In mathematics and indeed any quantitative field, they have this thing they call Correlation. It gives you the phase of dependency between variables where the change of one variable determines how the other one adjusts.  The most common examples are linear relationships, with slopes.

I have referred to correlation to help us explain what I have noticed in the startup ecosystem in Nigeria: our investors want the entrepreneurs to make huge returns, but at the same time, they do not want too much risk. That is a weak point and a very difficult scenario. When you want startups to return big, and at the same time you do not encourage them to take big risks with your money, it simply means the business relationship is on stasis. The usual concept in universal physics is that big force brings out big reaction: action and reaction are equal and opposite. Yes, small risks, small returns; big risks, big returns. That does not mean you cannot have deviations, but it makes sense to think within common occurrences in life.

The investors are good in giving a rule like this: do not lose my money no matter what you do. So, the key is preservation of the investment and making sure no money is lost. There is nothing wrong with that. Where I have issues is when you now add that the entrepreneur must come back with big returns. That is when the association breaks. Building startups does not follow negative correlation because there is a reward for the laborer. There is probably minimal risk producing candles in Nigeria as we are sure of continuous darkness for more years. If that is the business, be ready for the returns it can bring. But when you expect massive gains, that business may not be enough.

The entrepreneur cannot be timid on attacking opportunities and at the same time positioned to create immense value. There are investors that do not want to lose money like pension funds. And most times, they do not expect huge returns. But when a venture capital firm eliminates most of the key risks and expects huge returns, everything is broken.

Few years ago, some local investors were giving loans to entrepreneurs with options to convert to equities depending on the performance of the startups. They call it Convertible Note.

A convertible note is a form of short-term debt that converts into equity, typically in conjunction with a future financing round; in effect, the investor would be loaning money to a startup and instead of a return in the form of principal plus interest, the investor would receive equity in the company

The investors have the money and certainly could take equity, but somehow they like to offer loans to the startups. They always have the first option to determine if they want to convert to equity, in the future. This is the seed fund for the startups and the founders are beginning with loans which must be paid back. In some cases, the startups assets are used to secure the loans. For the founder, the mind is always on that loan. And every decision is influenced by that loan. To add salt to injury, the investors took board seats in the startups as “advisors”. I certainly believe the funds will not succeed in Nigeria because many brilliant entrepreneurs will not bother collecting money from such companies. Nigerian startup ecosystem is not optimized for such structures. It is either you want to take risk or not. And it makes sense to have confidence in the people you want to invest in their companies.

The Ecosystem

We are making progress in the country with regards to startups. Besides the challenge of unrealistic target, these are other issues to take note:

• Entrepreneurs think local investors ask for more equity.  I always receive a specific type of email where people ask me if the equity percentage the investor wants for the money being invested is fair. Unfortunately, no one can answer that question for any founder. Though there are tools to help in the valuation of startups, nothing is science in them. Besides, I do not necessarily think that our local investors are greedy. Sometimes it has to do with basic understanding of the business. If you are taking money from someone with good understanding of your tech sector, it will be easier to have a good conversation on the valuation. But when that is not the case, that process becomes challenging. The key is doing a better job to explain the vision and hopefully both can arrive at a fair term to both. Both local and international investors want good returns. Yes, the motives are the same.
• Giving away your company to popular people: Nigerians like big men in their teams. It is like having a very prominent man in your board will magically deliver huge revenue. Once you tell the world that this big man is the chairman of your board, revenue will fall like manna.  It is an illusion. The big man may not even have time for you. Yet, you have given away your company to him. Have confidence in yourself and let any person in your board earn that right, irrespective of his or her level in the society. Always remember that your customers make the decisions and most while spending their money do not care that much on the face of the man on the Board section. They want to be sure you can add value to their businesses or lives. Sure, bringing successful people in your Board is part of it. Nevertheless, I do hope you get the point.
• Foreign funds are better: That seems to be a near universal conclusion by most founders. Yes, foreign funds connote that you are now global. Nigerian like everything foreign. So, all efforts to get that foreign funding become the business. That is a big mistake. There are high quality investors in Nigeria just as we have foreign investors. The problem is that many Nigerian rich people did not make money from technology. But helping them to understand what is going on will help them support your venture. But irrespective of the source, a good fund is nice. Go for it. But do not degrade local funds should they become available.
• Raising capital is hard in Nigeria: There is no other way of making that point. While the funding round success is not the end, the difficulty makes it seem so. When you raise that capital, you must still have to execute the business plan. Do not be like some whose energies dissipate after the fund is raised. Yes, sometimes the strategy ends in getting that money.  There is no plan to run a company. It is common to see founders who are raising money and at the same time looking for jobs or applying for graduate programs. I found it hard to make sense of the thinking. You want people to give you money in a business you have not committed to build? Building a company is a battle and committing to it is the first phase of the preparation.

