Cyber CEOs Decoded Podcast Season 1 Episode 3

Marc Van Zadelhoff: Welcome to «Cyber CEOs Decoded,» where we speak with CEOs from established security giants to up-and-coming disruptors, getting the inside track on what makes a security company tick. I’m your host, Marc van Zadelhoff, the CEO of Devo. And today, my guest is Mariano Nunez, CEO and co-founder of Onapsis, a leader in business application security. Mariano, welcome to the show.

Mariano Nunez: Hey, Marc. Thanks for having me. Happy to be here.

Marc Van Zadelhoff: It’s great to have you here. And Mariano, both – we both live in the Boston area, and I’ve had a chance to see you a number of times. And I was really looking forward to this discussion to delve into some interesting topics that you and I have talked about. As I think you know by now, I love to start these just with really getting to understand where the CEOs come from. And in your case, I think it’s a particularly interesting story. So let me start with that question, though. You know, where were you born? Where are you from?

Mariano Nunez: Yeah. Yeah, I’m born and raised in Buenos Aires, Argentina. So I spent most of my life there. Moved up here to Boston about nine years ago. But in all my kind of upbringing, all my kind of early childhood memories are from Argentina.

Marc Van Zadelhoff: That’s amazing. And probably most people who listen to this podcast don’t know that I have a mother who is from Argentina. So I always joke with Mariano that we’re both Argentineans. You know, I was born in the Netherlands to a Dutch father, but an Argentinean mother. And I’ve been to Argentina three times. My wife and I got engaged in Argentina, in Patagonia, and we love Buenos Aires and are thinking of going there in December and taking my mom with us this time.

Mariano Nunez: I remember your mom being a huge fan of alfajores. That’s special cookies we have down there.

Marc Van Zadelhoff: That is true. That is true. Anything with dulce de leche is a winner.

Mariano Nunez: Yeah, exactly.

Marc Van Zadelhoff: And she makes amazing empanadas as well.

Mariano Nunez: Well, I need to meet her, then.

Marc Van Zadelhoff: We can make that happen. She’d love to join this podcast. But, you know, it brings up a serious topic, which is, can we think of another Latino CEO in cybersecurity between the two of us?

Mariano Nunez: That’s a great question. You know, I don’t know many. I think the only one I’ve heard of and I met a couple times is Enrique Salem from Symantec…

Marc Van Zadelhoff: Of course.

Mariano Nunez: …Kind of back from the Symantec days. But I probably can double my know, like, two other CEOs, like Latina CEOs in cyber. But yeah, we need more of the Hispanic community getting represented in cyber. There are not too many.

Marc Van Zadelhoff: Yeah, I think we’ll return to that topic later in the discussion. But I think it’s a really cool angle and sets you apart. Argentina’s a really interesting country. I was reading a book around – this is how they say the world ends, where they go into the hacking, you know, kind of zero day vulnerability market – and Argentina actually features more than others may realize as having a fairly robust community of hackers. Core Security came out of Argentina. A number of players and folks came out. Can you describe it all – that community in Argentina?

Mariano Nunez: Yeah. Yeah, I think that’s one of the – to your point, I think there’s not well-known by many people across the globe, but people that have been in cyber for a long time, when you say you are from Argentina, they’re like, oh, wow, like, do you know the Core guys? Do you know these people, like, know the Equiparty folks? So there’s a really, really big kind of underground and hacking security community in Argentina. I think it’s pretty honestly – like, in Argentina, like, it’s like, you have to have this hacker mindset to survive, right? It’s like, things change on you so quickly, like from government regulations, from like, in a social context situations, like, every day is like – it’s almost an adventure in Argentina, the things that were maybe work yesterday, they change, right? They change the next day, and you have to adapt a lot. So I think some of that may have spurred some of this kind of hacking mindset in Argentina, and that’s why we have such a big community. But you guys had charted the path. Like, Core Security was, like, early kind of really almost creators of the penetration testing category – right? – like, have a lot of, like, large organizations in the U.S. And they’ve done amazing things to really foster that community.

Marc Van Zadelhoff: Yeah, and that’s great. And you grew up in Buenos Aires in a regular kind of family, and good memories there?

Mariano Nunez: Yeah, yeah, absolutely. Yeah, like kind of middle-class family out of the kind of one of those towns in Buenos Aires, in the Capital Federal in Buenos Aires. So yeah, all good memories growing up, like doing a lot of, like, sports. I have two siblings, my parents. So yeah, all good memories from that time.

Marc Van Zadelhoff: OK, cool. Well, getting towards your career – so do you remember, what was your first kind of meaningful paid job?

