Laurent Balmelli, co-founder of Strong Codes and Strong Network : “An optimistic outlook is vital for an entrepreneur”

Laurent Balmelli, who holds a master’s degree in computer science and a PhD from EPFL, is the co-founder of two cybersecurity startups: Strong Codes and Strong Network. He’s now the General Manager for Secure Development Spaces at Citrix, which acquired Strong Network in 2024. We spoke with Balmelli about today’s shifting digital landscape and the experiences that shaped his view of entrepreneurship.

Were you interested in science and technology as a child?

Yes, totally. I grew up in the 1980s when the very first home computers emerged. I tried to figure out how they worked, taking them apart and putting them back together at a time when very little information was available. I also became fascinated with the US, which I saw as a technological promised land. In high school, I signed up for exchange programs in the US so I could immerse myself in its culture. Later, I read a book – Hackers: Heroes of the Computer Revolution by Steven Levy – which reminded me a lot of this period. It looks at the history of computer programming and has driven me to keep my technological skills up to date, even when I moved into management positions.

What was it like studying at EPFL?

EPFL was a sort of heaven on earth for me because I could work with computers all day long! The years flew by, to the point where, when I finished my master’s degree, I wanted to remain in academia – so I signed up for a PhD. I had worked on a project at the Signal Processing Laboratory headed by Prof. Murat Kunt, and he recommended me to Martin Vetterli, who had just arrived from Berkeley.

I was really lucky to get the position. I’d had a serious snowboarding accident while I was finishing up my master’s degree in early 1996 and had to have brain surgery. So I initially missed Martin’s message and didn’t see it until the end of my recovery several weeks later. But in the end I was able to complete my PhD in his research group between 1996 and 2000. We worked together on a project involving computer graphics and the optimization of 3D models using a mathematical approach that was innovative at the time.

After finishing your PhD, you began working for IBM. Was it hard making the switch from academia to the business world?

During my PhD I had the opportunity to work at Bell Labs, a company with a long history associated with the invention of the telephone by Alexander Graham Bell. After I graduated, I was contacted by a researcher I’d met at Bell Labs and who had just taken a job at IBM Research. I had also received an offer from Hewlett-Packard, but I was drawn more to New York and the US east coast, where IBM Research is located, than to Silicon Valley.

The team I joined in 2000 studied computer graphics – a subject related directly to my PhD. I had the opportunity to work alongside Gabriel Taubin, a leading figure in the field. I subsequently became involved in joint R&D projects with IBM customers, mainly in the aerospace industry, to help them implement conceptual design methods in their product development process. For instance, I worked with companies to develop the Systems Modeling Language (SysML), which supports the specification and description of various kinds of systems. I still teach SysML in a class at Keio University in Tokyo every October. In 2006, I was given the chance to transfer to Japan to further develop the language at IBM. My wife and I planned to stay for only one year but ended up staying for five! Both our children were born there.

How did your time in the US and Japan influence your approach to entrepreneurship?

In the US, the culture is all about hustle and bustle – it’s really energetic, with people constantly coming up with new ideas. There was an entrepreneurial spirit that didn’t exist in Switzerland in the late 1990s, when starting your own business was seen as a fringe and somewhat exotic endeavor. In Japan, I learned the importance of considering the customer’s perspective. The culture there is heavily focused on customer satisfaction and the user experience. I still remember visiting a shower manufacturer that researched how the very first stream of shower water feels to users. It’s a whole other level of attention to detail! And it’s something I feel is important, because it’s often the little things that make or break a company.

In addition to this international experience, my parents also played a big role in shaping my approach to entrepreneurship. They both became entrepreneurs almost despite themselves – my father was unemployed when I was born, and my mother was an immigrant who had completed only compulsory education. They started working in the restaurant business and eventually bought and renovated Hôtel Beaulac in Neuchâtel and managed it for 15 years. They’re my role models.

What prompted you to create a cybersecurity company – Strong Codes – when you moved back to Switzerland?

When I came back to Switzerland from Japan in 2011, I had the choice between returning to the US or leaving IBM. I chose the latter option because my wife and I wanted to stay in Switzerland with our children. We both decided to leave our jobs almost on a whim in order to become entrepreneurs. This initially led me to travel frequently to Africa to work on projects with local telecommunications companies. Then I started consulting for a number of Swiss startups. That’s when I met people from HEIG-VD who were planning to start a cybersecurity business. This was a field I was already very interested in, and we created Strong Codes in 2014. I managed the company and handled sales in particular. I loved the idea of selling a product that I had helped design myself. The cybersecurity industry really took off in the 2010s – before then it consisted mainly of cryptography.

I think that when you design new technology, you have to also think about what kind of world you want to live in. The systems generated by social media algorithms – especially those intended for young people – are extremely questionable.

What kinds of cybersecurity threats did Strong Codes address?

The system we developed at Strong Codes was highly specialized. It aimed to make the binary code used in software and applications much harder to analyze, in order to protect it from reverse engineering, piracy and unauthorized changes. This is a crucial issue for many companies, including in the banking industry, because even if a company’s applications don’t store much critical data, they communicate with back-end servers that do. That means the applications can serve as a gateway for cybercriminals.

Your company was clearly successful, as it was acquired by Snapchat.

Yes, Snapchat was a customer we were targeting, and I had built up a good relationship with their team. They were intrigued by our technology, to the point where they acquired our business in 2016. For us founders – young entrepreneurs who had created the company less than three years earlier – the successful exit was really unexpected.

