Cyber Security District

The episode is a 55-minute career biography with only a handful of actionable practitioner insights buried in biographical meandering and small-talk filler. Useful observations on trust-based security selling, product-vs-service traps, and culture-first hiring are present but arrive slowly and without depth.

“there are two ways of selling security. By fear and by trust. So I don't like the first one because a lot of reasons but mainly because it's not ethical but also because it's a matter of someone come and put it more fear on top of what you said and you will lose the connection”

“it's very tough to mix product and services. Okay. In Dognettis we did that mistake. We had a um, very strong capacity in terms of service delivering and we were always trying to put products on”

Almost all the business lessons (focus early, people matter most, trust over fear) are standard founder-circuit wisdom. The 20-year-old analogy comparing web-app pen testing adoption to AI adoption is mildly interesting, but no genuinely contrarian or first-principles argument is made throughout.

“I remember that in the early 2000s, uh, a very nice company called Net Canvas, they put it in the market, the first tool to automate pen testing...people were oh, this will change everything. I will lose my job...that didn't happen and it will not happen with Gen AI either”

“20 years ago there were two types of pen testers. The senior ones...and the youngest ones that were starting to testing web applications, that new thing...it's basically the same that is happening now”

Francisco is a genuine practitioner who built and sold a real MSSP, rose to CTO of a $5B group's cyber division, and is now on his third venture - not a career podcast guest. However, the current business is 50 people and regionally focused, limiting the scale of lessons on offer.

“Proscurities a worldwide leader in terms of security. They have a uh revenue around 5 billion”

“we were 350 people more or less around the world um operating for SOCs, um mainly MSSP but also doing auditing consultancy”

There are some concrete anchors - Prosegur's ~$5B revenue, 350-person division, 22 countries, 2007 Portuguese IP-space scans, Net Canvas named - but many claims stay vague ('a few countries in Africa,' 'top three banks in the world') and numbers are rarely accompanied by outcomes or timelines that would make them actionable.

“we were doing this sort of scannings to, to all the, the um, Portuguese IP space...gather some, some intel about how vulnerable the, the Portuguese Internet was. And then we released this anonymized statistics”

“we were the first of seven companies uh that uh were part of the cybersecurity division of Proscure”

The host occasionally pushes back well (challenging the 'luck' framing, asking for elaboration on meritocracy) but frequently asks long leading questions that contain the answer, and critical threads - like the actual mechanics of internationalization or the confidentiality message - are left almost entirely unexplored.

“I don't buy into it. Okay. Right. You have to be lucky for 20 years straight. Then, then you, you need to do some very good things”

“I feel throughout your career you've been sort of a trendsetter, uh, always a bit ahead of the curve, kind of a visionary. That is, is a ah, big strength”