Mariano Nunez: I think probably the first one that would qualify would be washing my dad’s car so that he would buy me a bike after – I don’t know – like, six months of washing it every weekend. But I think after that, when I was 15, I built a website for our town there in Buenos Aires. And really, the plan was build a website with the news about the town and the community. And then I ended up going with my laptop to all the shops in the town to try to sell them ads, to try to get advertising on the side. I think it was probably, at today’s money, maybe $0.50 a month or something like that, so…

Marc Van Zadelhoff: Wow.

Mariano Nunez: …Not a lot of money. So that’s probably my first, I would say, kind of paid job, which was quite a good learning experience.

Marc Van Zadelhoff: Yeah. I mean, mine was caddying, and then I also worked in a warehouse for lawnmower engine parts for a number of summers.

Mariano Nunez: Aw, nice.

Marc Van Zadelhoff: But I feel like yours gives you more skills that might be useful in your actual job today.

Mariano Nunez: Well, you know, I learned, like – I think it was the technical side of it, which I always enjoyed since I was a kid. But I think this thing about going with your laptop, like, as a kid and trying to sell, like, almost like cold calling, like in-person, right? You walk to the shop, like, hey, let me show you my website. With a – I had a very – again, we’re, like, kind of middle-class family. My laptop wasn’t the latest and greatest. Actually, the battery didn’t work. So I had to go in, plug it in that person’s shop and wait, like, 10 minutes for it to load. And then I will show him the website. And I think the piece I learn is, like, how hard it is to sell – right? – how hard it is to really, like, kind of put that value proposition in front of someone, like, from a cold perspective and really how – I always remember this phrase about, like, that no is the second-best answer that a sales guy can get, right? And it’s crazy how so many people, even when you are 15 – they will just drag you along – right? – and, like, not commit. Oh, why don’t you come next time? You can show me my logo in a different way. And they will just drag you along and not give you, like, a yes or no. So it gave me a really good appreciation for what my sales team goes through every day, right?

Marc Van Zadelhoff: Yeah – second-best to maybe, I guess, right?

Mariano Nunez: Right. Right.

Marc Van Zadelhoff: Yeah. So before we get into your proper career and your studies – but from your upbringing, did you really look up to somebody? Do you look back to that time of your life and say, you know, I really wanted to be like this person, and my career is like that? Is there a part of that – part of your life that you think of a lot and reference a lot in your thinking?

Mariano Nunez: Yeah, I think maybe two people come to mind at that age. One was – at that time, it was kind of more Microsoft – right? – and Bill Gates. And we didn’t have the Zuckerbergs or kind of the new generation.

Marc Van Zadelhoff: Right.

Mariano Nunez: So it was, like, kind of this idea of how you just – how he created this empire. And so that kind of got me into trying to develop my own operating system when I was at school, which, of course, was not.

Marc Van Zadelhoff: It didn’t work.

Mariano Nunez: I studied with a UI, just to give you a sense of how, like, wrong I got it.

Marc Van Zadelhoff: Yeah.

Mariano Nunez: But then, the other one was a person named Julio Ardita. He was a really well-known security researcher in Argentina. So that’s actually the person I reached out to also. Like, I called – emailed to him because he had a security consulting firm there. And I just reached out to him because I wanted to work for a guy for free just to learn from him. So I think that’s probably…

Marc Van Zadelhoff: Yeah.

Mariano Nunez: …Another kind of role model at that time.

Marc Van Zadelhoff: Cool. Are you still in touch with him?

Mariano Nunez: Yeah. Yeah. He’s a good guy. He’s been a – he’s still in the community. He is part of a different firm now but a really, really good person that taught me a lot of things.

Marc Van Zadelhoff: All right. Well, maybe I’ll listen to his podcast. So your studies – you went to university down there. What did you study?

Mariano Nunez: Yeah. I went to university – like, public university, studied computer science engineering there. So I think I spent – the first year, I was just studying. Then I started working pretty young. I started working at 18 at this person’s firm. So I was basically studying and working part-time until I graduated six years later.

Marc Van Zadelhoff: So that was your first kind of real job.

Mariano Nunez: Yeah.

Marc Van Zadelhoff: And what were you doing there?

Mariano Nunez: There was basically an offensive security researcher – so basically red teaming, penetration testing, doing bug hunting. It was my dream job. I was getting paid for what I was, like, doing, like, at home, studying and reading books. So for me, it was my dream job. And I learned so much. I think I did the university just to get – honestly, just to get a title because I was really learning on the job. The other thing was I think it gave me a good foundation for a lot of things. But for me, that job was really the place where I learned, like, a lot about security.

Marc Van Zadelhoff: I don’t have a similar experience to that. I never got as technical during my studies, so I always have huge respect for people who went that deep early. Building your own OS – did you really try to build your own?

