Security Confidential S2 E4 Matt Castonguay

Manoj Tandon: Hello everyone, welcome to another episode of Security Confidential. This is your host, Manoj Tandon, and today we are joined by our very own Matt Castonguay. Matt joins us from the wonderful city of Montreal. Matt’s been a developer, he’s a computer scientist, entrepreneur, and now a partner at Dark Rhino Security who is responsible for business development. So welcome to the show, Matt. Thanks for joining us.

Matt Castonguay: Thanks for having me.

Manoj Tandon: Hey Matt, so you’ve done a little bit of everything. So I’ve gotta ask you to start off with: are you a sales guy masquerading as a developer, or are you a developer masquerading as a sales guy? Which way?

Matt Castonguay: I think it’s a bit of both. I think I’m always going to enjoy the development background. That’s why I came through that; that’s what I did in school, that’s what I did when I was a kid. So this is definitely a lot of fun for me in understanding how things work. I can’t just accept that they work; I have to understand how they work. So the programming and the development have always been really fun. But I’m also a people person. I enjoyed doing the networking, I enjoyed doing the conferences, the trade shows, and the presentations. So I was able to merge both as I gained more experience as a developer to gain that confidence to go in and do presentations and explain that to people. So I would say at the core I am a developer, but I really enjoy sales and I really enjoy presenting and understanding what goes on behind the scenes.

Manoj Tandon: And I’ll tell you, I’m impressed with your communication skills. I have to believe that English is not your first language, right?

Matt Castonguay: That’s right.

Manoj Tandon: So is that a skill that every person growing up in Quebec is learning English well?

Matt Castonguay: Well, when I was a kid, the thing is, I played a lot of video games and spent a lot of time on the computer. Nowadays you just have a language option; you can switch anything into any language. But back then, everything was in English, so you had no choice but to learn to read some of the words in English to understand it so that you could interact with this software and play these video games. Also, when I was a kid, my dad got a job transfer and we moved to Toronto, so I ended up growing up in the Toronto area, which is a very predominantly English-speaking area. So for me, when I was a kid, I started always having to speak English. I was playing hockey and everyone on my team spoke English. Going to school, making friends, and then just everything was done in English. So I’d speak French at home and I’d speak English outside of home. For me, switching back and forth between the two is very, very natural.

Manoj Tandon: I have to say, none of us could tell.

Matt Castonguay: As you say, it’s usually until people see my name that they’re like, “Oh, what’s your background?” But usually in conversations it doesn’t usually come up.

Manoj Tandon: Your journey from developer to entrepreneur: how the heck did that take place?

Matt Castonguay: Okay, so I used to write these programs as a teenager in Visual Basic and just publish them online. Back then, there were really no search engines like you have today, there was no peer-to-peer sharing program. Essentially, it was basically along the lines of forums and things like that where you would just share the stuff that you’ve done. I learned myself, I taught myself HTML and CSS. There wasn’t really much JavaScript back then, so I taught myself how to make basic websites and things like that. And the thing is, you start by doing a website like an amateur website for a video game, for example, but then you hear of someone that needs a website and then that’s how the business side started. So I would make programs or websites for people that needed them. When I went to university, I did my degree in computer science at the University of Ottawa and I met a couple of people who were also interested in starting a business. We discussed a lot and I didn’t start anything with them, but it just gave me that boost of confidence saying, “Hey, this is doable.” Eventually, after working a couple of years in Montreal, I met a business partner that I was working with. We ended up starting a business on the side and then grew it to a full-scale company that was later acquired by Dark Rhino. So the journey was there, but from the beginning I always enjoyed building things for others and saw that there was an opportunity to make money there as well.

Manoj Tandon: It’s very rare to have people who have the technical skill set and the business savvy.

Matt Castonguay: Yeah, I started on the side while I was working on the job. I was working for a large telecommunications company and I was working there as a software engineer and it was paying the bills, but it was basically a means to an end. To get to that ability to self-sustain the business and to live off of the business, we built a content management platform, which I started from scratch. Based on what was on the market at the time, WordPress wasn’t there yet and all the other stuff like Shopify wasn’t there, so we built this intuitive tool that clients could use to make their own website. So that was kind of bridging both the technology—building something new and having fun doing it—and then having it be a viable commercial product that we could end up selling.

Manoj Tandon: For our listeners, I’d like to point out, Dark Rhino Security originally was not in the web hosting business. We acquired a company called Proteon Software, which was actually a competitor to you, Matt, right?

Matt Castonguay: That’s right.

Manoj Tandon: Subsequently, we acquired MG2 Media. You were the “M” in MG2 Media, correct?

