Not every IT business survives 20 years, let alone grows to become a 150-person services provider that beats multinationals to multi-year contracts with the likes of Transport for NSW, which Avocado Consulting has done.
“We never stood still”, CEO Gerardo Barranquero says about Avocado, which in its earliest phase saw him and the business's co-founder Terry Doherty meeting in a McDonald’s on George Street in Sydney’s CBD.
Barranquero and Doherty started Avocado in 2004 to test software for clients, which wasn't necessarily a dream professional path at the time. "At the time, software testing is where you went when you were no good at coding. So, it wasn't necessarily seen as a high profile or career,” Barranquero recalled.
Over time, the company’s wheelhouse expanded to include managed services, risk assessment, project delivery, software development and cloud migration services. Along the way, it picked up clients in the government, finance, retail, telecommunications, education and healthcare sectors, among others.
In March 2024, with the company fresh from celebrating its 20-year anniversary, CRN Australia spoke with Barranquero about how the business has worked to stay relevant and grow amidst decades of change and competition.
The "old Steve Jobs thing"
Software testing may not have been aspirational in 2004, but it was in demand. "We started with one client, which was AMP,” Barranquero said. From there, “the team just grew and grew.”
Landing Telstra as a client was an early milestone. “We went into Telstra, and they said, 'Can you give me 50 testers inside a month?' And we said, 'Of course we can.' And then we worked out the old Steve Jobs thing; we ran away and worked out how to build an operating system."
Within nine months, Avocado brought on business analysts and project managers to deliver projects, with Avocado building code, making sure it worked properly and delivering it.
Like many IT firms, Avocado ran without sales people for a considerable time, with referrals from AMP and Telstra opening the door to more work.
“We're not a sales organisation. We don't have hard sales targets, things like that. We've always been about taking care of what we do really well, and the rest will take care of itself,” Barranquero said. “I know that's an old saying, but for us it's actually proved to be true.”
Within five years Avocado grew to 50 employees and by the eighth year it employed 100 people.
Calculated risks
A key challenge was gaining credibility as a provider of more than software testing and project services.
“We saw a big opportunity to not just finish at the go-live date, but continue to provide services for clients well beyond that,” Barranquero said.
It wasn’t easy to convince the market that the software testing specialist could also monitor infrastructure and report on customer experience.
“We had to ramp up our marketing team to educate clients on our new service lines and it was a lot harder in practice than on paper,” Barranquero recalled.
Avocado was willing to take calculated risks – at one stage it created two fintech firms "just to prove to ourselves, more than anything, that we are able to not just talk the talk, but walk the walk". But it only jumped into new service lines once “we knew we could engage with a quality team and a strong robust governance process that enabled us to deliver with certainty.”
It sought out Gartner quadrant leaders with an Australian presence, and in 2014, with manual monitoring solutions not keeping pace with requirements, it partnered with Splunk and Dynatrace. By 2016 these services had evolved into “complete service lines” including managed services.
By this time, Avocado was winning large, multi-year contracts, including a contingent workforce deal with Transport for New South Wales (TfNSW) worth over $8 million, running to 2028. In 2023, Avocado won another contract with TfNSW – a five year contract for application monitoring across four cluster agencies and three technology suites.
High profile clients “see our investment in our people, our IP, our methodology and our governance."
The end-to-end nature of Avocado’s work can also be an advantage.
When “you have to do the managed services, you sure have a big investment and interest in making sure there's quality coming down the pipe, because you're going to be the one called at 2am and told it’s not working,” he said.
“It allows us to instil a mindset of a centre of excellence within clients to say, ‘if I'm going to own this, I've got these acceptance criteria before I let you put this into my environment.”
“We might be right at the tail end doing a managed service, but we can talk to the client around the way they're writing the code, pre-programming, DevOps, automation, continuous testing; we can talk to them all about that stuff before it gets to production…all that stuff impacts the managed service.”
Evolving the security story
In September 2022, Avocado acquired Melbourne’s Cyberisk Australia, adding cybersecurity governance, risk and compliance (GRC), threat risk assessment (TRA) and third-party risk management (TPRM) capabilities, in addition to 25 staff, including current cybersecurity lead David Vohradsky.
“The Cyberisk acquisition has paid off as it gave us instant credibility in the cyber market and with CIOs and CISOs through David’s credentials and network,” Barranquero said.
Risk quantification is key to Avocado’s security play. “There's a lot of people out there that will do a risk assessment and identify all the risks that go with it and the potential outcomes; what they can't do is quantify that risk,” according to Barranquero.
“Then the board is presented with 10 risks; which ones should they be working on? Which one has the biggest dollar impact and that actually eventuates? And how do we mitigate that impact down to an acceptable level, or a cost point that we can manage and work through?
