In conversation with Lucy Burnford, CEO and co-founder at coc00n – an NCSC For Startups and Cyber Runway alumnus – we hear all about her diverse career, business success and transition into cyber along with the difficulties of developing a truly novel solution.
Many founders have led past lives within the corporate world before realising it’s not for them, subsequently feeling inspired to embrace entrepreneurship. However, Lucy Burnford dived headfirst into leading a business from the outset.
But before becoming CEO and co-founder at cyber startup coc00n, which secures the personal devices of high-profile and high-risk individuals and their families against cyber-attacks, it was marketing where Lucy began back in 2002. “It wasn’t a conscious decision at all,” she admits, noting that an opportunity presented itself to her.
“I saw that a new brand needed to be represented in the right way, a premium way, and was aware that there wasn’t an offering in the market that provided that, so filled that gap,” Lucy details.
Just 21 at the time, she had no experience of starting a business but possessed the right ingredients: unique ideas that resonated with the target market, delivered with integrity and conviction. “I think the combination of an innate sense of what would work, with relentless effort and determination to deliver, made the business successful,” Lucy opines. “I can’t imagine working for anyone else in a traditional sense.“
Having achieved success through her marketing agency, which was experienced in developing unique, innovative strategies for premium brands, an approach both clients and consumers loved, Lucy’s next move took her into automotive tech. “I essentially used my skill for developing concepts that would resonate with consumers and devised a platform that automated and digitised all aspects of car ownership,” she recalls.
“A level previously reserved for government ministers and royalty“
Although in a different field entirely, coc00n prides itself on being unique – a signature of Lucy’s. “Our mission is to secure high value individuals and organisations against sophisticated cyber threats,” she explains. “coc00n provides personal cyber security and comprehensive digital privacy through mobile device protection at a level previously reserved for government ministers and royalty. “
The coc00n team comprises former GCHQ and NCSC cyber security architects who have experience of protecting high risk individuals with specialist solutions, which inspired the business launch. “Whilst my co-founders have the technical expertise to build the product and deliver the service, my experience of devising concepts and bringing to market innovative digital products is complementary and provides the missing commercial piece to their technical expertise,” Lucy highlights.
Entering the market in the second quarter of 2023, Lucy reflects on some of the key milestones the company has achieved already – the start of which saw coc00n secure their first globally recognisable ultra-high net worth client. “This validated some key assumptions including product-market fit, marketing strategy and price point,” she notes.
The product rollout also revealed where it could be evolved to meet customer demand, as Lucy shares: “We also adapted based on market need. Initially the device protections we apply to phones, tablets and laptops were for personal devices, but in response to client requirements we devised a version of coc00n suitable for corporate devices too.”
Like any startup journey, coc00n faced challenges – notably, achieving exposure. “We’re a very discreet service and therefore typical marketing and advertising activities aren’t appropriate,” Lucy says. “Attracting clients has been by word of mouth, personal introductions, referrals and networking – this is time consuming and requires a specific approach.”
Where the technology itself is concerned, that too created hurdles for the team to overcome. With device enrolment into coc00n protections initially an operationally intensive hands-on process, the team sought to deliver the service remotely to achieve scale and remove barriers to entry. “Initially we were uncertain remote enrolment was possible without compromising the level of protection provided,” Lucy reveals. “Fortunately, we overcame that – a testament to the genuinely exceptional and rare level of technical expertise our team has. So, we can now deliver coc00n device protection with zero touch which of course has positive implications for scale.”
Discussing why coc00n applied for NCSC For Startups, Lucy explains that the team was well versed in the programme offering due to their career backgrounds. “My three co-founders were all at GCHQ and NCSC for nearly a decade and as part of that they participated in the scheme on the inside – so they knew first-hand how beneficial the programme was to businesses of all stages,” she says.
“If you don’t ask, you’ll never get it”
The 12 weeks on NCSC For Startups proved to be incredibly impactful for coc00n, as Lucy says it allowed for an overhaul around their communications strategy. “Over the course of the programme, we completely changed our marketing literature,” she says.
