The Czech Cyber Billionaire Who Built A Fortune On Free Software

^On the rooftop terrace of the five-star Hotel U Prince, Pavel Baudis surveys the city he’s lived in for most of his 59 years. Over his shoulder is Prague’s tourist-heavy town square and the grand gothic spires of the Church of Our Lady before Týn; in front of him stand serried ranks of ochre rooftops. 

The city has become considerably more colorful in his lifetime. Baudis lived through the dark days after Warsaw Pact troops crushed the Prague Spring, entrenching a communism so stringent in its ideals it would prevent his father from practising psychiatry and limited his own education. Then came liberalisation after the Velvet Revolution in 1989, creating opportunities for would be inventors like Baudis.

Through it all, he’s persevered with a cool, thrifty attitude. It’s a mindset that has enabled him to transform a little cybersecurity company he co-founded during the waning days of the communist regime into an industry leader that is taking on, and in some ways outdoing, aggressive American rivals like McAfee and Symantec. It has also made him one of a handful of Czech billionaires.

Baudis’ baby is Avast, the anti-virus software that sits on more than 400 million computers and smartphones around the world. Like the similar products McAfee and Norton also developed in the late 1980s, it’s designed to prevent cybercriminals and spies from installing data-pilfering tools on computers. The main difference is that Avast is free and only available online, not in retail stores. That “freemium” model has lifted Baudis’ company to giddy heights, culminating in its 2018 London Stock Exchange IPO, which set it on a course to become a $4 billion business and has taken Baudis’ net worth to $1.4 billion as of June 2019. 

While Baudis’ swelling fortune has made him a member of the billionaire’s club, he epitomizes self-effacement. Wearing a plain navy waistcoat and a black fanny pack, his bristly white hair encircling a balding pate, Baudis displays no signs of his wealth. He’s taciturn throughout a two-hour conversation on the hotel’s chilly terrace, choosing his words carefully as he methodically sips from a hot chocolate and a single Staropramen beer. He professes to have “no expensive hobbies”; his most outré pastime is geocaching, a game in which participants hunt for treasures using GPS coordinates. His investments are small and sensible, the most recent a diaper manufacturer and a nearby hotel with a view of his city’s most imposing landmark, Prague Castle. “I’m not very good in hotel management. It’s a good education,” Baudis says of his latest side hustle.

Among Baudis’ more profitable decisions was recruiting a headstrong American to turn Avast into a giant-killer. That man, sitting across from Baudis, talking over the cackles of tourists and the cooing of dating couples, is Vince Steckler, Avast’s CEO for the past decade. It’s the first time the two have been interviewed together by an English-language publication since the IPO. The former Symantec executive, who’s louder and brasher than the Czech and with his physical heft and bald head looks like a retired army general, is happy to brag about the company’s success where Baudis demurs. “I was just looking at Aston Martin earlier today. We were the second largest IPO [on the LSE] of the year. Aston was the largest. We’re now more valuable than Aston Martin,” Steckler says. He’s not wrong. Bond’s favorite car maker has seen its stock plummet and its valuation slump to just over $3 billion.

Steckler was not an obvious choice. In 2005, when he was an executive at Logicon, Inc., the SEC handed him a $35,000 civil monetary penalty, saying Steckler had helped the Silicon Valley software company Legato inflate its revenue records by signing a $7 million contract with a cancellation clause. According to the SEC, Steckler knew that the cancellation allowance should have prevented Legato from counting the order as a sale and had advised Legato executives on how to hide the clause from their finance department. One former Avast employee said that staff used to joke about the “ex-con upstairs.”

Steckler's record came under intense scrutiny from the British press around the time of the IPO. Usually loquacious on any subject, Steckler declined to provide a statement on the episode at the time and again recently when Forbes asked for comment. He wasn’t at the top of Baudis and cofounder Eduard Kucera’s list when they were hunting for a CEO in 2009. The founders initially wanted Steckler’s old boss, ex-Symantec VP Dieter Giesbrecht. “They found someone they really liked who wasn’t me,” Steckler jokes. Giesbrecht declined the offer but introduced Baudis and Kucera to Steckler, who jumped at the chance to move to Prague from Singapore and take the helm from the cofounders, who are now guiding the company as board directors.