“Most of the people that are out there doing those assessments and identifying where the weaknesses are, basically issue a report at the end of it and give it to the client say ‘good luck.’”
“Mitigating all those risks and closing out those vulnerabilities – that's where the value comes for Avocado, that's where the traditional service lines of Avocado come in.”
For some of Avocado’s clients, risk assessment is a year-round activity – it performs over 3,000 third-party risk assessments annually for a major bank.
“It’s a bit of the ‘paint the Sydney Harbour Bridge’ scenario, where basically by the time you've finished doing that, you start again, because the world has moved on from when you did the first one for that client.”
In the cybersecurity domain, Barranquero puts wins against global competitors partly down to quality and capability. Expertise with Splunk, Dynatrace and Airlock was important in winning the five-year contract with TfNSW, he said. “That was the first criteria you had to meet, and most people didn't meet that, let alone have the ability to then deliver on those services.”
It isn't a race to the bottom, it's a race to quality. With that attitude we've been able to win both government and corporate clients.
Unsurprisingly, Barranquero saw security as Avocado’s biggest opportunity in the next 12 months.
“IT resilience” and digital identities or “secrets management” are focuses. In April 2024, Avocado expanded its CyberArk partnership to become the first fully certified ANZ partner for CyberArk Secrets Management.
Widening of the scope of critical infrastructure security legislation has resulted in Avocado “seeing a lot of interest in our CPS 230 marketing educating clients on their new responsibilities.”
“There's a lot of boards that are asking a lot of their IT departments ‘What should we be doing?’. They deal with a lot of third parties and they don't know if those third parties are secure.”
Eyeing AI opportunities
Avocado is trialling Microsoft Copilot internally to “help us prevent phishing attacks and unauthorised access to our systems.” A wider internal rollout will give Avocado confidence to support rollout to clients.
The company sees “a big opportunity in visual AI, particularly AI powered vision and object detection; especially for industry within the critical infrastructure legislation,” Barranquero said.
In the last year the firm built a prototype for visual recognition of objects at scale, training AI to detect what was taken from or placed in the firm’s office fridge.
“We programmed it to send alerts if alcohol was accessed between 9am to 5pm or if there was no milk in the fridge. Sounds basic, but think how you could use this AI model to secure cabinets with sensitive contents,” Barranquero said. This was presented this to a healthcare client who “could easily identify several use cases.”
Seeing "green shoots"
“Last year was flat for us”, Barranquero said, noting the impact of interest rate increases and tightening of government budgets on the industry. But several years of “good growth” has put Avocado “in a good commercial position to weather tougher times we are seeing in the market today”.
“We have invested heavily in our people through training and cross skilling; integrating our recent acquisition into our service lines and investing in our partnerships.”
We are seeing the green shoots from the time, money and effort spent on these activities which will secure our future growth.
Barranquero saw “signs of life” in the market. “Government clients have started spending and we expect this to ramp up with the handing down of the state and federal budgets in a few months,” he said.
“Our corporate clients continue to move services to the cloud with a heavy focus on cybersecurity and IT resilience,” and there is “growth in demand across GRC, TPRM and TRA services”.
"Never say never" to M&A
Avocado has been “constantly approached” for M&A but the firm has so far declined these approaches. “As we are masters of our own domain, we are free to set our own agenda and targets,” Barranquero said.
But “you never say never”, he added.
“The fact that the cyber assessment business has gone so well, it would be remiss of me not to say that I am continuing to look at opportunities in the space, because I think the demand is only getting bigger.”
Cisco’s acquisition of Splunk “is only going to create more opportunity for a partner like Avocado, because we are now a Cisco Partner effectively. All those services that Cisco provides that we also now inherit as part of the of the acquisition, we now need to broaden our service offering.”
“There's a lot of people looking for Splunk partners now, that only do Cisco, and there's a lot of Splunk partners that are looking for Cisco capability.
“If we can find a way to integrate that capability into a larger organisation, I think that's a lot easier than trying to do it organically.”
Playing a long game
Barranquero said that “never having an argument with my founding partner Terry Doherty”, who recently retired, ranked among his greatest achievements.
“Terry is the big brother I never had, someone I could always be myself with and share my worries and trepidations without the fear of him passing judgement.”
Doherty said he loved Barranquero’s “lack of ego and willingness to embrace a good idea from anyone.”
He also said that one of Barranquero’s strengths was his “tireless work ethic”. Barranquero was “steadfast in his focus on building the Avocado brand” during the demanding early days of the business.
Both mentioned the word brand several times. “Invest in your brand,” Barranquero said when asked what he would tell younger channel businesses.
“Do what you do well - the growth and diversity will follow. Those that sacrifice quality over short term revenue create a glass ceiling that they never overcome.”
-1.jpg&w=100&c=1&s=0)
.png&w=100&c=1&s=0)
