Abdullateef Abdulsalam is a cybersecurity analyst at Guaranty Trust Bank UK Limited, founder of Fa3Tech Limited, and the builder of three security platforms — PrepIQ, DefenceIQ, and CertPulse.
In this interview with PREMIUM TIMES, he speaks about an unconventional career path, the structural failure he believes underlies the UK’s cyber preparedness gap, and why he gave away his flagship products for free.
PT: You have a background in Industrial Relations and Personnel Management. How does someone with that starting point end up inside a major UK bank’s security function?
Curiosity, and then a very specific incident that made it personal. Before I came to England, I had spent years working in IT support and operations. I was a pioneer staff member at Sigma Pensions Limited in Abuja from 2004 to 2009, then moved into IT operations for Starfish Mobile Nigeria Limited, a value-added service provider in the telecoms sector. In April 2012, a threat actor gained unauthorised access to our infrastructure and began using it for his own purposes. Server utilisation spiked, revenue dropped, and it took time to understand what was happening. That was the moment cybersecurity stopped being abstract and became something I took personally. You do not forget the first time you watch an adversary quietly drain something you helped build.
By the time I came to England and started my second degree, I already had over a decade of hands-on technical experience. The academic route formalised something that had already been forming for years in the field. Understanding human behaviour turns out to be directly useful in security — most failures are ultimately people failures.
PT: You completed an MSc in Applied Data Science at the University of Sunderland in 2023. What drove that decision?
Abdulsalam: I wanted to build defensible things. In security, instinct gets you somewhere, but “I have a feeling” will not survive a board presentation or a regulatory review. The MSc gave me the ability to structure a problem, validate it quantitatively, and explain conclusions to people who were not in the room when the analysis was done. My dissertation was on predicting flight delays using supervised machine learning, which sounds removed from security, but the underlying discipline is identical: define the problem cleanly, do not deceive yourself with your own data, and communicate findings to a non-technical audience. I use all of that constantly, whether I am building a fraud intelligence model or justifying a security control recommendation.
PT: You also received the SuPA Professional Award from the University of Sunderland in 2023, presented by the Vice Chancellor. What was that for?
Abdulsalam: The SuPA — Skills and Professional Attributes — award recognises what you build outside the lecture theatre: leadership, community engagement, professional events, real-world projects. You must evidence and reflect on it, which is a rigorous process. Going back through my archive later, I realised it was an early marker of habits that have since defined my work — showing up to things that are not on the syllabus, building in public, treating professional development as a discipline rather than an afterthought.
PT: You have worked across incident management, threat detection, vulnerability management, and regulatory compliance with the FCA, PRA, and DORA. What has working inside a major bank taught you?
Abdulsalam: Scale and consequence. A misconfigured firewall rule in a bank is not a minor inconvenience — it is potentially hundreds of thousands of customer records or a material operational disruption that lands in a regulatory filing. That context changes how you think. You become precise about documentation, about change management, about second and third-order effects of any decision.
The limitation is that large institutions are conservative by design. The problems I kept seeing in the wider market — the small firm with no security budget, the civil society organisation that is a serious target but does not know it — were never going to be solved from inside a bank. That gap is what pushed me to start building.
PT: Was there a specific moment when you stopped seeing cybersecurity as a job and started seeing it as a problem you personally needed to solve?
Abdulsalam: The Starfish incident in 2012 was the first time. But the moment that truly set the direction came later, when I was working through a vulnerability assessment cycle at the bank and kept thinking about the organisations we were not protecting — too small for enterprise tooling, too exposed to ignore. I kept asking what a GP surgery or a 20-person law firm was supposed to do with a vendor contract that cost more than their entire IT budget. Nobody had a good answer. That is not a market gap; that is a structural failure. The moment I stopped expecting someone else to fix it was the moment I started building PrepIQ. I did not plan to become a founder. I simply ran out of patience waiting for the right product to exist.
PT: Tell us about Fa3Tech Limited. Why a company rather than independent consulting?
Abdulsalam: Consulting solves one client’s problem at a time. I wanted to solve the same problem at scale. Fa3Tech is a UK-registered cybersecurity and technology company built on the idea that capable security tooling should not only be available to organisations that can afford enterprise contracts. Products can reach people a consultant never will — the NHS trust with two people in IT, the professional services firm in Birmingham, the journalism outlet being targeted by a state actor without knowing it.
PT: What does PrepIQ actually do?
