“We are only at the beginning of our history” says Julien Mauras, president founder of the digital services group Exodata, in the interview he gave us on the occasion of the group's latest news : its positioning on cybersecurity under the Exodata Cyberdéfense brand and the opening of an agency in Bordeaux to strengthen its position on the metropolitan market. Julien Mauras puts Exodata’s spectacular growth into perspective. Born in Reunion, nine years ago, the Exodata Group is now established in Martinique, in Guadeloupe, in a city, in Mauritius and New Caledonia. He is making a name for himself nationally., with this unique layout which allows it to operate in “Follow The Sun” mode : Exodata is thus the only French service provider to be able to offer digital services continuously 24 hours a day, seven days a week.. A major asset for developing the SOC offering in particular (remote monitoring of information systems), centerpiece of its strategy. Exodata is not only a source of pride for its founder and his teams, but an exemplary success for the entire Reunion digital sector, proof that it is possible to have a national ambition, even international, from Reunion.
The Exodata Group employs 120 employees and achieved 10 million euros in turnover in 2020, only nine years after its founding ! How was Exodata born and developed to achieve this result so quickly? ?
I am basically a computer engineer, also trained in management and management. I started my career as an IT manager, then Director of Information Systems for the Austral Assistance Group. I participated for 15 years in the development of this Group providing high added value customer services, present throughout French Overseas and French-speaking West Africa. This activity made me discover Overseas and in particular Reunion Island. A little over ten years ago, Philippe Bellard, see PDG de GAA, was looking for growth drivers and we thought about new areas in which we could invest. I submitted my ideas around the cloud, because I had identified that this offer was not sufficiently developed in the French Overseas Territories. There was a slot to be taken. The Austral Assistance Group had the means, I had ideas. But getting started in the cloud without cybersecurity, it was risky. I spoke to OpenSphere about it, GAA’s cybersecurity partner at the time. It turns out that OpenSphere also wanted to initiate this type of cloud activity, but without necessarily having the means. As a result, in 2012, GAA and OpenSphere joined forces to found Exodata and I found myself named president of that company. I became an entrepreneur.
How many were you at the start? ?
There were five of us to start this first cloud and managed services business. Our historic profession which still accounts for 50% of our volume of activity. GAA’s West Indian customers quickly showed interest in this service.. Our subsidiary Exodata Caraïbe was created in Martinique in 2013. From there, everything accelerated. We created a marketing department in 2014 headed by Laurent Fontaine and attempted the adventure of an address in Paris in 2015 to open a subsidiary with a purely commercial vocation targeting the metropolitan market.. Our first idea, it was only part of our customers, throughout the Overseas Territories, had a headquarters in mainland France. To capture this market, we needed to be as close as possible to the directions and decisions. in parallel, we have decided to develop our service offering by integrating new professions and to expand geographically. Our first acquisition took place at the beginning of 2016 in mainland France : API Business. This company brought us the consulting and business intelligence professions : data manipulation, statistics, reporting, etc. We mastered the cloud infrastructure. With API Business, we enter the applications and, above, on the board, project management, customer support. And API Business has an office in Guadeloupe. In 2017, we established ourselves in the Pacific by purchasing a small company in New Caledonia : this is the birth of Exodata Pacifique. In 2018, OpenSphere, our former shareholder, became a 100% subsidiary of the Exodata Group.
You also bought a company in Mauritius : Is your development model based on external growth? ?
External growth is integrated into our economic model, it explains our very rapid growth, but it is not the only lever. We have three development levers. The first, this is our territorial establishment : we are established in several territories. This year we are opening an agency in Bordeaux. The second is organic : wherever we are present, our societies grew naturally. The third is external growth. Effectively, in 2020, just before the outbreak of the Covid 19 pandemic, we settled in Mauritius by purchasing a company specializing in SOC, remote monitoring of information systems, Helix Security.
For what purpose, this Mauritian establishment ?
