Andrew Bycroft

The transition from IT specialist to business leader has never been straightforward or comfortable for Andrew Bycroft, and is even more remarkable given his childhood of severe poverty. He embraced the personal challenge and set himself on a course for success, by creating a cutting-edge business at the forefront of online protection.

Beauty and the Geek is a television series which has been shown around the world. According to Wikipedia, “the premise of the show consists of a group of ‘Beauties’ (young women who have relied primarily on their looks) and a group of ‘Geeks’ (young men who have relied primarily on intellect rather than social aptitude or looks) who are paired up to compete as couples for a shared $250,000 and other prizes.”

While Andrew Bycroft, the founder and chief executive officer of International Cyber Resilience Institute, has never been on the show, and probably never will be, in an odd way he can relate to the experience.

As Andrew frankly comments looking back, “I think it’s fair to say I was a computer nerd. Today, I think it’s a compliment, but maybe not back then.”

Andrew wasn’t paired with a young female ‘Beauty’ but a young advertising agency called Mojo – the agency that brought us You Oughta Be Congratulated, How Do Ya Feel?, C’mon Aussie C’mon and Up There Cazaly.

Yes, Andrew stood out there, but, “because I was quite unique, I was very well respected.”

The biggest adjustment then for Andrew was having to dress down. “Until then I’d always taken great pride in presenting the right image. I wanted to look very corporate and professional. So to go into an industry where jeans and a t-shirt were the norm, was a challenge.”

As an experience it really broadened Andrew’s outlook and, without realising it at the time, laid the foundations for decisions he would make later in life and lead to the creation of his company, The International Cyber Resilience Institute.

In short, today Andrew’s business “helps executive and non-executive directors of large organisations stay out of the courtroom and remain in the boardroom when cyber-criminals target them. Cyber policeman is probably an apt description.”

Some fairly large changes were needed in Andrew’s personality for him to become the person needed to create, build and run a successful business: Andrew Bycroft is not your typical entrepreneur.

One significant difference is that, “I’ve always been a very quiet person, almost introverted. My personality has changed quite significantly since embarking on this journey and a lot of people have noticed that.”

The time at Mojo brought Andrew out of his shell – “I would go to Christmas parties in a Darth Vader suit” – and forced him out of his comfort zone, pursuing activities which would help him grow personally and professionally.

On reflection, “it was an interesting environment. Obviously they weren’t computer-savvy people: some would race around the office on scooters; they would be shouting and yelling at one another and this all stimulated their creative juices I think, which is important in that industry.”

At the time, Andrew observes, “there were lots of different types of computers. They had the big server computers, Apple Macs for artwork and publishing, and then they had lots of archaic systems for buying media spots online. I had to manage all that and bring some order to it and make them a computer-literate company. That was a challenge, but a good one.”

With his own mojo raised a few levels, Andrew began seeking sales and marketing jobs “to see if I could actually do it.” He knew that if he was ever going to start his own business those were skills he’d need.

As part of his personal growth, Andrew believed that, although he could have outsourced this aspect or found people who could do it for him, he felt he needed to know where his limits were. “I needed to know what to look for in those people. I actually quite enjoyed that experience. I had also thrown myself into public speaking.”

Admitting it “was extremely nerve-wracking at the start,” Andrew persevered, “but I knew if I could master that, selling would be easy. Once I’d done that, I realised I was ready to start a company.”

According to Andrew though, a funny thing happened on the way to creating his own company: “I retired.”

Andrew was almost forty, married with a young daughter and felt he’d gone as far as he could in the corporate world, so, when the opportunity presented itself where he was in a position to retire, he took it.

Being able to provide for his family both emotionally and financially was a motivating factor for Andrew after his own childhood was spent in poverty.

Recalling his childhood, Andrew comments, “I grew up in one of the outer suburbs of Melbourne, in a house which was pretty much falling apart. We struggled to pay the bills and to put enough food on the table, so it wasn’t an easy lifestyle. But, I knew the one thing I couldn’t be denied was free public education, so I made the most of that.”

Andrew’s parents had children late in life: he’s the eldest of three boys and his father was fifty when he was born. Both his parents lived on the pension but they had big dreams for their sons and encouraged Andrew to get into medicine.

“I actually wanted to get in IT back then,” Andrew reveals, “but I settled halfway between by getting into physics to keep my parents happy, but it wasn’t what I wanted to do.”

When Andrew found the right opportunity, “I actually engineered my way into the computer industry. I did that by attending computer clubs with the aim of finding a job, and achieved that in just six months. Over time, I realised security was the field to be in because it was constantly changing and there was always going to be a demand for it.”

It was the mid-nineties and the internet was then restricted to academic and research facilities, but even then information was being accessed illegally. Once the internet became a commercial network, “cyber-crime spread like a wildfire”.

According to Andrew you can’t stop cyber-crime, you can only reduce it.

“It’s a bit like trying to stop the common cold or trying to stop traditional crime or even the road fatality toll: you can get it down to a manageable level but you can never completely stop it. It’s very difficult to control because it is so widespread; everybody has access to information these days, everybody is a target.”

