Emily Orton | From founding days to IPO

Thank you very much, William. Very nice to have you here. Let's start out with the basics: who is Emily Orton? Well, great question. I'm the Chief Marketing Officer at Darktrace. I've been with the company since it was founded, so I'm part of the co-founding team. I'll tell you a bit about Darktrace as well. Darktrace is a cybersecurity company based in Cambridge. We were actually the first company to develop AI back in 2013, when we founded, that was capable of interrupting in-progress cyber attacks inside a company's systems. My journey has been going from the very early days setting that company up through to today, where Darktrace recently floated on the London Stock Exchange. A bit of background: you might want to hear about the founding story. What was interesting when we started Darktrace was the whole approach to cybersecurity was based on this idea of having a wall around your network, keeping bad actors off your systems altogether. The whole industry was built around this fundamental principle of keeping the bad guy off. Today, that whole approach is discredited; it doesn't work. The reason is that people are on your systems all the time. Your employees need to get into your systems, your customers are connecting to your networks. Today we have remote working, so many ways of interacting with data, which is great but also makes us very vulnerable. We really came in with this question: how do you deal with the situation where the bad guy can get in? In many cases, when we start working with organizations, we find that the bad actor, the threat, is inside already. It was a really different way of looking at the problem of security and how a technology like AI could be used to overcome that.

Well, it's really interesting because I am a linguist by background. I studied French and Spanish literature. How did I get into technology? It's a great question because it's not an obvious path. Certainly, if you go across Europe, I remember traveling in France and Spain, it seems kind of strange. As I said, when I traveled in the rest of Europe, people would say, 'You're a literature graduate, how did that happen?' Let me explain. I think it's really important for employers to be open in the way they hire. I was lucky enough to have an opportunity to work within a technology company at the beginning of my career. Darktrace was actually a company founded out of Cambridge, which is a very rich ecosystem in terms of technology. I studied there, so I was close to the Cambridge ecosystem and started working in Cambridge companies from the beginning of my career. At the beginning at Darktrace, I didn't know where it was going necessarily, but what I did know was that there were some really bright people behind it. We were founded by mathematicians coming out of the university, out of that science base in Cambridge. What attracted me, as someone who enjoys communicating and translating ideas into compelling concepts, was firstly that it was a massive challenge working with people whose brains work in a very different way to yours. I really liked being part of adding something different and unique to some very serious brainpower. We have PhDs in physics, computing, statistical modeling—pure scientific disciplines—and I'm translating that. I started in the early days building up that initial communication strategy. Eight years on, I'm now leading a global division. It's definitely been a lot of learning in my career in terms of how technology works, how science works. I love to encourage people coming out of universities in these broader subjects. You don't need a business degree to do business; that is a reality. What you want is someone capable, creative, with the ability to think laterally around a problem. You really want to give those people the ability to learn. That's something really important at Darktrace: getting capable people and allowing them to learn on the job. That's very much what I've done.

Absolutely. Just to pick up on your previous point, people used to ask me if I was a teacher or a translator when I said I studied French. I agree it would be great to start changing that mentality. In terms of building up the brand, Darktrace serves over 5,000 organizations currently across all industry sectors and different sizes of business. We work with enterprises with thousands of employees as well as smaller to medium businesses. I talked about coming into the market with a very different approach. There is no silver bullet to cybersecurity. A lot of people will tell you you can stop breaches, but you can't. You're vulnerable. We were coming in with a very different message. There was a lot of education we had to do in the early days to explain a different approach. This wasn't an incremental improvement on an existing approach; it was something very different. One of the key things for us has been to facilitate our customers to be storytellers around how they use our technology and what the benefits are. In the security industry, the customers we serve are a skeptical and demanding bunch. They have a tough job defending their businesses' intellectual property and employees. There's a lot of stress. What we've been able to do is foster a great community within the Darktrace customer community where they can share peer-to-peer insights of how this is used and the value. That's as important now as it was at the early stage. When you're getting a product out to market, the first thing I would say is get customer feedback early. It can be tempting to create the perfect product, but you need that feedback early. That's been really important for us: iterating the product based on customer feedback. In terms of the brand, really allowing our customers to tell stories and have a platform, because the threat landscape has changed so much in the last decade. It's become more sophisticated and aggressive. It's important to have that interchange. We've set up forum events where we bring chief information security officers, who are typically our buyers, to events where they can come together not just to talk about Darktrace but to talk about the problems they're facing. If you can help create those communities and interactions, you get a really great advocate base who will do that job really well because they want to hear from their peers.

Absolutely. One of the first events we did was a forum event where we set up a Q&A, invited people in the industry, and allowed the audience to ask questions. It was a really interactive event where we could talk about our approach but with an emphasis on interaction. We had networking afterwards. Everything you can do to create that community is ultimately good for your brand.