All Together

We will have a startup massive exit in Nigeria in the next 5-7 years and that will bring more attention to the ecosystem. U.S. based accelerator, Y Combinator, is already a believer as it has seen the innovation in the land. Our entrepreneurs are growing. From Facebook to Google, Nigeria is a strategic nation. We have the population and we like to spend. The moment will come.  There is no doubt on that. Yes, we need to make that happen and create many afro-unicorns so that more quality money will be activated both locally and internationally. When supply improves, great things will happen. Then suddenly, that money everywhere can flow to the shores of our startups.

Regulation kills innovation, they say. For most makers, the thinking is that when governments bring regulations, nothing of value happens, because entrepreneurs cannot break things fast, on the way to financial glory. So, in most startup communities, regulation is seen as a burden.

Few days ago, someone commented on a piece I wrote on the need for blockchain regulation as follows thus: “We must leave government out of blockchain because government will stop progress and slow things down. Even Bitcoin does not need regulation. The technology world will drive this without any government help”. This is typical because the narrative is that government uses regulations to put stumbling blocks on innovation.

Unfortunately, the perspectives from most startup communities are not right when it comes to regulation. When people think that regulation is bad, they miss the deal. While poor regulation is bad and does inhibit innovation, smart regulation unlocks value and accelerates innovation. The biggest limiting factor in the development of Bitcoin and by extension blockchain is lack of regulation in U.S., the world’s most important market. Without a clear regulation, there is a ceiling on the sector growth, because there is an uncertainty with legal ramifications.

Only a stupid person will invest another person’s money on these digital currencies without clear disclosures. The risk is huge. Clients may not bother during the happy days, but should things turn south, the trial lawyers will emerge from their hiding caves. With no law to fall back that you traded, for clients, on legally available products in the land, you will be on your own.

China has regulated initial coin offering – “an unregulated means by which funds are raised for a new cryptocurrency venture” – out. South Korea has done the same. For U.S., there is no regulation which means the regulation is weak. When you do not have a regulation on things people expect to be regulated, the community takes the default as confusion. When you have confusion, it is bad for innovation.

I commend the Nigerian government on its drone regulation. It was a brilliant moment in the nation. Without wasting time, they made it so clear that they were against civilian drone development. The registration requirements and the costs were evident government does not want drones to be flying around Nigerian cities. People moved on and that was it. Personally, they made a mistake on the draconian regulation. But yet, I was thrilled they moved fast making it. If anyone wants to change that, you have the courts or the Parliament. Simply, we have a clear regulation and can work to upgrade it. You cannot raise money for drone business now without a clear certainty on what the regulation says. That is far better than raising money with no clue of the possibilities in the future.

Traffic Light

Traffic light is so important in our transportation ecosystems. We see it as a very critical technology which makes our traffic challenges manageable. But there is one thing that makes traffic light very useful. That is the law behind it. Without the law that says that you cannot run a red light, the technology has no value. So, the value of the traffic light comes from the law that drives the transportation sector.

In Nigeria, people run red lights as they know the law is weak to punish them. The same traffic light which is highly feared in some parts of the world has lower respect, in some parts of Africa, where they are installed. You may be unable to drive for years in U.S. for running a red light. In Nigeria, it may be some fees. That is the difference.

The person that made traffic light produced a good technology. But without the law, it would be ignored. So, the strength of Bitcoin/blockchain may not necessarily be the engineering behind the duo but the law that will govern them. If it is smart, the society wins. If poor, the society loses knowing that society can win if a bad technology is banned. Making that call is left to experts because what seems exciting today can bring havoc in future, especially in finance.

All Together

So as we think about regulation, the focus should be making sure they are smart and timely. Working towards smart regulation is strategic. From cryptocurrency to medtech (medical technology), when governments put regulations, markets have certainties on the future. Regulation ratifies sectors and opens the flow of capital. Nigeria needs smart ones, and fast. Smart regulation does not necessarily mean approving all new technologies since some may be unhelpful to the society. But making that call on time, removing uncertainly, makes it possible for people to realign priorities and move on to other areas.

Cybersecurity (yes, cyber-hacking) is causing severe problems across industrial sectors. As the world was processing the implications of the massive hacking attacks on Equifax, a credit rating and management company, another one was reported on Monday. Accounting giant, Deloitte, was breached.

A bombshell report on Monday revealed that Deloitte was hit by a major cyber attack that compromised its email system and certain client records. The news is a major black eye for one of the world’s “big four” accountancy and consulting firms—especially since a major part of Deloitte’s business is selling cyber security. […]

The initial report of the Deloitte breach came from the Guardian, which revealed hackers had compromised the “confidential emails and plans of some of its blue-chip clients.” In response, the firm confirmed it had suffered a cyber-attack, but played down the significance by saying “only very few clients were impacted.”

