Benjamin Netter and the trouble with a perfectly good password

Benjamin Netter had been preparing for an ingenious criminal. At October, the European business-lending platform he co-founded, he was responsible for software through which considerable sums of money passed. He pictured someone discovering a clever weakness in the machinery. Then an employee received a phishing email and handed over a password. The criminal had found a much shorter queue.

The incident is the hinge in Netter’s account of founding Riot. His team had been spending time and money defending the platform. An attacker went through a colleague instead. There is a particular embarrassment in discovering that a problem has ignored the elegant solution you built for it. Netter’s response was to make something else.

He began with a test: imitate the attack and see who would fall for it. In his telling, roughly a fifth of the company did. The finance chief clicked first. A job title, it appeared, offered little protection against a plausible message. For a developer looking for a useful problem, this was an uncomfortable but persuasive demonstration.

A browser window to somewhere else

Years before he was rehearsing cyberattacks, Netter was making the internet a pleasant place to get lost. His early projects included a travel planner built with Foursquare data. In 2011, it won the company’s global hackathon. Type in a city and the app assembled an itinerary for a two-day visit, turning a collection of recommendations into a weekend someone could actually use.

It was an early example of a recurring preference: take scattered information and give someone a simple next action. Travel planning is full of tiny decisions. Where to go, what fits together, what to leave out. Software could do some of that sorting before the traveller had even packed.

Then came Somewhere. By 2014, Netter had built a website that let visitors wander through destinations using other people’s Instagram photographs. One button delivered another place. A desk could acquire a view of Normandy, the Seychelles or a rather less desk-like corner of the planet. The proposition was wonderfully economical: press here to wish you were elsewhere.

Behind that modest invitation was some deliberate editing. Netter gathered places into a database and used a script to collect photographs. Facial recognition screened out selfies. The scenery was allowed to be the subject. He was also working on Tripovore, a travel-planning website. These were products about helping people discover things, with much of the arranging concealed behind the interface.

His own founder biography supplies an earlier, less orderly episode. At 19, he says, he built a Facebook app that reached 500,000 users in a week. His first web server failed under the attention. Success had arrived with a useful technical lesson and a broken server attached. Nobody needed to invent an exercise in scaling.

When the code carried other people’s money

Netter studied at EPITECH and spent about a year studying artificial intelligence at Concordia in Montreal. His work moved through fashion and travel before finance. The sectors changed; the habit of building things remained. Cybersecurity would eventually put his technical background close to the centre of the business, but he had already spent years applying it elsewhere.

He met Olivier Goy through Partech and joined the venture that became October, originally called Lendix. The company started in 2014, making loans available to European small businesses online. Netter supplied technical experience to a business in which a software mistake could have consequences far beyond an untidy screen.

In 2017, he described reviewing every line of code headed for production. Even tests received extensive scrutiny. He talked about the risk of sending millions of euros to the wrong bank account. A lending platform provided a fairly convincing argument for taking one’s time. The romantic picture of a startup shipping new code every few minutes had to accommodate the less romantic business of checking it.

He was already trying to delegate. Development and design had moved off his personal list; hiring, reviews and managing projects remained. His advice about recruiting developers was that they needed to feel challenged. A demanding interview could tell candidates something useful about the work waiting behind it. Later, his responsibilities at October included the chief product officer role.

“The best advice I ever received is to start small.”

Benjamin Netter, 2020

A side project with an unusually good demonstration

The phishing incident supplied a problem he could reproduce. Instead of asking colleagues whether they understood cybersecurity, he could watch what happened when a convincing message arrived. The distinction mattered commercially, too. A demonstration gave another technology leader something concrete to react to. It is difficult to postpone a weakness after seeing it operate.

Riot began alongside his existing work. Netter has described coding in the early morning and using Firebase, partly because a side project gave him an excuse to try it. Other technology chiefs wanted to test the result. He applied to Y Combinator, and Riot joined its Winter 2020 batch. A practical tool for his own workplace had acquired a route into other workplaces.

The early business was deliberately legible. In April 2020, Netter described a per-employee subscription and an initial reliance on the press and personal networks to find users. He argued for launching a small product quickly and simplifying the pitch. There was little point spending months polishing something before discovering whether anyone wanted it.

He also admitted he had previously underestimated the importance of a good team. That observation sits neatly beside the product’s origin. In both cases, the developer’s attention was moving beyond the thing he could build himself. A company would depend on the people around the software, whether they were making it, buying it or opening the morning’s email.

Albert would like a word

Riot’s answer developed a character: Albert, a cybersecurity companion that talks to employees. In a 2023 conversation, Netter explained how Albert helped make onboarding and training easier to complete. Instructions that had previously lived in a long tutorial could become an exchange. The software adopted the manners of a colleague with a specific question.

That approach makes sense when the obstacle is attention. An employee has a job to do, and a training module competes with it. Riot brought courses into tools such as Slack and Microsoft Teams. Netter discussed completion rates as a measure he watched closely. The design problem included persuading someone to finish, rather than merely proving a course had been sent.

The product also moved from spotting trouble to helping correct it. If a user lacked two-factor authentication, a conversation could guide them through enabling it. If their details appeared in a breach, the explanation could connect that event to the risks they faced. The useful unit was a person taking an action, not a warning left sitting on a dashboard.

Netter’s account of attackers is similarly practical. They take routes that work and can be repeated. A company may spend heavily on a complicated system while leaving simpler approaches available. His own encounter with that imbalance gives Riot’s argument its force. He had been the customer who thought most carefully about the machinery.

The founder steps away from the keyboard

Building Riot also required a change in Netter’s daily work. Louis Cibot became his co-founder and chief technology officer. Netter has described Cibot encouraging him to leave the coding to the technical team. For someone accustomed to examining what went into production, that was a substantial redistribution of responsibility.

The chief executive’s job brought unfamiliar disciplines, including marketing, and a harder hiring question: how do you judge expertise in work you have never done? His approach was to learn enough to recognise when a candidate could teach him something. The developer’s instinct survived in another form, looking at repetitive office processes and wondering what could be automated.

There is a pleasing complication here. A founder who built a company around human behaviour still likes systems, technical competence and execution. In an April 2026 podcast, he discussed seeking technical approaches even in sales recruitment and his distaste for internal politics. The interest is in getting a complicated operation to work. People, inconveniently, remain essential to the operation.

Paris, with room for the rest of Europe

By February 2025, Riot announced a $30 million Series B led by Left Lane Capital, with existing investors participating. The company said its annual revenue had passed $10 million in 2024. Netter set out an ambition to protect more than ten million people by 2027. A target that size would require the company around the product to change again.

Its European expansion offered a revealing choice. In February 2026, Riot was recruiting people for overseas markets and bringing them to Paris, rather than opening a separate office in each country. The company reported 140 employees at that point. Its headquarters occupied a former distillery near the canal Saint-Martin. The international business would, for now, share a roof.

Netter called the attraction a “French Dream”. The plan included help with relocation and French lessons. Italy was already part of the expansion; Spain and the United Kingdom were next markets under discussion. The arrangement gave recruits proximity to the founders and other teams, while asking Paris to do some of the recruiting work.

It is a long way from a travel website’s button, though there is a family resemblance. Netter keeps working on the distance between information and action. A destination becomes an itinerary. A security warning becomes a conversation. A phishing email becomes a company. The question he encountered at October still travels well: what will a person actually do when the message arrives?