I banned people from having too much of a conversation about price before we'd demoed it, because how do you price something that you don't yet understand what it can do?

Well, you're anchoring too.

Yeah, you know, you've got to find a way of really showing the value before you start having a conversation about price. Um, and that's hard.

And I wanna dig into this a little bit. I've spent 3 years in age tech. And the thing about age tech is aging population, opportunities, all sorts of stuff. But what almost all startups get caught out on is the only business model that they can get is one where they harvest a portion of the savings that they offer a company. So almost everything that anyone can do in age tech is you don't have to have 2 nurses, you can have 1, and I'll take 10% of the savings. It's the only business model that kind of holds up. Did you try different business models? How do you get to a business model where you're like, I know that we can save you X, or are you—

No, we very much battled against that. And people want to put you in a box and say, oh, you're like Company A, but right, cheaper, better, faster, shinier, whatever it is. And we've always really fought against that. So for example, or the, you know, the big marketing people that have boxes and quadrants of things that want to put you in a particular silo. We've always said we've resisted that because then suddenly it's like, well, that company over there is that price and you're like, that's not what we do. We're very, very different. So you do need to be able to say we are, we are additive, we are making your entire security posture better. And this is something that's worth paying for, right? And it's not just, you know, a race to the bottom and being like that company but cheaper.

And in— I imagine in an organization where you're selling to a corporate entity, you're going to have a range of levels of engagement. So to whom in the alphabet of hierarchy are you talking price?

Uh, yeah.

So where, where are you trying to go in? Who are you talking about price with? Where in that sort of layers of, of internal organization are you matching benefits to need to—

I mean, we're in an interesting space, right? Cybersecurity, like, it's got to be one of the biggest risks for any modern business. So we are able to have a conversation at board level about how they can address that, which is useful. But then you've got to also build a relationship with the people that are going to be using it day to day and make sure that they're real fans and advocates of it. So you do need to span across the whole depth of an organization to be able to make that work.

So you just reminded me that a friend of mine worked at Sony when they had a really terrible hack. And he literally had to go and buy laptops on his personal credit card. They couldn't access any of the contracts that they— like, I forgot just how disruptive it was. Because on one side, I'm like, How disruptive can it be? But I'd forgotten.

It can be— I remember—

So how do you price that? Is that—

They're saying that they were hacked, shut down all the systems, and of course went to ring his crisis committee to say, what do we do? Everyone's phone number was on a centralized repository that they then no longer have access to. No one knows anyone's phone number by heart anymore.

Yeah.

Yeah. But people are resilient though.

Mm-hmm.

Often find a way, but that's not a situation you'd probably want to find yourself in.

Gosh, no. Well, I can see, so the business model, one is savings, but you are creative, creating additional value. You're working across.

This is not an and, this is an and, it's not an or. So yeah.

Good. Good. And there's a question about early stage pre-seed, seed fundraising. What's your experience doing the fundraising early before you have that business case and the proof? What—

live demo, really important, really, really important aspect of live demo. And that will always be the key thing that people will want to see as well as obviously the team. And then from your position as well, think about what they can bring you. And when we went through the sequential rounds of investment, it was thinking We obviously based in the UK, we had sort of fairly good European grounding, but then it was quite important that we needed a good grounding in the US and thinking about people that we took on our investors, are they gonna be able to help us expand presence in the US and then in Asia? And we were sort of fairly tactical about the regions that we, that we were drawing that, those funds from because we knew that they were gonna be able to support us in that region as well.

Yeah. And it's so important. I, in my startup, in the fundraise, I, I had someone that came in, I thought he was gonna be fantastic. We pivoted a bit away from it and he just became an unbelievably expensive person to maintain. Relationship-wise, it was so difficult to maintain that relationship. And so in the sense of who you're bringing in and what they can do for you, that's, I think, so important.

And work them hard as well because they've got amazing Rolodexes. They will make all of the instructions, but keep them. They will promise a lot, but you just have to—

How do you— so if I'm a small business, if I'm a startup and I'm less than 10 people and I'm— I've got I've got my MVP, I've got my first reference customer, I've raised some money. On the other side of raising the money, now I'm investing and deploying it to hurry it up. What's my relationship with my shareholders after that? Am I just—

Well, typically at that stage, they'll be coming onto your board. So you'd be speaking to them fairly frequently in board meetings and the like. But just a good— you need all the sounding boards you can get. Whenever you're at all points, like I have plenty now and I have plenty then. And that investor base are a really good sounding board. It's a good chance for you to pitch your ideas, hear yourself pitching them. You often learn a lot as well.

Yeah.

So good sort of regular communications there as well. And the other thing as well that we really use in those early days, just thinking about geographical expansion, is British embassies across the world were fantastic. And you can, they will help sort of bring together people. You can use brilliant facilities and they're really, once you've tapped into that, that's a really good useful resource.

Mm-hmm.

Um, that I think is a little bit underutilized.

Right.

So I'd strongly advocate those.

Uh, question about cybersecurity. So what kinds of threats do you predict will be the biggest negative impact on business and society? And what technologies do you think will be the most disruptive? Addressing these in the sector over the next 3 to 5 years?

