Welcome to the Innovation Conversation, a podcast
about innovators, both in business and real life.
Hosted by myself, Ricardo Rescual and Harry McCona.
This podcast is sponsored by OpenExperts .com.
OpenExperts is a place to go if you're looking
to talk with top experts from around the world.
That is Open -Experts .com. This podcast is also
sponsored by StartupNetworks .co .uk. Startup
Networks, it's an online forum where you can
find all the resources you need to learn your
startup. from grants to investors to tips and
tricks and how to be successful you started.
Today we are joined by Enrique Serrano Aparicio,
founder and CEO of HackRox. Hi, and welcome to
the Innovation Conversation. Today we are joined
by Enrique Serrano Aparicio. Enrique, welcome.
You're the founder and CEO of HackRox. Am I right?
Yep. So would you like to introduce yourself
to the audience, please? Sure. Thank you, Ricardo.
It's great to be here with you today. And yes,
the name of the company is this one actually
is HackRox. So yeah, I am the founder and CEO
of HackRox. I started off in the world of cybersecurity
when I was 14 or even less. I was very like trying
to understand how the computers were working
like a lot of time ago. So I co -founded with
a group of friends, Mundo Hacker. Mundo Hacker
is a team or a group actually of hackers that
every Friday we were hacking different stuff
from 7 p .m. to 10 p .m. just for fun just to
discover new stuff and always in a good way I
mean not to get money not in you know not to
ransom people. So the good point here is that
after several years I studied IT engineering
and I joined IBM. So I was in IBM around six,
seven years. And the last part of my career in
IBM was in the IBM ex -force command with the
headquarters in Cambridge, Massachusetts. And
I left and I went to Simulate. Simulate is a
startup from Israel. And it was also really good
fun to leave IBM, the huge company, to go to
a startup in Israel. And after that, COVID came
up. And during the lockdown, we made hackers.
So we were like programming a platform for more
than one year, more or less. And we have a cyber
security training platform where you can train
and you can hack different stuff, but in a practical
way. So for me, it's very important that part.
We, I mean, I have had, or I've been part of
several shows in Spain, TV shows where we were
hacking people on the street with hidden cameras
and this kind of things to demonstrate that it's
possible. So yeah, to conduct education and awareness
always bad. The good point here is, and actually
I have a TEDx talk on YouTube talking about the
need of having hackers in the society. How do
you know, by the way, first, how do you know
that the hacker is an actual hacker? The first
point. How do you demonstrate your knowledge?
So with hackers it's possible. Secondly, okay,
how do you trust in a hacker if the hacker was
a cyber criminal before? Because for me, we have
hackers and cyber criminals, both with a lot
of knowledge in cyber security, but hackers for
in a good way and cyber criminals in a bad way.
They use it. So that's the point. How do you
trust in a person who is hacker now, but you
know that it's mandatory to be a cyber criminal
before because if not, you don't practice. So
we have created this kind of battlefield where
it's possible to compete against other hackers,
to demonstrate your knowledge, to learn, and
always in a practical way and very important,
in a legal way. So that's the key of hackers.
There's a difference between, is it white hackers
and black hackers? What's the terminology for
that? Yeah, sometimes for me, hacker global is,
hacker is good. So white hacker, black hacker,
whatever. For me, hacker is good and cyber criminal
is bad. But it is true that the people normally
define black hacker like the bad guys and white
hacker like good guys. Maybe it's related with
some cybersecurity projects. Because for instance,
When you have a client and the client provides
you information about his infrastructure That's
considered as well a white hacking or white and
testing white box and texting It's black box
white box the black black and white is all the
time in the world of cyber security. So yes kind
of I'm assuming a lot of big companies use hacker
services to test the products against multiple
vulnerabilities and stuff like that. How relevant
is it? Yeah, I think it's very important and
actually it's mandatory if you want to have some
normatives or regulation. If you want to be compliant
with several normatives, depending on the country.
But for instance, I don't know, here in Europe
or even in the US, you need to demonstrate that
your infrastructure, your product, your network
are secure. So you have to make at least once
per year an external audit by the third company.
So you have to provide this kind of, hey, agreement
like, I give you my permission. So you are able
to have my website, my company, my product, whatever
for one month. And I'm going to be like working
as usual and you're going to have to hack me.
And after that, you're going to give me a report.