It is not just companies. Institutions like United States Securities and Exchange Commission (SEC) have been compromised as bad actors look for information to manipulate markets. Everyone is affected including governments and small businesses.  This is a huge global challenge. I have written on this in the past. I want to revisit it owing to questions from the community. Someone had asked: “how can a small company protect itself?”.

Why Are We So Exposed?

Indeed, we are exposed. The reason is the way the software industry is structured, largely in the past, though still prevalent. Before you buy software, you have to put in a company budget. The accounting people take a look and management approves. The deal is done and just like that they begin to depreciate the new acquisition. For the accountant, the software tool has been bought and there is no reason the IT department should come back, for more money, for the same software. It is bought and available for use. That has been the pattern. And that is the root cause of many of the hacking issues especially in small companies.

The company that sold you that software has a new version which fixed some security holes discovered a month after it deployed yours. Unfortunately, it has no incentive to tell you because you have paid 100% and the firm is gone. The vendor had supplied and left the premises. It happens all the time. The vendor puts a statement on its website. No one visits every vendor to read about software patches. The fact is that few customers know of any patch especially for those not deployed electronically.

Over time, your software and data become so integrated that even if you want to update to the latest software, the risk of messing up your operation puts such plans in the cooler. That was what happened in the WannaCry software when hospitals in UK were concerned that upgrading their solutions to newer versions of  the software would put some 3rd party software out of use. In other words, a company supplied software that runs on Windows XP and you have been using that software for 5 years. Everything has been working fine. If you upgrade to Windows 10, that software could malfunction because the vendor did not make it for Windows 10. So, to avoid breaking that critical software, you make sure you do not upgrade to Windows 10. That Microsoft had stopped patching the Windows XP is irrelevant to you. You just hope that bad things will not happen. Unfortunately, they do, maybe not in weeks, but in years. WannaCry was a good case study in the UK healthcare sector.

The 3^rd party vendor had since gone and getting him/her back will mean more money which you do not want to spend. You needed to have the vendor to upgrade the solution to work on Windows 10. You cannot because the accountant does not see a way to do that. You have your software and now you want more money for it. So, what do you do? You just hope nothing bad happens and so there is no update. When security issues happen, your system is one of the first to be affected.

The biggest problem in today’s software business is that interests are not aligned and that is why we are having many hacking challenges. Most times, the technologies are there but the operational fixes are not done. Without that alignment between IT and finance, no company can experience better protection. I do think the way we acquire software must evolve.

A Better Model

Work hard to convince your account people that software cannot be treated like vehicles which must be acquired and left to depreciate. Software is unique because it is “living” which means it has to be nurtured with licensing and upgrades. Where possible, pursue a path of Software as a Service (SaaS) where you do not buy software, but rather service from software. That way, the software, the security protection on it, etc are included in the service.

Today, it is only cloud offering that makes that possible. With cloud, the maker has no version. It only has a solution and that is always current. Think of Adobe model which does not have any version because its solutions are now cloud-only, meaning that it sells through subscription. Adobe gives you security protection and the service you need. You do not need software; you need a solution that does your work.

Once you can get the cloud subscription-based software, you can be sure that your software is at least update to date. To make that happen in your firm, you must convince the accountant that every month or year, money has to be made available to support the subscription.

All Together

I know that in Africa, we do not like subscription. We like to own things. But if you really want to be ahead of this cybersecurity tsunami of issues, you must learn to think differently.  Software patches do work but the problem is that most times we make sure patches do not happen.  It is as simple as turning the patch into manual update, and all the efforts from the solution providers to deliver upgrades are stymied. Cloud takes away that decision from your people and that is why it is more efficient. The product is always current and you do not need to worry about of any patch. Consider that software acquisition strategy where possible.

Good People,

Welcome to October – this is our victory month.

First, I want to thank all those that have subscribed to my new ebook – Africa’s Sankofa Innovation- which was launched last month. We have a community now. THANK YOU ALL.

Another book – Cybersecurity Africa: Policy, Management and Technology – is coming in nine days. Cybersecurity Africa will be a living document which can be updated many times in a year to keep it up to date and relevant. It will be a top destination for anything Cybersecurity in Africa. We have focused on Policy, Management and Technology to deliver value to readers of different interests. We will be releasing the Table of Contents in the coming days.

If you have subscribed to Africa’s Sankofa Innovation, you will have access to Cybersecurity Africa at no extra cost. The same applies to subsequent works we are working to help people unlock value in Africa. Once you are a Tekedia subscriber (subscribe here), all old and new materials will be available at no extra cost.

It is good to have you here.

Thank you.

Ndubuisi Ekekwe