Mr Abdulsalam speaks candidly about the structural failures that leave small firms, NHS trusts, and civil society groups exposed.
Abdullateef Abdulsalam is a cybersecurity analyst at Guaranty Trust Bank UK Limited, founder of Fa3Tech Limited, and the builder of three security platforms — PrepIQ, DefenceIQ, and CertPulse.
PT: You have a background in Industrial Relations and Personnel Management. How does someone with that starting point end up inside a major UK bank’s security function?
Curiosity, and then a very specific incident that made it personal. Before I came to England, I had spent years working in IT support and operations. I was a pioneer staff member at Sigma Pensions Limited in Abuja from 2004 to 2009, then moved into IT operations for Starfish Mobile Nigeria Limited, a value-added service provider in the telecoms sector. In April 2012, a threat actor gained unauthorised access to our infrastructure and began using it for his own purposes. Server utilisation spiked, revenue dropped, and it took time to understand what was happening. That was the moment cybersecurity stopped being abstract and became something I took personally. You do not forget the first time you watch an adversary quietly drain something you helped build.
By the time I came to England and started my second degree, I already had over a decade of hands-on technical experience. The academic route formalised something that had already been forming for years in the field. Understanding human behaviour turns out to be directly useful in security — most failures are ultimately people failures.
PT: You completed an MSc in Applied Data Science at the University of Sunderland in 2023. What drove that decision?
Abdulsalam: I wanted to build defensible things. In security, instinct gets you somewhere, but “I have a feeling” will not survive a board presentation or a regulatory review. The MSc gave me the ability to structure a problem, validate it quantitatively, and explain conclusions to people who were not in the room when the analysis was done. My dissertation was on predicting flight delays using supervised machine learning, which sounds removed from security, but the underlying discipline is identical: define the problem cleanly, do not deceive yourself with your own data, and communicate findings to a non-technical audience. I use all of that constantly, whether I am building a fraud intelligence model or justifying a security control recommendation.
PT: You also received the SuPA Professional Award from the University of Sunderland in 2023, presented by the Vice Chancellor. What was that for?
Abdulsalam: The SuPA — Skills and Professional Attributes — award recognises what you build outside the lecture theatre: leadership, community engagement, professional events, real-world projects. You must evidence and reflect on it, which is a rigorous process. Going back through my archive later, I realised it was an early marker of habits that have since defined my work — showing up to things that are not on the syllabus, building in public, treating professional development as a discipline rather than an afterthought.
PT: You have worked across incident management, threat detection, vulnerability management, and regulatory compliance with the FCA, PRA, and DORA. What has working inside a major bank taught you?
Abdulsalam: Scale and consequence. A misconfigured firewall rule in a bank is not a minor inconvenience — it is potentially hundreds of thousands of customer records or a material operational disruption that lands in a regulatory filing. That context changes how you think. You become precise about documentation, about change management, about second and third-order effects of any decision.
The limitation is that large institutions are conservative by design. The problems I kept seeing in the wider market — the small firm with no security budget, the civil society organisation that is a serious target but does not know it — were never going to be solved from inside a bank. That gap is what pushed me to start building.
PT: Was there a specific moment when you stopped seeing cybersecurity as a job and started seeing it as a problem you personally needed to solve?
Abdulsalam: The Starfish incident in 2012 was the first time. But the moment that truly set the direction came later, when I was working through a vulnerability assessment cycle at the bank and kept thinking about the organisations we were not protecting — too small for enterprise tooling, too exposed to ignore. I kept asking what a GP surgery or a 20-person law firm was supposed to do with a vendor contract that cost more than their entire IT budget. Nobody had a good answer. That is not a market gap; that is a structural failure. The moment I stopped expecting someone else to fix it was the moment I started building PrepIQ. I did not plan to become a founder. I simply ran out of patience waiting for the right product to exist.
PT: Tell us about Fa3Tech Limited. Why a company rather than independent consulting?
