Hack Attack

REVIEW SUMMARY
Business. KnowBe4, Clearwater
Industry. Technology, computer security
Key. Founder wants to grow startup firm in a nascent segment of the computer-security industry.

When technology entrepreneur Stu Sjouwerman set out on a new product mission six years ago, he mimicked the approach of a giant pharmaceutical firm.

He studied the issue. He hired a team of experts. And most significantly, Sjouwerman's firm, downtown Clearwater-based Sunbelt Software, spent a chunk of money — at least $10 million — to check and double-check the product's usability and veracity. But unlike a blockbuster cholesterol pill, Sjouwerman's mission was to develop software that could quickly and accurately fend off vicious computer virus attacks.

The approach worked. Worked so well, actually, that Sunbelt, with nearly 200 employees and $20 million in sales through 2009, didn't have the internal capacity to meet demand, which surpassed 1,000 units a month. “It took off so fast that I got worried,” says Sjouwerman, an Amsterdam native whose last name is pronounced “shower-man.”

So Sjouwerman and his business partners sold Sunbelt to a much larger software operation, a company owned by a $5 billion venture capital and private equity firm. The sales price wasn't disclosed.

Now, after a short break, Sjouwerman is back in the computer-security business.

This time the company is KnowBe4. Also based in downtown Clearwater, the firm provides Web-based Internet security training for small and mid-size businesses. At Sunbelt, the model was to develop and sell a product that could detect and defeat computer virus attacks.

KnowBe4 stretches that model. The firm's cyber-security training helps clients protect against phishing scams, which use hyperlinks in emails to lure people into malicious websites.

“I was retired for five days,” says Sjouwerman. “I decided I wanted to do something that was fun, but also useful.”

Sjouwerman might be on to something functional with KnowBe4, considering the results of a covert phishing experiment the firm recently conducted. Sjouwerman and his team sent out test phishing emails to employees at more than 3,500 companies on Inc. magazine's list of the 5,000 fastest-growing businesses nationwide. He found the domain names and email addresses from Inc.com and other websites.

An employee who clicked on the fake-scam link was sent to a page that let them know they had just taken part in phishing research. The results: At least one employee from about 15% of the companies clicked on the scam. That's nearly 500 businesses.

It's a scarily large sampling. It's also a roadmap for potential clients.

That's why Sjouwerman isn't shy about his growth plans for KnowBe4. “We're going for volume,” Sjouwerman says. “We aren't going to stay small.”

The firm has eight employees. Sjouwerman aims to double sales each year through 2016, when the goal is to surpass $25 million. He projects about $1.5 million in 2011 revenues.

'Hot product'
Sjouwerman backs up those lofty goals with a strong track record.

The most recent example of that success is Sunbelt, when the firm created its line of VIPRE antivirus products. The line was a huge hit in the community of system administrators for small and mid-size businesses, techies who made up the bulk of Sunbelt's client base. The IT people raved about VIPRE's speed and simplicity.

“Everybody needs antivirus, but a lot of people aren't happy with their antivirus,” says Alex Eckelberry, who was Sunbelt's CEO. “This is a genuinely better solution.”

Adds Sjouwerman: “We knew we had the tiger by the tail. We knew we had a hot product that could make it.”

Sjouwerman and Eckelberry nonetheless decided their best move was to sell the firm, rather than fail in an effort to keep up with the demand. They found a buyer in GFI Software, a Cary, N.C.-based business-to-business IT firm with offices in eight countries. Insight Venture Partners, a New York City-based private equity firm, owns GFI.

GFI bought Sunbelt in July 2010. Says Sjouwerman: “They had the resources to take it where it needed to be.”

That place, it turns out, is still Clearwater. GFI opened an office in town after the acquisition that now has at least 200 employees, including many former Sunbelt staffers. It also seeks to hire more local programmers and developers.

