The Security Interviews: Building the UK’s future cyber ecosystem

From national security to cyber security

You might be forgiven for thinking that Huq, who at one time trained to fly with the RAF, trod the standard military path into cyber security – through signals intelligence, GCHQ, and so on. But in his case, the path was less obvious – an unscheduled career change first saw him move into consultancy, where he ended up working on technology projects at the likes of Deloitte and PwC.

“I had a burgeoning interest in cyber security and I supported a number of large cyber security transformation programmes, typically in financial services,” he explains. “Coupled with that, I had always had an interest in innovation and entrepreneurship.”

Huq graduated from advisory work to take on operational responsibility for a major digital transformation project, a large part of which was cyber-related. From there, the combination of experience made it an easy jump to Plexal, and ultimately Lorca within that.

“What personally motivates me is I’ve always been a mission-oriented person,” he says. “It was actually something I found difficult to square when I left the military and joined the commercial sector, but the work we do here is very mission-oriented.”

More latterly, the worlds of national security and cyber security have met head-on with the emergence of digital, tech-enabled warfare capabilities, and threat actors backed (covertly and openly) by nation states considered hostile to the UK and her allies. With a foot in both worlds, Huq spies opportunity here.

“Technology has become much more central to national security in terms of execution of operations, and as a result of that, technology becomes more centralised and there is greater opportunity for collaboration with the private sector. The integrated defensive security view talks a lot about that in terms of ecosystem engagement,” he says.

Indeed, Westminster’s new £2.6bn National Cyber Strategy comprehensively highlights the importance of the cyber ecosystem in helping meet government policy.

“That’s the role Plexal plays in terms of building those ecosystems, integrating public and private capabilities, and bringing the best people forward with the best products to meet the right opportunities, whether they’re in the public or private sector,” says Huq.

Inside the Plexal process

So what is the process of moving through a Plexal-delivered programme like as a cyber startup or scaleup? Huq sees its specialism as helping to shape an organisation’s innovation strategy and providing for them an ecosystem of other organisations and services to lean on as they aim to meet their strategic requirements.

“We help them shape that and then we can execute against that plan on their behalf,” he says. “We’re doing that at the moment for a number of large technology organisations in domains including not just defence and national security, but also space technologies or the health sector, all with a cyber security slant. We’ve worked with over 280 companies in various guises over the past three-and-a-half years.

“Startups are important for enabling the concept of secure by design because they’re typically starting from a blank sheet of paper, they’re not encumbered by legacy technologies. I want to ensure that we don’t create the legacy of the future by forgetting about security”

Saj Huq, Plexal

“As a result, we have quite a broad spectrum of companies across multiple stages, but also different category areas of products, and also different sets of focuses. That’s where we think we can help companies or startups if they come to us specifically, not just to receive benefits such as potential business opportunities, but also help them shape how they can potentially pivot into new markets as well, given our breadth.”

Huq speaks of an ongoing “horizontal polarisation” of security, with a growing need to embed security into pretty much every element of technology, which, in his view, makes it hard for entrepreneurs to zero in on areas of relevance and work out how to secure the increase in digitisation across sectors.

Plexal has a role to play here, Huq believes, by helping new business leaders understand concepts such as “secure by design”, particularly in sectors that may not have previously thought about cyber as core to their business.

“From an enablement perspective, it allows them to create better products, it allows them to launch new technologies, and it allows them to secure their own supply chain, because they can now understand these concepts in a way that is relevant to them,” he explains.

“What we’re doing to enable that is running events with a broader cross-section of industry, not just security companies. Likewise, we’re going to look to bring in programmes where we can pair security and non-security experts together around a broader digital proposition, or product, so that security can genuinely be thought about at the point of conception of new products and services,” says Huq.

“Startups are important for enabling the concept of secure by design because they’re typically starting from a blank sheet of paper, they’re not encumbered by legacy technologies. I want to ensure that we don’t create the legacy of the future by forgetting about security.”

Skills and education

Security being as much a human problem as it is a technical one, there is also a growing need for cyber startups to innovate around people, something Huq says may have been neglected until recently.

“We identified a specific company, Capslock, who were deploying a new type of business model aimed at helping people enter the sector or reskill from previous jobs, an absolutely brilliant business and we’re really proud of them in terms of how they’ve grown,” he says.

With cyber skills development having been traditionally focused on training platforms – which still have their uses – Capslock’s business model sets out to lower the barriers for people to enter the security sector if they come from a non-traditional background or lack the financial resources to get themselves started.

“They basically defer any fee structure, akin to a student loan, until you are earning over a certain amount after they’ve put you through a training process and placed you into an organisation,” says Huq. “I think they’re now the largest provider of income share agreements in the UK, after formal academic institutions. They’ve really helped diversify the supply chain of talent in the sector and, as a result, they’re forming partnerships with DCMS [the Department for Digital, Culture, Media & Sport] and other government departments that are amplifying what they do.

“So there is definitely a people aspect to the innovation process and I still feel that more needs to be done there – it’s great to see startups like Capslock doing really well.”