Melbourne cyber consultancy ctrl:cyber buys Sydney counterpart elevenM

Pemba-backed consultancy ctrl:cyber has picked up fellow cybersecurity services provider elevenM, adding a team of around 30 specialists in Sydney to its existing 60-strong headcount.

Almost exactly one decade old, elevenM was established in early 2016 by former PwC security and cloud assurance lead Peter Quigley and provides what ctrl:cyber described as a range of complementary services around advisory, privacy, and AI & data governance.

The acquisition follows the 50 percent stake Pemba Capital Partners picked up in ctrl:cyber early last year, and continues a period of consolidation within Australia’s cybersecurity consulting market headlined by Accenture’s reported $1 billion-plus purchase of CyberCX.

“Cyber risk has moved well beyond technology alone,” ctrl:cyber CEO Steve Williams said of the acquisition. “It now spans security, data, privacy and increasingly AI, and organisations are looking for this to be addressed in a more connected way. Rather than them stitching together disconnected vendors, we are deliberately building an integrated, sovereign capability.”

Ctrl was established by Williams in Melbourne in 2017 and offers a broad range of services including 24/7 threat monitoring, penetration testing, and risk & compliance. Following Pemba’s investment last year, Williams said that the aim was to now become the leading cyber provider in the A/NZ region within three years, with an initial focus on expanding to Sydney and Perth.

In pursuit of that goal, ctrl:cyber has also recently strengthened its portfolio through the addition of a cyber engineering team of former Shelde senior leaders, including co-founder David Ng. Notably, Shelde was previously owned by Pemba, which it merged with Revolution IT to form Ampion in 2020 and then sold on to Wipro for almost US$120 million the following year.

Ctrl also noted that it expects further expansion this year, and the playbook is reasonably clear. As an amalgamation of twelve boutiques, it took less than six years for BGH Capital to build CyberCX into a billion-dollar business, while another cyber roll-up, Sekuro, recently sold to Insight within four years of its founding. Quadrant-owned Kiwi roll-up Bastion likewise continues to build.

Also notable is ctrl:cyber’s recruitment last year of CFO Peter Sherar, who previously held chief financial duties at Ampion as well as Planit and SMS Management & Technology, both of which now belong to Japanese IT giant NRI, the former via now rebranded Australian subsidiary ASG and the latter which was picked up in 2021 in a deal reported to be in the region of $300 million.

Meanwhile, ctrl:cyber now gains a team of ten elevenM directors and principals through its latest acquisition, with Quigley also bringing over a decade of previous experience spent at PwC in Australia and the UK following an earlier career start at Ernst & Young. He described taking the leap to establish elevenM as one of the most rewarding experiences of his life.

“Bringing together elevenM’s advisory strengths with ctrl:cyber’s managed services and offensive security capabilities creates a genuinely market-leading offering and most importantly expands the opportunities available to our people and clients,” Quigley said. “I’m incredibly proud of what we have achieved over the past decade and excited about what lies ahead.”