SOC stands for Security Operation Center, it is the supervision of security infrastructures. Our territorial presence across the Overseas Territories allows us, thanks to the game of time zones, to be operational 24 hours a day, seven days on seven. It is an asset to offer this type of service, and this Mauritian company saves us two years technologically. Because it is now that we must position ourselves on the SOC. This is the fastest growing offering. We will develop it from Mauritius. We are currently responding to very large national and international calls for tenders on the SOC.
You have recently acquired the Health Data Hosting certification, HDS. Safety certifications are increasing. Have they become essential ?
Alongside our acquisitions, we worked and invested for three years to obtain ISO 27001 certifications, international information systems security standard, and Health Data Hosting, HDS. They were other key steps for our development. We are the only ones to have them in French Overseas Territories : they guarantee a level of service that is not found in any of our competitors. Many certifications are emerging in the field of cybersecurity.
The government has launched several. Including PASSI, mandatory to be able to work with OIVs, “operators of vital importance” identified by the State. We are also in the process of applying for the Expert Cyber label to be able to work with communities and administrations who are upgrading their IT security.. We are already listed with them, but we now need, in addition, of this label which guarantees our skills and operational resources..
Does this mean your strategy is moving towards cybersecurity? ?
Indeed, OpenSphere and Helix Security are two companies specializing in cybersecurity. We have just renamed our entire cybersecurity offering Exodata Cyberdéfense. This new brand brings together all our teams specialized in cybersecurity. It will give us greater striking force. Two of our colleagues, including the former manager and co-founder of OpenSphere, Stéphane Jaillet, left this summer to settle in Bordeaux, in charge of developing the activity of Exodata Cyberdéfense on the national territory. Our Bordeaux agency markets our entire portfolio of offers, but with a big focus on cybersecurity. We have the means to meet the needs of small businesses and large groups alike.. Actually, we think we are only at the beginning of our history. We are certain that we can go much further.
How far ? What is your vision for Exodata ?
On our historic territories, we are on growth rates of more than 20% per year. We will continue our external growth through acquisitions. The creation of the Bordeaux agency is part of the objective of opening other agencies on the national territory. We are also in the process of building new offers in our historic business, the cloud. Finally, I am starting to think about an internationalization strategy, particularly in cybersecurity professions. Our future development will therefore follow several axes. Natural growth. External growth with new professions and new territories which will strengthen our presence. Strategic development of cyber defense. We will double our cyber defense teams in the next eighteen months : 17 recruitments are underway. We are currently 120. I already know that, in eighteen months, we will be 200. We have now reached a size that allows us financially to continue our growth and go further.. This is why I say we are only at the beginning.
Is cybersecurity destined to become your main activity? ?
She can become. It now represents 20% of our activity. I estimate that it will ultimately represent 50%.. By setting up teleworking somewhat urgently and hastily with the pandemic, companies have opened their IT to the outside world by becoming aware of their vulnerability. In this context of weakening information systems, there has been an increase in cyber attacks : and volume, i.e. no more attacks, but also in complexity. Cybersecurity needs are enormous.
The main attacks are ransomware ?
Yes. A parallel economy has been created. The word may seem a little strong, but I consider that we are faced with cyber-terrorism. How an underprepared business can recover if it loses its customer data, their billing data, etc. All professions are digitalized. How to work without computers ? It's not just the amount of the ransom to take into account, there is also the cost of overall IT unavailability in terms of lost activity.
In my opinion, companies will increasingly entrust their IT to third parties due to the increasing complexity of attacks. They require levels of expertise, training, availability of teams such that an SME can no longer tick all the boxes internally. However, SMEs represent the majority of the economic fabric of Reunion Island and Overseas Territories.. We must understand that the question is not whether it will happen or not, but when it happens. And zero risk, in computer science, does not exist. The challenge, it is to reduce as much as possible the probability of the crisis, to make the exercise too difficult for the hacker to insist, and to put in place all means to ensure, that in the event of an attack, IT will restart quickly.
Your cybersecurity offer highlights the notion of cyber defense, but also that of cyber offensive. What is the cyber offensive ?