Mariano Nunez: Yeah. I really tried. I was not successful. What I was successful, though – I built my own IDS in high school, one of the – you had to do a project for one of the classes, so I built a Windows IDS. I wanted to build an IPS. I actually wanted to stop the attacks, but I couldn’t figure out how to stop them at the network level and the company level. So I ended up building something that would detect it all. So…

Marc Van Zadelhoff: Yeah.

Mariano Nunez: But yeah. No, the OS was a complete failure. I just got a good level on UI but nothing more than that.

Marc Van Zadelhoff: That’s awesome. Did you start getting into thinking about business application security? – because Onapsis – and I think we’ll go to Onapsis after this. But did you already start thinking and get the idea about – maybe there’s something – because you talk there about network…

Mariano Nunez: Right.

Marc Van Zadelhoff: …And OS – right? – network and endpoints. So those are the two big attack surfaces, obviously.

Mariano Nunez: Right.

Marc Van Zadelhoff: But application is another one. Did you get into thinking about business applications security at this time?

Mariano Nunez: Yeah, that’s when I really kind of first encountered that. And honestly, it was more of an accident than anything else. Like, my background is not in business applications, right? It’s all, like, in cyber – and the same thing with the founding team at Onapsis. And it was really – during this job, I was doing a lot of penetration testing and application testing in general. And we ended up getting a customer to hire us to do a pen test on top of an SAP application. All right. And I didn’t – now I can say it, but I didn’t really know what SAP was at the time, which is pretty embarrassing.

Marc Van Zadelhoff: Sure.

Mariano Nunez: Right? But then…

Marc Van Zadelhoff: Yeah. We’ve all been there.

Mariano Nunez: I started researching this. Like, oh, my God. This really runs the planet, right? It runs the digital economy. All the largest organizations in the planet are running on SAP or Oracle, right? Like, in that case, like, at the time, J.D. Edwards, PeopleSoft, Siebel – we have now Salesforce kind of workday. But they have these huge application sets that are running the most critical processes, most critical data of the largest organizations in the world. And that got me really excited from – almost from a market perspective. And I think the key and the aha moment was when I started doing research and I started finding, like, a lot of zero-days that, for whatever reason, no one else was looking at. People – as you say, they were focused on endpoint or on maybe some databases at the time, a lot of focus…

Marc Van Zadelhoff: Right.

Mariano Nunez: …On the network. But I, like – then I realized, like, oh, my God. Like, we can hack into any ERP system in the planet without a user and password, and no one is talking about this. So that’s why I ended up getting invited to speak at Blackhat in 2007 about SAP cyberattacks and ERP cyberattacks and really started kind of building that snowball there.

Marc Van Zadelhoff: My perception always of the application security, you know, concerns from a security perspective – it is some similar things like malware and zero-days and the like. But there’s also a business-level concern like…

Mariano Nunez: Right.

Marc Van Zadelhoff: …Segregation of duty.

Mariano Nunez: Right.

Marc Van Zadelhoff: You know, somebody in receivables approving something in, you know, payable, you know – like, this is a different set of business-level concerns that you wouldn’t have on the endpoint and on the network.

Mariano Nunez: Absolutely. And that’s what we found. Like, it’s not on people’s – they were neglecting protecting these assets, right? Because they’re very critical. But, essentially, what they were doing was segregation of duties, like making sure that – as you said, if Marc created PO, he shouldn’t be able to create a vendor, right? But what we realize from a cyber perspective is that even someone without a user could hack into the system and be able to do all that and more, bypassing all those segregation duties, controls, shutting down the operation, performing fraud or stealing really sensitive data. We have customers that if these systems are taken off line, like, they cannot manufacture or ship products, like, $20 million per minute. All right. So we’re talking about very, very significant business impact that I think it was just, like, not being really, like, looked at from a cyber perspective.

Marc Van Zadelhoff: OK. So then it must be around this time that you start thinking of forming a company around this idea. Is that right? Is this when Onapsis was formed?

Mariano Nunez: Yeah, exactly. Yeah. We founded Onapsis in 2009, September 2009, out of my co-founder’s bedroom in his apartment in Argentina. That was really it. It was, like, this recognition, like, oh my God, this is a huge market opportunity. No one is doing it, and it’s very critical, right? So we decided to – maybe that’s when I combined that kind of Bill Gates kind of admiration from creating a large company with my passion for cyber and said, OK, let’s go after this.

Marc Van Zadelhoff: Yeah. Yeah. So – but I think in California and in the West Coast, they do it in a garage.

Mariano Nunez: (Laughter) Right.

Marc Van Zadelhoff: And you guys did it in a bedroom.

