Acquisition adds industry leading threat hunting platform to F-Secure’s detection and response offering and expands cyber security services to the biggest markets globally

New Delhi, India– June 19, 2018: F-Secure has on 18 June 2018 signed an agreement to acquire all the outstanding shares of MWR InfoSecurity, a privately held cyber security company operating globally from its main offices in the UK, the US, South Africa and Singapore. The acquisition is a significant milestone in the execution of F-Secure’s growth strategy, and makes it the largest European single source of cyber security services and detection and response solutions.

Today businesses are challenged by a dynamic advanced threat landscape in which attackers continuously use well-designed technology to circumvent traditional protection. Security perimeters are no longer enough to protect organizations, and developing better security capabilities on their own is out of reach for many organizations. Due to the shortage of skilled cyber security experts in-house there is a huge demand for both products and services to proactively search for newly emerging threats, detect and respond faster and especially stop future incidents. F-Secure’s combination of man and machine – an approach shared by MWR InfoSecurity – uniquely positions the company to support businesses to fight advanced attacks with its cyber security products and services.

“The acquisition brings MWR InfoSecurity’s industry-renowned technologies to F-Secure making our detection and response offering unrivaled. Their threat hunting platform (Countercept) is one of the most advanced in the market and is an excellent complement to our existing technologies,” said F-Secure CEO Samu Konttinen. “I’m thrilled to welcome MWR InfoSecurity’s employees to F-Secure. With their vast experience and hundreds of experts performing cyber security services on four continents, we will have unparalleled visibility into real-life cyber attacks 24/7. This enables us to detect indicators across an incredible breadth of attacks so we can protect our customers effectively. As most companies currently lack these capabilities, this represents a significant opportunity to accelerate F-Secure’s growth.”

With close to 400 employees, MWR InfoSecurity is among the largest cyber security service providers serving enterprises globally. MWR InfoSecurity has highly skilled experts in offensive techniques who understand the attacker mindset and is well-known in the industry for its technical expertise and research. Its threat hunting platform Countercept provides extensive proactive attack detection and complements F-Secure’s existing strengths. Additionally, F-Secure’s portfolio will be enhanced by MWR InfoSecurity’s suite of managed phishing protection services (phishd). As cyber criminals increasingly target companies through their employees, it’s crucial to enable company personnel to identify and avoid these email borne attacks.

“We’ve always relied on research-driven innovations executed by the best people and technology. This approach has earned MWR InfoSecurity the trust of some of the largest organizations in the world,” says MWR InfoSecurity CEO, Ian Shaw who will join F-Secure’s Leadership Team after closing of the transaction in July. “We see this approach thriving at F-Secure, and we look forward to working together so that we can break new ground in the cyber security industry.”

The combined company will have hundreds of the world’s best cyber security consultants, making F-Secure one of the few truly global technical security advisors positioned to help organizations fight today’s most sophisticated threats. Learnings from the most challenging incident investigations and from targeted attack simulations provide insights that feed directly back into product creation, ensuring the company’s detection and response solutions are constantly upgraded to meet the latest threats.

Financial overview of MWR InfoSecurity

Figures in the table are for illustrative purposes only and reflects MWR InfoSecurity’s accounting principles according to UK GAAP. Figures for financial year 2017 are based on MWR InfoSecurity’ audited financial statements. Figures for 2018 reflect MWR InfoSecurity’s estimated financial performance for the financial year ending on 30 June, 2018.

EUR million	1 Jul 2016 – 30 Jun 2017	1 Jul 2017 – 30 Jun 2018	Change
Revenue	25.1	31.1	+24%
EBIT	-0.6	-0.5	+22%

Figures have been translated into Euros by using the average exchange rate for the British Pound for the financial period (0.8595 forFY2017: 1 July 2016 – 30 Jun 2017; 0.8870 for FY2018: 1 July 2017 – 31 May, 2018).