Normally, actually two reports, one for executives
and the other one with technical details. And
you're going to tell me how you had me, how did
you enter, you know, wherever you went, how to
fix it. So with that, I'm going to demonstrate
with a paper that my company is safe or I have
this vulnerability, but now it's fixed. So please
come again and check that it's correctly properly
fixed again and try again. So after that, you
can consider that your company's kind of secure,
because we say in cybersecurity that there's
nothing 100 % secure. That's very common, actually.
I was just wondering, so you're from Spain, you've
also been to the US a lot, and you've been living
there as well, if I'm correct. How hard was it
to get people on board with what you're doing?
As a startup founder, did you just focus on the
Spanish market or you had to go elsewhere straight
away? No, at the end, as we are a SaaS product,
actually you can go to our website right now,
and we have also a small B2C part of the business,
but it's not the focus right now, but we have
more than 40 ,000 people from all over the world.
Thousands and thousands. So as we are a SaaS
product, we are global. The marketing stuff in
the beginning started in Spain. That's true at
the end. Typical family and friends for investment
and for clients. And after that, We tried to
expand our business in the US actually, because
in Latin America, we had organically clients,
because at the end, I think maybe because of
the language, I don't know, we have clients in
Mexico, in Chile, Ecuador, I mean, in a lot of
countries and also in the US, by the way. So
we have the product by default and from the beginning
in Spanish, but also in English. I think it's
very important to have a global company. So everything
is by default in English and Spanish. And actually,
one of the key things that we have and one of
our unique values, is that our platform is actually
a tool for companies. And when I say a tool is
that it's white label. So we put the logo of
the client, the colors of the client, and the
language of the clients. So we have the platform
translated to Portuguese as well, to Italian.
So it's very easy for us. We build the product
from the beginning in a way that is very easy
to upload new languages. And that's a differentiator
at the end. We go to a request for proposals,
RFPs. It's very interesting that this white label
part and language part is key. sometimes. How
easy was it to convince people that they should
invest in you coming out of Spain and going abroad?
Was it easy? Was it hard? How was that journey
like? No, it was really hard. When you create
a company, one of the things that you discover
in the beginning, I think, is the people. In
the beginning, actually, this company is very
technical. I was thinking that the most complicated
issue that I was going to have was the technology.
servers, infrastructure, etc. But no. I think
the most complicated thing you have to manage
is the people. And for different reasons. The
first one is to attract talent. How do you make
that a guy that is working, I don't know, in
HP, in IBM, like me in the beginning. Actually,
Simulate made this with me. I left IBM and I
went to Simulate. I was then playing number 20
or something. So how is that possible? I think
you have to offer an incredible product. You
could I mean, I was felt in love with the product
of Simulate. Also with the team, the founders
is important. How do you manage the people? I
have some employees that came from a big company
and they are saying to me that now they are living
much better because at the end they are like
their own bosses because in a startup you have
to manage your task very well. I mean, I cannot
be chasing people. I need you to be autonomous.
If this has to be done on Friday, I expect that.
I'm not going to ask you on Thursday. Like, hey,
how are you doing? No, chasing, chasing. So that's
different. In the big companies, that's very
common. So I think you have to make the people
happy to be with you. The product has to be good
as well. Because if they are going to work and
sell something very new, something innovative,
it has to be for real. And the other part is
how to retain talent. Because sometimes it's
complicated. When you come from a big company,
it's complicated to adapt yourself. to the daily
basis of an startup. It's really complicated.
Actually, I have had some people in my company
that didn't fit very well because of this, because
they used to use processes, approvals, these
kind of big company things. So once you're in
a startup and you discover that you are your
own manager, you have to manage your time, your
tasks, everything, sometimes it's not good for
everybody. I think you have to have that kind
of mindset. Yeah, the mindset, yeah. It's funny
because a lot of people, especially with this,
a lot of people kind of struggle with that, just
like you said, which is how do I manage myself
and my time in the startup? It's not for everyone,
right? And you do find a lot of people like that.
And maybe it's okay if they don't make the jump,
even though they're very high qualified in the
state where they are. How do you deal with this
uncertainty? Because there's a lot of uncertainty
with building a business. How do you deal with
that? Yeah, first of all, as a founder, You have
to be very alone. You have co -founders, you
have friends, I mean, someone to talk about this.
