International Strategy Working Group Case Study: VigiTrust

Case study put together by the IIA International Strategy Working Group reviewing the success and experience of Irish based entrepreneurs internationalizing their businesses

Company: VigiTrust

Interviewee: Mathieu Gorge, Founder & CEO
Date: August 14, 2009
Written by: Una Coleman, Codegaconsulting, member IIA International Strategy Working Group

Synopsis of company

Mathieu Gorge is CEO of VigiTrust, a specialist solutions provider in security assessments, compliance and security e-learning. Founded in Dublin in 2003 by Mathieu, VigiTrust is rapidly building a global reputation as a niche leader specialising in Cyber-crime, the Payment Card Industry Data Security Standard (PCI DSS) and ISO 27001 focusing on human aspects of security including social engineering and awareness training. VigiTrust already works with and leverages references from Blue Chip clients. It advises numerous tier 1 banks and retailers as well as government departments on how to design, develop and implement durable security strategies. Mathieu’s articles are published in the ISSA Journal and Computer Fraud Security Journal

VigiTrust is based in Dublin with US offices in NYC.

1. Why internationalise – what were the drivers?

A desire to be an entrepreneur

Mathieu’s and VigiTrust’s story is not unlike many other entrepreneurs and start-ups. He had an overriding drive to set-up his own business, coupled with a passion to bring something new to the security market. He had spent several years in the corporate world, acting as a sales person, project manager and product manager in the security re-selling space building a reputation as an industry expert.

Responding to market demands

VigiTrust started out as a service provider, with a focus on data protection. Back in 2003, there was much less emphasis on data protection, more on firewalls and anti-virus software and solutions. As Mathieu leveraged his existing network and reputation, he quickly found he and VigiTrust were being sucked back into the security re-seller space. It would take another few years for the market to mature to the point where VigiTrust could offer a differentiated service around its initial ambitions for data security.

A global play

In the meantime, VigiTrust was generating revenue and gaining a reputation as a thought leader. VigiTrust was delivering security workshops in Dublin and London and consulting on governance and compliance.

At the same time, the market was moving to greater demands for governance and compliance – driven in the very early years by the Worldcom and Enron scandals, more recently the Bernard Madoff debacle. It was clear that VigiTrust would need to have a global reputation and be a global player if it was to be successful in this space and give itself a future exit option. The US was leading the field of governance and compliance: it would be a key market within which to gain a reputation as a solutions provider and the launch pad into other countries.

As the business model matured, VigiTrust exploited the opportunity to productize its offering through its e-learning tools and build real IP (intellectual property) in the company.

2. How did you win your first client? How influential was winning your first client in developing the market?

Winning that all important client (not necessarily the first client) was enormously influential in setting VigiTrust on the path to internationalization and success. Like many others before, it was down to a mix of previously established reputation, hard work and luck. In 2004 it won a tender with the Dept. of Justice, which opened up a lot of doors. In mid 2005, a small German company was looking for security experience to manage the inherent dangers of using multi-functional printers. Mathieu’s reputation and google key word search won VigiTrust the gig. As it turned out this company was the path to VigiTrust’s first multinational, corporate client, HP. A one day consulting contract with HP quickly lead to 100 days to eventually allow VigiTrust to becoming HP’s Imaging and Printing Group de facto external security consultants. At one of those early meetings with HP EMEA, one of the HP IPG’s senior executives said to Mathieu, “This is going to be very successful for your company”.

“Success brings success”, says Mathieu Gorge. VigiTrust leveraged the HP client reference which then helped it win a contract with MasterCard in New York.

3. What needed to be in place?

• A differentiator: technology and subject matter expertise. It’s important to identify your USP (unique selling point).
• Positioning as a thought leader with deep experience in the security field.
• A strong understanding of the competitive environment: your ideal and “no go” customers: the decision makers and decision making process.
• A relevant market offering.
• An understanding of one’s strategic position.
• Understanding the requirement to think about strategic development whilst progressing on day-to-day basis at a tactical level (long term vs short-term goals and ambitions)

4. What were the main challenges / obstacles?

Lack of experience as an entrepreneur and in running a business.