Mariano Nunez: Yeah. Yeah. You didn’t want to be in that bedroom. It was like no AC, like, no heating. It was – but, look, that’s why I have a lot of – so many good memories – right? – from that place. But yeah, that’s – in Argentina, that’s the Silicon Valley version of the garage is a bedroom. Yeah.

Marc Van Zadelhoff: It’s a bedroom. Got it. OK. Makes sense. Give us a little bit more here. So what does it mean you founded a company? I have never founded a company myself. I mean, do you guys just get together after university and kind of be like, hey, let’s not get a job and start working out of your bedroom (ph)? I mean, how does this work?

Mariano Nunez: Yeah, for us, we were like – so I knew my co-founders from that, that consulting firm. So we had worked with each other for six years at that time – by the time I had finished university as well. And for me, honestly, I mean, we talk a lot about entrepreneurs, like, you just jump without a safety net. Honestly, for me, it wasn’t that kind of difficult decision because I knew I could come back to being a security researcher – right? – if it didn’t work out. Like, it was not – maybe – I know it sounds a bit more – I know it’s a better story if you say that, yeah, I kind of left everything behind and I knew that I couldn’t fail. The reality is that I knew I could go back to it, but I was pretty determined to make it successful. So that’s how we started. Yeah. I still remember the first day looking at my co-founders like, OK, what the hell do we do now, right? We just quit our jobs. He came back from Spain to do this. And we’re like, OK, now what, right?

Marc Van Zadelhoff: Yeah. Yeah. No, I can imagine. And so in 2010, you guys released the first product and you got your first customer. Tell me about that moment. That must have been thrilling.

Mariano Nunez: Yeah. Yeah. So we spent a year developing the product, release it in September 2010. And a month later we – yeah, we ended up getting our first customer that ended up being the U.S. Army. So (laughter)…

Marc Van Zadelhoff: Yeah. Way to start small. I mean, that’s incredible.

Mariano Nunez: Yeah. Yeah. It was definitely a very happy day for, at that point, four guys in a bedroom in Argentina. And yeah, it’s – I went to Huntsville in Alabama, delivered a training for them, like, some of the smartest people I have ever met. And they both are training with a product which they use. We had to learn – first, how to scale very quickly – right? – from zero to dealing with that type of organization. We got Fortune 100 customer sales kind of in the first two years. So we had to learn to scale to that very quickly. We didn’t have the step before that.

Marc Van Zadelhoff: I mean, was this, like, a multimillion-dollar contract or was it a small start?

Mariano Nunez: No, it was a small start. I think that contract was – I remember exactly. It was, like, $30,000 for the one-year subscription. At that point, we had – the first product was more of a point in time, essentially vulnerability scanner for SAP apps, right? So it was more of a desktop tool. It wasn’t really enterprise platform. We developed that in 2015, a few years after that, and that’s when we started really scaling the business at a different clip.

Marc Van Zadelhoff: Yeah, yeah, I know. It makes sense. Did you also end up doing some fundraising for the company?

Mariano Nunez: Yeah, we raised in 2012. So about three years after we started, we raised basically a seed round with some angel investors. With that round is when I came to the U.S. in 2013.

Marc Van Zadelhoff: Gotcha. OK. And were the U.S. investors – had invested in the company?

Mariano Nunez: Actually, it was a blend. And again, that’s kind of part of maybe the lucky strikes you get along the way because we didn’t (inaudible) we didn’t have a network of, like, wealthy people that we knew. We didn’t – we’re not part of any ecosystems, but we applied to essentially a startup challenge in Argentina. And one of our judges in that process was a person named Marcos Galperin, who’s essentially the founder and CEO of a company called Mercado Libre. So think about it as the Amazon of Latin America. It’s the largest company in Latin America from a market perspective. Marcos’s like – I think he fell in love with the story and he’s like, hey, if you need help, if you need money, let me know. Of course, we go to him right away. He connected us with people he knew from Mercado Libre – right? – people who had invested in the IPO and before IPO. So he connected us with people at TPG, Dragoneer and they invested in the first round.

Marc Van Zadelhoff: Yeah, I’m picturing, like, «Shark Tank» and TV and, you know, Robert Herjavec kind of personality here with this Marcos guy. But was it like that? Were you on TV and doing all that?

Mariano Nunez: No TV, but, look, I felt I was on TV. I was like – we were, like, super, super nervous, right? We’re like trying to pitch this to, like, guys who’ve created multibillionaire businesses. It was him, the other panelist next to him was Nicolas Aguzin, who’s now the CEO of the Hong Kong Exchange. So he was the CEO of JP Morgan of APAC at that time. So, like, you’re pitching to people that have really seen scale and that things before and you’re telling them that you’re going to conquer the world and sell to these Fortune 100 companies. So it was definitely – I felt it wasn’t to be and more, right? But they were super cool. They were, like, really – I think they lived through that themselves, right? Marcos founded the business out of a garage as well. So they – I think they related amazing.