But if not, if you're an only founder, sometimes
you have to be... I don't want to say quiet,
but you have to manage very well the information
that you transmit to your team. Because there
are several times in the life of an entrepreneur,
and I think this is a standard for everybody,
that the cash in the bank is going to be very
low. Maybe next month is huge. Maybe the next
month is again low. But at the end, that's very
hard to manage. Because you see the bank, you
see there's no money there. And this client has
to pay tomorrow. If this client doesn't pay,
we're going to have an issue. And maybe the client
is not going to pay because of maybe the guy
who pressed the button is sick that day. I mean,
something you have to manage a lot of things
that don't depend on you. And you cannot transmit
that stress to the team. I think that's very
important. And that's one of the tricky parts
that I have to manage every day, because this
is every day, actually. Every week or every day
in a startup is different. And you cannot transmit
this stress to the team, because if not, the
team is going to explode. Because I'm exploding
sometimes. How can I manage this situation? So
at the end, you manage it. But it's true that
it's very complicated. And actually, nobody told
me this in the beginning. Everybody was saying
to me, Startup is great. It's great to be an
entrepreneur. Everything's going to be great.
You're going to be your own manager. That's true,
but there are a lot of parts that you don't see
on a daily basis, and it's very hard sometimes.
At the end, for me, if you see the final result,
I like it, and I love to be an entrepreneur,
and I think it's worth it. But... It's not that
easy that it looks when you see this kind of
great companies, billion companies. It's not
that easy. And you have to manage a lot of stress,
your family, your employees. If you have 10 employees,
probably these guys, every single one has something
bad in his house or they need more salary next
month. So you have to manage a lot of stuff that
I didn't expect when I was creating a hacker's
tool. I'm wondering on the tool itself. I mean,
are you... Did you ever got to know how people
often talk about North Korea and how to have
hackers and China and all these big state players?
How are you finding this? Do you think it's a
big thing and we should be worried about it or
actually it's going to be okay because companies
nowadays, they're using tools like your own and
building enough resources to prevent that from
happening? No, I think we have to be worried
actually because we don't see it but it's there.
And when we have a war, probably this war started
before in a digital world. And probably right
now there are a lot of wars happening and we
don't know it because they are online only. So
yes, and I cannot talk, I mean, I cannot say
a lot of details, but I have seen several bad
situations because of this kind of spy things,
spying things, sorry, related with these Asia
countries. So yes, I've seen, I personally...
have seen these these kind of things and it's
happening it's happening all the time actually
if you create a server right now on a website
imagine you create a server right now and you
put different softwares for remote desktop and
you put the password 1234 i made the test and
in less than one second my mouse was moving automatically
alone in theory and only one minute took because
from normal information they are scanning the
network all the time new IP address. Let's see
what can we do there, what information we can
get. So that's happening, but in both ways. I
mean, this is the world right now. This is the
world where we are living. And what we are doing
in Hagros is not, we are not a firewall. We are
not an antivirus. We are a platform to train
your technical people because, you know, it's
very common to see it's very important conduct
education and awareness in cybersecurity. Don't
open this email. Be careful with these ransomware.
That's great. And even if you do it, the people
are still open. But what about the technical
people? Because we are assuming that the developers
are experts in everything. So, for instance,
clients of HackRocks, we have, for instance,
one client with 300 developers. And they said
to me, the CISO, the Chief Information Security
Officer, said to me, I want to make with HackRocks
different scenarios. And periodically, I want
to make my developers to hack stuff really similar,
very similar to the one that we have in our company.
Because once you know how to attack, you know
how to defend. So we are creating virtual scenarios
with the latest vulnerabilities that are coming
up every day. So with that, you can exploit those
vulnerabilities and you know how to defend yourself
against them. How important is it to keep up
to date with all these things? Of course, we
know the basics, which is always have the software
up to date and stuff like that. But is that a
foolproof way of not being hacked or you actually
need to invest a lot more? to fix that type of
issues. No, no, no. Even if you invest a lot
of money in cybersecurity, you could be hacked
tomorrow. I mean, and actually, there is one
thing that's a bit weird, but maybe right now
you are being hacked. I mean, right now. But
you don't know it, and maybe you're going to
know this in three years or 10 years. Do you
know the vulnerability that was called heartbleed?