Despite Steckler’s blemishes, under his watch the company has doubled its user base and booked an operating profit of $248.3 million in 2018, according to the company results. Steckler says that when he joined in 2009, the company’s revenue was at just $20 million. After myriad acquisitions that massively boosted user numbers, some profitable partnerships and an aggressively global approach, revenue over the past 10 years has soared. But Steckler’s reign is almost over: Two weeks after our meeting, he announced he was to retire at the end of June. He’s to be replaced by right-hand man and one of Baudis’ earliest hires, Czech national Ondrej Vlcek. 

^Steckler may have provided something akin to an adrenalin shot of American capitalism, but it was Baudis and Kucera’s unswerving belief in their product that put Avast on a trajectory to unicorn status and beyond. 

Baudis has taken actions you’d associate with modern tech tycoons like Mark Zuckerberg, but without the showiness. He ended his work on a chemistry degree in the late 1980s, admitting he wasn’t a natural scientist, and applied his hungry mind to computers. Under the Soviet regime, few consumer computers were available to Baudis, but he managed to get his hands on an Olivetti M24 while he was working at the severe sounding Research Institute for Mathematical Machines. He knew there was no market for the graphics software he was writing so stifling was the political and economic insularity of Czechoslovakia at the time. “It was frustrating that even if you were very good and do a very good job, you are just wasting your time and knowledge,” he says. This was at the tail end of the period of normalization, which had fostered the kind of environment you’d expect from a failed communist project. “A lot of people invite you to discuss your political beliefs and views, and so if they are not satisfied you are out of a job,” Baudis recalls.

But then Baudis was sent a floppy disk that contained one of the original computer viruses, called Vienna. “None of my colleagues were actually interested in it. [They thought] it’s a toy. So I took it for myself and I started to explore it,” he says. Those colleagues must rue the day: His tool, which simply found and deleted the file-wiping malware, would become a key component of the first Avast anti-virus engine and the launchpad for the business. 

Though the American-Czech partnership would later do wonders for Avast, competition with U.S. industry giants in the 1990s and early 2000s nearly brought Baudis and Kucera to their knees. They parried repeated attempts by McAfee and Symantec to dominate the market. In 1997, McAfee tried to acquire the Czech business. The ever-steadfast Baudis recalls that instead of selling, he and Kucera offered to license the engine that powered their software. “And they say, ‘No, no way.’ But after two weeks they just came back and they licensed it,” Baudis says, grinning.

Then, in the early 2000s, with Symantec pricing aggressively low in an attempt at global domination, the Avast chiefs had to try something radical. The plan was to go global too, but since they had no marketing budget, there was only one option: offer Avast for free. “We can either close the business or change something,” recalls Baudis. “We had nothing to lose.” AVG, a local rival, had done the same two years earlier but had made a major mistake by not offering the service in multiple languages, Baudis says. Avast wouldn’t make the same error. Two years after going free in 2001, Avast had one million users; by 2006, it had 20 million. Baudis puts some of the success down to good fortune but gives most of the credit to the open, geeky culture he’d fostered around Avast. “We were very lucky with the timing and very lucky that the program was not only free but it is based on word of mouth,” he recalls.

Whereas the likes of Kaspersky, McAfee and Symantec’s Norton antivirus would make money from the one-off cost of their tools, sold at Best Buy and other retail stores, Avast brought in revenue by encouraging users to purchase and download the full-featured versions of the software, which became smarter over time as the freemium tools fed it with the vast amounts of threat data they were collecting. Marketing partnerships with other software makers provide another revenue stream; for instance, since 2009, in return for an unknown fee from Google, Avast has recommended new users download the Chrome browser.

AVG had grown at a similar pace with the same approach. Not long after Steckler joined, Avast’s leadership decided AVG had to be taken out. After an abortive attempt to go public on the Nasdaq in 2012, Baudis, Kucera and Steckler developed a plan to swallow AVG. Short on funds, they enticed private equity firm CVC Capital Partners in 2014 to take a large stake in Avast. It gave the company a $1 billion valuation. Two years later, after multiple rejections, AVG caved, selling for $1.3 billion. That brought the number of computers and smartphones running Avast-owned software to over 400 million. Though it doesn’t make anything like its rivals’ billions in revenue, Avast had the highest number of Windows users in the antivirus game at the end of 2018, by 6% over second-place McAfee, according to industry tracker Opswat.

