Interview: Eldar Tuvey

Talking to someone about the internet's effect on our lives is a bit like discussing the impact of the weather. We all know it's there, it's changing all the time and going on about it is not going to make any difference, yet we do it anyway.

But for Eldar Tuvey, chief executive and co-founder of ScanSafe, it's a little different. The web is pretty fundamental to his life - and he has some justification in claiming that what he does has some effect on the functioning of the internet, if not the weather. If William Goldman's famous quote about the movie business that "nobody knows anything" can be applied to the web, then Tuvey knows something.

Following a lucrative career in investment banking with Goldman Sachs in London and Hong Kong, he founded what was to become ScanSafe eight years ago with his brother Roy as a regular managed service provider. Originally, ScanSafe operated as an email marketing business for a couple of internet cafe chains. It was through this that the pair began to understand the ins and outs of HTTP-based web mail; not so much, Tuvey explains, for security purposes, as how to handle millions of web requests without slowing it all down. Life was different then.

"At that time, we'd find many companies saying 'we don't have people who surf the web', or 'we do that for about one hour at lunch time', or 'only the sales people are allowed to use the web'. We never come across that any more," he says.

The eureka moment came in 2003 when the company expanded into malware prevention with its first managed security service offering. "We saw the success that Postini and MessageLabs were having with email, and so we thought we could do that with the web," Tuvey recalls.

"It's worked out through a little bit of judgement and a lot of luck that the threat has moved from email to the web, from the inbox to the browser - you very rarely get a big virus outbreak on email these days. Everyone's now focused on spyware and Web 2.0 threats", he says.

With a BSc in economics from Bristol University and an MBA from international business school INSEAD, Tuvey would never claim to be a technical expert; something those who have worked with him would confirm. But he does have a reputation for having enormous drive and the ability to spot a gap in the market. He believes that his banking experience, combined with the recognition that he doesn't have all the answers, has enabled him to outperform rivals in the market.

Tuvey certainly doesn't lack confidence or the ability to talk up his company. And he looks the part: the big watch, good suit, nice shirt, put together well. In short, the model businessman.

Likeable and charming as he is, that will only get you so far, and Tuvey knows it. "If you work in this industry for eight years, you become heavily involved with product development. You need to think about where the company is going, what we should be developing, which area we should be looking at, where the threat is coming from," he lists, mostly to point out that he doesn't just sit at the top of the table waiting for the results to come in.

"We do like to succeed. We like to compete. We've got some good technology because we were the first, and we still have a lead over some really large companies out there," he boasts.

When he launched ScanSafe, the product that eventually gave its name to the company, the industry was sceptical. "People told us it wasn't possible, that we would slow down web traffic by trying to scan it in real time, but we'd already done it," he says. "So we launched our very first web virus scanning service."

And here they were, hundreds of web-borne bits of malware being blocked by the fledgling company. "And week by week, we could see there were more viruses as people started focusing their attention on the web. That was really the eureka moment," he says.

I suggest that it's going to be difficult to maintain market share, especially as the space is becoming so crowded and competitive. "Look," he says, "there are 20 or 25 web security companies out there; a lot protect users when they're surfing the web, but there are only three that I know deliver it as a service. Our unique selling point is that we were the first to do it."

He claims not to be bothered about what the rest of the industry, or even his closest competitors, are getting up to and dismisses the fevered M&A activity we've been seeing over the past couple of years. "I've been involved in a few M&A deals from my own companies, but this is one of the fastest-moving markets I've ever seen. You go from pioneer to commoditisation in a blink of the eye. It's slightly ridiculous," Tuvey says.

"We just need to keep doing well, to continue delivering results, let everything else die down and just focus. We can't get our heads turned by all this activity. But certainly I think the big companies are looking to figure out how they're going to have some sort of participation in this market."

So there's the business confidence again, but his answers to the developing threat landscape are a little different, confirming his reputation for not pretending to know what he doesn't. What he does have is a team of very bright people recently recruited from Cambridge University.

These young hopefuls are charged with developing machine-learning technology to identify trends and new types of attacks before they become prevalent. Tuvey is confident that ScanSafe is likely to steal another march on its competitors.

"Websense can't do this. It has more customers, but that's just bits of software on thousands of PCs - they don't know what they are surfing," he claims. "We've got corporate customers in about 40 countries, and all their web traffic is routed through us. This gives us an enormous amount of data.

