The First Customer - Charting the Techscape with Capablanca Co-Founder Luis Castaneda

[00:00:27] Jay: Hi everyone. welcome to The First Customer podcast today. I'm lucky enough to be joined by Luis Castaneda. he is the co founder and CTO of Capablanca Security Practice Simplified, which, we'll definitely get into what that means. Luis, thanks for joining me, buddy. How are you?

[00:00:44] Luis: Doing great. Thank you for having me.

[00:00:46] Jay: You got it, man. we met through, some mutual connections and, I know you're kind of heavy in the tech space all over the place. but just tell me, where did you grow up and did that have any impact on you being an entrepreneur later in life? Silence.

[00:01:12] Luis: this might date me, but it's a time when we were starting to see this crazy thing called the internet start becoming a thing all over the place.

And. I experienced that in a way that I think is kind of unique because I am part of the generation which bridges that divide between the analog and the digital worlds. but the way that was experienced where I grew up was very interesting. We have this, a lot of parts of the world and certainly the part of the world where I come from, there's like a very big,do it yourself, informal economy way of doing things.

and that was very big in the early days of the internet. So I think even though I had no formal education in computers or computer systems or anything, it was a very, I would say, a very easy place in which to learn, to mess around with computers and systems in a kind of earlier moment when, in some ways, some things were harder because it was harder to come around information and all that stuff.

But on the other hand, it was easier because there was a kind of wide open, field, particularly in the stuff that I Ended up getting into on the kind of security and the stuff that you used to be called, I guess. Sysadmin sort of things, which is how I started getting into computers. So, I wasn't into computers very early.

the internet,as a kind of concept and a way in a place in which to do fun things was something I was really into, like in, in that environment that I'm describing. and I had a, we'll get into it later, but I had an interesting career arc after that, but there was never a time when I wasn't, when I was too far away from a computer, And a terminal where I could mess around with things.

and I'm happy that now I've kind of, I believe I'll put together into kind of a business vision, but that's always been a passion of mine.

[00:02:39] Jay: Yeah, no, I, I can relate, you know, the dial up modem days and like. The wild west of the internet. And, do you think that exists today in another form? I mean, I would assume that like, that's just a pattern that repeats itself, right? there's some area that every generation can probably dig into like that and explore.

And it's kind of like the wild west. Do you think there's something like that today where, you know, kids and teenagers and young adults, like can engage in something like that? I mean, maybe the social media world or

whatever the hell that is, but like, what would you say?

[00:03:12] Luis: Yeah. I mean, it's really interesting because this is very generational specific, but I do think the way technology works,is so complex because some things kind of stay the same, some things. I mean, we, in a lot of ways, the internet of that moment. The piping of that Internet isn't that different from the one now, although, of course, some things about the Internet are completely different.

The scale of it, what we do on it, the things you can get into, but every time there's been like a cycle of innovation, and I think the social media is the big one that we're still in the midst of maybe some folks would say we're in the kind of tail end of that early social media moment. you know, a lot of the platforms that probably folks like myself.

Kind of came of age with are now the older platforms, and there's many others on even the idea of what social media is itself has changed so much in recent years, but I do think there are so many areas that are still ripe for innovation and discovery. and there's so many things about the Internet, just the kind of the fundamentals of the Internet that we've had to learn to deal with.

Very fast. the Internet has developed in such a way, and I think technology has grown in such an explosive way that I think it's almost like a cycle happens of innovation, and then things start to break. Right? And we have to figure out how to kind of fix those things. And as soon as we figure out how those things more or less work, new things start to break that we have to jump to try to learn.

And I feel like there's a lot of that going on now, of course, with generative AI and other big changes. It feels like we're in the middle of this. Kind of like the beginning, perhaps, of this other big cycle of innovation that is bringing up a lot of problems and possibilities.

[00:04:45] Jay: Yeah, that's a great point. so let's, what is the, what's the kind of snapshot journey from, you know, learning that wild west stuff, digging into something that's kind of new and exciting and just gets your blood pumping. And like, I mean, I remember, you know, I remember those days, man, you're just like making stuff and like, people are

buying stuff and it's like such a fun, like, wild time.