Completion, consideration and financing

The transaction is expected to be completed in early July 2018. The initial cash consideration for the completed acquisition of all of the outstanding shares of MWR InfoSecurity Limited is GBP 80 million (EUR 91,6 million), subject to customary cash, debt and working capital adjustments. In addition, an earn-out of a maximum of GBP 25 million (EUR 28,6 million) in cash will be paid after 18 months of the completion subject to the achievement of agreed business targets for the period from 1 July, 2018, until 31 December, 2019.

Consideration figures have been translated into Euros by using the average exchange rate of 0.8732 for the British Pound on 15 June 2018.

F-Secure is financially well-prepared for the transaction with a strong balance sheet. The transaction will be financed by F-Secure’s cash reserve and committed bank financing. The bilateral EUR 60 million five-year financing arrangement with Nordea Bank comprises a long term loan as well as a revolving credit limit and includes customary covenants. The upfront payment will be made with company’s cash assets and the term loan of EUR 37 million.

About F-Secure

Nobody knows cyber security like F-Secure. For three decades, F-Secure has driven innovations in cyber security, defending tens of thousands of companies and millions of people. With unsurpassed experience in endpoint protection as well as detection and response, F-Secure shields enterprises and consumers against everything from advanced cyber attacks and data breaches to widespread ransomware infections. F-Secure’s sophisticated technology combines the power of machine learning with the human expertise of its world-renowned security labs for a singular approach called Live Security. F-Secure’s security experts have participated in more European cyber crime scene investigations than any other company in the market, and its products are sold all over the world by over 200 broadband and mobile operators and thousands of resellers.

Founded in 1988, F-Secure is listed on the NASDAQ OMX Helsinki Ltd.

f-secure.com | twitter.com/fsecure | facebook.com/f-secure

Volkswagen shouldn’t sue University researchers – it should employ them

Cars are now a genuine target for cyber criminals and it is possible for attackers to gain control of a vehicle while it is in motion, with disastrous consequences.

Alex Fidgen, Director at IT security company MWR InfoSecurity, said:  “It is feasible that an exploitation of any number of embedded devices within a car might allow an attacker to gain control. For instance, this would have serious consequences if the brakes were applied at high speed.”

The comment was made after Volkswagen allegedly sued the University of Birmingham to stop it from publishing how it had hacked anti-theft systems on luxury cars such as Lamborghinis and Porsches.

“Vendors should not try to block security research, they should work together with the researchers to understand the nature and potential consequences of the threats they are facing,” said Fidgen.

“Resorting to legal action to block such details from being published is the wrong approach. Manufacturers should instead incorporate strong security research in the design process.”

He added: “There are real concerns about the attitude of VW given they appear to be trying to suppress this information rather than working to rectify it.”

Fidgen said: “Manufacturers do not seem to have considered the security threat when using embedded computer systems. Cars are becoming increasingly more computerised, particularly supercars which sell for hundreds of thousands of pounds. But not enough thought appears to have gone into securing the systems which leaves the cars wide open to theft and the misuse of computer information.”

Fidgen indicated that such IT vulnerabilities could potentially have very serious impacts, both from security and financial perspectives, as cyber criminals target companies on a daily basis.

Fidgen said: “Volkswagen have only highlighted to the criminals out there that the problems are likely to be genuine and important, so the damage has already been done.”

He added: “There is a long track record of companies using legal action to try to prevent vulnerability information from being understood. This has probed to be highly ineffective as in most cases the security community was able to obtain the information through different research teams.”

Fidgen said: “Car manufacturers continually try to upstage each other with the latest computer ‘Gizmo’s’ for vehicles. They are on a never-ending treadmill to try and keep ahead and offer their customers the latest technology. However, they now need to take a step back and look at how security should be embedded.”

He added: “From a customer point of view, it’s not just about the car being stolen, it’s about the owners personal information being stolen from mobile phones and other mobile devices that are linked to the cars on board computer systems. From the manufacturers’ perspective, it’s about the latest ‘gizmo’ being stolen by competitors.”

About MWR InfoSecurity

MWR InfoSecurity is one of the world’s leading information security consultancies – MWR specialises in identifying, managing and mitigating Information Security risks.

The company undertakes simulated cyber attacks with organisations across different industries to help them understand the security threats they are facing.