Poppy Gustafsson, the cyber security chief with a human dilemma

Addressing a group of investors last year, Poppy Gustafsson pronounced: “An attack, once thwarted, needs to have all the tendrils of infection removed.”

“This is a human-intensive task that is prone to human error and insufficient vigilance,” added the chief executive of cyber security group Darktrace, one of the UK’s best-known start-ups.

News this week that tech-focused private equity group Thoma Bravo is mulling a bid to take Darktrace private is a vote of confidence in a company that is grappling with some scepticism over its growth prospects as well as risks to its reputation, the tendrils of which have proved difficult to remove.

Two of its founding investors were found to have fraudulently inflated the value of their company in the biggest case of its kind in British history.

Mike Lynch and Sushovan Hussain were accused of falsifying financial facts and documents in the run-up to an $11bn sale of Lynch’s software company Autonomy to Hewlett-Packard in 2011. Hussain was found guilty and sentenced to five years in prison in the US.

In January, Lynch lost a high-profile civil lawsuit brought by Hewlett Packard Enterprise, the judge making a finding of civil fraud against him and Hussain. British home secretary Priti Patel approved the extradition of Lynch — who denies any wrongdoing — to the US to face charges.

Gustafsson has charted a course between defending her former colleagues while making efforts to distance herself and the company from the Autonomy founder and the potential reputational fallout of the association.

She offered written testimony and was cross-examined during Lynch’s civil fraud trial, and she wrote a letter to the judge in defence of Hussain, describing him as a close friend. Darktrace did not respond to a request for comment over her defence.

Lynch, who was a director of Darktrace until 2018 and an adviser until 2021, still owns around £158mn in stock.

Tech investor Michael Dimelow said he believed Darktrace’s association with a fraud-tainted executive was “a drag” on the company’s reputation and investor confidence. But he added that Gustafsson was “a sound person” and “seems to have performed”.

A career in cyber security and rapid ascent through the ranks of British tech was not the obvious destination for Gustafsson. The 39-year-old grew up in Cambridgeshire where her father ran an agricultural sales business and her mother worked as a journalist for Farmers Weekly. After studying maths at Sheffield University she trained for an accountancy qualification at Deloitte.

But it was her next job that would shape her career — a three-year stint as corporate controller at Autonomy.

Hussain and Lynch and a number of other ex-Autonomy executives founded Invoke Capital in the summer of 2012, a year after the ill-fated sale of Autonomy to HP. Darktrace was formed the following year by a number of mathematicians and British spies from MI5 and GCHQ. Invoke seed-funded the company and helped bring in some ex-Autonomy staff to run the show.

Tapped to be chief financial officer of the fledgling start-up at the age of 30, she was soon promoted to become Darktrace’s co-chief executive in 2016, and then chief executive in 2020. She was awarded an OBE in 2019 and guided the company through its successful public listing in April last year.

Founded in Cambridge, Darktrace commonly uses the immune system as an analogy to describe its cyber security software, which uses artificial intelligence to identify new threats and vanquish them. The company, whose customers have included Rolls-Royce, Drax, the city of Las Vegas and the UK’s NHS, has capitalised on a thriving market for cyber security in recent years.

A former Darktrace employee said that Gustafsson “doesn’t believe in hearing about barriers and then giving up on things”.

One longstanding investor in the company described her as “very numerate”, adding: “Poppy is not very aggressive — she’s soft . . . but she ran that sales machine to make it work incredibly well.”

Darktrace has posted strong growth over the past five years, with revenues increasing from $79.4mn in 2018 to $417mn last year. It now boasts around 7,400 customers, most of which are small to medium-sized companies.

But not all are convinced. Last October the stock plummeted after the brokerage Peel Hunt published a note arguing the company was worth half its market cap, because the potential market it was targeting was not as big as the company claimed.

News of the preliminary discussions with Thoma Bravo have helped it recover. Shares are up 28 per cent since then, while the stock has risen 64 per cent since its IPO.

Some remain sceptical. UK hedge fund ShadowFall, which has a short position in the company, also believes Gustafsson continues to overestimate Darktrace’s potential customer base. Last year, she claimed there were over 150,000 companies that would benefit from Darktrace’s Immune System AI software.

“We struggle to satisfy ourselves that Darktrace is investment grade,” said Matt Earl, managing partner at ShadowFall.

Some former employees have criticised what they claim is an aggressive marketing and sales strategy. ShadowFall and competitors have also queried why Darktrace spends so much less on research and development than some of its peers.

Rival cyber security firm Vectra taunted Darktrace last year in a now-deleted web page that claimed that “instead of investing in innovation, Darktrace spends on F1 sponsorships and slick marketing campaigns”. It added that Vectra spends around 40 per cent of its revenues on R&D, compared to 10 per cent by Darktrace.

A person close to Darktrace noted that the nature of the company’s AI meant it did not require a large and costly group of engineers.

The investor argued “fuddy duddy British investors” rarely price tech stocks accurately and that Darktrace was being undervalued by the market. They added: “I hope that the Thoma Bravo thing doesn’t happen because I think there’s more upside, but at least it would wipe their slate clean from Autonomy.”