Marc Van Zadelhoff: And so you moved to the U.S. You moved to, I think, Boston, right?

Mariano Nunez: Yeah, moved straight away to Boston, 2013. So me and my wife at the time – like, she’s from Argentina as well. So we came together, and we actually landed the day of the marathon bombing in Boston. So it was a pretty interesting way to start. So it was a very sad way to start, with everything that happened. So I work fairly close. We live by the West End, which is fairly close. So we were hearing the ambulances and everything else. Yeah, it was – we got into curfew here in Boston. I know some people may not know this, but, like, there was a curfew that day after the bombing. Shops were closed. We didn’t have anything in the fridge because we just landed. So I ended up going to a Subway to get a couple of sandwiches to, like, have dinner that night.

Marc Van Zadelhoff: I mean, did you – did this give you any pause, like, we made the wrong decision? I mean, that’s a scary start to an adventure.

Mariano Nunez: Yeah. Honestly, no because maybe – again, maybe worse. I’m coming from in Argentina. This, of course, is very sad and it’s very dramatic, like, but in Argentina or in Latin America in general, you have a lot of, like, kind of crime is high and you have a lot of things from it. Like, maybe because I’m engineer, for me, from a statistical perspective is way more likely to – that something bad happens to you in, like, in Argentina than in Boston, right? So for me, it is, of course, a very sad thing. And it’s crazy that those things happen. For me, didn’t personally make an impact in the decision itself.

Marc Van Zadelhoff: Understood. And so let’s talk about the business at this point. I mean, how many employees are in the company? Is it still just you and a couple of founders by the time you move, or you have a larger team now?

Mariano Nunez: 2013, I think we’re probably maybe 30, maybe. But we didn’t have anyone in going to market essentially. So it was all product development, kind of research. That’s where really we started hiring the first – basically building the go-to-market team. So we hired kind of first head of sales, first head of marketing, kind of first few reps. So really, for us, we’ve been in kind of go-to-market mode since 2013. Before that, it was more like, I was doing the selling, and we’re getting the first, like, perfecting the product. We keep it almost like stealth for a few years, for three years. And then as we raise and hire to go-to-market team, that’s when we started really accelerating.

Marc Van Zadelhoff: And you and I have talked about this before. You know, Devo’s in a category that is creative, right? We are in the security analytics category – not to get too much into Devo – and whenever we come into a client, they have something, then we’re the next generation…

Mariano Nunez: Right.

Marc Van Zadelhoff: …Right? They have the – but generally, they have a budget, and they have something that’s not working to satisfaction, and we’re able to replace it. You were creating a category. It’s more of a greenfield scenario. Is that right?

Mariano Nunez: Yeah, and I think legally, that’s – there’s a lot of really good things about it and there’s a lot of drawbacks, right? For the first one is, you don’t have competition, right? And the problem is that you don’t have competition. So there is no budget. There is no urgency. There is no established, like, buyer persona or governance or programs to fund this. So a lot of the early days had to do with kind of really creating the market category. I think in 2017, Gartner made it officially, like, a category inside application security. That’s one of the, I think, biggest things that it was a lot of investment and really helping people understand that they had the problem. We go see a Fortune 10 customer, and they’ll be like, no, why are you telling me it’s impossible? No one can break into my ERP without a user, right? And we would – the good things that we could show them – right? – like, we could actually do, like, a mini penetration test and they’ll be like, oh, my God, I need to call my CIO, right? But then it takes time – right? – takes time to get the budgets and things like that.

Marc Van Zadelhoff: No, and in a prior life, I was a venture capitalist in Amsterdam, investing in companies. And a lot of entrepreneurs would brag that they have no competitors, right? They would pitch us their business plan and say, and we have no competition. And they used to think it was a great thing for CRRVC. And at the time, we would write down, like, a demerit, right? It was like, it was a – because in a way, it’s easier having competition that’s helping to create the market. And you’re doing it all by yourself with your little marketing budget.

Mariano Nunez: Absolutely, no, that’s – now, when I kind of look it from that perspective now after so many years because I used to be that naive. Like, finally, we’re like, oh, no, we’re great. We don’t have anyone, right? And now, you understand that it’s not that easy when that is not there. I think fortunately, if you look now, kind of fast forward, there is competitors. We sustain that market leadership position. We created that ecosystem. We worked with many of the big four kind of, like, top system integrators like Street, like, I think, more than 20% of Fortune 100. So we really were able kind of to cross that chasm.

Marc Van Zadelhoff: Yeah.

Mariano Nunez: But there’s still a ton of opportunity. Still, again, we have, like, less than 3% of the market. And we’re the leaders, right? So there’s a lot of greenfield.