Abdulsalam: Consulting solves one client’s problem at a time. I wanted to solve the same problem at scale. Fa3Tech is a UK-registered cybersecurity and technology company built on the idea that capable security tooling should not only be available to organisations that can afford enterprise contracts. Products can reach people a consultant never will — the NHS trust with two people in IT, the professional services firm in Birmingham, the journalism outlet being targeted by a state actor without knowing it.
PT: What does PrepIQ actually do?
Abdulsalam: PrepIQ is a free, open-source cyber preparedness platform built specifically for UK organisations without a dedicated security function. It includes a UK SME Cyber Health Index that benchmarks your organisation against sector peers; 27 learning modules aligned to frameworks including NCSC Cyber Essentials, UK GDPR, FCA SYSC 13, and DORA; a six-scenario incident simulator with AI-powered debrief; a phishing simulation engine using UK-relevant templates; and board-ready PDF reporting. It is live at prepiq.fa3tech.io and open source on GitHub under the Apache 2.0 licence. It currently has 78 users across 12 UK organisations spanning financial services, healthcare, education, retail, and the public sector.
PT: You made it completely free. That is not the obvious commercial decision.
Abdulsalam: The organisations that most need it are the ones that cannot pay for it. I kept encountering the same situation — a small charity, a local authority, a GP surgery — who understood they had a gap but had no realistic route to addressing it because commercial products start at price points that bear no relationship to their budgets. Making PrepIQ free removes that barrier entirely.
The broader point is that cyber resilience in the UK is not a competitive advantage problem — it is a collective infrastructure problem. If PrepIQ helps thousands of organisations become better prepared, that matters to large banks and insurers too, because they are downstream of those smaller organisations in their supply chains. Making it free is the right call, even from a self-interested perspective.
PT: How does DefenceIQ sit alongside PrepIQ?
Abdulsalam: They address different parts of the same problem. PrepIQ is about preparedness — understanding your security posture, training your people, practising your response. DefenceIQ is an AI-powered fraud intelligence platform with 12 modules, including AML transaction monitoring, sanctions screening, adverse media classification, a UK NCA-format SAR generator, and network link analysis. Also open source under Apache 2.0 at defenceiq.io. Together, the two platforms give any UK organisation access to capabilities that previously required enterprise contracts and specialist staff.
PT: And CertPulse?
Abdulsalam: CertPulse is a commercial SSL certificate monitoring SaaS at CertPulse. tech with active paying customers. It is the proof point that Fa3Tech is not building open source for its own sake. The answer to why people pay for a tool rather than simply use a free one is mostly about accountability and reporting — customers want to know something is watching so they do not have to.
PT: Two of your three products are free. Some would call that a poor business model.
Abdulsalam: I do not find it particularly hard to defend. The UK has a well-documented problem with cyber preparedness in the SME and public sector space. The NCSC publishes the data. The insurance industry prices it. Everyone knows the gap exists. The organisations most exposed are the ones with the least capacity to act, and the commercial market has not solved that because it is not designed to. Open source is one of the few mechanisms that can reach those organisations at scale.
What I find harder to defend is the alternative — building another paid product that serves organisations already served, while the rest remain exposed. CertPulse is how I answer the business model question in practice. You can run a sustainable business alongside genuinely public-benefit work. They are not in conflict if you are deliberate about how you structure them.
PT: In March 2026, you spoke on a panel at a TechChat and Networking event hosted by ParayTech and supported by the NatWest Accelerator. What did you cover?
Abdulsalam: The invitation came because of the intersection of things I do — working at the operational frontier of financial services security while simultaneously running a startup in the same space. The panel covered the realities of building a cybersecurity venture inside the UK’s fintech ecosystem: the friction between moving fast as a founder and the discipline required as a practitioner in a regulated institution, what digital trust means in practice rather than on a slide deck, and why the UK needs more people who have done both. ParayTech and the NatWest Accelerator have built something that genuinely works for early-stage tech founders.
