A respectable logo can have a disreputable evening. Copy it onto a false account, add a plausible offer, and the reputation a company spent years earning becomes somebody else’s sales pitch. Fábio Ramos has built much of his working life around that unpleasant exchange. His subject is the space where a business’s name travels beyond its control, meeting customers, impostors and the occasional very convincing lie.
Ramos, Axur’s founder and its CEO at the time of its acquisition, has followed that problem across products and borders. Infoblox completed the purchase on May 5, 2026. Axur’s current English-language author biography identifies him as Senior Director of Product at Infoblox. The title has changed; the question running through his public work remains practical. Once you have spotted the danger, what can you actually do about it?
The longer journey began in Porto Alegre
Long before the acquisition, there was a sales office in New York. In 2008, Ramos was explaining Axur’s American expansion while insisting that his life remained in Porto Alegre. The overseas office began operating in April, alongside the launch of Axur ISMS, software for implementing and managing ISO 27001. Security then arrived wearing the rather sober suit of risk management and compliance.
The commercial reasoning was candid. Ramos thought Brazilian software faced a credibility problem abroad. An American presence could help with distribution and partnerships in other markets. He also welcomed the directness of doing business in the United States. There is a pleasingly ordinary detail in his account: international expansion chiefly meant longer journeys. The grand strategy still had to fit inside a suitcase.
An older connection reaches further back into internet culture. Francisco Milagres remembers knowing Ramos through the era of bulletin board systems and IRC. He later worked alongside him at Axur, and the company became the first invoiced customer of Milagres’s Mirach Ventures. Their connection gives the corporate history a human scale: familiar people, changing ventures, and relationships that outlast individual jobs.
The borrowed name, the real customer
By 2021, Ramos was explaining security through the customer’s predicament. Criminals could borrow a company’s identity to reach people who trusted it. A familiar brand became the invitation to a transaction whose proceeds went elsewhere. For Ramos, the responsibility of the business extended into that encounter, even when the fraudulent page or account sat outside its own systems.
He wanted protection to become available to medium-sized and smaller companies, too. Education mattered, he argued, but developing the judgment to recognise fraud could take generations. In the meantime, the work of finding signals, assessing them and responding demanded automation. His enthusiasm for artificial intelligence was already attached to that labour problem in 2021.
His public teaching kept returning to the same awkward territory. At Axur Summit in 2022, his session for financial institutions covered phishing, fake profiles, false apps and digital fraud. Another discussion with Conviso’s Wagner Elias connected secure development with protecting data and monitoring exposed code. The audience might change from bankers to software teams; the exposed edges of the business kept providing the agenda.
“Os criminosos utilizam as marcas, as empresas, como isca para atingir os consumidores.”
Fábio Ramos, 2021
“Criminals use brands and companies as bait to reach consumers.” Translation.
A research team with a one-year assignment
Ramos’s ambitions for Axur included the people producing its intelligence. When Thiago Bordini joined in March 2021, Ramos gave him a year to build a cyber threat intelligence team recognised across Latin America. Bordini’s later account describes a brief that included researchers who published and speakers whom others sought out. The company wanted people whose work could stand up in public.
That is a revealing way to specify a team. Publication invites questions; speaking invites an audience to ask them aloud. The ambition placed expertise alongside the software, giving the business people who could explain what they were seeing. In his farewell, Bordini remembered the learning and the quality of the discussions as well as the assignment itself.
Mauricio Garcia offers a more affectionate portrait. After years at Axur, he described Ramos as someone who had given him opportunities and become a friend. He recalled an early conviction about building products while others thought in services. His tribute included a teasing Portuguese description, “maluco”. Ramos answered warmly, thanking him for the trust even when the ideas had seemed a little mad. A business relationship had acquired the licence to tease.
Funding the distance
The international ambition acquired another instrument in July 2023: a Series B round with Igah Ventures as sole investor. The amount was undisclosed. Ramos said the money would support product development and expansion of the international team. DGF Ventures had invested in the earlier Series A in 2019. The successive rounds belonged to a business already serving customers rather than waiting for its first proof of demand.