Marc Van Zadelhoff: But you have – yeah. You have over – I mean, to give you some – to repeat some of those stats, over 300 clients, like you said, 20% of the Fortune 100. You guys have really good growth rate over the last few years. So it’s become a substantial and impressive business. Can you say how many employees you’re working these days?

Mariano Nunez: Yeah, about 350, yeah, globally.

Marc Van Zadelhoff: Nice. Yeah. It’s still a lot in Argentina, or have you…

Mariano Nunez: Yes, we essentially have three hubs. So for a long time, we kept kind of from the same perspective, like U.S., Boston was – and Europe were kind of go-to-market, and we would keep R&D in Argentina. Then in 2019, towards the end of 2018, we acquired essentially our biggest competitor in the SAP space, a company called Virtual Force, this company founded out of Germany. And so now we have a team about 100 people in Germany, and that’s a blend between R&D and go-to-market as well.

Marc Van Zadelhoff: You know, something we haven’t talked about, but I want to ask you – the whole phase of developing product and product management. I’ve noticed at this company and in my career that when you go from that founding phase, where you had, as you said, you know, 30 people in the company, most of them technical in product, but now you have over 300. At some point, you probably had to set up a professional product management function. And that changed – ‘cause in the beginning, I think the techiest person is just making the call, making the features, and off we go, and, at some point, probably had to professionalize that with a product management team and process that would represent all the more diverse needs as you got better.

Mariano Nunez: Yeah, absolutely. And that’s a critical step, right? I think that evolution from, like, a technical – and also, I think it’s also, like, a founder evolution because I’ve seen founders who were – I think if you’re not able to do that transition as a founder, where, A, you’re really, like, hiring someone who’s like, 10 times better than you to define what the product is. You can always – for me, I see myself as an input to that process, not the one leading or defining what needs to be built. Like, I want to be an input like the customers, the partners, the competitive landscape, like other stakeholders. But I think if you also find they are not able to recognize that and really create a solid product monitoring function, I think that becomes a limiter for growth.

Mariano Nunez: For me, the other big – I think it’s maybe specific to category creation, but you spend a lot of time educating the market and essentially – because you’re making them aware of the problem and, at the same time, you’re telling them what the solution is for that. I think there is a point in time where if you don’t make that transition from really – and you have to do that in the early days, right? But – because they don’t even know they have the problem. I think it’s very important.

Mariano Nunez: We recognized this a few years ago when – like, now we have – again, when you have hundreds of customers or even dozens of customers, I think evolving from you telling the market what they need to really having your customers drive your roadmaps, drive your strategy – like, get that outside-in prioritization versus inside-out – that’s what I think are the key transitions that we had to do as a business. I remember telling my team, like, I don’t want to hear that we’re doing anything because, quote-unquote, «Mariano says.» Oh, Mariano said – like, that, for me, is like – maybe some people get a kick, like, on their egos or high on the egos front. For that, for me, that was like – almost, like, dagger in my heart. It’s like, no, we – like, we cannot be doing things because I said so. It’s like, it has to be because, like, our customers are driving there, right? So that’s really, I think, a key evolution.

Marc Van Zadelhoff: The title of founder carries enormous weight, even just CEO without founder, in my case. Sometimes the titles we carry as business leaders have too much weight. And as you said, you don’t want everybody running around saying Mariano said…

Mariano Nunez: Right.

Marc Van Zadelhoff: …Or Marc said, because maybe we’re wrong.

Mariano Nunez: Right. That’s right. Yeah.

Marc Van Zadelhoff: And there are better ideas that our customers or competitors have…

Mariano Nunez: Yeah.

Marc Van Zadelhoff: …That we need to be doing.

Mariano Nunez: Absolutely. You have a lot of biases, right? You have a lot of biases. You have a lot of kind of assumptions built over the years that I think – but to your point, Marc, I think that’s a great point because I think you have to be intentional and explicit about that transformation with the team because if you don’t do it, to your point, people would kind of – naturally, as human beings, you’ll kind of default to that. OK, the CEO is saying it, or the founder’s saying I should do it. I think, like, trying to really empower the teams and be intentional about, guys, like, I’m not going to be part of the – like, happy to review, like, your recommendations after you talk with customers. But, like, use me as a kind of check, not as the one defining it, right? So I think it’s very important.

Marc Van Zadelhoff: So you got maybe one other thing on the kind of build up at the company. You raised quite a bit of funds over the years. I think you did a $55 million Series D a couple of years back. Do you enjoy raising – fundraising? Is that part of the job you enjoy?

