US Special Forces Roots

While in retrospect I question my experience with American intervention in Iraq, I had a very clear sense of purpose and direction in my time serving as an American wartime military officer. My task and purpose were clear as day, and I woke up every morning able to look myself in the mirror and know who I was. My role was not just a job — it was more than that — it was a calling.

The calling was bigger than myself, and I did not realize how meaningful that time was for me until I transitioned to the private sector.

Of course, I found exciting times at Credit Suisse as an equity swaps trader in Hong Kong, enjoying the high-flying world of finance and life in the proverbial fast lane. I also loved the innovative and dynamic environment of Palantir Technologies and helping start-up its office in Singapore. However, I always felt in my heart that there was something missing. When I eventually packed up my things from Palantir and headed into gardening leave onto the next tech start-up, I was vacant and without a calling anymore.

Then the Evelyn Chang incident happened.

That series of events reminded me what it meant to have a sense of task and purpose, what it meant to have a calling again. I was reminded of the fulfillment I find in helping others in crisis. Crisis response bound me to my family friends forever, and the same can be said now of every client who suffered a physical and cyber crisis that I have been part of—the heightened emotions, the imminent risks, and the absolute certainty of doing “good” has brought a powerful sense of purpose to my life and, now, my private sector career.

This sense of purpose is precisely the reason Matt Pecot and I co-founded Blackpanda in 2015.

In fact, Matt was the first person I called when I needed help with planning, resources, and advice in how to approach the Evelyn Chang case. Despite his demanding role as the Asia-Pacific Head of Prime Services at Credit Suisse at the time, Matt responded promptly at all hours throughout the operation and remains an inspiring mentor and friend to me today.

"It is a special group of people that are able to endure the physical, emotional, and psychological stresses of the most elite special forces in the world."

It is a special group of people that are able to endure the physical, emotional, and psychological stresses of the most elite special forces in the world, and Matt and I knew that if we brought together the right people that we could form something special by way of a company in this space in Hong Kong.

Blackpanda 1.0

Blackpanda’s first incarnation was as an international security consulting firm—the most directly translatable skill for our American special forces brethren and their Ivy League credentials.

While we certainly enjoyed the highs of signing some of the largest blue-chip companies in the Philippines and one of the wealthiest family offices in China, the unpredictable ebb and flow of large security contracts followed by quiet periods of relative inactivity were difficult to handle with the lack of recurring, stable revenue. So, we turned to the insurance sector, which I realized is ultimately just another form of security. We leveraged our networks in Hong Kong and abroad to connect to various key stakeholders back in Lloyd’s of London, the largest specialty insurance market in the world.

Tying together security consulting with insurance placed us in a well-established sector of insurance called “special risk insurance”.  This very small (roughly only USD 500M market globally), but stable, area of insurance is quite niche and holds few players—perhaps most well-known is Control Risks Group, founded by former British SAS operators and backed by Hiscox, one of the most prestigious insurance syndicates in Lloyd’s of London. The most well-known insurance product is “kidnap-and-ransom” (KNR) insurance.

(Side note: You may have seen the film Proof of Life, where Russell Crowe is basically a former British SAS Control Risks Group crisis consultant who responds as part of a KNR insurance policy to help recover Meg Ryan’s husband, kidnapped by narco-guerrillas in South America.)

And so we decided to build out an Asia-centered special risk insurance business for Blackpanda.

From Special Risks to Cyber Risks

As a computer science honor graduate from West Point, I have always been interested in cyber security. I grew up in Cupertino, California, the heart of Silicon Valley and global headquarters of Apple, and started coding in FORTRAN and Pascal when I was in junior high school. At my high school, Monta Vista High School, I did not even realize that there were other types of “engineers” other than computer science and electrical engineers.  We just referred to it as “engineers” as if there were no other types.

"To us, cyber security is not an IT problem, rather it is a security problem; it isn't a computer that is hacking you on the other side, it's a person."

In the American special forces, we often mixed our operations with highly technical components. To us, cyber security is not an IT problem, rather it is a security problem; it isn’t a computer that is hacking you on the other side, it’s a person – and that person has friends, motives, and desired end states that differ and must be addressed.

For me, seeing cyber security as merely a digital extension of the existing physical security world has always been natural and obvious.

On my first visit to England, as I was standing on the Lloyd’s of London trading floor, I noticed a significant disconnect between the special risk insurance underwriters and the cyber security insurance underwriters -- they did not even know each other or even know what floor each other were on in the building. Cyber security was not seen as a “security risk” insurance product, but rather as part of a division of insurance called “financial lines”. Whereas special risk insurance products would often lend themselves to bundling physical security services and technology packages to optimize risk management, cyber insurance as a financial line product often did not.

I began researching the market potential for cyber insurance in Asia (huge growth potential and blue ocean space, at ~30% CAGR), competitor analysis of approaches to the market, and existing service providers in the cyber crisis response space, otherwise known as Digital Forensics and Incident Response (DFIR) specialist firms. What I found was a significant problem in Asia waiting to be solved.

If we use the physical analogy of cyber DFIR to be “cyber firefighters”, there are very few, affordable, and competent fire departments in Asia.  How would you feel if you could not afford to have a fire station with firefighters on stand-by for your town?

Pivot to Digital Forensics and Incident Response (DFIR)

To meet growing demand and bridge the cyber risk management gap in Asia, Blackpanda pivoted primarily to cyber security DFIR. Our retained services essentially serve as a type of “cyber” special risk insurance, in that our specialist digital forensics and incident response services are attached to the largest cyber insurance companies and law firms in the region, helping investigate and manage cyber risk as well as activate in response to a cyber crisis.

"DFIR services and tech products bundled in a comprehensive cyber insurance policy is the most efficient, effective, and cost-effective way to deliver cyber crisis response services for holistic 3rd party cyber risk transfer – bar-none."

DFIR services and tech products bundled in a comprehensive cyber insurance policy is the most efficient, effective and cost-effective way to deliver “cyber crisis response” services for holistic 3rd party cyber risk transfer – bar-none.

We realised that cyber security was growing fast, and that there was a massive shortage in skilled service providers offering incident response services in the APAC region. 
‍
Demand for cyber security services was projected to experience a compound annual growth rate (CAGR) of over 10% between 2020 and 2030, and cyber attacks were causing a loss of total GDP across Asia Pacific greater than 7%. 
‍
To double down on the need for incident response in the region, Matt and I decided to pivot the company in 2019 with the investment support of Gaw Capital, a very large $18B AUM private equity real estate firm with numerous hospitality investments concerned about cyber security after the multiple headlining Marriott International data breaches.

--

​Our crisis response nature remains rooted in our DNA as former American counterterrorist officers and permeates throughout the culture of our company. Our sense of purpose and calling will remain the same as when Matt and I chose to start Blackpanda: to serve our clients in their greatest time of need, delivering timely service, advice, and solutions to the best of our ability.