Bruno Lecoq

Bruno Lecoq runs a cybersecurity company out of Redmond, Washington, and he has a dog named Mocha. The detail matters more than it looks. The man drinks espresso, named his dog after it, and built a business on the unglamorous idea that good security is a daily habit, not a heroic sprint. Patience is the whole personality.

Today he is co-founder, CEO and CISO of BEMO - a Microsoft-centric security and compliance firm built for companies with somewhere between 10 and 500 employees. That is the awkward middle. Too big to ignore the risk, too small to hire a security team, too busy to read the 110 controls of a compliance framework. BEMO exists for exactly those companies, and Lecoq has spent fifteen years making their problem his.

He came to it the long way. Born in France, Lecoq spent close to two decades at Microsoft in Redmond, moving through the products that defined the era - MS-DOS, Windows, Exchange, Office, then the hardware and supply-chain side of the house. He started as a software localization engineer, the person who makes software speak other languages, and worked his way up to Director of Business Processes. Two decades is a long time to learn how a giant operates from the inside.

The gap he couldn't unsee

From inside Microsoft, Lecoq kept noticing the same thing. The enterprise customers had everything - teams, budgets, tooling, consultants. The small and mid-sized businesses had the same Microsoft 365 and Azure subscriptions and almost none of the expertise to secure them. The security existed. The know-how to turn it on did not.

So in 2010 he and Joel Lachance founded BEMO to close that gap. Early backing came from Kima Ventures and Zgarage. The bet was simple: meet small businesses where they already live - inside the Microsoft cloud - and do the security work they cannot do themselves. No rip-and-replace. No second stack of tools. Just turn on what they already pay for, and run it properly.

That line is the cleanest summary of how he thinks. For Lecoq, compliance is not the goal. It is the audit of the goal. SOC 2, ISO 27001, HIPAA, CMMC - the certifications are receipts. The real work is having the security behind them, every day, with the evidence to prove it. He is allergic to the shortcut version, the company that buys a badge and skips the discipline.

The year of the product

For most of its life BEMO was a managed service - people doing the work for clients. Then Lecoq pushed it toward software. In 2024 he called it "the year of the product" and launched the BEMO App, a SaaS platform that automates the security and compliance grind inside Microsoft 365: policy frameworks, control monitoring, the evidence-gathering that auditors demand. The pitch is to turn a months-long manual slog into something a small company can actually keep up with.

BEMO was an early adopter of its own medicine, too. The company built identity verification on Face Check with Microsoft Entra Verified ID - using biometric matching to make sure the person logging in is the person they claim to be. It is the kind of move that fits Lecoq's whole approach: take a serious enterprise capability and make it normal for a 40-person firm.

Compliance for the people who build the planes

Lately the focus has sharpened toward CMMC - the cybersecurity standard the US Department of Defense now requires of its contractors. For a small machine shop supplying parts to a defense program, CMMC is a wall. Lecoq has positioned BEMO as the guide over it, and become a steady voice for defense-adjacent small businesses trying to stay both secure and in business. He even co-hosts a podcast about it with Brandon Lecoq, BEMO's head of sales. The name is a wink at the whole field: Trust Issues.