A cybersecurity company buys another tool. Then another. Soon it has an impressive collection and a surprisingly awkward question: can anyone tell whether the whole collection works? Mauricio Benavides helped build a business around that question. In May 2025, the answer became the company’s name. Metabase Q became Batuta, the Spanish word for a conductor’s baton. An orchestra is a useful comparison. Buying another violin does little for an ensemble that cannot agree when to come in.
Benavides had spent years moving between industries where people, money and information had to cross organizational boundaries. By the time he and Louise Ireland were building a cybersecurity business, he had worked in corporate leadership, hotel distribution and payments. The recurring difficulty was familiar: getting separate parts to behave like a functioning system. Cybersecurity supplied a particularly unforgiving setting for that problem. A gap between teams could become an opening for somebody else.
His account of Batuta’s development begins with customers and the repeated difficulties their teams encountered. Technologies failed to communicate. Specialists worked through incidents. A product emerged from those encounters. Eventually, the company put that product’s name above its own door. The choice gives this founder’s story a useful starting point: the work became more specific as the business learned what customers needed.
Before the baton, the bills
Benavides’s education combined industrial engineering at Tecnológico de Monterrey with graduate business study at Cornell’s Johnson school. His professional route then took him through General Electric and into the running of businesses with international operations. The combination places him at an intersection that would recur in his later work: understanding a system’s moving parts and understanding the organization responsible for them.
In January 2008, he was appointed director general of Bancotel, the hotel voucher business. He arrived at its Madrid headquarters from the United States, where he had been a General Electric vice president. His experience included financial analysis, international transactions and market evaluation. Rafael Moreno joined the commercial leadership alongside him. Long before the endpoint console, there were hotel rooms, intermediaries and transactions to coordinate.
Rêv Worldwide appointed him CEO of Latin America in May 2012, with responsibility for partnerships, operating efficiency and management. He later served as its chief operating officer. He also founded Switch.mx, an online bill-payment platform in Mexico. These are useful details when considering his move into cybersecurity. He had worked with services whose value depended on people being able to transact. Protecting a digital service and operating one belong to the same practical conversation: whether a customer can rely on it when needed.
Switch gave that work a distinctly Mexican team. In July 2017, eight members were in San Francisco for Google Launchpad Accelerator training. Their application let people pay household service bills from a phone, computer or tablet. Benavides spoke about the pride of competing with companies from around the world. The ambition to have Mexican expertise recognized abroad was already visible, years before the cybersecurity research presentations.
He also had a pointed illustration of business friction. Describing entrepreneurship in Mexico in 2023, he recalled the circular requirements for establishing a company and opening its bank account. Paperwork asked for evidence that seemed to depend on completing another step first. The comedy was bureaucratic; the problem was operational. Making a complicated process understandable was something he spoke about as part of a founder’s job.
The cash machine makes the argument
Financial infrastructure soon gave his cybersecurity company concrete problems to investigate. In March 2021, Metabase Q announced that its Ocelot research division had identified Ploutus-I, a variant of malware targeting Itautec cash machines in Latin America. The work concerned machinery people encountered on an ordinary pavement or inside a bank. Behind the familiar screen sat software, interfaces and opportunities for criminals to interfere.
Benavides used the discovery to argue that cybercrime crossed borders while corporate defenses remained too regionally confined. He described an ambition spanning technology, education and regulation. That scope matters to his story. The research team’s findings were one part of a larger effort to change how organizations prepared and worked together. He spoke as a company founder supporting that effort; the technical discoveries belonged to the researchers doing the investigation.
That distinction is particularly clear in the company’s account of DEF CON 29 in 2021. Ocelot researcher Salvador Mendoza presented PINATA, research into an implementation weakness affecting payment-card PIN verification. Benavides framed the appearance as an opportunity to give Mexican and Latin American cybersecurity expertise international visibility. The achievement had a named researcher and a specific technical subject, rather than an abstract claim about regional potential.
The same period included cybersecurity education with the Mexican Consulate in Las Vegas. A workshop led by Daniel Aldrete put participants through a simulated cybercrisis. Research and rehearsal served different purposes: one exposed a weakness; the other gave people a chance to practice making decisions. Together, they made the regional ambition tangible. Expertise could be developed, demonstrated and shared.
