Mariano Núñez

He was twelve when he watched a movie about hackers and asked his mother to buy him an 800-page computer security book in English, a language he still did not fully understand. He read the entire thing. That boy eventually founded Onapsis, the company that built an entire category within cybersecurity from scratch and today protects the SAP and Oracle systems of some of the world’s largest organizations.

The beginning: a movie, a book and a “no” at sixteen

Núñez’s path into cybersecurity did not begin at a university. It started with a movie he watched as a child and continued with a book that caught his attention at a street stand during a family trip. He devoured it as a preteen.

Then came the less romantic part. There was an Argentine security researcher he admired, so he wrote asking for a job. The answer was no: he was sixteen. He tried again at eighteen, this time offering to work for free. They hired him and paid him. He has never left the field since.

The discovery that became a company

In that first job as an ethical hacker, he was assigned to audit a client’s application and came across software he did not know: SAP. As he researched it, he understood two things at once. First, it was one of the most critical platforms in the corporate world, handling an enormous share of global transactions. Second, and more surprisingly, almost nobody in the security community was looking at it.

With no previous experience in the field, he found serious vulnerabilities that nobody had reported.

That mismatch —an essential system receiving almost no security attention— became the starting point. In 2009, he founded Onapsis with Víctor Montero and Juan Pablo Pérez Etchegoyen. All three came from middle-class Argentine families, with no network of contacts and no access to capital. They started in one partner’s bedroom in Buenos Aires, with no air conditioning in summer and no heating in winter.

One hundred rejections before the first yes

The first customer to buy a product license, in 2010, was the U.S. Army. That did not make raising investment capital any easier.

Núñez says their first presentations to U.S. investment funds produced around one hundred rejections: investors and security experts repeatedly told them that protecting business systems was not a real problem.

Moving to the United States added another layer of difficulty. He arrived as a first-time immigrant CEO, with no contacts or network, and had to build sales teams from scratch in a different cultural environment.

From that period, he developed a firm opinion about a piece of advice he often heard and now considers empty: fake it until you make it. His position is the opposite —be as genuine as possible and surround yourself with honest people.

From research lab to market category

Before selling software, Núñez and his partners built a technical reputation. They created the first open-source penetration-testing framework for SAP and ERP systems, and Núñez discovered more than sixty vulnerabilities in SAP applications, as well as critical flaws in products from Oracle, IBM and Microsoft.

He was also the first to bring the subject to some of the industry’s biggest stages: RSA, Black Hat and SANS.

That research remains the engine of the company. Onapsis Research Labs has been responsible for discoveries that made cybersecurity headlines, with names such as RECON, ICMAD, P4CHAINS, 10KBLAZE and, more recently, the SAP zero-day identified as CVE-2025-31324.

His explanation for why the company stood out is not about the product but about the category: they did not simply create a company; they created a market segment that had not existed before —the protection of business-critical applications.

The numbers behind the growth

By 2014, the company already had offices in Boston and Germany. In 2019, it made its first acquisition, German company Virtual Forge, to strengthen its European position. Núñez admits that the purchase had not been planned and that the fit turned out to be more complementary than expected.

By early 2020, Onapsis had around 300 customers —including IBM, Microsoft, Verizon, Siemens, Sony and the U.S. Army itself— and 330 employees, 40 percent of them based in Argentina. Revenue measured in U.S. dollars had been growing by roughly 80 percent a year for five consecutive years.

The company had raised around 63 million dollars since its founding, including 31 million in its 2018 Series C round. Business media listed it among the Argentine companies with the potential to exceed a billion-dollar valuation, and Núñez himself said at the time that he was designing the business with an eventual public offering in mind.

In 2020, the industry gave the company another recognition when it was named the year’s best vulnerability management solution at the CyberSecurity Breakthrough Awards. A year later, Bloomberg Línea included Núñez in its list of 100 Latin American entrepreneurs.

What stands out is that he never dismantled the Argentine operation. His argument was straightforward: even if salaries cost the same as in the United States, he would still keep it because Argentina’s cybersecurity talent is simply too good to ignore.

The EY award and the international circuit

In June 2018, at a gala at the Westin Boston Waterfront, Núñez received EY’s Entrepreneur Of The Year award for the New England region, selected by an independent panel of judges.

The program, which has existed since 1986, had previously recognized founders such as Howard Schultz, Pierre Omidyar, Reid Hoffman and Hamdi Ulukaya. Winning the regional award made him eligible to compete for the U.S. national honor.

Other distinctions followed, including recognition by MIT as one of its innovators under 35, the Boston Business Journal 40 Under 40 and his selection for the Black Hat Review Board, the committee that evaluates which research is accepted into one of the world’s most important cybersecurity conferences.

Giving something back

In 2017, the company launched Onapsis Cares, its community impact program. Its most interesting element is the internship program: instead of recruiting from elite universities, as much of the industry does, the program accepts only applicants from low-income communities in Argentina, who join the company’s largest research and development center.

In 2019, Onapsis made another unusual decision: it stopped spending money on conference merchandise and redirected that budget toward donations. In 2020 alone, it contributed more than 40,000 dollars to organizations including the Breast Cancer Research Foundation, the American Foundation for Suicide Prevention, Feeding America and UNICEF.

Behind that is a conviction Núñez expresses without embellishment: he believes meritocracy is, to a large extent, an illusion because opportunities are not distributed equally and success does not depend on effort alone.

If he could build a movement, he says, it would combine mentorship, education and employment to help level the playing field.

How he thinks about leadership

Núñez identifies three traits as decisive in his journey: resilience, perseverance and integrity. He associates the first with the years when money was scarce, team members were leaving for other companies and a pandemic arrived along the way. The second is tied to those one hundred investor rejections. The third is about holding firm principles when uncomfortable decisions have to be made.

His advice to founders on financing is more nuanced than the usual startup rhetoric: raising capital is not merely a business decision but also a life decision, because it introduces a particular logic of growth and returns into the company. He recommends bootstrapping for a while and gaining some traction before raising a first round, which gives founders a stronger negotiating position.

When asked about the most common mistake first-time CEOs make, his answer is short: they underestimate how much things cost and how long they take. Successes that appear to happen overnight almost never do.

To sustain the pace, he relies on concrete routines. He meditates, works out and takes vacations seriously: he turns off email and work apps on his phone and tells people to call only if something is urgent. His logic is that checking messages while resting means the brain never actually stops working.

What remains

The trajectory is unusual even within Argentina’s entrepreneurial ecosystem: a technical researcher who identified a blind spot in the industry, documented it publicly when almost nobody was paying attention and then built a global company around that discovery, headquartered in Boston with its operational heart in Buenos Aires.

He lives in the United States with his wife and daughter, says Lionel Messi is the person he would most like to have lunch with, and continues to argue that what Onapsis does from Argentina is something nobody else in the world is doing.