No, but tell me more about it. I'm not going
to go deeper in technical details, but the interesting
point of this vulnerability is that it was discovered,
imagine, I don't remember the year, but imagine
2020. And they discovered that 10 years before
2010, it was like published or that happened
for the first time. So during those 10 years,
the cyber criminals were using that to hack a
lot of passwords, a lot of servers, a lot of
stuff. So the point is, what are we going to
discover in 10 years? that were vulnerable today.
On that note, I got a question for you. We hear
a lot of things about quantum computers and how
it's going to revolutionize the way that we process
information, but above all that we create passwords.
How impactful is that going to be? A lot, yeah.
Yeah, a lot. And I'm glad that you make this
question because for me it's very important and
the people sometimes don't think about this because...
I was in front of this quantum computer of IBM
in Switzerland, in Zurich. Is Watson the name
of the company? Yeah. Watson is the artificial
intelligence of IBM and they have quantum, IBM
quantum. So I was in front of the quantum computer
in Switzerland, in Zurich. It was incredible,
like in front of me. Everybody wearing white
with a lot of careful because you know the temperature
is very important for these kind of computers.
Yeah, I was wondering this, and I was making
some research, and it's true. Probably something
that we consider safe. Right now, imagine a password.
This password cannot be encrypted today, or could
be, but in 1 ,000 years. It cannot. With a quantum
computer, maybe that password can be decrypted
in days or in minutes. So I think we have to
change our mindset and think that maybe something
that is protected today with some encryption,
it's not going to be enough to protect this information
maybe in two years. Because I was in a conference
related with a very incredible man from Spain.
He's one of the key masters in quantum computing.
He said, in the last five years, we are seeing
that in 25 years, we have to change all the passwords
and all the encryption systems. But every year
is in 25 years. Maybe it's not going to be tomorrow,
but maybe in 30 years, maybe 40 years. But for
sure, a password or an information that is encrypted
with technology that we have today, maybe it's
not going to be enough to protect something in
20, 30 years. Because with quantum computer,
you can decrypt something in minutes. So we have
to change. And actually, I have heard that in
the MIT, they are creating new subjects, which
are called quantum encryption, or how to define
encryption related with quantum computer. Because
that's going to be the future. But is it a big
issue right now? Like, can you already use quantum
computers to track passwords or it's still...
No, you can't because probably if you try, the
host of this quantum computer is gonna block
you. Because for instance, the IBM one is for
free. I mean, you can go to IBM quantum and it's
for free. You can make a request and they're
gonna return the result. It's for free until
some point, but yeah. Why? Because normally,
I think, why? Because normally they want to be
the standard in the future. So they have created
a programming language for quantum computer.
So the one who creates these programming languages
will be the standard in the future. So it's for
free. You can do it. You can go to IBM, write
a small script, and use the technology. It's
for free. But if you try there to hack a password,
probably they are going to tell you, hey, Ricardo,
don't do it. Don't go that way. Do you think
we should be concerned with state actors using
this technology to to hack a lot of things. Yes,
but I think before is the artificial intelligence,
because I'm saying one thing. I was using artificial
intelligence seven years ago or something like
that with IBM before ChatGPT, but now everybody
has access to artificial intelligence and could
be the same with quantum computing, because right
now, if you are not in IBM or in Google or in
this big tech, you cannot access quantum computing,
but now you can even create your own AI. engine
in your own laptop. I am always saying if I have
access to ChachiPT to hack people or to make
hacking stuff, the bad guys can also do it. So
bad guys, cyber criminals have access to ChachiPT
as well. So they are making better email phishing.
They can guess passwords with AI much better
than before. So as the bad guys are using ChachiPT
for bad things, we have to use it as well for
good things. I think we have to evolve. Yes or
yes? Treats or recommendations you can give to
someone and say, no, just do this straight away
because that's really going to save you a lot
of time or a lot of hassle in the future. I mean,
for me right now, there is one thing that is
mandatory, which is a two -factor authentication.
So take for granted that your password is going
to be stolen. Because sometimes it doesn't depend
on you. You see, we saw that LinkedIn lost hundreds
of millions of users, whatever. This is another
password lost, 10 hundred, no, whatever. Millions
of users have been lost in the last years. So
our old passwords, our user names, our IDs are
in the dark web already. So probably if you use
some of those passwords in an old account, maybe
it's going to work. Or maybe you are using the
same password into accounts. So maybe Instagram
is working, but Google is hacked for instance.
