← Conversations archive
VIDEO — 4 Nov 2023

Pitching Secfix at Web Summit: security compliance in six weeks instead of twelve months

A three-minute pitch at Web Summit Lisbon: why compliance is so hard for European SMBs, how Secfix makes it simple, and the jury’s questions.

WS
Published in
Web Summit Lisbon
Role
Speaker
Watch on YouTube

At Web Summit in Lisbon I pitched Secfix in Pitch, the summit’s startup competition. In three minutes I explained why security compliance is so hard for European SMBs and how our platform helps them get certified. Then I answered the jury’s questions.

Why SMBs have to meet security standards

Last year, a single data breach cost 4.4 million US dollars on average. More than 20 million European SMBs struggle with cybersecurity every day and are attacked by cybercriminals.

That is why large enterprises and state authorities demand that SMBs comply with strict security regulations and standards such as ISO 27001, TISAX and GDPR. It strengthens the supply chain and trust, and lets these companies close bigger deals with enterprises.

Getting compliant is the hard part

It is a frustrating, very demanding process, as we know from our own experience and from many founders. The story goes like this:

  1. 01Many companies don’t even know where to start.
  2. 02Those that do start get stuck very early in the process.
  3. 03They end up paying expensive consultants, and it takes them more than a year to reach their compliance goals.
  4. 04More than 80% of them never even finish.

Six weeks instead of twelve months

We believe cybersecurity compliance can be very simple. Secfix helps companies get and stay compliant with ISO 27001, TISAX and other standards in a record six weeks, compared to twelve months.

The platform integrates with your tech stack: cloud tools, code repository, HR tools and ticketing systems. With our resources and your data, we generate a gap analysis and a checklist that tells you exactly what to do to reach your compliance goals.

We have a 100% success rate. All our clients get certified and stay certified. We automate the monitoring of their ISMS, tell them when they fall out of compliance and keep them on track.

A colossal market, and the team for it

Since we launched the product in early 2022, we have grown exceptionally with SMBs of up to 300 employees across the EU. Europe is a colossal market for us, worth 200 billion euros.

Our team is focused on cybersecurity and deep automation, with experience in building MVPs, scaling companies and creating security programmes for more than 200 customers worldwide. Since the beginning of this year we have raised 3.6 million with Octopus Ventures, and we are scaling our team.

Questions from the jury

How we reach SMBs

The first question was about go-to-market, since SMB contracts are small and these clients are hard to reach and to educate.

I started with education. Our educational webinars generate leads, and we spread security awareness at events like this one, especially in high-risk industries such as healthtech and fintech.

What sets us apart from competitors

Asked how we stand out among so many competitors, I said our best line is a 100% success rate, and customer stories speak for themselves. Huge US competitors are trying to break into the EU market, and we are thankful to them: we have learned a lot, and they push us to be better. But in the EU we are the first movers.

  • —Our technology is deeply integrated into companies’ tech stacks.
  • —We have the best false-positive rate in security monitoring.
  • —We support local EU languages, and local legislation that is hard to build into competitors’ platforms.

In follow-ups I said that we currently convert about 20% of the customers we reach, and that around 50 clients have been approved for ISO 27001 so far.

Liability, when nothing is 100% secure

The last question was about liability, because nothing is 100% secure. Responsibility for an organisation’s cybersecurity lies above all with its top management. When they use our platform, we educate them about these risks and responsibilities and help them reduce risk, so they sleep better at night.

Our integrations only read data, in one direction. We don’t change anything through them, so our platform cannot change any configuration or cause any damage. That keeps the risk from our integrations as low as possible.

More conversations & talks