[00:05:05] Luis: what's the snapshot between then and now. publish something on the internet was kind of like the first thing I learned and was excited about.

Yeah. but then I had a whole other career. I mean, I ended up, by training formally, I'm an art historian, which is on paper, nothing to do with computers. but I kind of ended up in that world, actually, because there was a big intersection of that in that early moment of the Internet between people who were doing all kinds of creative professions and the possibilities that the Internet opened up, people who are publishing the first things that would count as content, even though we didn't know what content was back then.

and,people who wrote things and blogs and all of that. So the very first kind of professional interaction with the internet was by, was in that world, host, helping people host things, publish things, make things bigger and put in the first versions of stores, which was a big thing where you could start selling things on the internet.

And I'm talking about, of course, like the early two thousands moment. and so on from that moment. I mean, it was a few years before I got back into technology, but I never stopped doing as a freelancer, as a consultant, all kinds of what you would call sysadmin work. So this is before the public cloud platforms became a big thing, but essentially, you were doing the fundamentals of what you do on those platforms today.

Of course, we are, you know, many layers of abstraction sometimes removed from, What it means to start a database, host a database, run, I don't know, some server, all those things. and so I experienced that whole kind of transition from the birth of what's called the cloud and cloud technologies. And I kind of landed back years later.

after a kind of interesting career, the first career, kind of where I started because I started doing kind of DevOps work when the term DevOps already had become a thing and the whole culture of DevOps was an automation and all that stuff was becoming big. and so. I started out as a, just a sysadmin and a DBA, basically doing things like understanding how a database works, the fundamentals of it, that was the very first thing I ever did.

A friend of mine would ask me to put a website together and I would. And at that point that was kind of a whole. Journey unto itself. and then about a decade ago or so, I got kind of got back full time into the full on DevOps, world. And I kind of worked my way through a number of different situations, always combining the kind of developing products and offering services and trying to understand, you know, that very interesting relationship there is between,SAS, right.

Companies that offer just software, truly software as a service.

[00:07:30] Jay: hmm.

[00:07:36] Luis: thing. and so that latter part of the journey is where I'm kind of where I'm at now, having worked in a number of different places, typically as a kind of hired gun coming into, kind of do like the cleanup of your cloud environments or transitions from.

from on prem to cloud environments for a lot of folks, and more in recent years, more and more gravitating towards kind of like audit situations. this would be the situation where, you know, you had some kind of a company that would grow very fast. they wouldn't really think about like how to grow responsibly, and all of a sudden they had business demands that forces them to be audited and clean up their act.

and I saw firsthand what it meant. Actually on both ends of the issue, whether to be the person in that company that you grew too fast and you didn't think about, didn't think about how you were growing as you were growing. So I've experienced that firsthand as a kind of head of engineering and an early stage startup, which is a position I've been in a few times.

But I also knew what it was like from the other end. I was the hired person who came in to do the cleanup for a company that hadn't done that. Sometimes for a very long time and sometimes in the cases of large companies with large operations. So I saw that the complexity, and I think in all those scenarios, there's, we can get into what that means, but, seeing that from both ends is very important because you kind of understand that the customer's pain, if you've been in the, in, in that person's shoes, when you have to do the cleanup and you don't have time, but it's also really important to kind of develop the expertise of a consultant.

I think if you're going to offer anything as a service. when you are the kind of outsider who knowing nothing arrives in this context, which is typically very messy and needs to make sense of

[00:09:10] Jay: now, I think that's a great point. And I think all the really good, especially service companies that I've seen, have that high level consulting baked in, right? Like the

ones that don't last, I think, are just the people who try to put bodies in places. And, but like, if you have that background knowledge of why your people should be somewhere and what pain points to alleviate, it makes the whole process You know, the value is just skyrocketed compared to somebody who's just going to give you somebody that can do the work that they think you need.

so where did the company come from? I know it came out of, some sort of business relationship or some sort of kind of, you know, direct, conversation, but where did it come from? And who was your first customer? Yeah.

