Andrea Carcano and the problem that followed him home

Andrea Carcano’s first computer arrived in pieces, by choice. At fourteen, he wanted to assemble it himself. His parents agreed to the experiment with a condition: if he broke something, he would be left without a computer. He researched parts in magazines and books, without the convenience of an internet connection at home. The project took about four months. Even before he had a machine, he had acquired a fairly demanding relationship with it.

Years later, that interest in the workings of things would take him into industrial facilities, where a computer might be connected to equipment rather less forgiving than a teenager’s desktop. It would also take him back to his parents’ home in Varese. There, in a room upstairs, he and his friend Moreno Carullo began building Nozomi Networks. The commute had become shorter. The problem had become considerably larger.

A computer, some magazines and four months

The boy who wanted to build the machine did not travel through school with a certificate of inevitable success. Carcano has recalled struggling in middle school and being advised toward vocational study. With his parents’ support, he chose an accounting course with a computing component, keeping open both employment and university. His enjoyment of studying grew. Eventually, he continued all the way to a doctorate.

There is a pleasing mismatch between that early assessment and the eventual academic record. It also explains why the childhood computer story is more interesting than a tale of precocious brilliance. Carcano describes wanting to understand why things worked. The slow assembly, the reading and the uncertainty over whether each component belonged in its chosen place were part of the attraction. Buying a finished answer would have skipped the enjoyable bit.

The thesis goes to work

At the University of Insubria, the interest became research. His computer-science studies moved from examining how industrial systems could be attacked toward developing ways to detect intrusions. A European scholarship helped him pursue industrial security. Professor Igor Nai Fovino encouraged the doctoral work; Alberto Trombetta supported his master’s and doctoral studies, including opportunities to gain experience outside the university. The people around the project mattered alongside the algorithms.

Carcano’s publication record captures the direction of travel. A 2009 paper explored a proof of concept for SCADA malware. Later work examined intrusion detection, critical states and filtering industrial network protocols. SCADA systems supervise physical processes. Studying their weaknesses meant asking what happened when a digital instruction reached equipment in the real world. His research was already looking past the screen.

Eni supplied a different kind of education. Carcano worked in security and spent time at production sites, encountering both the office technology team and the people responsible for operations. He learned to build relationships with industrial engineers who could be skeptical of IT visitors. A technically correct answer still needed to be useful to someone trying to keep a facility running.

He traveled through countries including Tunisia, Nigeria and Congo. The practical problems made him think again about the defensive software he had developed during his doctorate. Research that had solved a theoretical problem began to look like something he wanted beside him at work. Eni’s business was oil and gas; developing a complex software product internally was a different proposition. Carcano decided to pursue it himself.

“a lot of lateral thinking involved.”

Andrea Carcano, 2025

Upstairs, with the alarm code

He called Carullo, a friend and programmer whose abilities he admired. Carullo brought his own background in artificial-intelligence research. Their relationship had existed before the business, which gave them something more useful than matching job titles. They knew how the other person worked. In 2013, they founded Nozomi Networks.

Leaving a permanent position was harder to explain at home than the technology. Carcano remembers his mother questioning why, after the effort to help him study, he would give up an important job. The concern was practical. He had a secure position and a possible product; the possible product did not yet pay the rent.

For a while he lived in a shared apartment in Milan. When his savings could no longer support it, he moved back to his parents’ house, where the office already occupied a room in the attic. Carullo had the keys and the alarm code. An early arrival could let himself in and go upstairs to work. Venture creation, in this version, involved quite ordinary household logistics.

The two founders initially contributed €10,000 each. Consulting helped support them while they developed the business. Carcano later described the friendship as essential to surviving the changing fortunes of those years: when one founder lost confidence, the other could keep the project moving. Their partnership had to accommodate a succession of moods as well as a succession of technical problems.

Someone in the room said yes

A working product and a fundable company are separate achievements. The early fundraising brought rejection. After one unsuccessful presentation, however, someone who had attended contacted the founders and invested personally. Later, Planven’s Giovanni Canetta became an institutional investor. Carullo recalled an investor checking their customer claims directly. The names Enel and Eni became more persuasive when a telephone call confirmed them.

Enel was also an important test of the technology itself. An initial deployment at a regional control center grew into a wider rollout across the Italian power-generation operation’s regional centers, with central management at the main control room. The product’s usefulness extended beyond identifying attacks: understanding an industrial network could help operators spot communication failures or configuration changes, too.

Carcano’s ambition had a geographical component from the beginning. Reaching Silicon Valley within five years appeared in the founders’ first business plan. They arrived sooner. What attracted them included people who understood cybersecurity and investors capable of asking detailed questions about it. Technical competence on the other side of the table could make the conversation more demanding and more productive at the same time.

When he spoke to visiting Italian businesspeople in San Francisco in 2023, Carcano emphasized that the company had raised money first in Europe and later in the United States, while keeping much of its development in Italy. Crossing the Atlantic did not erase where the work had begun. His own route had depended on an Italian university, industrial experience and a research relationship that became a founding partnership.

The factory ignores the org chart

As chief product officer, Carcano’s job included carrying the customer’s perspective into Nozomi. His conference biography described that responsibility explicitly. It fits the formative experience at Eni: a security team’s categories have to survive contact with an operator’s actual environment. A camera, printer or ordinary computer may sit alongside specialized industrial technology. Connections between them complicate any tidy division of responsibility.

He has argued that cybersecurity needs to understand that whole environment. A department can draw a boundary; a connected device can communicate across it. The product question follows naturally: how can the people responsible see enough of the system to make a useful decision? Visibility becomes part of the operational work, rather than a decorative map displayed after something has gone wrong.

His stated management philosophy has a similarly practical emphasis. He dislikes finger-pointing and wants a team that shares responsibility. He also speaks about helping customers make use of the technology they already have, within limited budgets. More detection has limited value if it leaves the people receiving the information unable to act. For a founder trained to investigate systems, the customer’s working day is another system worth understanding.

His interest in AI also comes with a view of how the technology reaches people. In 2025, he pointed to the combination of more available data and greater processing power as an explanation for its progress. He expected the security analyst’s job to change, while acknowledging that AI would make mistakes. Carullo remained part of that conversation: Carcano credited his co-founder with reminding him that the underlying mathematics had a longer history than the recent excitement. Even when discussing the future, he kept returning to the research.

Two returns, one unfinished question

In January 2026, Mitsubishi Electric completed its acquisition of Nozomi Networks. Its closing disclosure put the company’s 2025 revenue at $101.709 million. The business that began upstairs had become a wholly owned subsidiary of an industrial group, with Nozomi continuing to operate independently. The corporate setting changed; the work still concerned customers running equipment across connected environments.

The following month brought a more personal return. On February 16, Carcano received an honorary degree from the University of Insubria in Como. His lecture traced the journey from Insubria to Silicon Valley and back. The institution that had supported the research was now recognizing the business built from it. He stressed the shared effort behind the company, including Carullo’s role.

Then, on July 28, Nozomi announced that Carcano would resume the CEO position he had held at the beginning. Edgard Capdevielle, who had led the intervening decade, moved to an executive advisory role. Carullo remained the technical co-founder beside him. Carcano called the moment “a new Day 1,” with AI innovation and customer outcomes central to the next phase.

There is more responsibility in that phrase than its startup cheerfulness suggests. The returning founder has a larger organization, an industrial parent and established customers depending on the product. He also has the same basic problem that once followed him home from the field: software needs to help people understand and protect the equipment they operate. The attic has served its purpose. The question still shapes the company he leads.