So they can use it in both networks. I am always
saying is, in addition to the username and the
password, you need something else. And that something
else could be SMS that comes to your phone, could
be your face ID, fingerprint, but something else,
not only username and password. With that, you're
going to be much more protected. Of course, not
100%, but yeah. What about because, you know,
I actually heard a horrible story like this,
some guy who worked for a hedge fund, he got
his phone stolen. And then within hours, people
had asked for bank loans in his name using the
phone because, yes, as you're right, two -factor
authentication, they send you a text, but if
they do have your phone, they can do everything
from there. Is there any way for us to protect
ourselves against that? Because if someone has
your phone and your phone has your email accounts,
it's stopping the person who has your phone and
free access to your phone to actually be going
crazy. The key here is that, for instance, I
have this configured in my phone. If you put
10 times incorrect, my password is going to be
deleted automatically. So things like that, like
of course you have to protect your phone, you
have to put always a password, not something
easy, not the typical withdrawal. Or the remote
control. For instance, there is another tip that
is very useful. You can configure that. If the
phone is not unlocked, you cannot disable Wi
-Fi or 3G. 4G, 4G, 5G, whatever. That way, you
can go to the remote control and say, delete
my phone remotely. That could be done in iPhone
and in Android. And that's something very easy,
because you can find the phone, because it's
going to be connected, and you can delete the
phone remotely. And by the way, for the second
one, for the two -factor authentication, if you
can avoid SMS, much better. And the other option
could be an application that every 30 seconds
or every minute, change a random token or a code.
Google Authenticator is a different thing. Okay,
interesting. Instead of SMS. Going back on your
startup and yourself as an entrepreneur, what
tips and advice do we give to someone just starting
out, based on your experience? Related with technology
or with a startup? With the mindset and the startup.
Not so much technology, but something completely
agnostic, just saying, you know, I would advise
people to go here or go there and do this. Yeah.
What lessons have you learned anything? Yeah,
no first of all the lesson that I told before
it's not that easy that it looks and you're gonna
You're gonna have bad moments hard moments that
you have to bypass second that every see every
single euro or pound or dollar counts Because
when you raise money and you have 1 million or
you have half million, whatever You spend on
marketing salaries, whatever, but when you don't
have the money is Very tricky, very, very tricky.
So be careful with the marketing, for instance.
Right now, I'm not spending too much, but I have
had some moments in the past where the investors
said, hey, we have to invest more in marketing
or less, whatever. Be careful because sometimes
if you have, for instance, a B2C model, the marketing
could be a black hole. All the money can be there.
So be careful with every single euro that you
spend, even if you have a lot of money right
now. Because sometimes, for instance, the venture
capital, some of them, not all of them, but some
of them I'm going to tell you, I want you to
spend my money in six months, mandatory. Why?
Because if you don't get your goals, maybe you
need more money from the VC and you're going
to be like, I need your money or the company
is going to die. So sometimes I have seen this
also with some of my colleagues that are working
a lot with a lot of VCs at the same time. You
have to be careful or at least understand the
business of a venture capital. I think it's important
to empathize in both ways because When you guys
are raising money, you have to be very careful
with the amount of the company that you're going
to provide, the conditions. Be careful because
maybe they can say in a term, if we say no to
something, it's going to be no for everything
or for always. We call it veto in Spain. My word,
if I have no and I have 1 % of the company, but
if I say no, it's no. The veto power, so they
can veto the... Yeah, exactly. I have seen that
in some of my colleagues and they said to me,
be careful with that. We were not careful. So
these kind of small details are very important.
And also, yeah, so how to manage the money. Every
euro counts. And be careful with the conditions.
Also business angels, everybody. Because at the
end, everybody has their own goals. And it's
okay. So find a fair situation always. Because
sometimes when you don't have the money, you
sign whatever you have. in front of you. So you
have to be very careful. And very important,
I think we made it in calculus, but it's complicated
sometimes to get this. You have to have a plan
B in case you don't have cash the next month.
