VMRay is a Bochum-based software development startup that specializes in technologies for the automated analysis and detection of malware and phishing threats. The solutions enable the company's customers to examine suspicious programs, files and URLs in a “sandbox” environment, i.e. an area isolated from the system environment that does not endanger the system. These analyses reveal the behavior of malicious code and help cybersecurity teams to react quickly to new attacks, improve security and develop targeted defense strategies for their companies and organizations.
In an interview with NRW.Global Business, CEO Carsten Willems talks about the challenges in cybersecurity, the cat-and-mouse game with attackers and how VMRay tries to stay one step ahead of them. Willems also explains the advantages of NRW as a location for setting up an IT company.
- Cybersecurity is a ubiquitous topic these days. How would you explain this field to someone who doesn't work in IT?
Cybersecurity protects digital systems and data from a wide range of threats. An important aspect of this is to prevent disruptions in order to counteract technical or organizational problems. However, the main focus is on defending against active attackers, which include cyber criminals, hacktivists who infiltrate a computer system for political or social reasons, and state actors. As digitalization and networking progress, the target area and its complexity continue to grow. This involves hardware and software as well as people and their data.
- Attackers are constantly adapting themselves and their methods. How do you ensure that your solutions keep pace with changing cybersecurity requirements?
Usually, attackers have one advantage: They only need a single working attack vector, while defenders have to secure all possible paths. This cat-and-mouse game has been going on for decades. New attacks, so-called zero days, are often very successful at first, until the security industry can develop and deliver appropriate updates. VMRay focuses on these new types of attacks and has developed behavior-based methods to detect even unknown attacks. These methods are more complex and take more time, so we typically combine them with conventional, faster but less effective technologies. In addition to specialized technology, continuous monitoring of the ever-changing threat landscape requires expertise and 100% focus.
- VMRay is based in the Ruhr Metropolis. What makes NRW an attractive location for an IT company and what specific advantages does the region offer IT startups?
We are a spin-off of the Ruhr University Bochum, one of Europe's leading addresses for cybersecurity. After starting up, our proximity to the university was crucial, both for recruiting staff and for joint research projects. The resulting ecosystem of cutting-edge research, established companies and startups in the field of cybersecurity offers valuable synergy effects and a great exchange of ideas. The region also impresses with its excellent infrastructure, high university density, unbeatable mentality and low cost of living. Our customers are mainly large corporations and government organizations. And although we operate globally, we also find a large number of them in NRW.
- VMRay also became active in the US market shortly after it was founded. German software companies are rarely as successful there as VMRay. What challenges does a German company face if it wants to gain a foothold in the US market?
Our path is atypical, as we mainly addressed the US market right from the start. This was possible to a great extent because the founders already had an existing network of potential customers, partners and employees in the US. The advantages are obvious: It is a huge, unfragmented market in which there is a greater willingness to take risks and a more pronounced sensitivity to security issues. We also received support from the German Chamber of Foreign Trade and the German Accelerator. However, there are many challenges, particularly of a cultural and legal nature. Germans find it difficult to sell to Americans, as there are sometimes language barriers and differences in business practices. You need employees on site and have to be there frequently yourself. An additional legal entity in the USA does bring some security, but also complexity. All contracts must be adapted to US law and the level of risk there, but must not appear "too German" in order not to deter customers. There are significantly higher costs for almost everything, especially for salaries, lawyers and rents. Finally, the US market is also very competitive due to its aforementioned advantages and the numerous American competitors face significantly fewer challenges than German companies.
- What are your goals for the next five years and what developments in cybersecurity do you expect to see in the near future?
In order to maintain our growth trajectory and our profitability, we are focusing on expanding strategic partnerships. These partnerships are crucial to strengthening our market presence and leveraging synergies. The aim is to integrate our technology into a variety of use cases and thus open up new markets. We are committed to continuous learning and improvement to stay ahead of the curve and best serve our customers.
- Mr. Willems, thank you very much for speaking with us!