With AVG aboard, Avast was on a path to go public. Less than a year before the London IPO, though, disaster struck. Avast learned that 2.3 million computers had been infected after hackers found a way to turn one of the company’s other acquisitions, the Piriform CCleaner, into a launchpad for cyberespionage. In September 2017, hackers infected downloads of CCleaner, which was supposed to help customers remove dangerous software. Anyone who updated or installed the tainted CCleaner during the period had a backdoor installed on their computer. According to cybersecurity analysts, the attacks had all the hallmarks of a Chinese government-backed attempt to infect major technology companies, including Cisco, Intel and Microsoft, though it is unclear how successful the attack was. Baudis’ response to the crisis today is typically straightforward: “We have learned our lessons that when we acquire such a company, we have to put our processes in place much sooner than we did.”

Avast successfully managed the crisis by being open with law enforcement and the cybersecurity community, turning the narrative into that of a cybersecurity company being targeted by some of the most talented spies on the planet. The event was just a speed bump on the drive toward the London Stock Exchange, where Avast arrived on May 10, 2018, with a valuation of $3.4 billion. It put Avast amongst the top five largest tech IPOs to ever launch on the LSE. That’s far beyond what Baudis had dreamed was possible back in the 1980s; he says he only wanted a product that would be more popular than his graphics programs: “It’s huge, and it’s a good feeling.”

“We can either close the business or change something,” says Baudis. “We had nothing to lose.”

In a bid to expand further, Avast plans to launch its first hardware product for the home this year, Steckler says. The little box will monitor all internet traffic in the home, flagging and potentially blocking incoming threats to Internet of Things (IoT) devices like your refrigerator or your Sonos speakers. “You could do a lot of damage with Alexa,” Baudis warns. 

The Avast Omni box will be bundled into a yearly subscription that covers computers and cellphones. No other anti-virus rival has gone as deep into the home, and Steckler admits it’s a risk. But according to Frost & Sullivan analyst Tony Massimini, if anyone’s positioned to do it, it’s Avast. “It’s been something people have been talking about, but let’s see if you can actually make it work. I’d think Avast has a pretty good shot at doing that.”

Not that Steckler will have a hand in guiding Avast through future challenges. He officially retired at the end of June. He’s been replaced by Ondrej Vlcek, a long-time employee and a Czech native, who recently announced he’ll be taking a $1 yearly pay. He and the board are confident that equity-based incentives and his 2% share in the business will be adequate remuneration.

^Despite all the changes in strategy and leadership, the ever-shrewd Baudis held on to most of his shares as others around him sold, a significant reason he’s a billionaire and his colleagues aren’t. He owns a 27% stake, compared with Kucera’s 10.5% and Steckler’s 3.3%.

People inside and outside Avast praise Baudis’ steady construction of a cyber behemoth over the 30 years since the Velvet Revolution freed Czechoslovakia from communist control. “I’ve known Pavel for 20 years. . . . I have a lot of respect for him as a person and for what he’s built,” says Kaspersky’s Costin Raui, one of the oldest hands in the cybersecurity business.

"You have to change the whole company—how it works, how it operates," says Baudis. "And you still need to keep up the company culture in some way."

Baudis has also preserved the geeky ethos that helped incubate Avast through all the mergers. “You have to change the whole company—how it works, how it operates—and you still need to keep up the company culture in some way.” That culture is why more than half of Avast’s 1,700 employees work in research and development labs in the Czech Republic and California. And why the original Olivetti that Baudis was hacking on in the late 1980s is kept at the Prague headquarters.

As the sun goes down over Prague, Baudis recalls how much the city has changed. “It was all gray in 1990. A lot of buildings were in bad shape. Downtown has changed a lot. It’s really like a zoo or something,” he says, clearly not entirely enamored of the never-ending stream of Brits on bachelor parties.

Just before he departs for his country house, Baudis plugs Avast’s foundation, which gives 2% of the company’s profits to worthy causes. One of its focuses is improving palliative care in the Czech Republic. It’s Baudis’ way of giving back to the country that, through the harsh years of communism and latter-day capitalism, helped make him the kind of billionaire he is today.