Tarang Grewal is co-founder and chief executive of Netforte, a London cybersecurity consultancy that helps smaller businesses with Cyber Essentials, ISO 27001, penetration testing and cloud security.
Incorporated in March 2024, the company has since built EVADA, an AI-native security validation platform that is now available to enterprise customers, with Free and Pro plans listed as coming soon.
The platform keeps approved checks, priorities, fixes and evidence in one place, and no test runs until ownership of a system and the scope have been confirmed. Grewal tells Business Matters why growing businesses deserve more than a cut-down enterprise service, what a father’s resilience taught about limits, and why trust always comes first.
What do you currently do at Netforte?
I co-founded Netforte, and as CEO my focus is on how we turn our mission into practice day to day. That covers everything from Cyber Essentials and ISO 27001 through to penetration testing, cloud security and ongoing security support, all built around the risk in front of the business rather than a fixed technical checklist.
It also means thinking about what happens between the formal points of assessment. A compliance audit or a penetration test gives you a clear picture at that moment, but a business does not stand still afterwards.
That is the gap I am working to close through EVADA, an emerging platform we are building to bring more continuous security validation to SMEs.
What was the inspiration behind your business?
I have always thought that there should be more to cybersecurity than just buying more tools. I co-founded the business with Pancham Agrawal, who has decades of experience in the sector, and while we approach the market from different perspectives, this is our guiding principle.
Businesses need someone who can help them understand the risk, explain it in plain terms and work with them on what to do next.
SMEs are at the heart of that. Smaller businesses can assume they are less attractive to attackers because they are not household names, but their size can make them more exposed if they do not have the security teams and resources of a large enterprise. I wanted to deliver proper cybersecurity around how a growing business really operates, not a cut-down enterprise service.
EVADA grew from the same thinking. A conversation with my father prompted the question: if attackers can use automation and AI to move faster, how should the defensive side respond? That pushed me to look at the gaps created when penetration testing only happens periodically.
Who do you admire?
My father is my absolute hero. He had to fight his way out of hardship, as he did not have many opportunities growing up, and life did not exactly give him a break either.
The thing that inspires me about him most is that he always fought for his goals, no matter what came his way. He did not accept his hardships as unavoidable circumstances, but instead saw a way to overcome them. By seeing his example, I learned that the only limit is the one you set for yourself.
I also really admire Steve Jobs. He always focused on the product and what the customer actually needed. He had the vision and the courage to say no to a thousand ideas before he said yes to the one that would change the world.
He also knew when to sacrifice what he had for the sake of a bigger goal. That vision inspired me to dedicate myself to creating products with a real purpose, instead of just making things out of convenience.
In a nutshell, Jobs showed me what I had to strive for, and my dad showed me that it was possible. That was especially true during the creation of EVADA, when I took up the challenge of finding a convenient, less time-consuming and more engaging way to carry out penetration testing.
Looking back, is there anything you would have done differently?
I would have been more patient with the pace and less impatient with the people. I came in wanting to move quickly, which is not wrong, but I underestimated how long it takes to make good decisions when you are dealing with real businesses, risk and people who have seen a lot of ideas come and go.
I would keep the urgency but apply it to learning faster, listening more carefully and building stronger relationships early. The speed you move at matters much less than the direction you are moving in.
What defines your way of doing business?
We do not expect the customer to speak our language. Our job is to understand what is happening, explain the risk in a way that is useful to the people making the decisions, and help them take practical action. The service has to fit the business and the risk, not force the business into a standard technical model.
I also like to challenge established approaches when there might be a better way, but fresh thinking only has value if it stands up in the real world. That is why I work alongside Pancham. An idea has to hold up from more than one perspective before we take it forward.
What advice would you give to someone starting out?
Expect trust to come before anything else. I assumed the quality of the work would speak for itself quickly, but trust is built over time by showing up, following through and being honest when things are difficult. Customers and partners want to know you will still be reliable when the going gets tough.
Be patient with the pace, and put your urgency into learning and listening. And bring in experience alongside your fresh ideas, because the best businesses combine both.
