Google, Microsoft, Apple… Although less well known, the cybersecurity firm Irius Risk (IR) also appears on the list of successful startups that have seen the light of day in unique places. Its founders, the Spanish Crisina Bentué and the South African Stephen de Vries, gave birth to their baby in a cabin built by them in the Huesca Pyrenees. In just six years they have gone from 2 to 155 employees, with subsidiaries abroad and clients of the best in the world of banking, automotive or pharmacy.
They met more than a decade ago in London, where they both worked for a consultancy. She was dedicated to business development; he was an ethical hacker who made his living finding flaws in application security systems. “She used to tell me that this part of her work had to be done by a program,” says Bentué, so they thought of creating software that would automate the list of possible threats. They proposed it to their company, but they were told that such a product was not part of their business model.
The slammed door did not discourage the couple. With their savings, they bought a piece of land in Montesa, a small town 8 km from Barbastro (Huesca) where only one other family lived. “He is entering paradise, to the right,” her brother often says. Using manuals and tutorials, they built the cabin and planted a garden. After setting up the internet, he began to chop code while she provided the business vision. “We were going against the clock, if HP or IBM released something similar we would be out of the market,” she says.
They sought venture capital, but were not taken seriously. The coup d’état came in 2015 twice: BBVA bought the product from them –still in beta version– and they received the first prize from the National Institute of Cybersecurity for the best startup. The following year, with the company already founded, they attracted large clients such as Inditex or the pharmaceutical distributor McKesson with their alpha version. “Then investors did start to listen to us,” recalls the businesswoman. Since then, they have carried out three rounds of financing: the first was 1.5 million euros from Iberian funds; in the second, 6.8 million, Americans also entered, and in the last, out of 28 million, there were only Americans.
His good work is in his product. Bentué explains that 50% of vulnerabilities in cybersecurity systems are usually failures in the application design phase. “It’s like building a house. If you think about security when it is finished, it will be very difficult for you to adapt it; but if you do it off-plan, the costs are reduced”, he says. To do this, they have created software that automates the process from the initial design, banishing the human error factor and standardizing vulnerabilities. They sell security for financial applications –JP Morgan, American Express, HSBC–, industrial controls or medicine manufacturers. “We guarantee security from the first line of code,” he says.
The company, with 155 people, maintains its headquarters in Huesca, where it has successfully implemented the four-day working day. In 2022 they opened subsidiaries in the UK and the US Another is in the works in Australia. They already have their first client in Japan and other potential ones in Singapore, but their main bet is the US, where they plan to double their current workforce (40 employees) in one year.
The couple lives in Jaca and they almost always work remotely, although Bentué frequently travels abroad. “Many told us that we had to go to a big city to get something, but I always refused to have to choose between family and work. We have shown that we were right, and now staying here is already a matter of pride.”