Matt Castonguay: That’s right, exactly. Founders, exactly. So we started, we built the CMS, the Content Management System. We dabbled in a lot of different businesses: e-commerce websites, standard content websites, and then we ended up in the associations business. So managing members’ access, event registrations, online payments, recurring membership fees, and creating a sort of dashboard for the administrators to be able to delegate certain access rights to different volunteers or people who worked within the organization, for them to manage their invoicing and their billing all under one roof. That turned out to be a pretty big success and we ended up with clients in multiple countries, all on a recurring revenue basis, which was a very interesting model for us. Rather than just having one big project, you have a smaller introduction fee, but then you have a recurring fee over the years that the client uses the platform. So that’s a model that we shifted, and we shifted with the market. There’s nowadays tons of CMSs on the market with WordPress being one of the biggest ones, and Shopify and Magento in the e-commerce space, so it wasn’t worth it to compete in that space anymore, and I wouldn’t want to go back and compete in that space. Web development and programming as a whole has changed so much from what it was a decade ago. Now it’s all about having a product; it’s all about having something that’s easily and instantaneously accessible, and based more on a recurring monthly model, which is exactly what Shopify does, rather than a one lump sum and some maintenance fees afterwards.

Manoj Tandon: Right, the whole world is trending towards a much more subscription-based model rather than licensing. But when you look at one of our prior acquisitions, Proteon, which I briefly mentioned, they were built off an open-source platform called Joomla.

Matt Castonguay: That’s right.

Manoj Tandon: Then you went off and you built a competing application on your own platform. You actually built the platform; you didn’t utilize Joomla or WordPress or any of those off-the-shelf technologies. What was the decision point for that? Why not use an open-source, off-the-shelf technology?

Matt Castonguay: When we started building a platform, the biggest CMS on the market at the time was called PHP-Nuke or DotNetNuke, which was the Microsoft version of it. It was a CMS that, for its time, was very good, but very limited in the ways that you could modify the page. You were stuck: every site had the same three-column template, every site looked the same. Your customization was basically the color palette; it wasn’t much more than that. You couldn’t drag and drop things around and you couldn’t live-edit any of the pages. So we built it based on what was on the market at the time—I’m talking around 2006 or 2007. Then other CMSs came along and nowadays there are endless libraries of plugins for them. At the time, that was the solution that made sense. And if you look at today, if you look at a lot of the commercially viable, cloud-based applications, they’re all closed-source programs, but a lot of times they’re based on open-source technologies. A lot of them are running on Linux servers, which are entirely free in terms of the software approach. A lot of the modern technology is running on Node.js; it’s built in JavaScript and it’s built on free technologies, but then these companies build their own proprietary platform based on that. So the model has kind of gone full circle: where everything was closed-source, then it went to open-source, and now it’s a mixed hybrid of both.

Manoj Tandon: Yeah, and you know what we found where we acquired the company that had built the CMS on the Joomla platform? It worked and it works well even today, but if you stick purely to open-source without putting your own detailed customizations into it, you really never end up optimizing for your specific business use cases.

Matt Castonguay: That’s right. If you take the associations model—which is what we’re using here in this example—if you have a couple hundred websites running on Joomla, they might not all be on the same versions. They’re all kind of like these independent silos with their own SQL database and their own directory of files, and that gets messy from a management point of view. If you want to update things, there are tools that allow you to update multiple sites at once, but then again, there are always risks associated with that. It becomes difficult when you want to move things around or when you want to manage load balancing and things like that. The platform that we had built was SaaS—Software as a Service. Essentially, there’s only one instance of the CMS running on the server regardless of there being 20, 100, or 500 websites running on the server. Now, what that means is that you don’t have a duplicate of 500 copies of the platform. Maintenance and updates are done almost instantaneously without any downtime. There are a lot of different aspects to it, and the security aspects are tremendous.

Manoj Tandon: I look at it—and I’m a little biased there because I know a lot about security and that has been our heritage—having a single instance, being able to patch it, maintain it, and monitor it for any potential malicious threats is much easier than looking across 200 different instances. I guess for our listeners, that’s what we mean by that, or that’s what I mean by not being able to optimize for a particular use case. If you go completely open-source without adding your own special sauce to it, open-source will get you 80% of the way there out of the box, but what makes you special is that last 20%. You’re going to have to add those components in to truly have something like we’ve done in the associations market, where it’s a very focused application that is really well-geared for what those folks are doing in terms of managing their events, managing their memberships, and informing and communicating with their subscribers. And that’s kind of hard to do with the other model, which is why we’re migrating everybody off the Joomla technology into what you and Jeff actually ended up building and putting out there.