"So, roughly speaking we're scanning something like seven billion web requests a month. That's a huge amount of data. We know what people are visiting, where threats are coming from, which sites they're going to, which sites they're getting hacked by. It gives us unique insight, and the more data you have the better that insight is," he says, staking a claim for industry leadership.

There follows a slightly wonky explanation of how all this machine learning actually works in reality, Ns sort of become Xs, apparently. Tuvey then gives up, realising that Ns and Xs and other algebraic theories are beyond us both, but happy that his brilliant Cambridge graduates will sort it all out.

The important thing is that his company will be using techniques to find anomalies, uncover any curious behaviour and spot trends quickly, he says. He admits that finding clever technical people is hard due to the competition from the likes of Goldman Sachs, Merrill Lynch and other cash-rich organisations looking to hire the best developers. "The banks, the law firms, the consultancies, the hedge funds; they suck up the best talent. They can pay for it, which makes it difficult for us at the moment,' he laments.

Last year, the company launched a free download called Scandoo, which acts as rating service for websites. Users can block access to a site based on their own ratings and approval; it has obvious uses in the home market but, as Tuvey admits, it has benefits for the company too.

"It serves a core purpose for us. Ninety per cent of new websites are visited through searches. Some of the sponsored links on Google are a big source of malware, because people pay to drive people to their infected sites," he explains.

"It seemed natural that we would offer it as a free service to consumers while we're perfecting it, and as consumers go to different types of sites than our corporate customers, it enables us to see a different segment of the web," he adds.

"What we're trying to do is to get users themselves to categorise the web. That then feeds through to our corporate users and helps categorisation for them." And of course, as he concedes, it's a great marketing tool. It provides free research for the company, and a bit of extra protection for web users.

Perhaps Google should be doing more to protect users of its dominant search tools. Tuvey says firmly that what Google is doing is simply its business model. He is less than keen to criticise the company for doing what he does: make money from the web. "Its business is to sell advertising," he says. "But Google has made some strides and is starting to focus on the security aspects of what it does."

In fact, in a recent statement regarding Goggle's purchase of Postini, Tuvey was more effusive about Google's efforts on web security. ScanSafe's CEO said that the acquisition showed Google was placing more emphasis on the safety of its users' web-based applications and searches and that this was a good thing. "Now that Google has successfully entered the market for hosted office applications, it needs to assure customers that its offerings are secure against spam, viruses and other malware," he told the world.

Tuvey claims that ScanSafe has the edge over the anti-virus and "signature guys", as he calls them, mostly because they cannot detect attacks buried in websites. "We'll block those before any of the AV companies have reacted to them. We can see things they just can't".

He mentions the Nationwide Mercury Prize website as an example. "We found a particular IFrame that was being used to link people through to a piece of malware. That's something that AV outfits such as Symantec can't possibly know about. They can update signatures, but they don't know where it's emanating from," he claims.

With this kind of confidence and tangible enthusiasm for his business it's no surprise that Tuvey doesn't think too far beyond ScanSafe in terms of what he may do next. He's having too much fun. "There is no life after ScanSafe!" he says, laughing.

"There may well be," he backtracks slightly. "It may turn out that I do something else at some point in the future, but we're not into looking at the next thing and thinking about encryption or something else. There's just a huge amount that we can still do."

And to make the point he teases me with talk of an unspecified new product. He gets excited again. "This is something that no one else does, and it's coming. We have fun innovating and keeping ahead of where the market is, and then watching the market catch up," he enthuses.

"It's always a nice feeling when you're a little bit ahead of the curve and being proved right. I spend the majority of my waking hours in this office, so it's nice to be challenged and to have fun doing what you're doing," he adds.

ScanSafe has been listed as a "hot company" in the security industry in Michael Moe's book Finding the Next Starbucks, a guide for investors searching for the corporate stars of tomorrow. Now there's something to live up to. Is that likely to happen, I wonder. Tuvey signs out with a flourish.

"I don't know about our company being as big as them, but I know that the problem is bigger than Starbucks. I'm not sure whether we'll be as big as Starbucks. I doubt it very much," he says. Really? Such modesty. I can't help but think Tuvey would love to be as big as the coffee giant.

interviewsecurity