5. How did you overcome them?

Tapping into all the support structures and expertise that is available in Ireland: Enterprise Ireland, Dublin Enterprise Board (mentoring and coaching), Dublin BIC.

6. What activities were most successful in achieving success?

Mathieu is an evangelist for the work of EI and believes the Irish brand, particularly in the space of security and e-learning, positions Ireland (and Irish companies) on the global map for expertise.

7. What are your most effective routes to market and why?

Growth for VigiTrust is predicated on building sales through local Channel Partners. While VigiTrust’s current model has the opportunity of being a pure internet play – doing business through the internet, enabled by web-based applications and SaaS (software as a service), a sales process supported by reputation, client references, white papers, webinars, web demos, VigiTrust believes that it will need to have a physical presence in each of its key markets to substantially build its revenue and support its Channel Partner Distribution model.

The Channel Partners will give you the cultural plug-in.

8. What markets did you focus on?

As previously noted, the US is a key market for VigiTrust. It now has a sales office in New York.

Even though Mathieu is French, he says Enterprise Ireland’s support, in conjunction with the Irish Embassy in Paris, has opened the French market much more so than his French nationality.

Contrary to popular perception, VigiTrust has not found the UK an easy market to penetrate. This is not least due to strong competition and limited resources to dedicate to opening up and maintaining a presence in several countries at this stage in its maturity. VigiTrust believes that the decision making process and buying patterns in the UK are different to that of other western countries.

9. What were the key learnings? (legal, tax, language, culture)?

Localisation

As a small, but growing company, managing marketing materials and websites in several languages is difficult. For now, VigiTrust’s main website and marketing material is in English, with front page local language websites to come shortly in French and German. This includes website translation (at a minimum), localised sales and marketing materials, local SEO, creation of press packs etc.

Mathieu delivers his conference presentations in English and French. For German speaking audiences he uses slides in German and delivers either in German or English. He can participate in conference Q&A in these 3 languages. He believes this gives him a cultural edge.

Channel Partners (CP)

One must be committed to one’s CPs. Continual training and support of the CP is essential as is a CP programme. Mathieu praises Dublin BIC for the support they give them in developing a CP programme.

It is easier to recruit CPs when you have reference clients in their respective markets.

Exchange Rate

The exchange rate can have an impact on one’s sales and marketing budget and the opportunity cost of opening up new markets: eg UK is now more cost-effective to target as it was when exchange rate was GBP 1 = 1.5 Euro. Young organizations need to understand the opportunity cost and not just focus on the size of the market.

Finance & accounting

Get yourself a good management account: an outsource model works well. You must understand the tax system (in different countries).

Cash is king. Having an early understanding of accounting is valuable – P&L, Balance Sheet, Cashflow statements.

The importance of having a Business Plan from the outset and revising at least yearly.

Scale and market credibility

In the US, large buyer organizations like to meet their supplier shareholders. If you are a HPSU, (High Potential Start-up) with EI as a shareholder, use it!

10. What marketing initiatives have you used to support your internationalization?

Building a public profile

Much of Mathieu’s marketing efforts were focused on writing articles and white papers (in English, and French – 2 languages in which he is comfortable), attending conferences, and eventually, being invited to present at conferences in the US, UAE, Hong-Kong, Germany, France, the UK and Ireland.

Participating in the right networks

It’s easy to waste time in the early days networking in the wrong places. Identify the business and subject matter networks for your industry: for instance the PCI council (there are only 3 or 4 Irish members – 79 in Europe).

The Irish American business community and networks are very powerful.

Leveraging client references and testimonials

SEO

Some SEO activity in local markets.

11. What advice would you would give companies starting out on internationalization?

• Recognise where you don’t have skills: work with people who’ve done it before.
• Be mindful of what is realistic for you to achieve.
• Be prepared to make sacrifices but be aware of the impact of your entrepreneurial zealousness on your family and personal relationships: understand family obligations.

12. What are your future plans with respect to internationalization?

VigiTrust has identified its Tier 1 markets as: US and Canada to be followed by Tier 2: UK, Germany and France and Tier 3: Brazil and Australia.

It already has sales and clients in the US, Canada, Ireland, Germany and France.

VigiTrust is building an international business to give itself a 3 year exist strategy.