A small firm's security should arrive as a decision its owner can understand, afford and carry out on an ordinary working day.
I am chief product officer of Calvessin Security, a Lisbon-based company that protects small organisations in Portugal, Spain and Ireland. Our customers employ between five and 250 people: dental clinics, accountancy practices, architecture studios, workshops and charities. In June 2026 we served 33,800 paying organisations and about 412,000 user accounts, with annual recurring revenue of €64 million. Around 60 per cent of revenue arrives through some 940 independent IT partners. I lead 92 people in product management, design, research and product writing, and I report to our co-founder and chief executive. Engineering reports to the chief technology officer, and the 24-hour alert desk to the chief operating officer.
My first job, in September 2000, was fixing computers for small offices around Coimbra. Most of the security failures I saw there were not technical mysteries. A backup nobody had tested, a password taped beneath a keyboard and an error message a receptionist could not interpret did more harm than any skilled intruder. Later work in usability research, backup software and shift-scheduling apps kept bringing me back to the same person: competent in her own trade, short of time, and asked by software to make a decision nobody had prepared her for.
Three decisions describe how I work. We introduced a flat plan for the smallest firms knowing it would lower revenue from some existing customers. We launched supplier bank-detail checks as warnings rather than automatic payment blocks. We allowed an automated assistant to explain alerts but not to close them. Each choice disappointed a colleague, a partner or an investor whose argument was reasonable. I describe the cost alongside the result, because a board reading a product decision needs both.
A flat price for firms under nine people
The Micro plan, at €39 a month for up to eight users, raised trial-to-paid conversion among the smallest firms from 11 to 19 per cent. It also removed about €0.94 million of annualised revenue when 2,350 existing customers moved down.
Warnings that preceded 61 confirmed fraud attempts
In its first twelve months the supplier bank-detail check flagged 4,860 changes. After calling their suppliers, customers stopped €2.7 million of misdirected invoices. Nine customers paid despite the warning, and three in four early flags were legitimate changes.
An assistant confined to fourteen alert types
Analysts graded 2,400 automated explanations before release. The material error rate fell from 7.9 to 2.6 per cent once the assistant was limited to alert types with written playbooks. The other 24 types still carry text our analysts wrote.
Current focus
I am preparing our owner dashboard, alert messages and partner console for a full external accessibility review, and deciding which of the 24 remaining alert types deserve an automated explanation and which should stay human-written.
Conversations I welcome
I would welcome a first non-executive role, around eighteen days a year, with a European company whose customers are mostly non-specialists, subject to my chief executive's consent and a review of partner and supplier relationships.