It's a really good point. Getting that initial momentum is your first priority as a new business. You want to lower the barriers as much as possible to get that first customer relationship, which is as good for you as it is for them. It's a mutual relationship. As I said, that feedback is absolutely critical; you can't build a product without getting it early. For us, we were founded by mathematicians, and the genesis was coupling that group with individuals coming out of the UK intelligence services, GCHQ and MI5, who had direct experience of the cyber threat at a government level and had worked with large corporations, seeing the extent to which they were getting infiltrated. We had a great team with a lot of credibility. We built an advisory council early on where people talked about why this approach was necessary. It's an existential problem; you're not going to have a business if your engineering blueprints are being stolen or competitors go after your customer databases. It was a critical demand we recognized. Being able to couple up external parties that validated the approach was really powerful in getting those early customers engaged. The second thing is very practical. We're an AI company. Today there's a lot of hype around AI, but that wasn't the case when we started. We knew as a deep tech company with a different approach that at the end of the day, you need to show it working, not just in a test lab theoretically, but in their systems. From a very early point, we decided to roll out a trial period where we would provide the technology free of charge, install it into the customer's environment, whether in their data center or cloud, wherever they wanted to test it. We go in and start looking at those systems. The way AI works is it goes in and starts learning what is normal activity for that business, the pattern of life, the day-to-day cadence of the employees. It learns that and develops a sense of what we call, if you think about the immune system and how the human body defends itself, it's similar. It's predicated on the idea that you're not going to keep bad stuff outside; your skin won't keep everything out. You have to find and identify bad stuff intrusions internally. We have a similar model where we put the AI inside and then show them what we found. The real test and proof is that in over 75% of organizations where we go in and apply that AI, we find threatening activity that the company was unaware of despite investment in that wall and a mature approach to perimeter security. Being able to put that technology in the hands of our customers was critical in building early credibility and winning those first customer wins.

Darktrace today has 1,600 employees, so we've done a lot of hiring over the past eight years. The first thing to say is that hiring is probably the most important thing you can do when building a business. People are critical. Understanding what you're looking for and communicating that across the business when you get to scale is really important. We're looking for very bright, capable people. In our Cambridge R&D team, we're looking for highly skilled scientists and software engineers. They are a finite resource and the magic team doing the amazing engineering work. But across the business, we need skills to commercialize and scale. For us, it was about getting skilled, capable, bright people, but remembering that you can learn a lot on the job. In security, we have a massive skills crisis; we don't have enough people who know cybersecurity. We realized that a lot of that can be implemented on the job. We spent a lot of time developing training programs to get people up to speed. What you're looking for when hiring is that potential and core competency. It can be tempting to look for specific degrees or capabilities, but you'll miss a lot of really good people if you're too narrow. For us, it was about spotting potential. When you're growing a company, you are hiring your future leaders, whether it's an entry-level position. You need to think, could this be a future leader? That has allowed us to get really interesting people who perhaps don't fit a particular mold, whether in a commercial role or a cybersecurity analyst role. It creates a great culture of continual learning and opens up amazing career paths. We have people who studied classics and have gone on to join the software development team. Those career paths were unimaginable to me at university, but we see them at Darktrace. Believe in people's core capability; they can learn, and I've seen that proved out in various departments. We have a bit of a rule at Darktrace: you want to take a problem back to its first principles. You're not rolling out playbooks; with tech, often there is no playbook. You're in new territory. You don't necessarily want someone who has the management answer or a preconceived idea of how to run a business. You want someone to sit back and think, if I took this back to first principles, what is the problem and how can I solve it? Often you get the most creative solutions when you take that approach.

Absolutely. One of the joys of seeing a company grow is seeing people grow. We have people on the team who have been with us three to five years and have had amazing careers, learning and escalating, and now leading teams of their own. It's really fulfilling to see people develop exciting career paths with our company.

A lot of learning, clearly. The company has changed a huge amount from when I started, just developing the first website and doing the first events and collateral. Running a team is very different. Scaling has been the big challenge. It's a cultural challenge: how do you make sure that entrepreneurial culture, which is important to us even as a large company, is maintained when you're not physically there and can't influence everyone directly? For myself, it's been about having a really strong leadership team that can do that in different regions of the world. I'm continually learning. You need to be a little humble when you're in a fast-growth industry; you won't have all the answers. Even now, we're looking at new technologies and new ways to apply AI, and we have to rethink how we sell and roll out to customers. It's about getting the balance right between directing and executing strategy, but also being open to learning. It's important for my whole team to constantly learn and keep up with changes in the market and technology. It's really exciting. We are now at a really exciting stage with this amazing platform we've achieved through floating the company earlier this year. We're excited about how to get to the next phase of growth. These milestones give me a lot of energy. I'm really excited about growing Darktrace's presence into new emerging markets and really exciting product launches that will change the way people think about enterprise security and AI. The wonderful thing about being in tech is you're always learning; you're rarely resting on your laurels. It's a challenge, but it keeps it exciting. You're never just executing the same playbook; you have to be on your toes all the time.