So what's the minimum cost that you're going
to have to avoid a company die? Imagine that
tomorrow that client is not paying. Imagine that
tomorrow the VC say, no, finally we are not going
to invest the day before. Things like that can
happen. And what's your plan B? If you don't
have a plan B, probably you're going to die because
you're not going to pay salaries. You're not
going to pay the service of your platform. At
least, I have learned this in the beginning of
Hagrooks and I think we always have this kind
of plan B and that's why we created the company
four years ago now. I have seen a lot of friends
with the company in 2020 that the company is
not alive because of cash stuff and things like
that. Because you raised it from investors in
Spain and also in the US, correct? In Spain,
not in US yet. Oh, okay. I was just asking about
the mindset. You know, from the conversations
you're having so far, is there anything that
you think is different between all these geographies
or investors thinking the same way? No, no, it's
totally different. I didn't get investors from
the US, but I've been talking a lot with several
VCs in the US, business changes, whatever. It's
totally different. I mean, the mindset. Some
of them... I mean, for instance, in the US, we
have this problem with Spain. If you are raising
in Spain, I don't know, 6 million euros, maybe
it's too much for the standard average ticket
that ABCs are going to invest. It's too much.
But if you go to the US, a couple of million,
3 million euros, you're like, OK, we are not
going to waste our time for that few. millions.
For me, it's a lot, but for the US, it's not
that much. So it depends on the country, it depends
on the business that you can find in that country.
For instance, in the UK, I think it's much similar
to the US. But for instance, in Spain, I have
friends that they were raising a friend of mine,
actually. And he didn't get it. And to get that,
or to try to get that, he had to combine like
three or four VCs. 250. So you're like, four
VCs for this amount of money, which is not that
much. More or less. It's really complicated.
You have to talk with a lot of people. Everybody
has their conditions. But if you go to the US,
maybe you can raise 6 million, 10 million with
only one VC. So that's the difference sometimes.
No, yeah, something like that. I think the amount
of the money is not the same in the geography
that you are. And maybe you can make some mistakes.
Because if you go to the US and you say, I need
200k. They're going to tell you, okay, come back
to your country. I mean, you are too slow for
us. That happened to me, actually, sometimes
in the beginning. That's why I'm saying this.
How have you dealt with it? I mean, it must have
been hard when you go there and say, you know,
only this much and a lot can happen. And they
say, no, you're too slow. Go back to train. How
do you think about that? In my case, and maybe
this is a mistake, actually, I wanted to be very
honest. I mean, because if you're in the US and
they tell you, hey, no, but instead of 200k,
it's going to be 20 million. You can say, OK,
whatever, perfect. But with the valuation of
your company, that means that you are setting
your company. So make no sense. So you have to
be careful, because if you say yes to all the
money that you have, maybe you're going to lose
a lot of percentage of your company. Or maybe
you don't need that money, actually. You have
to raise the money that you actually need for
the goal that you set. So if you are talking
with an investor in the US, and suddenly he's
saying to you, and this happened to me some while
in Spain, why 200? No, it's 100. Maybe yes or
maybe not. Maybe I don't need it because I'm
going to sell. I prefer to sell and get money
with sales, not with investors. So you have to
be very careful with the words that you say when
you are talking with a VC or business angel because
maybe they are tricking you at some point. Let's
see what he says when I say, I have 20 million
instead of 2 million. In what do you invest my
money? I don't know. I think it's very tricky
because if you say one word that doesn't fit
with his mindset, because sometimes they are
saying, no, we only invest in projects with these
conditions. Maybe you don't know those conditions
because it's secret or they are internal from
the PC. And you say, yes, whatever. Yes to all.
I need your money. Yes to all. I have seen that
a lot. Maybe that's tricky. At the end, it's
dangerous. So I prefer to be honest and I know
this is the money that I need because this is
my business plan. If you are able to provide
more money, we can redo the business plan and
we have to negotiate the amount of company that
you want. You are going to invest triple or double.
Of course, you want double of my company. Of
course, yeah. You have to be very careful. Yeah.
And how do you find these investors? Honestly,
family and friends or friends of friends of friends
at the end. So that's one option. Second, events,
but not typical start -ups events. More specific
networking events for... Yeah, so events in cybersecurity.
So events related with the industry of the company.
Because there you're going to have business partners,
you're going to have investors, you're going
to have clients. So normally I prefer to go to
cybersecurity events instead of start -up events.
Because sometimes when I have gone to these start
-up events, I'm feeling that we are like... wolves
following the three investors that are in the
audience. You know, everybody's chasing them.
It's very complicated to get attention, to get
one minute to talk about your company is really
complicated. I mean, they're okay, but it's complicated.