Portrait inspired by Salvador Dalí,  generated by Gemini based on a prompt by Laurent Balmelli.

That gave you an insider’s look at social media companies. Were you surprised by some of their ethical practices?

I think that when you design new technology, you have to also think about what kind of world you want to live in. The systems generated by social media algorithms – especially those intended for young people – are extremely questionable. They deliberately magnify extreme ideas because provoking strong emotions is a known way to increase user engagement. I believe that social media companies should make it a priority to have a philosopher on their management team! My years at Snapchat were long and uninspiring since the firm had no long-term vision – the only goal was to grow user numbers in order to survive in a highly saturated market. After three years, I felt it was time to leave and seek fresh opportunities.

That’s when you decided to found another business: Strong Network.

Exactly. One of my employees in Switzerland wanted to join me in the new venture, so we spent several months putting our heads together to flesh out our business plan. We explored different possible technologies: one of them reminded me of the virtual desktop infrastructure (VDI) system developed by Citrix that I had used at IBM. It enables users to access their Windows desktop from any device via a secure internet connection. We decided to develop a cybersecurity system for this kind of remote access that’s much more effective and designed specifically for application coding. That’s because, back then, VDI technology had several vulnerabilities and problems related to the user experience.

That’s what led us to found Strong Network in 2020. Developers can use our system to work remotely in a fully secure cloud environment – something that was unprecedented at the time. Other companies subsequently copied us, but we had a first-mover advantage thanks to our patents. Citrix acquired Strong Network in late 2024, completing the circle in a way since the idea for our system initially came from Citrix technology.

There’s a lot of talk today about zero trust architecture – an approach to cybersecurity that assumes threats can even come from within a network. Is that an approach you also believe in?

Zero trust architecture adds another layer of protection to the system we developed. The idea is to strengthen the authentication process during login by setting up more holistic verification mechanisms than just a user name and password. Zero trust architecture also ensures that users can only access the parts of a network that they need. Before, when an employee logged into their organization’s VPN, they could generally “see” other computers connected to the same network.

Could small businesses and startups realistically implement the cybersecurity system you’ve developed? Or is it intended mainly for large organizations?

That’s a good question, and it’s hard to answer without knowing the specifics of the small business. The first thing to ask is whether the business really needs such a high level of cybersecurity – does it generate intellectual property or possess other differentiating factors in its industry? Or is it a services company? The next thing to ask is whether the company produces sensitive data.

Beyond the cybersecurity aspects, our system also enables developers to work on code remotely, which is an advantage for organizations wanting to hire programmers who don’t live near the office. Our technology is perfect for small businesses with these needs. But they also have to consider the in-house capabilities necessary to operate our system, as the requisite skills are quite sophisticated and many businesses might not have them.

AI is particularly effective for complex architectures where different virtual environments that were designed separately have been pieced together. Security breaches often occur in the friction between these environments.

Do you think the latest developments in AI will revolutionize the cybersecurity industry, or are they just the natural next step?

I think a genuine revolution is taking place that will change the dynamics of the entire industry. AI systems can spot security vulnerabilities much better today than they could just a short time ago. But these systems work better in some areas than others. For instance, AI is particularly effective for complex architectures where different virtual environments that were designed separately have been pieced together. Security breaches often occur in the friction between these environments. However, because AI is also useful for designing security systems, this ends up creating a game of cat and mouse. I use generative AI for product design as part of my own research and for the class I teach in Japan. One thing I enjoy is using AI hallucinations as a springboard for lateral thinking when I’m brainstorming new ideas, because the hallucinations can lead me to something completely off the beaten path.

Besides computer science, you’ve also developed an interest in literature and philosophy. What do you get out of these subjects?

When I was a student, computers were the only thing I was interested in. I found classes like history pretty boring. But I’ve changed my mind! Over the years I’ve gotten into a variety of other subjects – that’s essential in today’s complex world. I really like the philosopher Nick Bostrom, although his books can be challenging. Deep Utopia, which came out this year, is captivating. In it, Bostrom takes us into a “solved world” where all technological challenges have been resolved and we’re faced solely with fundamental philosophical questions. I also like books on classical psychology, such as Thinking, Fast and Slow by Daniel Kahneman, which describes how our brain processes information and sometimes gets things wrong.

What advice would you give to EPFL graduates thinking about starting their own business?

Creating a company requires a huge personal and emotional investment. There are the technological hurdles, but, even more importantly, there are financial and people-related challenges to deal with. These aren’t as visible at first but they demand the most attention. I think my most significant contribution has been my ability to lead teams and motivate people towards a common goal. And an optimistic outlook is vital for an entrepreneur – I’d say it’s the most important trait. Optimists sometimes get a bad rap: as humans, we tend to view optimistic people as being naïve or somewhat childish, and pessimists as being prudent and wise. But optimism is what turns entrepreneurship from a job into a vocation. Finally, I’d say that it’s really important to choose your business partners carefully. You should only team up with people who are fully invested in what you’re doing.

PROFILE

2000
Completes PhD in communication systems at EPFL, in the research group headed by Martin Vetterli

2000
Begins working for IBM Research in New York before transferring to Tokyo

2014
Co-founds Strong Codes, a cybersecurity and software-protection startup, which was subsequently acquired by Snapchat

2020
Co-founds Strong Network, a provider of a secure cloud development platform

2024
Strong Network is acquired by Citrix

Photo d'en-tête: EPFL/DR Laurent Balmelli