Well, AI is going to be an essential part of cyber defense, obviously saying that as a cyber defense AI company. But the reality is AI is becoming more readily available and attackers are innovators too, and they're going to be taking advantage of that. And you've got to make sure that you are If the attacker is able to deploy software that can sort of change shape, or it can shift and respond, or it's very sophisticated at tricking people into doing things they wouldn't otherwise do, like, you've got to have an equally sophisticated defense capability within your organization if you have any hope of surviving. I think what we've seen over the last few years particularly was the speed of the attacks. So things like ransomware, meant that when we found this 10 years ago, there was a big stat that someone's dormant within your organization for an average of, I think, 240 days before they, before they get noticed. So it's these low and slow attacks that people will find a way into a business or creep around, have a rummage through your drawers, and then work out what the best thing to try and take away is. Then that shifted to being a much, much faster ransomware, you know, within seconds. Someone's, you know, bashed the door down and taken everything of any value. Now we're seeing a shift towards thinking about how do you be far more proactive in your cybersecurity posture. So instead of just thinking, this is happening, here's a crisis, how do I fix it, thinking what might be the future crisis, where may I be vulnerable, and what can I do today that mitigates against that. And it's not necessarily about predicting the attack, but understanding your unique vulnerabilities and how your business is interconnected and what systems it relies on and how you can sort of wrap a sort of safety blanket around those today, such that if there's some weird and wonderful attack that you never thought of tomorrow, you know that those really essential components of your business are properly protected. So now it's— there's much more in this sort of proactive chapter when it comes to cybersecurity.

Right. And so we've talked about sort of product mix and ML. This sounds like a service layer that's almost there, like an engagement with partners that's possible to help them ask questions they didn't know they needed to ask. Is that—

This is something that—

Or customers capable of doing that.

Like it's something that— Like your technology can better understand the way that an attacker could move through your organization than any sort of humans or, you know, you get a lot of, often you get organizations that bring in penetration testers whose job it is to say, right, okay, let's come and see how secure your digital property is. And they'll take you through those checklists and then they will sort of go and test it in a particularly rules-driven way. But that's a very predefined process and structure. Technology itself is much better at just saying, okay, right, well, simulates all the possible outcomes and scenarios that could possibly happen. And, you know, 90% of the time there was water hit, but in 10% of the time they weren't for these reasons. Well, what can we do today to protect those?

Is culture something you planned and said, these are our values? Where's— was there like a whiteboard? Was there like one of those like startup whiteboard sticky note moments where you're like, values are X, Y, Z? Or did it organically grow over time? And does that mean that Darktrace's culture today is the same as it was when you hired your second employee?

I feel like the culture is very similar, but I— it's, it's, it's really hard to describe as a CEO because you're in a bit of a sort of lofty position peering in from the outset from your sort of golden pedestal thinking, yeah, from what I'm seeing, everything's looking great. Whereas the reality is that culture is defined by the people in the that are actually doing all the work instead of wafting around on their lofty pedestal. And so I don't feel that culture is mine to dictate. My job is to provide and facilitate the culture that my team is asking for that best enables them to be successful in their job. So it's very much an asking process. What is important to you? Like, what do you see surrounded in the employees that you like and admire and respect, what values do they reflect and how do we amplify those and how do we celebrate those? So it's something that's sort of ongoing.

But what I, what I hear you identify is like a leadership style. It's like a servant leadership almost. It's, you know, what do I need to do in order to facilitate where there are definitely other styles of management out there, you know, which is like setting a question mark.

And yeah, I'm definitely not in this sort of tech bro culture. No, that's not me. No. Like my, my business is defined by the success of the R&D team, and I just need to make sure that I've created an environment that allows them to experiment with weird and wonderful and exciting applications of AI that, you know, go on to become the next big groundbreaking success story of the future and just make sure that I do that technology justice.

Amazing. I have one more question for you, and then I need to do a little plug just to sort of wrap things up. We're almost at the top of the hour. Thank you, everyone, for your patience and for these amazing questions. I'm sorry we haven't gotten out to them all. If you were in the future, knowing— what advice would you give yourself when Darktrace was founded, knowing what you know now? What would you tell your history self?

Oh gosh. I think it's— there's never a predefined answer. It's more than one way it's going to cap. But once you've decided a way, you've all got to do that together. Like, you can't have everyone trying to skin the cat differently. I'm going to really sort of regret this metaphor now, aren't I? But there's lots of different ways to solve a problem, right? But once you've decided on a way as a team, you've got to all get on the bus and solve it together in the same way. And there may have been another way to approach it, but once you've picked your way—

like, once it's like agreed, we leave the room. Yeah, this is what we're doing. We're staying.

Yeah. Until we decide to change it, which may not be right.

You have the right to come back and—

but we can't all solve the same problem in a different way because it just won't work.

Yes. Stay true. And it's— I mean, it's a fairly— it's a lovely insight, and it's one that would be helpful for all of us to remember that you can make a choice, commit, but you can pivot and you can change. We have time. I've lost my last piece of paper, which is where I promote my cohort. I want to say thank you to Peter, and I want to say thank you to Mark as well for facilitating and hosting. I want to thank Founder Institute HQ for helping us set this up. Poppy, you've been sensational and amazing. I know you to be that anyway. This is just so powerful. And anyone who I've said, oh, We're going to have a fireside chat with Poppy, just eyes light up and they're amazed. So congratulations on the success of the company and wish you much, much more. I just want to say we— I found my notes. We have upcoming events. We will have— so Founder Institute Cambridge has been founded. We hope to have our first cohort. Our early deadline is March 26th, and the final deadline for our cohort is April 23rd. So we have this event, which sort of kicks us off. Our next event, which is on the 7th, is about angel investors and angel networks and how to work with them, what you need to know, and some trends in that space. And then we're going to have an in-person event on March 18th. But I think Mark can put into the chat the link to our event calendar, and he'll also put in there a link to our chapter itself, and you can learn more about us. And you're welcome to contact us. I think Mark will also share an email address that you can reach Peter, Mark, and myself on, and we'll get right back to you. But Poppy, thank you so much for your time. This has been amazing. And thanks.

More Cambridge founders.

More Cambridge founders. There's so many. It's an amazing place to be. Thank you so much, everyone.