So you have to manage very well this kind of
events, because I mean, I've gone to some of
them are some of them are great. And if you do
it well, you can manage it very well. But you
have to know that you have 30 seconds per investor.
That elevator pitch is very important. That card,
that message that's, hey, this guy I can make
money with this guy. So you have to be very ready
because you're going to have all the walls looking
out for investors as well. So I've been there
several times and I've got investors as well.
And normally the investor that's finally invested
in my company or yeah, normally have come from
this kind of industry events. I don't know why.
Maybe because cybersecurity is very specific
and very close industry. It's very, at the end,
we say always that we are a few people in the
industry. Everybody knows everybody. Yeah, it's
different to me. I always compare going to events.
It's a bit like dating, right? You're single,
you go to a bar full of single people. Now you're
there, there's a likelihood of you meeting the
right person, but there's also a likelihood of
you meeting the completely wrong person. And
it's the same thing with any event you go to,
right? If you're there looking for investment,
there are investors at the event. Is it likely
for you to talk with them? Yes. Is it likely
for you to be a good match? You know, that's
up for grabs, but it's... You can never know
that beforehand. Exactly. Exactly. So it's great
as well. I've been in this speed dating sometimes
as well, and it's okay. Maybe you feel that,
okay, this isn't going to invest in the first
second. So you have a conversation, five minutes
conversation very well, and that's all. And the
opposite. So yeah, that's okay as well. But normally,
I mean, I think this important message. You have
to fight or you have to manage to get your goals.
Nobody's going to give you an investor for the
event. Actually, right now we are as well in
the Tampa Bay wave accelerator. We are in Florida,
the city of Tampa. And we are there in an accelerator
right now, very happy. And it's the same. We
have had in front of us investors, mentors, business
partners. But if I don't go, probably they are
not going to say, hey, Enrique, how can I help
you? How are you today? Let's go, you know? So
in this kind of big events, it's the same. So,
or startups events, you have to be, I mean, If
you are like quiet or introvert, you have to
change. At least you have to try. Like, hey,
let's talk with everybody. Let's see what you
get. I was wondering one thing, because I know
the ecosystem here in the UK. And I know, for
example, as an investor, you do get a lot of
tax incentives to put your money in the startup.
What is it like in Spain? Do you also get some
type of government support? Yes, for the investors,
if you invest some money, you can say at the
end of the year, related with your taxes, you
can say, hey, I invested in this startup, so
I have some benefits. There are some benefits
as well. Yeah, and it's very important to know
very well the benefits in every country. Because
not only benefits, also some helps. I mean, and
helps not only money. Helps means, for instance,
I went to Saudi Arabia with the government of
Spain. They said, hey, five... a businessman,
whatever, five companies, related with defense
and with cyber security, and they invited us.
That's great, of course. That's one opportunity
that I had. And it's not money, but sometimes
you get it. And also, depending on the country,
for instance, in Spain, you have some money that
you have to return. I mean, it's not for free,
but maybe you have some, this kind of money that,
okay, I give you the money now and in two years,
you start to return the money. You have that
gap. These kind of things are there, but you
need someone to tell you this. Actually, I recommend,
and we are using this here in Spain, companies
that work, but you only have to be the company
if they get the result. If they don't get this
money or if they don't get anything, they don't
get the money from you. So that's great, like
a success fee only. Interesting. So they can
tell you benefits and this stuff because they
are going to get a percentage of the benefit
that you get. And do you find that people are
more risk -averse for willing to take the plunge
and start a business in Spain? Sorry, sorry,
say again? Do you think people in Spain are more
likely to start a business and take the plunge?
Because you left a very nice stable job in IBM.
Do you think people are like... No, that's weird.
In Spain, I think the mentality here is more
like have your job, your salary every month,
no pressure. I think that's our philosophy, unfortunately.
For my family, it was very shocked. that I left
IBM. And in Spain, we don't have... I don't know
how to say this. That's philosophy. And also,
we don't have a lot of help. When you are self
-employed or when you have your own business,
you have to pay from the day zero. I think in
the UK it's different. In the UK, if you don't
get 60k, you don't have to pay that much. No,
you, so you, you need to be, uh, so in terms
of VAT, for example, uh, you only pay after you,
you're starting over, I think it's 80 ,000, uh,
per year, then you need to start paying VAT,
uh, which actually is quite good because you
pretty much have a 20%. Um, and then there's,
it's, it's easier. You don't pay anything to
have a company open and start training. You do
pay it yearly when, you know, when you close
your account, uh, but you don't pay monthly on
a monthly basis. So I think that's actually quite
good because I know In Portugal, for example,
you have to pay every month regardless if you
are making profit or not. You still need to pay.