“Cybersecurity is borderless”
Mauricio Benavides, 2024
Sixteen banks, ten countries, one rehearsal
Cooperation also took an institutional form. Through an agreement with Mexico’s Consejo Coordinador Empresarial, Metabase Q pursued a framework for working with authorities and encouraging information sharing across sectors. Benavides’s stated concern was prevention: organizations needed ways to prepare together before an incident forced a hurried introduction. The work placed cybersecurity alongside public policy and the conditions for a digital economy to function.
There is an organizational problem underneath that ambition. A company can improve its own procedures, but its suppliers, customers and counterparties remain part of the environment in which it operates. Benavides’s approach treated those relationships as a reason to build cooperation. The same instinct that appears in endpoint orchestration appears here at a different scale: separate participants need a workable arrangement for exchanging information and acting on it.
In 2025, that idea became a banking exercise in Bogotá with FELABAN, the Latin American banking federation. Batuta described participants from 16 banks across ten countries working through a cybersecurity incident challenge. Benavides joined Enrique Leiva, Dan Regalado and Jesús Domínguez in guiding the session. The participants used the platform in a simulated incident to work on visibility, mitigation and control.
A rehearsal offers something a presentation cannot: decisions made under a shared scenario. The exercise connected his financial-services background with the practical work of cybersecurity teams. It also gave regional cooperation a manageable scale. Sixteen banks could spend time on the same problem before any real emergency required them to do so. The conference badge, for once, came with homework.
His participation extended to policy and executive discussions. A June 2025 Mexico City agenda placed him on a financial-sector threats panel with representatives from the FBI, Mexico’s security authorities and Mastercard, moderated by Cisco’s Adriana Servin. Different responsibilities were represented around the same subject. For a founder advocating cooperation, that was the relevant gathering: people who would otherwise encounter the risk through different institutional windows.
The product gets the nameplate
Meanwhile, Batuta had become a software business with international deployment. In September 2024, Metabase Q announced an $11 million Series A extension led by SYN Ventures. The financing brought its announced total raised to $16 million. John Watters, formerly president and chief operating officer of Mandiant, participated. At that point the company reported more than 50 enterprise customers and deployments in 45 countries.
A September 2024 snapshot. Customer and deployment figures were company-reported; funding is capital raised.
The platform brought IT and cybersecurity management together around endpoints, the devices at which much of an organization’s digital activity takes place. Its functions included patch management, checking security-tool deployment and identifying unused software licenses. The commercial proposition rested on making an existing technology estate easier to see and operate. The software collection could be examined as a working arrangement.
Benavides made the reasoning explicit in a May 2025 column about endpoint management. Growing organizations, he argued, could lose sight of devices as their operations expanded. His recommendations started with an accurate inventory and centralized management, then moved through automation, training and continuous evaluation. The order is revealing. Before deciding how to protect an estate, someone has to know what is in it.
It is an operational argument with a modest starting point. A laptop, a server or another connected device may seem individually manageable. Multiplication and dispersion change the work. Benavides’s prescription placed visibility and routine reassessment close to the center of the task. Security became something an organization had to keep doing as it changed, with people and procedures participating alongside software.
The May 20 rebrand followed that focus. In his retrospective, Benavides described launching Metabase Q with Ireland and a small expert team in 2020. Their customer work helped shape the platform. When he announced the change on LinkedIn, he joked, “We hacked ourselves.” The target was their own processes and decisions. A cybersecurity founder had found a reasonably economical way to describe a corporate rethink.
The baton changes hands
On April 28, 2026, Batuta announced Federico Nan as its new CEO. Nan had spent four years with the team, most recently as chief technology officer. The announcement thanked Benavides for founding Metabase Q and developing it into Batuta. The succession marked a clear change in responsibility: the founder’s operating chapter had given way to another leader’s.
That same date, an episode of CoreFinanciero featuring Benavides was published. His conversation with Jorge Álvarez and José Antonio Quesada concerned artificial intelligence, cybersecurity and the financial system. The episode covered changing attacks, organizational weaknesses, talent and regulation in Mexico. These were familiar concerns from his earlier work, brought into a discussion about how quickly the conditions around organizations were changing.
Across this career, the interesting unit of progress is often a connection: between a researcher and an international audience, between banks rehearsing a common problem, between tools that need to cooperate. Benavides helped turn one such connection into a company’s organizing idea. Batuta’s name records the proposition neatly. An instrument can make a sound on its own. Keeping an ensemble together is a job somebody still has to do.