Building a Cybersecurity Ecosystem (Thiago Vieira)

Full transcript

Welcome back to the podcast guys. Today we are joined by Thiago, an angel investor in cyber defense and a builder in the cyber security ecosystem. Thiago, welcome to the podcast. >> Thank you. Thank you, Miklo. Thank you for the invitation. It's a pleasure to be here with you today. >> To start, could you share what you are focused on right now across cyber investing and building the ecosystem? >> Perfect. So very very quick story. Basically 15 years ago I started my career as a developer. I worked as a software developer for some time. I created my own company. Then I sold this company. I moved to Portugal. I started to wonder how I could give back to the ecosystem. How I could help other entrepreneurs to also be funded to create a good idea to also sell their companies in the future to have the same experience that I had. So I was invited to join core angels which is an international group of business angel and then I started this activity of helping and mentoring uh the entrepreneurs in the middle of the way I found an opportunity to create an incubator here in Portugal in the first place and then I saw another opportunity which is help cyber security startups specific which was a niche that was not so much attended especially in terms of how to scale most of the founders they need help in terms of personal development They are very good technically but they need help in terms of business.

I created a program called cyber techch acceleration that I'm I'm running in the last two years which has this focus of helping startups from the United States to enter Europe and European startups to enter the US market. So we have this bridge between those two countries that the entry point is always Portugal which is where we have to be. >> How many people have gone through your acceleration? How many startups? Now we have 19 startups. We always work with 10 startups every batch. So we got nine startups in the first batch and we have 10 startups now for the second batch. The second batch starting this month in February specifically on the tw of this month and uh it's going up to May. So in the end of May we're going to finalize with inerson immersion in the Silicon Valley and all the startups will join us for a week very intense activities.

How do you select which kind of startup you will actually help? >> We are refining this selection criteria. In the first moment, we didn't have a specific criteria because we were validating the model and testing which kind of startups would be able to attract. To be honest, the first one it was free because we received a grant from the Portuguese government to create this. So, we didn't charge anything for the startups. The second one now we are charging. So, there's a fee to enter in the program. And then we raised the bar. So we are now looking for startups that are ready to scale up. So which means that you at least need to have some kind of traction or pre traction some kind of list already paying users even if it's a little bit if it's small number you need to have a a validated MVP are changing a little bit the criteria but uh that's it for the second one we are asking for more things. Yeah. >> So you mentioned you sit close to founders and operators.

What are the biggest cyber security trends that you are seeing right now that you think actually matter in the market? >> Yes. Well, we know that cyber security is a very people thing, right? It doesn't matter if we have the best technology in the world if people are not prepared to deal with that technology and what we are seeing in terms of trends specifically because of AI of course people they they don't know how to use AI you know are they using AI without knowing the risks and that's the worst vulnerability that that we can have inside any company inside any situation in terms of cyber security. So the trends are of course everything related to AI and anything that you can do to avoid AI, right? So we have for instance and I I will quote some specific examples that we have in terms of startups. We have startups creating AI agents to simulate scams to help people to protect against it. We have some startups they are creating a defense technology using AI to fight against scams.

We have different approaches even inside the what we call the red team or the blue team which is the attack and defense in cyber security but everything is is related with AI. Another trend that I see very very strong in the future especially here in Europe is regarding forensics especially when it comes to democratize a little bit the forensics part because forensic services and equipments they are kind of untouchable sometimes because they're very expensive and sometimes only police forces or governments they have the money to to afford this kind of services or or equipment. So any startup that could somehow solve this by turning this more accessible to BME, small companies,memes, small business, it will be interesting. So I always like this kind of solutions when you when you are like Yuber right democratize all the possibilities and the way that we could ask for transportation. So especially people cyber resilience create cyber culture everything that we can do to help this in this part which is the major problem that we have right now. You are also a lawyer. How do you use law in your job if you use it? >> Yeah.

So it's very interesting because the law helped me to understand about process and this is another thing that's important when we when you talk about cyber security because we need to implement process inside organizations. It's very important. We receive complaints from a lot of companies that are attacked or easy target and they have got in some bad situations even scams or anything like this and we when you're going to look deep dive into it to see the real cause it's always because there is a lack of process even like I received an email and my financial department instead of looking about the source of information just made a payment to the new bank account without checking if this was a legit or if or if I had a process to actually confirm if right that information before I make the payment this would be much easier so the lack of process it's a very big problem and the law schools helped me a lot with that but also another thing that helped me a lot law school is increasing my participation in the digital forensics which tights with cyber security it's in terms of cyber forensics and I learned a lot with law school because I was inside an environment of lawyers with another colleagues lawyers and inside courtroom I could understand what is witnesses process right because in this forensic part I'm sometimes when I when I give some forensic reports I'm invited to be witness of the process as well because my evaluation of the case my speech let's say like this would be taking consideration by the judge to give a secret right it's a very big responsibility and is a very important part of of course especially in terms of criminal investigation cyber crimes so it helped me a lot on understanding this part of the process, you know, now talking about the legal process, right?