The bottom line for Andrew is that cyber-criminals “are stealing information because information has value. To put it into perspective, if I was to steal your credit card details, that would be worth about forty-five dollars on the black market. On that basis, I wouldn’t simply steal one set of credit card details, I would steal millions.”

Taking that further: “This means in a couple of days you could potentially make a few million dollars. That could be as much as fifty million dollars if you position it correctly on the black market.”

With cyber-crime increasing alarmingly, organisations began knocking on Andrew’s ‘retired’ door.

In hindsight, Andrew admits, “it’s fair to say I was pretty good at what I did. I would look at things from a completely different angle. I didn’t focus just on the technology, which I see as a huge mistake in this industry. The cyber-security industry seems to be focused on looking at the next technology that is going to solve all the problems. But considering the hackers – the cyber-criminals – are humans, it actually takes humans to catch humans.”

Initially Andrew played hard to get, not because he was holding out for a better deal, but because spending time with his family was of higher value.

“But, they kept knocking, they kept asking. They were only able to solve part of the problems they were facing and kept saying there was no-one else they could turn to. That was when I actually relented. I suppose there was a sense of feeling a moral responsibility to come out of retirement and help them.”

The first thing Andrew emphasised was the need to accept the fact that cyber-crime is here to stay, then he set about changing a few basic rules on how to combat it.

Typically, Andrew says, “IT people manage your computers, but what often happens is that accountability is pushed down to them when their computers are hacked. That’s unfair because they can only solve part of the problem.

“When cyber-criminals strike, it has a lot more than an operational impact. In has physical, personal, legal, reputational and financial impacts.”

In Andrew’s view, “that’s when you need to get your finance, PR, legal and compliance people involved.”

By making IT accountable for this aspect of business, Andrew firmly believes “you’re only going to solve the operational aspect of it. What needs to happen is that accountability needs to go back up to the Board. That drives the Board to put together the right team, so collectively they can deal with it as a business problem.”

The challenge facing Andrew Bycroft now is the demand for his services. He has a unique set of skills to control a growing problem, but there’s only so much one man do. “It is quite difficult. In fact, I haven’t found anyone with quite the same set of skills as me and I guess that’s because I’ve built up these skills over a long period of time, through experience.”

What Andrew can find, though, are “people who have a cyber-security background and they realise what they are doing isn’t solving the whole problem. So, when I find them, I take them on board and mentor them, giving them the education they need to get to that point where they can replicate what I do. They may not be as efficient as I am, but they can certainly replicate what I do.”

Now, those sales, marketing and public speaking skills, together with the Darth Vader suit, are coming into their own as The International Cyber Resilience Institute has grown from a one-man band to twenty-six full-time employees across five countries and a research team in Manila.

To Andrew, this is just the beginning. “I believe in the next five years my company will grow to around a hundred and twenty people. It’s something I need to manage, because I don’t want to grow too quickly but obviously I need to make sure I’m satisfying the demand.”

Andrew finds himself spending more time in the field these days, selling and marketing his company and networking – using all those entrepreneurial skills that didn’t come easily to an introverted computer nerd.

The basics instilled in him at an even earlier stage haven’t altered though: “my personality might have changed, but my values haven’t. It might sound like a cliché, but honesty and integrity are very important, I believe, especially in my industry, it’s all about trust. At the same time I see authenticity as being very important.”

One of the things Andrew feels his business does differently to his competitors is “send in people who are very authentic to do the job. They can sit down and have the right conversation, they have the right skills and won’t have to say, for example, ‘sorry, I don’t have the answer to that, let me come back to you in a week’. Being authentic means sending in people from the start who are highly educated and skilled in what we do.”

ADVICE

There are many lessons to learn from Andrew Bycroft if you’re embarking on your own entrepreneurial career. Arguably the main one would be to not blame your current environment for your lack of success or desire.

Andrew changed his personality, learnt new skills and put himself in uncomfortable situations to become the person he needed to be to have a successful business.

Happily, he says, “I also realised my perceived weaknesses could also be strengths. I realised that in being introverted, I could actually have a conversation and educate people in that conversation and make a sale as opposed to doing the loud obnoxious pitch, to which a lot of salespeople resort. So I found a unique way to sell.”

Andrew has condensed his experiences into three key areas:

“Firstly, passion is very important. These days with the work/life balance shifting heavily towards work, it’s not enough to just enjoy what you do in life, you need to enjoy what you do in work. So if you’re starting a company make sure it’s based on some sort of passion.”

For Andrew, “the next thing is purpose. If you don’t have purpose, then you’re going to find your passion is a hobby. That’s great and can provide plenty of joy, but it could also suck a lot of money and time away from you. But, if you turn that into a proper business, it actually creates revenue for you.”

Finally, and perhaps most critically, “the last one is pivot: the ability to make sure you can adapt. Obviously we live in a very fast-paced world, so it’s essential to have the ability to adapt and keep up with trends to make sure you don’t become stale in whatever it is you enjoy doing.”

Andrew’s own journey is testament to that last point, “pivoting from physics into IT and then from IT into security and then what I’m doing today, which I guess is more in the management and consulting field. So the ability to adapt and stay fresh is very important.”