[00:09:53] Luis: Yeah. Sothe company was born out of like, essentially the, a consulting engagement for the company,authentic startup that I work with. On and off. I mean, I knew the founders from a couple of different experiences. I was part of a company called win a few years ago that got acquired by a larger company called opportune, a great opportunities, not public company, great, amazing, transformative company.

and the folks that I kind of linked up with there were a couple of founders of a couple of different ventures. Then they, we all subsequently came, you know, left and started our sort of other things. and. The company's called Autopay. It's a great payments company. the founders, Maxline and Andy Burke, great friends of mine, shout out to them.

they were starting this new thing, and they had, as always is the case, a need for pretty specific, at that point, DevOps help. So this was started out as a kind of consulting, DevOps consulting situation. Essentially, There was a, there was an app in place. There was ways in which this thing was going live.

There was ways in which that could improve on. They just kind of needed a general management of their cloud environment, which is something I had done as a consultant a few times. But what started to become apparent, you know, in the midst of that engagement, and I think in part because this is a key point, there was a relationship that was in that case a little closer than just a regular consultant.

I knew these folks, you know, we have trust, I understood where they wanted to go and I understood quickly that their needs were a little bit more specialized. And so, the scenario is this, right? You have a company that grows fast, a company that needs to go live with several things at the same time.

It is a startup, so it doesn't have a very well defined business model. Everything is scarce, particularly time, resources, all that stuff. But there are certain things because of the space of your company. In this case, it was like, at that point, a payments focused company. So there were very high bars of regulation you had to clear very quickly.

So that's happened a lot, right? That's what's kind of spawned a whole new category of companies that help companies that grow very fast, that are not well established companies, but they're doing complex things in spaces that are highly regulated. This was kind of the profile of this company.and so, when you're in that environment, I mean, it's quickly becoming normal that very different kinds of companies go through audit very quickly.

Nowadays, it's coming, it's becoming like something that 10 years ago, it wasn't the case, right? If you could go very quickly, it could be many years before you had to do something like this. But today you want to start, or in these, the last few years, if you want to start a company in a highly regulated space, even if you yourself are not mature as a company, your partners, your vendors, whoever you, your whole environment has a high bar.

[00:12:32] Jay: Right.

[00:12:36] Luis: to conform to. And so theirs was very particular and it kind of overlapped with how to manage their cloud, but it was much more specialized specific. And, you know, at that point, I had been before that a head of engineering at a similar situation where I was on the other end of that same conundrum.

This was a health tech company. So in health tech, all kinds of regulations around the privacy of data, many different things you have to do and really think about even before you really have a company, you have to think about these things. And so. I thought, well, maybe there's an opportunity here to not just provide a service the way I have before, that is kind of like general DevOps or, you know, general security or general compliance, but to kind of put a lot of those pieces together in a, something that felt more like a product.

and so that's kind of where the platform was born out of that one particular. Case, which was somebody who needed to become out of ready very quickly, didn't have the time, didn't have the means, and had a few different kind categories of needs at the same time. so there was this. Overlapping between compliance itself, like going through a formal audit, proving that you've, you know, checked a few boxes and so on, really proving it.

Also beefing up your security is often part of audits. It's not exactly the same, but they kind of go hand in hand, as you know, very well. and, some of that have all of that really kind of is also closely overlapping with. Security and DevOps, and some of the principles of DevOps culture. And so that was the first company I encountered that I started kind of building a beta platform around that.

And I approached it in this very specific way. I said, okay, so I'm solving a problem for a customer that has this very specific need. It's a pretty acute pain point. So, in that case, there's no, it's not a lot of like soul searching you have to do about what the problem is and what the problem needs to be solved.

And there's a time constraint, like you need to do this fast. But I also said, I'm also in this case, the person offering the service. So part of my philosophy was, how can I build this thing in such a way that not only will the person on the other end of the equation, the person for whom the problem is getting solved passively, let's say gets benefit, but how can this also help me perform the service, better, right, which I think is something that a lot of companies that have been successful have, the empathy for the customer obsession with a customer and, you know, customer needs coming first.

Are super important. The expertise that you have to develop as you offer a service needs to be embedded in the product. The product kind of has to be like the product. I think good products are born out of the mastery of a service. Right? and then what started happening after that, of course, that was the 1st customer.

