Next Generation Cybersecurity Training: Why EIP Invested in RangeForce

By Nazo Moosa

Protection of critical infrastructure is at the heart of EIP’s mission to help innovators transform asset intensive industries. Over the last few years, infrastructure around the world — including power generation and transmission lines, communications networks, and the data centres that keep the essential services operating — have all experienced devastating cybersecurity attacks. Covid-19 has changed the type, but not the frequency of attacks.

We work closely with our partners to really understand these threats. And as we’ve spent more time with the executives responsible for the national infrastructure across North America, Europe and Asia, we’ve found there is a common concern about their ability to defend their organisation in the event of a breach.

They tell us that while they have plenty of ‘kit’ designed to keep them at the leading edge of cyber advancements, only ~25% of it is ever used in an organisation. Furthermore, no amount of kit can make up for operator error. Having the right tools is immensely important, but they are only as effective as the operators trained to use them.

That simple fact has brought us to the thesis behind our investment in RangeForce: The skill gap is the next frontier in cybersecurity. Every organisations’ resiliency is weakened because of the difficulty attracting leading talent and maintaining a current skill base for that talent.

The heart of any cybersecurity strategy — the security operations centre (SOC) — is expensive to operate, averaging $2.8 million annually. A third of this cost is employees. And, given that it can take a year to train a single SOC analyst and there are 1 to 1.5 million more open roles than there are eligible candidates, holding on to your key people is a necessity. Organizations simply cannot afford high rates of employee churn.

Keeping skills relevant and staff engaged is not easy. Traditional classroom-based courses can be overly theoretical, quickly outdated and expensive. In the Covid-era they are also no longer feasible, adding to the problem of how CISOs keep pace with the speed of change in the underlying technology and the increasing sophistication of hacker networks. The organisation learns the most during a real attack, but the costs can be devastating for them.

It was this problem that RangeForce, EIP’s latest investment, identified and set out to solve with realistic cyber-simulation tools that mimic a real attack.

From a learning standpoint, the next best thing to a real attack is a highly realistic, simulated environment. Active learning has been demonstrated time and again to better prepare the organisations when a real cyberattack happens. A hands-on, cyber range in the cloud that exposes the practitioner to the latest threats and vendor tools, while instilling muscle memory to mitigate them, enables a true human layer of security orchestration.

This is what RangeForce and its founder, Taavi Musk, have now achieved. I first met Taavi when he had just secured his seed financing from Paladin Capital. He had built his career developing complex cybersecurity simulation ranges for NATO in his native Estonia, the country with the population of 1.3 million inhabitants that has given us unicorns such as Skype, Transferwise and Bolt. And he was ready to conquer two continents with just 10 employees.

Until recently, cyber ranges were large, complex, bespoke environments used by those in critical industries such as the defence sector. With this in mind, Taavi developed his vision to bring the benefits of immersive, highly realistic simulations that mimic cyberattacks to the broader enterprise market.

When I joined EIP late last year, Taavi was one of the first people I contacted. Since our first meeting the company has experienced a 400% surge in demand and has won customers such as Barclays, Santander, Sodexho and Microsoft. At EIP, we believe in trying before buying. Taavi and his team presented to over one dozen CISOs from our investor base who collectively represent annual capex spending of $65bn+. We gained great insights through their interactions and, in that process, RangeForce won a few new customers.

RangeForce marks EIPs fifth investment in cybersecurity over the last three years.

The overlap between cybersecurity and e-learning remains an important investment theme which EIP will continue to mine. We’re really excited to be able to make this commitment to RangeForce and also to welcome Cisco as an investor and partner in RangeForce and Oliver Friedrichs, VP Products at Splunk to the Board.