The 2023 picture was specific: roughly 600 clients and about 30 percent of revenue coming from abroad, mainly elsewhere in Latin America. Axur wanted to pursue customers in Europe, Asia and the United States. Those figures describe that moment, rather than a permanent company size. They show how far the international effort had travelled since the New York office, and how much territory remained on the map.
Ramos also participated in the surrounding investment community. His reported interests included Ventiur.net, WOW Aceleradora and TiqueTaque, where he was described as board chairman. Alongside his own operating job, he had a place in the smaller network through which founders meet backers, advice circulates, and young companies find their next introduction.
A megaphone is an odd security tool
In March 2025, Ramos turned his attention to his own industry’s manners. Allegations concerning a possible Oracle data leak had created a public argument. He wrote about the incentives surrounding that argument, asking whether security companies were helping potential victims or turning uncertainty into an opportunity to attract customers.
His concern was the advantage publicity might give an attacker. Reports, campaigns and attention could increase pressure on the targeted company, serving the criminal’s purposes along the way. He distinguished investigating an allegation from amplifying it for commercial gain. His argument did not require the reader to settle the disputed incident. It asked professionals to examine the consequences of their own behaviour.
It was a pointed intervention from someone selling security technology. The trade can profit from anxiety, which makes restraint a rather demanding commercial virtue. Ramos was proposing that the quality of the response should matter more than the volume of the announcement. A siren may attract everyone’s attention; somebody still has to decide where the fire engine goes.
The useful part comes after the alert
The same impatience appears in his product thinking. In an October 2025 discussion of continuous threat exposure management, Ramos criticised alerts that never become action. The ambition he described was a connected place for understanding exposure, deciding priorities and resolving problems. A queue of alarming messages was an inadequate destination for all that effort.
Infoblox’s purchase gave that ambition a new setting. The announced combination brings Axur’s view of external threats together with network intelligence and protective DNS. Axur looks into places such as websites, social platforms and app stores; network controls can help prevent users from reaching malicious destinations while removal is being pursued. Discovery and enforcement can inform each other.
At the acquisition’s close, Infoblox described digital risk protection services scanning more than 40 million URLs a day. That is a measure of the system’s stated scanning activity, not a count of criminals or confirmed attacks. Ramos framed the combination as a way to take the mission further internationally and connect external intelligence with deeper network context. Integration was to proceed over time.
An experiment after the acquisition
Ramos was still writing about how work might change later that May. With Jônadas Techio, he published a manifesto on human and AI agent teams, drawing on a seven-week experiment involving more than twenty people across eight Axur functions. The participants were not engineers. They were trying to make their own knowledge and methods usable by software agents.
The proposal favoured durable, reviewable company knowledge and reusable workflows. It also acknowledged a learning curve and left open how the approach would scale beyond the pilot. Publishing at that stage gave the work the character of an experiment with consequences still to be discovered. The acquisition had scarcely closed before Ramos was discussing another way to organise the work inside the company.
Home appears in the small replies
There is a quieter example of the connection to Rio Grande do Sul. In May 2024, Ramos shared an Axur update about removing fraud associated with donations to the state. The company reported 205 resolved cases, divided among phishing, false social accounts and brand misuse. His own accompanying message was brief: “Continuamos na escuta!” It means, approximately, that they were still listening.
Here the familiar categories acquired a local purpose. A false account could divert generosity as readily as a shopping payment. For a career so often described through international offices, funding and technology, this was a concrete use of the same machinery close to home. The work had an address even when the software could travel.
Ramos’s public story runs through those different scales: an individual fooled by a familiar name, a research team given an ambitious brief, a Brazilian company seeking foreign customers, an acquisition connecting external discovery to network defence. The recurring test is usefully unglamorous. Somewhere beyond the dashboard is a person about to click. The technology earns its keep in what happens next.