How the legal process works, how the police works like the institutions that are investigating the cyber crime, how they articulate with each other, how the international cooperation in terms of crimes, how this happens. So, it helped me a lot to understand law first of all, right? And the second thing to understand process. So, it helped me a lot to understand about everything regarding regulation, regarding compliance, which is very important for cyber security. And it still helps me until today when when I talk with founders when I help them especially those startups that are actually developing something regarding digital proof for instance which is very important as well scams being cyber crimes threats uh anything that's related with fighting this these threats that we have in the world it helped me a lot so I'm still using it not as an active lawyer in court but as a digital forensics and with the knowledge that I got from the law school and from the experience that that I had as a lawyer.

It helps me a lot nowadays. >> As a lawyer, do you think it's worth it to study law in today's digital age where there is this whole AI bubble and I can basically tell you anything from the law in seconds? >> You know, there's a very interesting question because this is one of the reason I actually did law school in Brazil, okay? because I had a science teacher in high school and she used to to our student that you should do two colleges and one should be law school second one which whichever we want. So I strongly advise that if you have time and you like to read definitely recommend every person do also because it will help you understand processes right which is a very interesting thing and understand law understand how the law works I strongly advise for those that uh can to study law as a second you know even if it's not a primary if you don't want to be an attorney or or work as a lawyer but it will definitely open some doors for you >> also I would like to know more about who you serve and what do the startups actually come to you for besides scaling the company?

Are there any particular things? >> Yeah. So basically the needs that we have now especially cyber security companies it's scale first thing right and when we talk about scale is basically to develop sales strategy most of the companies they are looking for some people that could open some doors so networking especially in Portugal and in US we created an ecosystem of cyber security so we have cyber security professional cyber security mentors they are more than 15 years 20 years in the industry. So they know a lot of people and they can open doors, right? And I think this is the most valuable thing that you can do for them is opening doors, making some warm introductions with potential clients. This is the most important things that they need. Second, of course, investment. There are startups that reach me looking for investment. It's not so easy, especially depending on what they want to do. And I will give an example. I was talking for a startup last week. they would like to develop some um postquantum startup.

So it's a very specific technology. It's a costly in terms of stuff because you need very specific people, PhD researchers, uh very uh deep tech and uh especially because it's hard to find people that understands anything about this and they are looking for 3 million euros. I mean they don't have clients and they are finishing the MVP. It's hard, you know, but yeah, basically opening doors like some kind of business development service that we do a lot. Opening doors in in a new country, it's always good when you have someone that could introduce you to the right people. It's important. And then second is money. But in the middle of this, Nicholas, we always understand and we always identify that there are other things missing in in this process. And like I was telling you in the beginning when we are talking about cyber security usually there is a lack of clarity. They don't have strong goals. They don't have clarity on the where they want to go what they want to achieve. This is a hard part especially when when you're looking for investors because investors they have some kind of radar.

They can identify if people they don't don't have a clarity of what they they're going to where they want to go. I used to say to my founders that getting investments like to getting married with a pre-announced divorce right because you need to exit the investor he won't stay for you for the whole life and you need to have this very clear if the investor is not understanding if it's not clear for him the path that you're going to pursue to to achieve that or if you don't have goals at all right because this is another problem. Yeah. So we need to step back and work on on it first and then look for investors because if you're looking for investors without this part very well so it won't work you know it's it's very hard. >> What's your vision with the accelerator in the next year? >> My goal now is to increase the number of batches uh every year. So for instance this year we are planning to do two batches. The first one is finishing in the end of May and we are looking to start a new one in August.

So our plan is to create more batches every year and help the largest that number of startups that we can. Uh we would like to help at least 30. So this year probably we'll have 20 20 more right 10 and this first and then 10 for the second one but next year we are planning to do three right so we are going to make faster batches or maybe batches in parallel as well. That's it. So our plan is to increase the number of startups that we can help. We also help to create more cyber security startups because this is still a blue ocean, right? There's enough and a very huge market to be explored. Just to give you some numbers in Portugal, we have 5,000 startups and less than 2% of this number are cyber security startups. So you can imagine that a very very good opportunity to work in this field to like to attract more corporate these batches that we're going to to create and maybe create some batches specifically to help new startups you know since we are now more focused in scaleups but we also would like to help those that are starting right it's it's hard you know because the startups that they are starting they usually don't have money so they will need someone to support them some kind of uh government or some kind of corporates that are failing to receive that in the end.