Defensive security consists of securing the information system, put the safety devices in the right place. Offensive security applies the adage that the best defense, this is the attack. She will test the security of the information system. We have teams made up of what we call “ethical hackers” who carry out intrusion and penetration tests on computer systems in order to identify vulnerabilities.. These tests are carried out in a perfectly safe environment for our customers.. The objectives of the test are agreed with them. We also organize crisis exercises. This new trend is starting to be practiced in Reunion. We do it for ourselves. Gathered in a work room, a management committee engages in a role play. A major attack is simulated against the company. We see how she reacts to this simulation. The goal is to improve the company's preparedness for the day an attack occurs.
Exodata is also under attack ?
We have detected intrusion attempts on our own systems, as on those of our customers. Everything we sell, we apply it to ourselves. The same tools. Last month we carried out a cyber crisis exercise, as we recommend doing to our customers to be ready in the event of an attack. Global security management is part of our offer.
Are you required to collaborate with security services to get to the source of attacks? ?
This happens to us. I personally followed the training of the Institute of Advanced National Defense Studies. I belong to the citizen reserve of the gendarmerie. We have relations with the gendarmerie, local authorities, the National Information Systems Security Agency (TRAP). The State is aware of the vulnerability of businesses, communities, hospitals, facing computer attacks. It invests a lot in cybersecurity via ANSSI. Another trend should be taken into consideration : insurance companies now require companies to have certain cybersecurity services. Very large calls for tenders from large national groups, to which we respond, are motivated by this insurance requirement and impose deadlines on them, particularly in terms of SOC. And this explains why SOC activity today explodes all our forecasts in terms of activity.
You also offer a white paper on the digital transition in business. What is in this Book and who is it for? ?
We have written several white papers intended for professionals. This is aimed at managers of VSEs and SMEs to show them the range of all the challenges of a digital transformation. Many companies have only a fragmentary vision of these issues. The objective of this white paper is to make them aware of all the issues and all the benefits that they can derive from a good digital transformation..
Exodata headquarters will remain in Reunion ?
Yes, I care about it. I arrived in Reunion, over 20 years ago, en tant que stagiaire. La Réunion m’a accueilli. J’y ai développé mes activités professionnelles. Mes enfants y sont nés. C’est pour moi un juste retour des choses qu’Exodata contribue à l’activité, à l’emploi et au rayonnement de La Réunion. On the other hand, nous n’avons aucun besoin de délocaliser notre siège. Les infrastructures, les compétences sont là. Les cursus de formation locaux s’ajustent aux nouveaux enjeux du numérique. L’emplacement se justifie aussi par le positionnement géographique de La Réunion entre Est, Ouest, Nord et Sud. C’est notre fierté d’avoir débuté notre histoire à La Réunion et d’avoir construit, à partir de l’Outre-Mer, notoriety and a national presence. We are currently preparing a national communication. We have already broadcast a TV campaign on BFM Business. We prove that, while being in the tropics, we are able to compete with the big names in our industry. I cannot reveal the tenders we are currently responding to, but I can tell you that we have already ruled out large competing metropolitan companies. We have won some very good markets, including internationally. To give you an example, we recently signed with a major Belgian bank for the management of the cybersecurity of its three European subsidiaries in London, Brussels and Paris.
Can the Exodata Group serve as an example to other Reunion companies? ?
I am convinced that it is possible to export and develop from Reunion Island. This is the message that I carry within the Reunion digital sector, Digital Meeting, la French Tech, where I intervene to share our experience. If we did it, others can do it.
THE FOUR PROFESSIONS OF EXODATA
The first, it is the cloud and managed services intended for companies that outsource their IT. Which includes server infrastructure, networks, internet and building connections. Managed services are intended to complement clients’ IT teams, no to replace it. Second job, business applications. Exodata offers existing solutions or develops tailor-made professional applications. Third profession, le consulting : advice before projects, project management, design of master plans, project management assistance. Exodata supports its clients in their digitalization strategies, in change management, in establishing a roadmap. Exodata “Ambassadors”, the consultants rely on the entire range of services and solutions that the group can offer downstream. The fourth profession, inseparable from the other three, it is that of cybersecurity on which Exodata now bases its development strategy.
