Exporting Cybersecurity Services to the World

Cynalytica Inc., Arlington County

Virginia is a national leader in the cybersecurity and technology industries, offering tech firms access to the highest concentration of tech talent and the third-largest tech industry workforce in the country. Tech firms in Virginia focus on a wide range of issues, from basic cybersecurity functions, to government-level security, to specialized services such as protecting manufacturing operations and managed security.

Not every country has the same level of cybersecurity offerings as the United States, especially as the sophistication of attacks and the needed security tools become more specialized. Virginia cybersecurity companies are filling the void by exporting their products and services around the world.

Cybersecurity on the International Stage

For many civilians, cybercrime has always been something that happens to someone else. Ransomware has changed that. The millions of dollars’ worth of cryptocurrency at stake in enterprise-level cyberattacks are an abstract concept to most, but when ransomware causes long lines at the gas station or shuts down a hospital and prevents patients from getting life-saving treatment, the attack becomes very real to everyone.

The motive behind cyberattacks isn’t always monetary, particularly on the global stage. “You have state actors who are looking to conduct espionage, the goal of which is to not destroy anything, but rather collect information,” said Eric Malawer, CEO of Arlington-based cybersecurity company BluVector, which uses artificial intelligence (AI) and a proprietary machine-learning engine to enhance its protection for commercial and government clients. “You have state actors looking to disrupt or punish.”

Internationally, there’s a very strong geopolitical component to cybercrime. For example, the tensions between mainland China and Taiwan and Hong Kong, the current state of the Middle East, and threats from North Korea all drive risks to cyber networks, infrastructure, and systems.

BluVector, Arlington County

International Help

The U.S. cybersecurity market is on overload. It’s a hot industry rife with opportunities to expand into providing cybersecurity tools and expertise. According to Malawer, BluVector previously worked primarily with the federal government and saw international trade as an opportunity to expand its customer base. Organizations based abroad may not have access to more sophisticated security systems, but are at high risk for a nation-state attack, which BluVector’s platform is prepared to detect and hunt down.

However, because of compliance regulations and legal requirements at all levels, an American cybersecurity company cannot simply reach out to a foreign entity and make the sale. “Working with VEDP’s International Trade division can help to facilitate consultations with companies around the world,” said Richard Robinson, CEO of Arlington-based cybersecurity company Cynalytica, Inc.

“What they’ll do is hire a regional contractor to help us with the facilitation,” Robinson explained. “The regional contractors are knowledgeable about the local laws and have a good understanding of the market and what companies there are looking for.”

VEDP’s team of international research consultants covers more than 80 countries around the world. These experts provide valuable in-country market research specific to a company’s products and services, compiling background information, identifying potential representatives, conducting due diligence, and arranging appointments with potential distributors and customers.

Finding the Services That Fit International Needs

Cynalytica specializes in hardware and software for industrial control systems and the industrial internet of things (IIoT). Critical infrastructure around the world is vulnerable to ever-more-sophisticated cyberattacks, making security more important than ever. Yet the hardware — and often any software — that constitutes this infrastructure often consists of legacy systems that need to be upgraded to meet today’s technology standards.

Cynalytica’s analytics and machine learning-driven products are compatible with critical infrastructure for most applications. Finding the right fit is not a problem, but when selling into other countries, the company — which, in addition to its U.S. federal clients, exports to Australia and the United Arab Emirates, along with several South American countries — needs assistance with understanding local laws, finding the appropriate customers, and then working with the proper agencies to make sure that everything is conducted in a legal, cost-efficient manner.

“One interesting thing going into these different regions is most of them require, as part of doing business, that there is a regional component to the business,” Robinson said. That might mean setting up a subsidiary in that area or sourcing as much labor or supplies locally as possible.

Guidance With Complicated Issues

VEDP’s international trade resources help guide companies through any roadblocks that may exist in selling into another country. For example, some countries have very strict rules about the percentage of local employees who must be hired by a foreign entity setting up a business. VEDP services help companies fulfill those requirements and deploy their resources where they can make the greatest impact.

While many ventures overseas are intended to set up new business, companies also often need to expand to better serve existing international clients. BluVector works in European countries where parent company Comcast or affiliates like Sky are already located. A U.S. company using BluVector’s services will open offices in other countries, which requires increasing and shifting operations deployment. This allows an easy, efficient introduction into the international market, which can lead to new opportunities.

“It opens the number of conversations we’re having. The more conversations, the more relationships you’re going to close,” said Malawer.

To help with that process, BluVector joined VEDP’s Virginia Leaders in Export Trade (VALET) program in 2021. VALET is an award-winning, two-year international business acceleration program. Benefits include executive training, international sales plan development, educational events, and customized research provided by VEDP and private sector partners.

Challenges and Risks

Cybersecurity is focused on addressing and mitigating risks. Managing cybersecurity across cultures offers some unique challenges. With so many U.S. vendors offering cybersecurity products and services, the noise level in the overall cybersecurity market is deafening. It’s difficult enough to get American companies to find the right security systems among the hundreds of vendors; that difficulty increases in foreign markets, where regulations may impact the system’s viability. Data privacy laws, such as the General Data Protection Regulation in the European Union, are in various stages of legislation and implementation all around the world. Deploying cybersecurity solutions in different countries may require different approaches to how customer data is handled.

BluVector, Arlington County

Another potential issue is how security systems are delivered. Managed security service may work in one location, but in another country with a more bureaucratic environment, a managed service offering might have to be shifted to a more hands-on, in-person solution. Legacy systems with an archaic internet infrastructure require a different level of expertise to put together the right security solution for an international company’s needs and network architecture.

“Maturity” is a term used often in the cybersecurity space, particularly when working in a global setting. Most American cybersecurity companies rely on next-generation solutions, but because of the vast selection of offerings, organizations in the United States have more options when considering the right solution based on their own levels of tech sophistication. When working across different countries, the cybersecurity company’s solutions can be more mature than the demand in those markets. For example, while AI and machine learning are emerging tools for cybersecurity solutions, an international organization may not yet have a need for this type of cybersecurity. The level of service from Virginia-based companies has to make sense for both the cybersecurity company and the international business.

“Our solutions can be a bit ahead of where some organizations are in how they think about their cybersecurity problems and their level of maturity in the problems they’re currently trying to solve,” Malawer said.

In such a competitive, global cybersecurity market, education is a must — both on what the product or solution offers and on how employees use the product or solution to cut down on errors that lead to cyber incidents.

Exporting cybersecurity systems and tools overseas leads to questions for companies. For example, will an overseas market have the capabilities and maturity to ensure that a company’s solution will be a good fit? Companies must be prepared to provide support for international clients, even if it requires sending support personnel overseas. The logistical considerations of providing customer support should be a primary consideration before any overseas deals — a big investment that is often overlooked until it is too late, according to Malawer.

“Later comes pretty quickly sometimes,” he said.

However, those questions shouldn’t deter companies from exporting cybersecurity services if they have the capacity, and VEDP’s customized services can help determine whether that’s the case. By exploring opportunities internationally, cybersecurity companies can make global communications and internet traffic safer, reduce exposure to the risk of domestic economic slowdowns, and increase revenue, leading to more jobs and investment back home.