Cyber-security is now the focus of everyone’s attention – the protection of personal data and defense against cyberattacks have become priorities for companies and governments alike. In a field where the nature of the threat is constantly evolving, innovation is an absolute necessity. While the United States and Israel dominate, France is starting to make a name for itself thanks to the dynamism of its cyber-security start-ups and the diversity of the schemes set up to support them. This article takes a closer look at the specificities of the ecosystem in France.
Cybersecurity in France
A dynamic base of over 100 start-ups
There are currently over 100 innovative start-ups and SMEs active in the field of cyber-security in France. This constantly growing number reflects the dynamism of the sector in France and the advantages it offers in this area. The sector represents over 1,000 direct jobs. And while that may not seem a lot, this number is expected to increase significantly over the next few years.
Most start-ups choose to reinvent security solutions that are already well established
60% of start-ups enter the market with the intention of improving on security solutions that already have a proven track record (device security, network security, email security, identity management, etc.).
As a general rule, tackling an already consolidated market is not simple. But there are still windows of opportunity, particularly in application security. Many of the major players are present in this field, and yet they still do not offer truly satisfactory solutions. The innovative approaches taken by start-ups such as Sqreen, Ingen and Yagaan can provide new paths forward.
Industrial security, cryptography and reverse engineering : innovative fields in which France is well-positioned
In reality, numerous French start-ups (40%) have positioned themselves in technologies where everything remains to be done.
For industrial systems, for example, French players such as Sentryo and Seclab are particularly well placed.
This is also the case for technologies used to analyze malware, with products and services such as those offered by Tetrane and Quarkslab. Their expertise is internationally acknowledged, including by major American groups.
In cryptography, the French school of mathematics enables start-ups to enjoy access to cutting-edge expertise, difficult to access in other countries. This helps them to develop innovative vulnerability analysis tools such as Cryptosense.
On the other hand, certain fields continue to be neglected in France despite strong growth potential, including deception techniques (that aim to provide false information to a hacker to slow them down), which are gaining popularity in Israel, and even at a European level.
French start-ups experience difficulties with communication and appreciation of their expertise
The national ecosystem of start-ups is very dynamic and even the highly specialized forms of expertise exist, helping to turn ideas into reality and launch the first products. A key point is nevertheless required for the cyber-security market: the ability to communicate effectively. Our contact with several foreign incubators shows a striking difference in terms of communication with Anglo-Saxon start-ups able to promote their products using hard-hitting pitches and effective marketing.
This lack of commercial know-how is particularly negative for French start-ups that wish to take their products to an international level.
France – fertile ground for cyber start-ups
For several years, many initiatives have been developing to support the cyber sector in France. We could mention the government’s Digital Security strategy driven by the French IT security agency (ANSSI) or the investments made by the Ministry of Defense. Different economic clusters are involved, which in practice translates into a geographic concentration of start-ups. Paris, as is often the case, is in the lead, but Lyon, Rennes and the south of France are also very much present.
Methodology for the construction of the start-up radar
Since 2015, Wavestone has been actively monitoring the start-up ecosystem as part of its ShakeUp program. With its many contacts and activities within the ecosystem of cyber-security innovation in France, the start-up radar now lists almost 400 structures across Europe and the world, with a special focus on France. The criteria for joining the French radar: registered office in France, less than 35 employees, and a legal structure that is less than 7 years old (excluding for major hubs).
Following these monitoring activities by the cyber-security practice and digital trust teams, we meet up with the most innovative start-ups to evaluate their solution, and some are selected to join ShakeUp, the Wavestone accelerator program.
Support structures are numerous and active, but not very specialized
France is a global leader in innovation with no less than 228 incubators, and around fifty accelerators. But in comparison to Israel, Switzerland and the United Kingdom, we do not have incubation or acceleration structures dedicated specifically to cyber-security. Certain incubators have created clusters to concentrate the necessary skills, but they still do not provide specialized support. It is therefore rare to find coaches in these structures who have an in-depth knowledge of the cyber market, its players and its specificities, particularly the product purchasing and qualifying process. Axeleo and Wavestone are perhaps the most similar to the dedicated foreign structures. Looking forwards, a regional initiative called Ocssimore will be starting in Toulouse in September 2017. “FrenchTech”, which enjoys excellent international visibility, has recently begun to focus on the issue of cyber-security with the creation of the Security & Privacy network.
A favorable, but perfectible funding ecosystem
France has real strengths when it comes to funding innovation, and many start-ups are evidence of its effectiveness. The “Programme Investissement Avenir” (invest in the future) invests 22 billion euros in research; the Research Tax Credit and the status of “Jeune Entreprise Innovante” (young innovative enterprise) help to reduce the costs of R&D, social charges, and corporate taxation.
For its part, BPI France provides a wide range of funding opportunities for entrepreneurs and support activities thanks to its partners (banks, investors, local authorities, etc.) and, through accelerators, it offers participatory loans and can stand as guarantor for the banks.
Many forms of regional support are also available. At the same time, we are seeing a distinct increase in corporate ventures, as well as Business Angels who are often even in competition with each other to invest in the best cyber start-ups.
Nevertheless, the complex ecosystem with its many different players often makes finding funding complicated. The formalities for raising funds often resemble a real marathon, with bureaucracy still very much present. It is necessary to have a detailed plan of attack, to apply for every scheme at the right time with the right application… but without sacrificing the time needed to grow the start-up! Finally, few major French groups tend to acquire start-ups, with the latter being tempted to accept offers from foreign companies.
France has a vibrant cybersecurity start-up ecosystem; the country ranks among global leaders in this field. Indeed, the creation of start-ups in France is supported by numerous structures. But these start-ups need to find many customers for their development so they seek them among corporate accounts.