Mariano Nunez: It’s a very good question. I’m a technical founder. But I like going to market and selling and marketing and position more than the technical thing. I usually tell my team, like, if you see any piece of the code that still has my name, you should assume it’s wrong; delete it; like, build it again because I’m sure it has more bugs per line than anything else we have. So just – I never – I was never a good developer. I was not like – I think I was a good researcher, but, like, I don’t enjoy a lot of the technology aspects of the business. I really like the – kind of more of the sales and marketing side of it.

Mariano Nunez: So I think from a fundraising perspective, there’s a lot of that, right? It’s a lot about – you’re telling the story; you’re telling the vision; you’re telling, like, kind of the traction. So I really enjoy that part. And I think now we have really a good team. Basically, I deal with my CFO. Like, OK, I’m going to get us to the term sheet. I’m going to get us the best possible deal. Then once we get a term sheet, like, you run the diligence. You run the process. You, like – you get us to closing.

Marc Van Zadelhoff: Yeah.

Mariano Nunez: And the good thing is that, like, we have a really good CFO now, Denis Cashman, who’s a former CFO of EMC Corporation. Yeah. He’s now our CFO. So we have a really good kind of cadence there, that I know he can run this with kind of his eyes closed, right?

Marc Van Zadelhoff: Nice. Nice, nice. Awesome. Throughout the building of the company, just to take it in a different direction, did you ever think you weren’t going to make it? Did you ever think that maybe you’d run out of money and it wouldn’t happen?

Mariano Nunez: No, that never happened to me. (Laughter) Just kidding. That happened so many times. But I think that’s part of the game, right? It’s part of the – that is why I think it’s a hard job. Like, for me, it’s – the amount of intensity of, like, good news and bad news you have per day – kind of the ratio of, like, good and bad news per day is really, really high when you’re running, like, a startup like this. And you’ve seen it, right? Now, you’ve seen that with Devo – even a large company. I think it’s a bit slower. But Devo – I’m sure that you’re seeing that every day, right? Specifically, I remember, like, two situations, one where we actually got the funding the day after our bank account went to -20,000. So that was…

Marc Van Zadelhoff: Yeah.

Mariano Nunez: …A pretty stressful few weeks and months. It was one of the earlier rounds. At that time, like, we were not fourth. Like, it was not just a founding team. So I was responsible for a lot of, like, people’s, like, payroll, right?

Marc Van Zadelhoff: Yeah.

Mariano Nunez: And that, of course, carries a lot of weight. Yeah. There were definitely – I think that was the closest one we’ve been to like, oh, my God; this is going to be really, really, really tough. And then you go – along the way, there are a lot of times where you think that things are going to work or not work out, but it’s really about, like, trying to do what you can control, right? And what you cannot control is just – like, it doesn’t make sense to stress about it.

Marc Van Zadelhoff: Yeah, totally get it. All right. Well, beyond Onapsis, which has been an amazing success story, you mention hacker mindset. Tell me about that. What do you mean by this hacker mindset? We talked about it coming out of Argentina, that you had to have a hacker mindset.

Mariano Nunez: Yes, I think that it’s that ability to adapt, I guess. It’s like it – things – when you put the business plan together, when you, like, – and start executing, things do not go as you expected, right? And you have to continuously adapt, continue to find new solutions or solve problems in a different way – right? – and try not to keep doing what you were doing before. So I think there is a lot of, like – in the hacker mindset on how you apply or how you approach hacking a system, right? The security – like, approaching angles that maybe the people that designed that system didn’t think about. I think it has a lot to do with how you’re going to apply – especially, for me, in a market – kind of in a category creation, really, phase, it’s like, OK, how do you really convince – right? – the buyer? How do you – like, how do you educate them? How you change their perspective? How do you – like, what are the assumptions? What are the mental models that they have and that you have to really try to kind of awake them, in a sense? I think that’s going to – from an awareness perspective and then from an execution perspective, is just, like, I think the – like, good hackers I know, like, they just don’t give up, right? You’re always…

Marc Van Zadelhoff: Right.

Mariano Nunez: OK, this doesn’t work. And, like, you find they’re back after…

Marc Van Zadelhoff: Tenacious.

Mariano Nunez: Right. You’re tenacious or you’re resilient. You’ll keep trying until you actually are able to break it. So I think it’s a lot of what I think made us successful to this point, and it’s important to keep with that mindset.

Marc Van Zadelhoff: Awesome. Awesome. So let’s step back to your roots. You’re a Latino leader. Do you think about that often? Is that a big part of your – kind of your personal story and leadership, or is that kind of in the background for you?

Mariano Nunez: No, I think it’s more in the background. Maybe it’s because of how I think about other people’s kind of background that I, like, really don’t care too much where people are from or, like, what like I – you know, I think we’re all humans and period. But so maybe it’s not forefront for me, but I guess you’re reminded about it, like, every now and then, right? Well, maybe in not a very nice way.