And then I started finding, of course. Other customers that were fitting a similar profile, and typically it was folks who either had to go through. All this because of the nature of the industry they were in and they were not prepared. And in some cases, like, for example, more recent cases, there's, somebody was,had to go through these newly invented standards.

this was, something very useful for us, very interesting for us. So, if you work, for example, with a lot of, What's going on to go back to the theme of like changing technology as new spaces and technology get created, there's existing standards that everyone knows about. There's SOC 2, there's ISO, right?

These are like well established standards that are multi industry, but as new industries and spaces get created, those standards themselves need to evolve. Sometimes they don't evolve fast enough. And sometimes brand new standards are created for new industries that are appearing so that are very specific to what that industry is about.

And this was the case of a different customer. They were said, okay, we have this particular partner. They've created a whole new standard of security. It is not one of the existing ones. It's kind of a custom thing that they're creating because it's such a big vendor in the space where they work that if you want to work with them, you need to conform.

And that was a kind of a different angle, right? Okay. It's not somebody who needs to go through to a standard that we all know. I've seen before. It has commonalities in terms of principles that the standard is about, you know, the security fundamentals are kind of the same in both standards. There's all these divergences that are industry specific.

And that became kind of a moment of insight for us. We said, okay, maybe There's all these companies that are having to conform to the existing compliance world and all of those standards that we all know very well, we've all gone through those audits at some point or another, whether we've been consultants for them or our companies have done it, but then there are these other adjacent and sometimes new standards that are popping up because of innovation that we can also help service.

And that's kind of like where we started finding a niche.

And where did you start finding customers? Yeah. I mean, the early, journey of finding customers is, I mean, it's fun if you are somebody who has had experience as a consultant, there is like a, probably a network you've built, which is my case, a network you've built for folks, you've, you know, You've done specific things for in the past, you know, you've had successful partnerships doing, you know, discreet things, you know, you did, I don't know, 1 type of job for somebody, another type of job for somebody else.

And I started out just tapping that very close network 1st. Because. You, if you do, if you have the ability to do that, you have the luxury of a little bit more, patience, first of all, because, you know, folks will be able to understand that if you are actually setting your mind, your sights on developing a product, that there'll be a lot of imperfections in that product.

and if the need for the product is acute enough, that'll be kind of a test of whether you can really use the product, right? That is obviously the, you know, in the venture capital world, that's what you would call product market fit, right? Right. The pain is so acute that even if you get this imperfect thing to deal with it, you'll still, you still use this imperfect thing.

And so I feel like the early, you know, talk about the very first few people I started doing this with,there was a built in trust from previous. You know, previous successful partnerships, and an understanding that went a little bit beyond what a regular consultant would have of their businesses and their missions.

and that was the very 1st, you know, very 1st approach, you know, kind of almost like word of mouth, almost like friends and family, you know, 

[00:18:40] Jay: Yep. 

[00:18:41] Luis: you know, 1 degree of separation after that. You have to really change how you do this because, you know, that you'll tap that network out pretty quickly.

and depending on what your growth goals look like, you'll have to professionalize your operation. So after that, my co founder, who is a great marketer had all kinds of ideas and tactics. but we haven't veered too far away from that original DNA. particularly since we're still early of having to have this almost like, I think now beyond beta, but very close relationship with our customers, what we're really.

We really are collaborating with them to the extent that it's possible in, in building that product. that too, right, is a risk. You can't do too much of that. Like, you know, you have to have kind of a separation as well. And you have to have, it isn't the best approach if you want to really test whether something you're building has, there's demand for.

If the network that you expose that thing to is only a network of people who like you. because you have to know what doesn't work quick as well. and, I think I, but I do think it's useful if you can early stages of a product journey or offer a service that you. That you can get that kind of buy-in because it'll be pretty invaluable customer feedback that is very difficult to get in other ways.

you know, that's just like our experience.

[00:19:58] Jay: no, that makes sense. if you had to start over again tomorrow 1 for you, to kick this off?

[00:20:09] Luis: Yeah, that's a great question. I mean, that's such an important in, I think as an entrepreneur you have to ask yourself that question, like kind of often. I almost like periodically you have to check in with yourself and be like, okay, what have I learned in the last quarter, a couple of quarters?

and how will that inform how I do things going forward? In our case, I think. there were things we know we did well, and there's things that we know we kind of missed on and couldn't prove. And I think on the doing well things, I think the concrete answer is that I would do one thing I did, but I would do it a little bit faster, which means that I think it's really important when you're thinking about, you know, your own operation and your own, discipline as an entrepreneur, that you put the thing you want to put out in the world, right?