Moreover, GFI continues to invest in the local operation in other ways, says Eckelberry, who joined the firm after the sale and now runs its security business unit. For instance, GFI overhauled Sunbelt's antiquated phone-system, Eckelberry says. That move saved time and helped the sales force find new clients.

“With Sunbelt, it was a constant struggle for cash,” says Eckelberry. “GFI came in and really invested in infrastructure and resources.”

The positive vibes Sunbelt executives have for GFI are mutual.

“We were impressed by the high quality and innovative technology that underlies Sunbelt's VIPRE line of products...” GFI Software CEO Walter Scott says in a release that announced the acquisition. “We have acquired a good, growing and cash-flow-positive business that fits well within GFI's strategic vision to consolidate our products and grow our business.”

Target clients
Sjouwerman, meanwhile, shifted his enthusiasm to KnowBe4.

Sjouwerman dropped out of college in Amsterdam in the late 1970s, both to get away from academia and to get into the world of IT. He and some friends formed a software company that implemented automated membership systems for nonprofits. Greenpeace was an early client.

He then worked in IT for a few Dutch businesses and entities, including the Amsterdam equivalent of the U.S. Postal Service. In 1988 Sjouwerman moved to Paris, where he worked for Sunbelt International. The firm focused mostly on content management software at the time.

The jackpot, though, was when Sjouwerman relocated to Clearwater in 1993 and he and some business partners opened a U.S. subsidiary of Sunbelt. The concentration was to create and sell software to go with Microsoft Windows, which was relatively new back then.

The piggyback worked: Sunbelt grew from $8 million in annual sales in 1998 to $18 million in 2002, when it made the Inc. 500.

Soon after that year, Sunbelt switched its focus from Windows-related products to anti-spam and antispyware. That was the genesis of VIPRE.

And while viruses remain dangerous threats, Sjouwerman says phishing scams and similar schemes are the Next Big Thing in computer and Internet security. He compares phishing criminals to the mafia. “The bad guys have gone professional,” says Sjouwerman, “in a big way.”

That's the crux of the KnowBe4 sales pitch. The firm has 36 clients so far, mostly in the financial and healthcare industries.

KnowBe4 was also recently asked to bid on an Internet security-training job for a company with 50,000 employees. KnowBe4's fees would only come from employees who need the training. But Sjouwerman says the potential work is a “significant turning point for KnowBe4, indicating that we are now a real contender in our industry.”

One more key spot to find clients, Sjouwerman hopes, will be to mine the list of companies with an employee who failed the covert phishing experiment KnowBe4 ran earlier this year.

“Any business that provides access to email or access to its networks via the Internet is only as safe from cybercrime to the degree that its employees are trained to avoid phishing emails,” Sjouwerman says in a press release that touts the experiment. “The more employees within an organization who use email or go online, the greater the risk of exposure to cybercrime.”

And it's protection against that risk that boosts Sjouwerman's confidence in his ambitious goals, especially the one to reach $25 million in annual sales in five years. “You have to shoot for the moon,” says Sjouwerman, “even though you might land in some trees.”

Protect Yourself

Stu Sjouwerman has been in the IT business for 30 years, including the last decade in cyber security.

Sjouwerman's startup firm, Clearwater-based KnowBe4, provides cyber-security training for small and mid-size businesses. The training prepares clients to protect their company against email phishing scams, which use hyperlinks to lure people into malicious websites.

Here are Sjouwerman's tips for business owners and executives on IT and computer security:

• Be vigilant: Make sure all IT antimalware defenses are up to date, says Sjouwerman, and aren't being turned off by employees because it slows down their computer.

• Be smart: Use a separate personal computer from work for online banking, and use it only for financial transactions. No email, and no Web surfing, Sjouwerman suggests. “Ideally it's not even connected to your normal business network,” says Sjouwerman, “but never use a wireless network for online banking.”

• Be proactive: Provide training for employees to ensure they aren't an easy target for hackers who break into the network through phishing email attacks.