Marc Van Zadelhoff: Yeah.

Mariano Nunez: Not like you, where we’re talking about it. Some people remind you about it in very subtle and negative ways, and you have to deal with some of that. I think it was maybe a bit more in the early days. When I came to the U.S., we were kind of trying to get started. I faced a couple of situations where I – you just get – you’re being reminded about it, even if you had it in the background, right? I think – other than that, I think that the positive things for us is that we’re almost kind of diverse by design – right? – from a company perspective, right?

Marc Van Zadelhoff: Yeah.

Mariano Nunez: We have a…

Marc Van Zadelhoff: I like that, yeah.

Mariano Nunez: More than 50% of the team is, like, Hispanic. We have people in the U.S., and we made – we were very intentional to, like, not have second-class citizens, right? Even when we acquired this company in Germany, when, like, we had a team – started a team in the U.S., I would hear someone in the company be like, oh, no, like, Argentina this, or Germany that, or, like, hold on – like, are you talking about the engineering team in Argentina? Are you talking about – like, there’s no, like, us versus them, and there’s no, like…

Marc Van Zadelhoff: Yeah.

Mariano Nunez: If you start labeling things that way, I think that, like – that goes the wrong direction, right?

Marc Van Zadelhoff: I did that on a call this morning. We have most of our amazing technical teams, engineering teams…

Mariano Nunez: Right, yeah, exactly.

Marc Van Zadelhoff: …In Madrid for us. So we – someday we should get our teams together. They’d all speak Spanish. And we have some great Germans in our company, too. But it’s the same thing – somebody today on a call said, well, Madrid, and I said…

Mariano Nunez: Right.

Marc Van Zadelhoff: …You mean the engineering team? And by the way, that leader also has people…

Mariano Nunez: Exactly, yeah.

Marc Van Zadelhoff: …In different countries, not just in – yeah. I very much agree with that. Yeah. Words matter. As you said, kind of diverse by design – you also, I think, have done quite well – and it’s an area of focus for me as well – on female representation. I think your management team has got a good representation there. So is that something you’ve worked on actively?

Mariano Nunez: Yeah, absolutely. Also, across the next layer of management, I think we got a really good start from that perspective. My first board member back in, like – was a female board member, even before it was trendy or fashionable, like – so I think it’s – again, for me, it’s about making sure that we have a diverse and inclusive team. We’re doing a lot of active things in that way. But, again, if you don’t map it to real actions, then it doesn’t matter. So we put a lot of emphasis in that.

Marc Van Zadelhoff: Final question – what’s your advice for entrepreneurs? You’ve gone, like you said, founder, CEO. You’re now 13 years into this journey with Onapsis. What’s your advice for entrepreneurs thinking of starting a company?

Mariano Nunez: That’s a difficult one. I think if someone is thinking about starting a business or how ready – I think it’s maybe more if someone’s thinking about becoming an entrepreneur, they should know it – at least my perspective, my opinion, is that it’s really, really, really hard, and it’s way less glamorous (laughter) than it seems from the outside. But my perspective is, like, I wouldn’t trade it for anything. It’s really about the experience. It’s about the journey. I think you learn so much about yourself, first and foremost, and then we were just talking about the roller coaster – like, you’re going to go through really, really good times and highs, and you’re going to go through really difficult times, and you learn a lot about yourself, and you learn a lot about people and how people think – what motivates people, how they respond, and – for me, it’s, like, a great experience from a learning perspective. If you crash and burn for whatever reason – like, you’re not successful with your venture, like, you’re going to come out a much better version of yourself anyway, right?

Marc Van Zadelhoff: Yeah.

Mariano Nunez: Just for going through it, it’s such an – like, a rich experience, that I would strongly recommend anyone to do it. I find it hard to believe that, like, once you do it, you can do something different because it just gives you so much perspective. It’s such a rich experience that, I think, yeah, I’d recommend it to anyone.

Marc Van Zadelhoff: That’s awesome. Well, I have the luxury of seeing the big smile…

Mariano Nunez: (Laughter).

Marc Van Zadelhoff: …On your face describing this, so I could see how happy that thought makes you, of being an entrepreneur. So I think that’s a great note to close this podcast out on. Mariano, thank you so much for joining us on «Cyber CEOs Decoded.»

Mariano Nunez: Yeah, Marc, this was my pleasure being here. Thanks a lot for the invite. Next time, we’ll do it with your mother, with alfajores, and we’ll have her talk to us about – and empanadas (laughter). Thanks a lot, Marc.

Marc Van Zadelhoff: Thanks, Mariano. And thanks to our audience for listening today. And be sure to join us for the next episode of «Cyber CEOs Decoded.»