Which you have to accept as a rough draft. you have to be ready for it being dealt with as a rough draft, right? But you have to, you have, speed is really key. So, I would have put the first version of the product that's been iterated on many times since then. But I would endeavor to put that in front of folks, the harshest possible, folks, faster than I even did.

We did it relatively fast, but we probably could have been even faster at that.not just because the, that feedback was useful, you know, in, in just in helping us improve the product, but also because you have to kind of build the discipline and almost like the thick skin to go through that journey as quickly as you can.

Because you have, you'll have multiple moments when you'll, that rough draft will have to be, sharpened,and you have to cut things out and let things go, you know, you'll have your own assumptions tested. So I would say. Really to anybody who's starting this journey that I think if you, the fastest you can start to get that kind of feedback and start to almost like get the muscle memory of going through that exercise, the better.

[00:21:56] Jay: That makes a lot of sense. I've heard that a lot. and, you know, the old, the old saying that, you know, you can't prove that something works. before it hits production, but you can, you know. Proof something doesn't work. it's about as real as it gets, right? I mean, you can't,

you can think it's the best thing in the world, but, it doesn't really matter what you think at the end of the day, right?

it's will

[00:22:13] Luis: people give you money and get value out of your product. All right. One last question, non business related.if you could do anything in the world and you knew you couldn't fail, what would it be? And I would probably, I'm very intrigued by the kind of intersection of, security, which is something I kind of work in.

and like basically energy. And so I feel like we have all these problems in creating reliable, sustainable, safe sources of energy for all of the things that we need energy for. We are increasing all the time, the amount of energy we need to exist and to do interesting things. for instance, right now, one thing that's, you know, all of us in the tech industry are kind of looking at closely is that, and particularly all of us who are in the cloud, is that our demand for, you know, servers has, ramped up very quickly, with the advent of, the kinds of AI we're using today, and it's becoming more and more commonplace that, basically folks are having a hard time finding, not just the energy to power servers, but the, the raw materials which should produce more powerful servers all the time.

So I would love to tackle that kind of supply energy supply chain problem, which I think is a multifaceted global problem. I don't know if I would, I guess I would have to know I wouldn't, I couldn't fail, but I wouldn't, you know, the odds of anybody succeeding and solving that are not very good because it's such a complex thing.

But I'd love to 

[00:23:40] Jay: percent because you can't fail. You can't

fail. So it's 100 percent chance that you'll, I love that. it's a very thought provoking answer. and kind of. Kind of just a foundational human and, you know, point, right? Like

even if it's something complex and it's all these crazy things, like at the end of the day, it's do the people have the power to do the things, literally energy to, you know, power some of these big dreams we have. so really interesting answer. I liked that a lot. All right. Louisa, people want to learn more about you or about, your product, where do they find you? Where do they find it? And, you know, how do they get in touch? so much.

[00:24:18] Luis: Yeah, so we are at capablanca. io is our website. you can just shoot me an email at louise at capablanca. io. or, you know, find me on LinkedIn, which is typically where I'm mostly at. And just, shoot me a note, happy to talk to anybody.

[00:24:32] Jay: Where did the name come from, by the way?

[00:24:35] Luis: Yeah, there's a little bit of a story there. I, it's actually a name derived from chess. there's a very famous chess player from originally from Cuba. that was their last name. And, among the, they're very good at many things, but they were very good. It was called,the kind of the end game, how to finish a match.

and so I thought there was an interesting, you know, resonance there where the kind of like the way in which you have to think ahead and be strategic,when you think about your own security and cloud posture. And how you have to think about when you think about a chess challenge.

[00:25:03] Jay: Love that. All right. Well, Luis, it was fantastic getting to spend some time with your brother. let's stay in touch. Be good. Enjoy your weekend. And, we'll talk again soon, all right?

Thanks for being on. 

[00:25:12] Luis: you so much. Thank you so much.

[00:25:14] Jay: See ya. 

​