Matt Castonguay: Yeah. Now, when you are looking at—you’ve seen a plethora of technologies come to market, and I’m not just talking CMS, but in general—when you look at the technology marketplace, if you are a software developer contemplating commercializing an application like you did, what do you think are a couple of things that you should really test the weather with before you go in and say, “Okay, we’re gonna jump in all-in and we’re gonna go ahead and commercialize something”? so it used to be that you would draw up specs and then you would create mock-ups and sort of do the whole layout of the application. You can still do that once you know where you’re going with your product, but technology these days has made it so much easier to just boot something up and get a program up and running. Whether it’s a mobile app or—everything’s going web-based. There are not that many desktop-based applications anymore outside of the gaming industry, of course. So it really depends what field you’re in. I personally don’t have much experience with game development, and I think that’s a whole other branch on its own. But there are platforms like Unity now that have made game development much simpler. Essentially, when you’re looking at development these days, your software is most likely going to be web-based so that it’s easily accessible from any device. And if you have a mobile app, you’re probably communicating with the same back-end system through a REST API or something along those lines. Essentially, what you want to look at is: what are the best choices of technology I can make to develop that platform? And that usually implies: is it something that’s brand new on the market, or is it something that’s been battle-tested? There are so many platforms out there, it’s difficult to choose, but a lot of them are based on JavaScript nowadays. Essentially, that’s something to look at. Look at what back-end infrastructure you want to be using. Try to get something that’s easy to have as what we call an MVP—which is your Minimum Viable Product. Which is essentially: what can I build that has the basic features of my application, and without having to go too far into the details, test that out and see if there’s a need for it. See how well it reacts with people, and then if that’s successful, then you can build on your MVP and either go again from scratch or add upon it. But don’t try to get this perfect product out the door. I’ve seen too many startups or companies fail with that—trying to get the perfect product, having everything flawless. It’s not how things are done anymore, because then you put that out there and your customer base says, “Oh, I don’t like the switch,” or “I don’t like that,” and then you’ve just lost so much money and time on something that wasn’t necessary.

Manoj Tandon: You know what? My advice on that would be, as you termed it very appropriately, the MVP. I think your MVP should be at least 3x better than whatever the heck is already on the market if you’re gonna make a run at commercializing and being very successful with the technology that you’re developing. If you’re equal to them, I don’t know that you’re going to have a lot of success, unless your strategy is to be a follower—a low-cost follower, which in a matured market may be the thing. But where you’ve been playing, it’s been on the bleeding edge. And if you’re on the bleeding edge, you want to make sure that you maintain that distance from your competition.

Matt Castonguay: Absolutely. And so that MVP really better be pretty solid in its core, what it does relative to what the competition has to offer. I see a lot of companies—I’ve known a lot of VC-backed companies that have failed with that, where they didn’t do that self-evaluation of their own product and say, “Are we really that much better than what is out there?” And be wary of people who are not too critical. Because if you go to your immediate surroundings, they’ll support you and they might say, “Oh, that’s a good idea, it’s smart,” and then you’re not getting the exact feedback that you should be getting. And then what I’ve seen happen a lot is people come out and they say, “Well, everybody likes my product or everybody likes my website.” It’s like, “No, the people around you don’t tell you the truth.” And then you have that roadblock of creative criticism, and then some people just can’t take that. They’ll keep pushing, they’ll keep beating that dead horse rather than either stopping what they’re doing and trying something new, or changing things and going in a different direction.

Manoj Tandon: That is a very astute observation, Matt. The number of entrepreneurs that can dissociate emotionally from their creation is minimal. And that means, I think, that might be a huge contribution to failure. Because you really have to emotionally dissociate from what you’ve built and be willing to look at it as just an object. And if the market says that object is good—great. If the market is saying that object is crap—well, don’t try and keep telling the market it’s good, because the market doesn’t really care about your opinion.

Matt Castonguay: Right, exactly. That’s as well put. And I have personally, in my own experience with startups, seen that come over and over again—that typically entrepreneurs don’t want to get that kind of feedback and they get very, very emotional and guarded about it if you bring it up. Which is maybe why people around you won’t tell you the truth. But I love the startup world. I think it’s great; I think it’s good for people to just try stuff out. Obviously, try to do it at a minimal financial risk. Don’t mortgage your house trying to start something. But at the same time, don’t expect to be the next Mark Zuckerberg and all of a sudden become a billionaire. There are people that jump through tons of steps and hit the top right away, but for the majority of business owners, it’s a grind. It’s a never-ending grind, and if you stay true to that and if you’re understanding that, then you follow the path and you work hard at it. There’s a possibility that it’ll work, but there’s also a possibility that it won’t. You can do everything right and still fail. But absolutely, Lady Luck has to play her hand. I mean, you get all the cliched sayings with that: that you create your own luck, or entrepreneurs are people who overcome bad luck. But at some point, with 99.9% perspiration and 0.1% luck, you’re ultimately playing on the roulette table.