“Initially this was tech-heavy on the basis that we presumed we would primarily be speaking with highly technically competent individuals who would want to review and discuss technical architecture in-depth. In fact, barely any clients or prospects want to review the technical aspects of coc00n – instead preferring a solution-based narrative.“
From participating in the programme when it was live, coc00n is now one of the 70 plus companies that form the NCSC For Startups alumni community. “It’s hugely valuable to forge close relationships with such forward-thinking individuals and their respective companies,” Lucy opines.
“Open peer-to-peer discussions are priceless for troubleshooting and sharing experiences both good and bad. The wider alumni community is really rich territory, in which we hope to grow our relationships through. Plexal has been hugely proactive with activities that help drive this.”
A few months ago, Lucy joined Plexal’s CyberWomen webinar during which she discussed what it means to be a leader. Elaborating on that during our conversation, she says: “I’m definitely still learning and on a leadership journey – something I don’t think ever ends regardless of how long you’ve been in business for. I’d like to think that I’m a good communicator and approachable which I believe is very important.”
Clearly, Lucy is practicing what she preaches. In July 2024, she was named as a cohort member of the leadership-focused Cyber Runway Ignite programme delivered by Plexal and the Department for Science, Innovation and Technology. And in March 2025, she graduated from Ignite, championing peer group power during Cyber Runway Live: “Whether it’s commercial, strategic or technical, someone in this ecosystem has valuable advice but if you don’t ask, you’ll never get it.”
“Being truly innovative is about looking at a problem or gap in the market from an outsider’s perspective”
Lucy reasoned during the CyberWomen panel that the cyber sector can benefit from female role models who aren’t just technical, which she’s proof of. Outside of her varied career background, she qualified with a Master’s degree in English and Drama from RADA and Kings College London – something Lucy notes is particularly useful for writing, communicating and delivering client presentations. “Not all people in the tech space have that ability so it’s definitely a benefit to our business.”
“Often industries are very insular, which can be stifling and not conducive to creativity, she begins. “I think the more variety there is, the better. I’m not going to purport to have the level of technical knowledge as our CTO, or the level of insight into cyber risk as our CISO, but I don’t need to – they are leading experts. Ensuring there’s a diverse range of voices and a wider range of expertise from totally different sectors involved is essential to fuel ideation.”
With more than 20 years of business leadership experience under her belt, Lucy has some prudent words of wisdom to impart. “Do what you’re good at and delegate the rest,” she declares. “It was only in hindsight I realised that my first business had a 100% pitch win and 100% client retention record – I didn’t even know those were metrics I should be tracking, let alone have the time to consider how valuable that was. I was too bogged down with tasks I should have outsourced or recruited people to take on.
“Business is about relationships. Anyone looking to work with you or buy your products will primarily be concerned with if you’re trustworthy, credible, have integrity and are someone they can revert to in the event there’s an issue. Fundamentally, do they like you? Almost all of our initial meetings are non-technical and about establishing a relationship to determine if it’s worth developing that forward.
“I believe that being truly innovative is about looking at a problem or gap in the market from an outsider’s perspective. All three of my businesses have been in sectors where the industry itself hasn’t come up with the solution because they’re too inward-looking and focused on evolving existing solutions or are too insular rather than being able to come at it totally fresh with a consumer’s view. “
With fresh in mind, it begs the question: what can we expect from the future of coc00n? The business has experienced a surge in demand for device protection around high threat deployments due to world events leading more countries to be considered “high risk,” Lucy explains, with a direct impact to both private and public sectors.
“To that end, we’re working on technical developments to support this use case further, taking input from a variety of individuals who have extensive experience of operating in hostile territories and using that to inform our product development strategy for this specific use case,” Lucy says. “We’re also looking towards expanding our presence in other markets – both directly and through partnerships.”
You can connect with Lucy on LinkedIn where you can also follow coc00n’s updates.