I think the first thing to say is that in the UK, and in Europe as well, particularly in the UK, we have second-to-none scientific research. We have the ecosystem in terms of universities and funding. It's really important to maintain that great support and funding for research; it's the core base we rely on to create companies like Darktrace. We do really well on that, and we need to continue that support from a government perspective. Within our business, it's an absolute priority to keep innovating. It's not something you do at the beginning and then launch the company. We're a deep tech company, an AI company at our core, developing solutions for cybersecurity. We very much see ourselves as an AI company, a mathematics company at its core. Within our R&D team in Cambridge, they are mathematicians, not all cybersecurity specialists. We need those core capabilities to be innovative and rethink problems. We have a range of skills within the R&D team. As we get larger, we have a lot of customer roadmap plans, but in parallel we have several teams working on pure research and innovation. The core there is giving them the time and space to think laterally. If you're always executing on a roadmap, you won't give people the headspace to think about new problems. What's exciting about Darktrace is we have an AI that learns a sense of self for a company, a very fundamental capability understanding the digital DNA of an organization. We are conscious that the application of that could also be interesting outside of cybersecurity. We are actively investing in our R&D team, increasing its size, and giving teams the ability to spend time on how we could use this not just in security but in other areas of business. Getting those bright people and giving them the space and encouragement is how we get to these really interesting new innovations that create whole new tracks.

We expanded internationally pretty quickly. In the first couple of years, we already had close to 20 offices around the world, so it was pretty rapid. We took the approach of going out because we knew there was demand. It's a fundamental problem: companies were getting infiltrated and experiencing cyber intrusion. One of the key learnings is that culture is probably one of the big concerns. How do you make sure it doesn't feel like you're setting up five or six different companies but a single company? That's really hard. It comes down to the people you have setting up. You need people who are brought into your culture, not just good at sales, but who spent time with the founding group and can build that culture in different regions. We went to North America and across Europe pretty quickly, expanded to Asia, and then added Latin America and other exciting emerging markets. Getting that leadership in place was important. We also took the approach of having centers of gravity in those regions, really strong hubs with office environments where people can collaborate and get that culture. It's really hard at the moment with the global pandemic; people haven't been able to do that. Running a remote workforce when you've just started is a challenge. Some companies have done well, but it would have been a challenge for us because we wanted people to meet and have somewhere to go back to. We created regional hubs: Singapore for Asia Pacific, San Francisco and New York as key hubs in the US. We made sure there was enough interaction from the founding team getting out and spending time in the markets. Markets are different. From a marketing perspective, understanding where you need to localize is important. There are language barriers and different business practices. In parts of Asia, your event strategy may not work the same way as in Europe because of cultural practice. You want to translate your culture but also listen to cultural norms and get that balance right. Ultimately, you have a team that is proud of your culture and that HQ link, but also feels they have the autonomy to make it work for their market.

I don't think there is a perfect time. It was certainly an aspiration shared by the leadership team for a long time. We've always been very ambitious for the company since its early days, so it was on the horizon. The time was right for us in terms of the threat landscape. You've seen the escalation in attacks really ramp up in the last year. Summer has become almost synonymous with cyber attack for a lot of people. It was a really good time to double down. The flotation has enabled us to invest and expand our R&D team in Cambridge and get those innovation projects done more quickly. It was the right time from a market perspective and internally to put the pedal down. It's been a really interesting time for talent flows and getting the right people on board. We've been doing a lot of hiring, particularly in our R&D team. The timing worked for us. It's given us an amazing platform that pegs us in terms of growth and gets us to the next stage.

Absolutely, no question. There is a huge amount of credibility. What was great about the IPO was our customers' feedback. They're really proud of being part of the Darktrace journey pre-IPO. It's really nice when you can take customers along a journey, those early customers who were trailblazers trying a brand new approach, coming all the way up to the IPO. It's validating for that customer community. That was one of the joys: getting that great feedback. You're completely correct that credibility is valuable in expanding and getting bigger customer wins.

I must say I'm slightly disappointed because we were all waiting for the bell to ring and be at the stock exchange with balloons, but it was a global pandemic and very different. Personally, that was a bit of a shame. The team speaking to investors day in, day out had to do it on Zoom, not how we imagined it. You really want to be sitting with people, looking into the whites of their eyes, talking about your business. There was a lot of Zoom fatigue by the end. That was a challenge, but it was amazing to see how we pulled it off virtually. What's really nice about the whole process, certainly as a founder coming through the business, is that you're in the weeds day in, day out, just pushing forward day by day. It was a great opportunity to take a step back and look at the business as an external party would. It's a moment of pride because we get to present not just the business today but also the business tomorrow and show that pathway. It surprised me, not our business because I know it well, but really looking at the amazing future we have was really exciting and motivating. It was a great moment for our employees as well. Again, it was the pandemic, so it was a shame we couldn't get together and have that big party. We did do one later, but it was an amazing moment for all the employees who have been on that journey for years. For me, it was just a great moment of pride recognizing the last eight years.

Well, thanks so much for having me. Thank you, and thank you to everyone who tuned in. See you in the next episode. Bye.