A Chat with Graeme Huddy, Director at Cyber Threat Intelligence Firm: Mobius Binary

Mobius Binary is a UK-registered penetration testing and cyber threat intelligence firm specialising in translating technical security findings into business risk language. Founded in 2021, the company serves clients across financial services, retail, mining, oil & gas, fintech, wealth management, and technology sectors in the UK, Europe, USA, and Africa.

Mobius Binary’s approach focuses on risk-based testing rather than checkbox compliance, ensuring organisations invest security resources where they matter most. The team holds Crest accreditation and operates on the principle that effective security requires understanding both technical vulnerabilities and business impact. Mobius Binary is part of the Mobius Group, with offices in London, Bath (UK), Johannesburg, Cape Town (South Africa) and Mauritius.

What makes Mobius Binary unique?

We founded Mobius Binary in January 2021 around the idea that pen testers want to hack and find vulnerabilities, not drown in timesheets and corporate process. Meanwhile, the market was racing to the bottom on price. Our view was that if you’re testing the wrong things, a cheap engagement is more expensive than a thorough one.

What makes us different is translation, I come from IT audit, risk management, and operations including managing telecommunications during the 2017 Knysna fires where 1,000 homes were lost, it was South Africa’s largest fire and it decimated communities. It taught me that technical expertise means nothing if you can’t communicate clearly with decision makers under pressure.

We’re also the firm that sometimes tells clients NOT to hire us, hear me out on this… But if you are using off-the-shelf software, request the vendor’s pen test reports or attestations instead. When we do find issues, say, 100 customer credentials on the dark web, we translate it: “Your cyber insurance won’t cover this. Here’s your DORA exposure. Here’s your customer communication plan.” We’re Crest-accredited for technical rigour, but we speak business risk, not CVE scores.

What’s your advice to aspiring entrepreneurs?

Start by solving a problem you actually understand deeply. Mobius Binary exists because I watched brilliant pen testers drowning in corporate process whilst trying to translate security findings into executive language. I live(d) both problems.

Second: build with a clear cultural thesis. If your culture is “we’re professional and work hard,” you have no culture, that’s table stakes. We created a company where security professionals could focus on technical excellence, not bureaucracy.

Third: be willing to say no to revenue. We regularly tell clients not to hire us for certain tests. That honesty builds more trust than maximising every opportunity.

Finally: find partners who complement your weaknesses. Rob Len, our Technical Head, brings pure hacking expertise whereas I bring business risk translation. Founding teams that are too similar create blind spots that are often the end of companies.

What excites you about Mobius Binary?

The timing. Security is finally becoming a boardroom issue, but most organisations haven’t figured out the operational side yet.

For example: we worked with a global company with operating locations in almost every country. One of our threat assessments found thousands of unauthorised Facebook pages. IT couldn’t determine which were legitimate versus scams. Marketing wasn’t involved and couldn’t approve takedowns. HR had no protocol for credential breaches. It’s sort of the perfect paralysis in this world.

That’s the opportunity. Security isn’t just IT’s problem, it’s marketing’s when brand impersonation dilutes campaigns, HR’s when remote workers use compromised credentials, legal’s when suppliers are breached.

And we can’t ignore the fact that the technology has transformed. Five years ago, dark web monitoring was expensive and difficult. Today we scan for exposures in near real-time. We’ve gone from “you’ve been breached, here’s your response plan” to “here’s what’s exposed right now, let’s fix it before the breach can happen.”

How has Mobius Binary evolved in recent years?

The biggest shift is from pure pen testing to cyber threat intelligence and continuous monitoring. We kept hearing “This report is perfect, but by the time I get budget approval, what’s changed?”

That led us to dark web monitoring, breach database analysis, supply chain risk assessment, understanding what adversaries already know before they attack. It’s the difference between testing your locks versus discovering someone’s been mapping your building for months.

We’ve also evolved how we communicate, penetration testing reports are usually technical, they are CVSS scores, remediation steps etc. We’ve learnt into structuring our reports around business impact first: regulatory exposure, and what needs fixing this week versus next quarter. This doesn’t mean that technical takes a back seat, it is still what we do, but we realised that a focus that allows management to know what is going on, and what needs to be done, what the risks are etc, means we can do the technical AND provide companywide understanding.

What can we expect from Mobius Binary in the future?

The immediate focus is establishing credibility in the UK in the way we have done in RSA, strong credibility through thought leadership, speaking engagements, and sector-specific expertise and in the end, drive business growth. We’re developing tailored cyber threat intelligence, what matters to wealth management versus manufacturing versus fintechs.

AI governance is becoming a major business imperative/challenge, and I don’t mean AI-powered tools, but helping organisations understand security implications. What happens when Copilot surfaces restricted SharePoint docs? How do you govern AI in regulated environments?

The cross-functional opportunity excites me. Marketing needs dark web monitoring for brand impersonation. HR needs credential breach monitoring. Legal needs supply chain visibility. The tools exist in IT, but nobody’s built operational frameworks to make it work.

We’re exploring strategic partnerships with M&A advisors for pre-deal security due diligence, business consultancies for market entry planning, family offices for cyber as a client service differentiator.

Longer term: changing how organisations budget for security. From reactive (“something broke, panic spend”) to proactive business cases: “Here’s your current exposure, here’s exploitation cost, here’s prevention cost.”

The next chapter isn’t about becoming the biggest firm. It’s about being the firm that changes how organisations think about security, from compliance checkbox to strategic advantage.