Poppy Gustafsson runs a cutting-edge and gender-diverse cybersecurity firm on the brink of a £3bn stock market debut, but she is happy to reference pop culture classic the Terminator to help describe what Darktrace actually does.
Launched in Cambridge eight years ago by an unlikely alliance of mathematicians, former spies from GCHQ and the US and artificial intelligence (AI) experts, Darktrace provides protection, enabling businesses to stay one step ahead of increasingly smarter and dangerous hackers and viruses.
Marketing its products as the digital equivalent of the human body’s ability to fight illness, Darktrace’s AI-security works as an “enterprise immune system”, can “self-learn and self-heal” and has an “autonomous response capability” to tackle threats without instruction as they are detected.
“It really does feel like we’re in this new era of cybersecurity,” says Gustafsson, the chief executive of Darktrace. “The arms race will absolutely continue, I really don’t think it’s very long until this [AI] innovation gets into the hands of attackers, and we will see these very highly targeted and specific attacks that humans won’t necessarily be able to spot and defend themselves from.
“It’s not going to be these futuristic Terminator-style robots out shooting each other, it’s going to be all these little pieces of code fighting in the background of our businesses. In my time here at Darktrace, I’ve seen attackers try [to] use things like Teslas parked in the office car park, [internet-connected] fish tanks in casinos, and fingerprint scanners on the doors of warehouses, all as a sort of new and novel way into businesses.”
Gustafsson was 30 years old when she co-founded Darktrace in 2013, and her star has ascended in tandem with the company’s rise from promising tech startup to rare British “unicorn” to list on the London stock market in the coming months. While Gustafsson is likely to be worth at least £20m from the flotation of the business, which has almost 5,000 customers ranging from the NHS to Coca-Cola, she has also become something of a gender diversity champion in the male-dominated tech world.
Darktrace employs more than 1,500 staff globally, of which 40% are female – including at management level – a rarity against an industry average of just 15%. A rare tweeter, the last post still lingering at the top of her Twitter feed references how “proud” the company was of its gender diversity marking International Women’s Day.
“It’s only something I’m aware of when I’m doing interviews or when I’m at an industry event and suddenly you see a sea of men staring back at you,” she has previously said.
By design or not, Gustafsson, who was awarded an OBE last year for her contribution to cybersecurity, has proved to be something of a gender stereotype-breaker for much of her life.
She grew up in Cambridgeshire, where her father ran an agricultural sales business and her mother was a journalist for Farmers Weekly. After attending Hinchingbrooke secondary school – alumni include Oliver Cromwell and Samuel Pepys, and Wolf Hall author Hilary Mantel was patron of its 450th anniversary – she took a maths degree at the University of Sheffield, where her first student job was building kitchen cabinets. She then qualified as an accountant at Deloitte before working for Amadeus Capital, the venture capital firm run by ARM Holdings founder Hermann Hauser. In 2009, she moved to Mike Lynch’s Autonomy, a business that would become inextricably intertwined with Darktrace, for a two-year stint, before the cybersecurity company was born.
In February, former home secretary Amber Rudd, who sits on Darktrace’s advisory board alongside former MI5 director general Lord Evans of Weardale and CIA veteran Alan Wade, penned a piece asking “how we can find the future Poppy Gustafsson and more like her” in male-dominated science, tech, engineering and mathematics. She also complained that despite the female-led success of Darktrace, when the company is written about, “the only name that seems to get mentioned is the founder, Mike Lynch. It is as if women don’t get to run their own show.”
The problem is that Lynch, whose Invoke Capital was Darktrace’s first and biggest shareholder, has always had a significant influence on the business. The Autonomy co-founder is fighting extradition to the US, where he is accused of fraudulently inflating the value of the company before its £8.4bn sale to Hewlett-Packard in 2011. Lynch, who could face a maximum prison sentence of 25 years if found guilty, denies any wrongdoing.
Darktrace was built from ex-Autonomy staff, including Gustafsson, and in 2018 it was subpoenaed by US authorities for information about Invoke, warning there was a risk of money-laundering claims if its backing money included cash from the Autonomy sale. Darktrace says its liability in this regard is “low-risk” in IPO registration documents.
To create distance, Lynch stepped down from Darktrace’s board in 2018. However, he remained on its advisory council until last month, when he moved to a newly created science and technology council. Last year, Darktrace used $127m of a loan from several existing investors to reduce Invoke’s share holding. Lynch, with his wife, Angela Bacares, currently owns 19% of Darktrace, worth as much as £570m when the company floats.
Gustafsson has for the most part remained tight-lipped about her former boss, the financial backer instrumental in her rise at Darktrace, rejecting the idea that London may have been chosen over the US for a flotation because of Lynch’s situation.
“No, not at all,” is all she will say.
Gustafsson, whose choice of transport is a canary yellow Vespa and has said her one regret is not putting more time into learning the piano, is laser-focused on ensuring Darktrace has a legacy all its own.
“It really feels like we are just getting started,” she says. “We’ve never been happy with just sort of following the status quo and doing things, you know, 2% better than the last product. We are never going to be happy to be a company just following in the footsteps of others.”