Exactly. Here it is the same. And that's, I don't
like it actually. And the taxes that the self
-employed have in Spain normally are increasing.
We don't have too many helps actually related
with money or related with you don't have to
pay until you see that your business is going
well, like, or things like that. No, you have
to pay the day zero. The first month that you
start your business, you're paying taxes. So
Yeah, there is a lot of point of view related
with that in Spain. It's more a political thing.
But yeah, I think it's not easy to start a company
here. And I'm saying this because I've been in
that path and also because I have friends that
went to the UK to make the company because they
said to me, I prefer the UK instead of Spain
to make my business because it's much easier.
You can try the thing that you said related with
the money. So yeah, I have friends, a friend
of mine actually from Spain is living in London
because of this reason. because of taxes things
and because of his magic here and yeah, he met
a girl there. So I don't like that because means
that talent like this guy is living in Spain.
So I don't know. It's a funny thing. The cost
that you have to start to launch a business from
scratch, if they're too high, they actually create
a barrier for innovation and create a barrier
for entrepreneurship because You just can't afford
that because you need to pay the government regardless
of what happens in your business. And like you
said, there's highs and lows, right? Some months
you have money in the bank, others you don't
have money in the bank. But if one of the reasons
you need to close the company is because the
state then comes and asks for money, that's incredibly
frustrating, I would say. No, it is. And in the
beginning, it's terrible because you see the
gas going down and down and down every month.
It's great. And much hard rock because in hard
rock we had to be one year creating a platform
with no sales. It was really hard to see how
we were paying taxes and taxes and taxes. It's
what we have here. What was the hardest that
you had? What was the one you said, you know
what, I'm going to give up? And how did you came
back from that moment? We had a moment where
at the same time, three or four clients didn't
pay. Same month. For different reasons. So sadly,
we had one time in four years, very, very complicated.
No money at the bank. Clients don't pay in. It
was really hard. I think not too many people
know this, but yeah, this happened. And we said,
hey guys, we have to sell something now. Today,
like incredible. And we made it. It was incredible.
We saved the company or at some point we saved
the situation because we always have that plan
B. But the plan being means that we have to fire
people. It's a very tough plan. So we had that
situation where everybody suddenly were not paying,
like from one day to another, like, what the
hell is going on here? And the cash was going
down. So we had to make several changes in the
company, several changes in the technology, several
optimize the economy of the company. And I think
that was very good at the end because we were
able to change different parts to save a lot
of money that month, that period of time. And
we kept those changes, or a lot of those changes,
because we optimized the cost of the company
a lot. So it was a good experience related with
the money, but a very bad experience related
with my years of life. Like the street that we
had at that time, we had to call the client,
hey, guy, in theory, you had to pay last month,
you're not paying, whatever. So finally, one
client paid a bit. Other times, you have to put
your own money suddenly, but you have to be careful
because you cannot do that all the time. you
don't have unlimited money. So yeah, for me,
the hard part is those moments where you don't
have cash and you have to take very complicated
decisions like fire people, restrict to the company,
talk with your partners, talk with your employees.
That's very complicated. That's the hard thing
to manage. Enrique, you're going to be one of
our speakers at our event on April 23rd. So I'm
very much looking forward to hearing you speak
on stage. In between now and the event, if people
want to reach out to you, how can you do so?
Normally, in my social media, it's great. My
name is Enrique, like my name, and at the end,
I -T -E, I -T engineer. Enrique, I -T -E. It's
very easy. You can find me. Normally, I use more
Instagram or Twitter, X now, or even LinkedIn.
You can connect and you can send me whatever
question that you have. If I can help, I'm more
than happy. Thank you so much for your time today.
I really appreciate it. Thank you for the invitation,
Ricardo. This podcast is also sponsored by startupnetworks
.co .uk. Startup networks, it's an online forum
where you can find all the resources you need
to run your startup. From grants to investors
to tips and tricks on how to be successful in
your startup. This podcast is sponsored by openexperts
.com. OpenExperts is a place to go if you're
looking to talk with top experts from around
the world. That is open -experts .com.