Abdulsalam: PrepIQ is a free, open-source cyber preparedness platform built specifically for UK organisations without a dedicated security function. It includes a UK SME Cyber Health Index that benchmarks your organisation against sector peers; 27 learning modules aligned to frameworks including NCSC Cyber Essentials, UK GDPR, FCA SYSC 13, and DORA; a six-scenario incident simulator with AI-powered debrief; a phishing simulation engine using UK-relevant templates; and board-ready PDF reporting. It is live at prepiq.fa3tech.io and open source on GitHub under the Apache 2.0 licence. It currently has 78 users across 12 UK organisations spanning financial services, healthcare, education, retail, and the public sector.
PT: You made it completely free. That is not the obvious commercial decision.
Abdulsalam: The organisations that most need it are the ones that cannot pay for it. I kept encountering the same situation — a small charity, a local authority, a GP surgery — who understood they had a gap but had no realistic route to addressing it because commercial products start at price points that bear no relationship to their budgets. Making PrepIQ free removes that barrier entirely.
The broader point is that cyber resilience in the UK is not a competitive advantage problem — it is a collective infrastructure problem. If PrepIQ helps thousands of organisations become better prepared, that matters to large banks and insurers too, because they are downstream of those smaller organisations in their supply chains. Making it free is the right call, even from a self-interested perspective.
PT: How does DefenceIQ sit alongside PrepIQ?
Abdulsalam: They address different parts of the same problem. PrepIQ is about preparedness — understanding your security posture, training your people, practising your response. DefenceIQ is an AI-powered fraud intelligence platform with 12 modules, including AML transaction monitoring, sanctions screening, adverse media classification, a UK NCA-format SAR generator, and network link analysis. Also open source under Apache 2.0 at defenceiq.io. Together, the two platforms give any UK organisation access to capabilities that previously required enterprise contracts and specialist staff.
PT: And CertPulse?
Abdulsalam: CertPulse is a commercial SSL certificate monitoring SaaS at CertPulse. tech with active paying customers. It is the proof point that Fa3Tech is not building open source for its own sake. The answer to why people pay for a tool rather than simply use a free one is mostly about accountability and reporting — customers want to know something is watching so they do not have to.
PT: Two of your three products are free. Some would call that a poor business model.
Abdulsalam: I do not find it particularly hard to defend. The UK has a well-documented problem with cyber preparedness in the SME and public sector space. The NCSC publishes the data. The insurance industry prices it. Everyone knows the gap exists. The organisations most exposed are the ones with the least capacity to act, and the commercial market has not solved that because it is not designed to. Open source is one of the few mechanisms that can reach those organisations at scale.
What I find harder to defend is the alternative — building another paid product that serves organisations already served, while the rest remain exposed. CertPulse is how I answer the business model question in practice. You can run a sustainable business alongside genuinely public-benefit work. They are not in conflict if you are deliberate about how you structure them.
PT: In March 2026, you spoke on a panel at a TechChat and Networking event hosted by ParayTech and supported by the NatWest Accelerator. What did you cover?
Abdulsalam: The invitation came because of the intersection of things I do — working at the operational frontier of financial services security while simultaneously running a startup in the same space. The panel covered the realities of building a cybersecurity venture inside the UK’s fintech ecosystem: the friction between moving fast as a founder and the discipline required as a practitioner in a regulated institution, what digital trust means in practice rather than on a slide deck, and why the UK needs more people who have done both. ParayTech and the NatWest Accelerator have built something that genuinely works for early-stage tech founders.
PT: You published an expert analysis on the alleged Remita data breach — Nigeria’s central government payment platform. Why did that incident draw your attention?
Abdulsalam: A threat actor claimed to have extracted 3TB of data, including KYC documents, government HSM keys, source code, and over 35,000 password hashes. If the HSM key claims are accurate, that is not a routine breach — HSMs are the cryptographic trust anchor of financial operations. The alleged entry point was a misconfigured S3 bucket. Not a zero-day. A misconfiguration. That is painful in a specific way.
The public response also caught my attention — language about “some hitches” while quietly telling partners to regenerate API keys. The gap between those two things tells its own story. I wrote about it because millions of Nigerians interact with Remita and deserved a clear-eyed explanation of what was at stake, including the 72-hour notification obligation under Nigeria’s Data Protection Act.
PT: In December 2025, you spoke at HEDA Resource Centre’s monthly Chatting with HEDA series on X, to an audience of journalists and advocacy professionals. What did that session cover?