So basically that this is what we like to achieve uh to reach the highest number that we can of uh cyber security founders. >> Well nice. Do you have any advice for people in the same field? >> Well my advice would be don't walk alone. I always recommend Nicholas even if you don't have money to afford acceleration program or someone that could be your business developer always look for a mentor. And the mentors, there are a lot of programs where you can get a mentor for free. For instance, in Europe, there's a a program called this is more for for women, but uh it's called women for cyber. So, especially for the female founders, there is mentoring for free to start a business in cyber security. Even if you are starting, doesn't matter where you are, the stage that you are, but I really recommend you to have someone you know that could guide you.

Maybe buy a book from this uh from this person and start to follow this person. Try to replicate what they they are teaching because they are giving a lot of value especially in Instagram linking articles. I really recommend start picking some mentors. If you can participate in acceleration programs that are backed by government like we did last year, it would be great because you have access to a lot of free but you really need you really need to to look for this kind of support. I don't believe in founders that succeed without this kind of uh expertise from people that are uh with a lot of experience. They already pass through the all the difficulties that you are having. So they will have an answer even if it's not 100% right but they at least can point to the direction that you should go. I used to say Nicholas that nowadays I'm giving the advice and the connections that I wish I had to have 10 years ago. I would be in a different level right now especially because I moved from from Brazil to Portugal.

So as an immigrant you can imagine that well I was born again right because no one even know me in this country so I had to create everything from scratch everything from zero and it was very very hard and now I can do one thing that I didn't have when I came here is this kind of support that people should look for. It's very very valuable because you can save for instance if not 10 years but maybe two five years for sure that you will save in terms of um getting faster in some points. >> Yeah, mentors really help because they walk the path that you are trying to walk. So if you follow the steps you will get there much faster and it's obviously not all rainbows. What's the biggest challenge that you've been facing since building what you are building? >> The main challenge because it's when you're starting something new, a lot of people won't believe in you.

So, you need to find those that are believing. And it's the same recommendation that I give to all my founders where I can find my first 10 clients where I can find inside the network that I have with the friends that I have and you need to start asking them about other people. So it's just a simple question like do you know someone that would be interested in this solution? This is what I did when I started the acceleration program. It was the first exploration program for fully dedicated for cyber security startups in the country in Portugal. Never existed before. It was really hard because I didn't have startups enough to start. So what I did my strongest network in terms of cyber security was two years ago in Brazil. Now I can say that I have more connections in in Portugal than Brazil or Europe in general and United States as well because I started to talk with people, right?

And sometimes this is what we need to do. We need to to go out the cage, go out to the house or the office and talk with people, go to events. But everything very calculated and strategic, right? Don't go to any event. Understand if that event what's the possibility for you to talk with people there. If there is someone that can go with you and introduce you to other people this kind of warm introduction. So this is must be done is strategically. But this is to tell you that I started in the first batch. We had I think 80% came from Brazil in our acceleration program because I had a lot of people in Brazil that I knew and they were able to help me. So they started to send email, newsletter, a lot of incubator accelerators that I knew in Brazil. They sent me to a lot of people and they helped me to actually get these startups. So what I would like to say to you is that is the same when we are starting a business.

So I give you an example of starting a solation product in cyber security but starting a cyber security company is the same thing is the same strategy. So you need to to create this way where you're going to select your first 10 10 clients and where you going to find them with people that are already around you people that you already know and these people you need to bring them to your side and ask them for help. That's what happened with me. They are uh willing to help. You just need to ask them. It's a very basic principle that you learn in law school because let's say that you want to get money back from some supplier a product that you didn't like and you want to return, right? If you don't provoke the court, no judge in the world will do anything for you. So, it's the same thing. You need to provoke things. You need to start. You need to ask. And this is the the principle of a lawsuit.

If you don't ask to a court to do something for you, won't do it, right? Because they need to be provoked. You need to ask and that's the same thing. >> Door doesn't open itself. Exactly. Okay, perfect Thiago. Well, thanks again. I will add links so people can check you out and thank you guys for watching. >> Thank you very much, Mikos. It was great pleasure to share some thoughts with you guys today and congratulations again for what you're doing. It's a very interesting initiative. Thank our