Good Hackers against Bad Hackers - The New Strategy in Cyber Attacks

With her company, Fabiola Munguia supports companies in the fight against cyber attacks. In doing so, it also relies on the help of hackers. Because many companies only become particularly painfully aware of the topic of IT security in a certain phase.

Fabiola Munguia has a lot to do. She receives masses of customer inquiries these days, says the founder. "It's a bit like having a doctor," she says. "Few patients come for a prophylactic health check. Most of them come when something hurts them acutely." Cyber attacks cause their customers pain.

The intrusion of criminals into company computer systems can cause enormous financial damage to companies. In the recently published "Risk Barometer" by Allianz's industrial insurer AGCS, cybercrime ranks first among the risks for companies and thus before natural disasters and pandemics.

In 2020, the US company Cybersecurity Ventures estimated the sum of corporate damages caused by criminal hackers worldwide at six trillion US dollars for the year 2021. This horrendous figure is due, among other things, to data theft, extortion, loss of productivity and costs of repairing damage.

Start-up Secfix fights against evil hackers

None of this is new. Nevertheless, many, especially smaller companies and start-ups, find it difficult to protect themselves, observes the Munich founder, so that they only end up with her when it has already happened.

With their start-up Secfix, Fabiola Munguia and her co-founder Grigory Emelianov offer companies help to find and fix security gaps in their computer systems – with the help of hackers. Good hackers, if you will. Or as Munguia says: "Ethical Hackers". Those who have nothing evil in mind.

The big problem, however, is: How do you recognize a good hacker? How do you know who to trust? "You can't google ethical hackers," says Munguia. So what she and her partner founded was, in the first step, a trustworthy marketplace for non-criminal hackers.

"You need a very good network for that," she explains. "Logically, we can't take everyone, but have to go through a complex verification process with every hacker."

Basically, she does not work with lone fighters or freelancers, all her hackers are already organized through hacker networks or agencies. "This is important if only because they are so insured in the event that they accidentally break something while working on a company network."

In addition, she does a background check of all agencies and hackers. Most of her "Ethical Hackers" come from Europe, but she also works with some in the US and Australia.

Vulnerable in the growth phase

When Fabiola trusts a hacker, she refers him to her customers. "Most of them are start-ups from Seed to Series C," she says. This is a phase in which the topic of cybersecurity first comes to the attention of many companies – often in a painful way. Many "evil" hackers are aware that the growing up companies are the most vulnerable, according to Munguia.

However, this is only part of the services offered by the Munich-based start-up. The second part is a software solution that allows companies to certify their cybersecurity status. There is an ISO standard for this, ISO 27001.

Especially when start-ups want to work with large companies, the corporations require proof of the security of the computer networks of the smaller business partner.

"Becoming and remaining ISO 27001 compliant is incredibly time-consuming," munguia explains. It is a pain that bothers start-ups more than others. The implementation process is very manual and can take up to a year. With Secfix, she and her co-founder Grigory Emelianov have now developed a security monitoring platform that can shorten this to weeks or a few months.

Cybersecurity concerns everyone

And then, with Secfix, she also has a third area of work: to create awareness of the topic of cybersecurity. "The biggest problem is that this area is completely non-transparent." When founders build a business, cybersecurity is often the last thing they have in mind. "And if they do, they don't know where to start."

And where do you start? "Actually with your own people," says Fabiola Munguia. Employees are the number one security risk. Post-It's with passwords on the computer? There are plenty. Access codes sent via WhatsApp? Too. And phishing emails are still an often successful trick for criminals to break into corporate networks. Looked at fleetingly, the mail looks like from the boss.

"Employees often do not feel responsible for the IT security of their company," says Munguia. "They just think, 'That's what tech ops does.' Unfortunately, this is not true: every employee has to help keep the company safe."

And is Fabiola Munguia afraid of cybercriminals? Has she ever been afraid that a non-ethical hacker, whom she virtually puts a stop to, will take revenge? "I'm not afraid, but I'm cautious," she says. "I know what can happen. And I try to take precautions to keep the risk as low as possible." However, there is never one hundred percent security to be protected against Cyber attacks, she says.

Fabiola Munguia didn't really think that she would one day take care of the cybersecurity of growing start-ups in Germany. When she came to Germany from El Salvador for her business administration studies and for a master's degree in management and technology at the Technical University of Munich, she had a career in the automotive industry in mind.

In fact, she also worked at BMW, MAN and Volkswagen before the opportunity arose to found a company. "My parents are both entrepreneurs, I've always experienced all the ups and downs of entrepreneurial life and never really wanted to do it myself," she laughs. But on the other hand, as long as she is young and bears little risk, now is the right moment.

Secfix is supported by the Flixbus investors

In a six-figure pre-seed round in 2021, well-known investors joined her company, including the founders of Hotel.de, Torsten Sturm, Heinz Raufer and Reinhard Wick (the first investors of Flixbus), as well as Heinrich Arnold (former CEO of Detecon International and Head of Research at Telekom), Paul Taffee (CEO of Finance People Solutions and former CFO of Pepsi Cola, Nike and Dell DACH), Sarah Wolff (CEO of I-Welt) and Andrea Lederer (Director Market Management at Expedia).