The house that hacks built: Cyber defender sells to Fujitsu
Outfit set up by ex-GCSB managers says 7-year-old business ready to go global
InPhySec, a Wellington-based cybersecurity firm founded by a trio of ex-GCSB managers, has been sold to Japanese multinational Fujitsu.
The seven-year-old firm gained profile after it was parachuted in to review the NZX’s cyberdefences following an April 2020 DDoS attack that took the exchange offline for days.
“I have always maintained that InPhySec is not for sale,” chief executive and co-founder Marc Barlow said.
“Over the years, we have dismissed many offers because we felt they had the wrong motivations.
“However, Fujitsu presented a highly compelling offer that is wholly about opportunity. With Fujitsu’s support we have the opportunity to take InPhySec beyond New Zealand’s shores. This is fantastic news for our team of 70-plus who all get to enjoy the rising tide that comes with this opportunity.”
How fantastic?
Neither party will reveal financial terms of the deal — although it appears to be somewhere south of the Overseas Investment Office’s $100 million approval threshold.
Barlow was the GCSB’s vulnerability assessment team lead, then later head of the spy agency’s National Cyber Security Centre forensic investigation and response lead until 2013.
He co-founded InPhySec in 2015 with Jonathan Berry — a former GCSB manager who worked as technical lead on the agency’s Cabinetmandated Cyber Security Plan for Government Information and Assets.
The pair were soon joined by a third director, Ian Fletcher — who served as the GCSB’s chief executive between January 2012 and February 2015, a period when the agency was found to have illegally spied on Kim Dotcom. In an increasingly crowded field of cybersecurity firms, InPhySec says its “intelligence-led” approach is its point of difference.
It works with three insurers — Vero Liability, Delta and Donaldson Brown — on loss prevention and incident recovery. As well as an assessment of software and policies across a broad range of government and industry, it offers a review of physical security — and says it has audited “most major NZ data centres”.
Ahead of the Fujitsu takeover, Barlow (33.3 per cent), Berry (33 per cent) and Fletcher (13 per cent) were
InPhySec has reached the point of its maturity where we want to take it global. For us to achieve this ambition, it made the most sense for us to collaborate with a wellrespected and mature partner.
Marc Barlow, InPhySec
the three largest shareholders.
The deal is due to close on October 1. On completion of the acquisition, Barlow will report to Graeme Beardsell, executive VP and chief executive of Fujitsu Asia Pacific.
“InPhySec — a small group of three people to now being around 75 people,” Barlow said.
“Unlike some of our local competitors, we’ve organically grown to this size, as opposed to a product of small acquisitions. This brings a real cohesiveness and consistency.
“Now InPhySec has reached the point of its maturity where we want to take it global. We are very good at what we do and we offer a globally relevant set of services.
“For us to achieve this ambition, it made the most sense for us to collaborate with a well-respected and mature partner.”