Abdulsalam: HEDA is a registered civil society organisation with over 16,000 supporters. They brought me in because journalists and advocacy workers are genuinely high-value targets — state actors, criminal groups, and disruptive actors all have reasons to compromise them — yet they receive almost none of the institutional security support that corporate environments provide. We covered targeted hacking, AI-generated misinformation, deepfakes used to discredit activists, and practical steps they could take immediately: encrypted communication tools, email security practices, and password hygiene. HEDA’s Chairman, Mr Olanrewaju Suraju, described the session as timely and highly engaging. What meant more was feedback from attendees who said they left with things they could actually do the next morning.
ALSO READ: FG to establish Cybersecurity Council to combat cyber threats
PT: In April 2026, you delivered a guest lecture at the University of Sunderland to postgraduate students. What is the core argument?
Abdulsalam: Human-centred security, cyber resilience, incident response, and organisational security culture. The core argument is that most security failures are ultimately human failures — not because people are careless, but because systems are designed without adequate consideration of how humans behave under stress, time pressure, and information overload. I want students to leave understanding that good security design starts with empathy, that resilience is a more useful frame than pure prevention, and that the ability to communicate clearly to a non-technical leadership team is as important as any technical certification.
PT: Teaching in an institution where you were recently a student is a strange position. How do you approach it?
Abdulsalam: You must be honest about the gap between what the curriculum covers and what the first three years in the field actually feel like. What I can offer is the unfiltered version — the incidents that did not resolve cleanly, the board presentations where the security recommendation was overruled for budget reasons, the moment you realise the human layer of security is harder to manage than any technical control.
I am also deliberate about showing students that unconventional routes into the field are not a disadvantage. I came from operations, from live infrastructure, from a decade of field experience before the formal qualifications. That is a different kind of preparation — and in some ways a better one.
PT: Be honest about what it is like to build a company alongside a full-time role at a major bank.
Abdulsalam: Most of PrepIQ was written between 10 pm and 2 am. The phishing simulator, the incident scenarios, the AI coaching feature, and the board reporting engine — those represent hundreds of hours of work that happened after a full day inside the bank. There are weekends when I have been debugging a database migration while finishing a compliance report. It is not something I would romanticise. But I stopped believing in perfect conditions a long time ago. The alternative — waiting until circumstances aligned before starting — was not available to me, and I do not think it is available to most people who end up building something real.
PT: What does the UK cybersecurity sector still get wrong that someone with your background can see clearly?
Abdulsalam: Two things. The first is the assumption that security awareness is a training problem. You send employees a phishing simulation, track click rates, and report to the board that the percentage went down. None of that tells you whether the organisation is actually more resilient. Real awareness is about building a security culture where people raise concerns early, where the security team is seen as a resource rather than a compliance function, and where leadership models the behaviour it expects.
The second is the talent pipeline. The sector recruits heavily from a narrow profile — computer science graduates, certain certifications, and certain universities. The result is teams that are technically similar but contextually limited. Some of the most effective security work I have done drew directly on understanding how people behave in organisations under pressure, which is not something you learn in a lab. The sector would be stronger if it recruited more deliberately from operational backgrounds, from social sciences, and from people who have worked in regulated environments outside technology.
PT: Where does Fa3Tech sit by 2030?
Abdulsalam: PrepIQ deployed across thousands of UK SMEs, NHS trusts, and civil society organisations — genuinely moving the needle on national cyber preparedness. DefenceIQ has formal partnerships with financial crime units and regulatory bodies, feeding intelligence into the system rather than simply serving individual organisations. And a funding round that allows me to hire a proper team and build out the commercial tier alongside the free tier, which is a commitment, not a marketing strategy.
PT: You also have a PhD on the horizon. What is the research direction?
Abdulsalam: Adversarial machine learning in network intrusion detection systems — specifically, maintaining detection performance when adversaries actively probe and adapt to your models. Most current research assumes a relatively static threat environment: a model is trained on labelled traffic data, validated, and deployed. But in practice, sophisticated adversaries conduct reconnaissance, identify detection thresholds, and craft evasion techniques that exploit a model’s blind spots. That gap between laboratory performance and real-world degradation is the core problem I want to investigate. The research connects directly to what I am already building — PrepIQ and DefenceIQ both sit at the intersection of AI-assisted detection and accessible infrastructure. The PhD is a way to contribute to that body of work from a practitioner’s perspective.
PT: What would you say to someone from a non-technical background who wants to work in cybersecurity but cannot see a way in?
Abdulsalam: Find the specific problem that makes you angry. For me, it was watching organisations get torn apart by threats they could have survived with basic preparation, and knowing that nobody was building accessible tools to help them. Anger is a better motivator than a career plan. And start building before you feel ready, writing before you feel qualified, speaking before you think you have earned it. The qualification comes from doing it, not the other way around. If I had waited until I felt ready, PrepIQ would not exist.
