Ferruh Mavituna and the trouble with almost right

The machine had finished. Ferruh Mavituna still had work to do. As a penetration tester, he spent hours checking the results of automated security scans, sorting actual vulnerabilities from false alarms. Automation had arrived with a rather demanding chaperone: the person paid to supervise it. Somewhere in that arrangement, he thought, the division of labour had gone wrong.

He began developing Netsparker in 2006. The irritation was specific enough to become a product brief. Existing scanners could miss flaws, or announce problems that did not exist. The next tool needed to do more of the checking itself. A finding accompanied by evidence would give the person receiving it a better reason to act.

That ambition carried Mavituna from security work into company building. Netsparker became part of Invicti, where he served as CEO and now holds the title Founder & Strategic Advisor. Along the way, the founder who wanted software to require less supervision discovered how much attention a growing organization requires.

A useful way to get hired

Long before the investment announcements, there was a young freelancer writing software and working on web security. In January 2004, Mavituna described himself as a technical high school graduate who had started working in the internet sector during secondary school. His education continued through reading, research, experiments, development and sharing what he learned.

One early encounter made that last activity unusually practical. While researching something for a business he worked with, he discovered a vulnerability at an overseas company and reported it. Correspondence followed. Eventually, so did an offer of work. He needed help understanding the proposed arrangement; a lawyer associated with the publication interviewing him provided assistance.

It is a pleasingly unceremonious entrance into a profession. Find something wrong, tell the people responsible, become useful to them. Mavituna also described a long list of things to read, investigate and learn, with little expectation of reaching its end. Curiosity, in this account, came with a permanent backlog.

Three years, then a company

The move to Britain began with a job advertisement for a penetration tester. Mavituna applied, travelled to London for an interview and joined a security team. About a month after starting, he began developing Netsparker. He later described working on it intermittently for approximately three years.

The route to a business ran through other people trying the software. Colleagues liked it and began using it. With backing from three British investors, he left his job and established a company. Three technical colleagues in Turkey joined the team. By 2010, he was working in Britain while the rest of the team was in Turkey.

His early pitch had the confidence of an engineer willing to surrender the microphone to a test. Potential customers were asked to compare Netsparker with the software they already used. The product would have to demonstrate what it found and how it handled false positives. An existing scanner made a convenient debating opponent: it could be invited to produce its own results.

The engineer in the argument

Mavituna’s technical writing shows the same interest in work that a system leaves behind for someone else. In a 2019 essay on framework choice, he challenged the idea that a sufficiently capable developer could make the underlying framework irrelevant to security. A flaw in that foundation could compromise an otherwise carefully written application.

He pressed for secure defaults and built-in protections. Session handling, authentication and safeguards against common injection problems should receive serious attention from the people building the framework. Expecting every application developer to reconstruct those protections creates repeated opportunities for mistakes.

His argument also reached the documentation. Example code teaches habits, and simplified examples can omit checks that matter when copied into real applications. It was an argument about how tools influence behaviour, down to the small decisions made by a developer consulting a sample. The scanner founder was interested in what happened before a scan became necessary.

His research and explanations travelled beyond a company brochure. His published work includes an SQL injection cheat sheet, while the sqlmap project’s acknowledgments thank him for exchanging ideas about features. Those are modest, concrete traces of a practitioner participating in a technical community. They sit comfortably beside the conference appearances and podcast discussions.

Capital with colleagues attached

In March 2018, Netsparker announced $40 million in financing led by Turn/River Capital. The intended uses were recognizable company-building tasks: product development, sales and marketing expansion, and acquisitions. For an engineer accustomed to evaluating a tool’s performance, the business now had several other kinds of performance to improve.

Mavituna later explained that he had wanted help with connections, strategy and execution as well as funding. Turn/River brought operational experience in software businesses. The attraction was the prospect of people who could help build the machinery around the product, making the investment a choice about collaborators as well as capital.

That spring offered another measure of progress. Netsparker received a Queen’s Award for Enterprise in International Trade. The distinction recognized overseas business, with entry requirements tied to export sales and growth. For a company organized across Britain and Turkey and selling abroad, it marked a commercial achievement that a scanner benchmark alone could never describe.

The founder learns to repeat himself

As the business grew, Mavituna’s account of leadership moved toward the conditions in which other people could succeed. In 2020, he described his early emphasis on technology and innovation, followed by a growing focus on the environment and culture that would allow innovation to continue.

Hiring the right people and sharing the vision had become central responsibilities. His conclusion was compact: “Great teams make great companies.” It is the sort of sentence that looks effortless on a slide. Getting to the point where a founder organizes his own working day around it is a more substantial change.

“Great teams make great companies.”

Ferruh Mavituna · 2020

His PeopleStar podcast conversation returned to the human consequences of having done different jobs inside a company. Experience across departments could help a founder understand colleagues’ needs and the demands of their roles. Choosing people also required thinking ahead about skills the company would need as it grew.

Then came the advice about repetition: leaders should keep repeating the message. A founder’s familiarity with an idea does not automatically make it familiar to every colleague. This was a different kind of maintenance from improving a scanning engine, though it belonged to the same working organization.

Put out the fires first

Mavituna’s advice to enterprise security teams had a similar respect for the distance between a good idea and an organization capable of carrying it out. He supported moving security earlier in software development, an approach often called shifting left. He also argued that an enterprise might need a more gradual route toward it.

Start with the applications already running. Discover what exists, understand the exposure and prioritize improvements that can produce visible results. His prescription was direct: “First of all, put out the fires. Then ensure you are not creating new fires.” A longer transformation would need evidence of progress and support from management.

Application discovery mattered in its own right. In another discussion, he described the layers an inventory needed to capture: hosts, applications and their components. He also described security teams using scan results when evaluating software before purchase. The scanner had become part of a buying decision, helping people assess what they were about to bring inside.

These discussions place his product in the middle of ordinary institutional complications. Someone must know which application exists. Someone must own the repair. Someone must explain why a proposed change deserves a budget. Accurate findings can help those conversations proceed, but the conversations still require people.

The job changes; the question stays

Invicti brought together Netsparker and Acunetix in 2018. In October 2021, with Mavituna as founder and CEO, it announced a $625 million growth investment led by Summit Partners. Turn/River would remain a significant shareholder. The announcement connected the financing to product development and continued expansion.

The scale of the business was far removed from the early development project. At that point, Invicti reported more than 3,100 customers and over 800,000 websites scanned. Those figures describe the company at the time of the announcement. Behind them lay the same practical demand: security teams needed to cover growing portfolios of applications.

Mavituna subsequently moved into a Strategic Advisor role as Michael George succeeded him as CEO. The current leadership roster lists Mavituna as Founder & Strategic Advisor, with Neil Roseman as chief executive. His place in the organization now carries a different remit from running its daily operations.

On his personal website, Mavituna gives prominent space to a Steve Martin maxim about becoming too good to ignore. The attribution is right there. For someone whose early sales request was to compare the software with a competing tool, the choice feels apt. He had asked customers to pay attention to results.

His career’s most revealing detail remains the work after the machine stopped. A scan had produced an answer, and a skilled person still had to decide what that answer was worth. Mavituna saw room to make the tool more useful. Building the company meant learning, in turn, how to make room for other people.