Manoj Tandon: Absolutely. Business is a risk, and anyone that thinks that it’s not a risk should not be in business. It’s a question of timing as well. There’s always an example, like the Microsoft Zune and the Palm Pilot. There are technologies that predated all the stuff that Apple did, but they were too ahead of their time. It wasn’t as user-friendly as the Apple products were, and then Steve Jobs came along and repackaged everything and it was a massive hit. So the iPod wasn’t anything innovative technologically wise, but they marketed it in a way that it worked, and it was a timing in the industry that worked.

Matt Castonguay: In fact, you bring up one of my favorite examples with that: Palm Pilots. If you look at the history of those technologies, Apple was one of the first companies to bring a PDA to market with their Apple Newton. I don’t know how many people listening to this podcast even remember that, but it was a PDA and it had handwriting recognition. It was big and it was clunky, but when it was introduced, it was way ahead of its time. And it was a colossal failure. And this is from a company like Apple. But what it did do was it educated the market enough that such a possibility exists. It along came Palm, and it opened the door for Palm to improve upon the deficiencies that were there and really take care of a latent demand that was available. But had the Newton not come along, I don’t know that that latent demand would have ever been created. Timing. So you could have the better technology, you could have the better product, and you could certainly be avant-garde, but those are not necessarily recipes for success, always.

Matt Castonguay: Exactly. Timing is absolutely critical. And sometimes the market just isn’t ready. You can build something technically incredible, but if the consumer behavior or the infrastructure isn’t there yet, then you’re too early. And being too early can be just as bad as being too late. That’s why when we talk about startups, I always tell people to spend more time understanding the market than obsessing over every technical detail of the product. Because the market ultimately decides if you survive.

Manoj Tandon: That’s a fantastic point. We tend to romanticize technology and innovation, but if no one is willing to buy it or adopt it, then it doesn’t matter how elegant the engineering is.

Matt Castonguay: Exactly. One thing I learned through commercializing software is that technology alone rarely wins. Customer experience wins. Ease of use wins. Accessibility wins. Support wins. Reliability wins. There are plenty of technically superior products that disappeared because they were difficult to use or because the company failed to communicate value properly.

Manoj Tandon: That actually reminds me of something Steve Jobs said years ago: customers don’t care about the technology itself—they care about what it does for them.

Matt Castonguay: One hundred percent. Most users don’t care what framework you built your application in or what database engine you’re using. They care whether it solves their problem efficiently and whether it’s easy to use. Developers sometimes forget that because they get emotionally attached to the technology stack itself.

Manoj Tandon: That’s an engineer problem in general. Engineers fall in love with elegant solutions instead of practical solutions.

Matt Castonguay: Absolutely. And practical solutions are what businesses actually pay for. That’s one of the biggest transitions developers have to make if they move into entrepreneurship or product development. You stop thinking purely about “Can I build this?” and start asking, “Should I build this?” and “Will people actually pay for this?”

Manoj Tandon: That’s actually a much harder question.

Matt Castonguay: It really is. Because developers naturally love creating things. We love solving problems. But businesses survive because they solve problems that customers are willing to spend money on. There’s a difference between an interesting technical exercise and a commercially viable solution.

Manoj Tandon: So for somebody listening to this who’s maybe a younger developer or someone interested in software entrepreneurship, what would you say are the most important skills outside of coding?

Matt Castonguay: Communication, by far. Communication and adaptability. You need to be able to explain technical concepts to non-technical people. If you can’t communicate your value proposition clearly, you’re going to struggle. The second thing is adaptability because technology changes so quickly. If you become emotionally attached to one framework, one language, or one approach, you can become obsolete very quickly.

Manoj Tandon: We see that constantly in cybersecurity too. Technologies change, attack vectors change, and people who refuse to adapt get left behind.

Matt Castonguay: Exactly. The developers and engineers who survive long term are the ones who keep learning continuously. And honestly, that’s one of the things I love most about technology: you never stop learning. There’s always something new.

Manoj Tandon: Speaking of new things, artificial intelligence is obviously dominating every conversation right now. As someone with a development background, what are your thoughts on AI and software development?

Matt Castonguay: I think AI is going to fundamentally change software development, but maybe not in the way people think. I don’t think developers disappear. I think repetitive development tasks disappear. AI will become a productivity multiplier. It already is. Developers are using tools like GitHub Copilot and AI-assisted coding systems to speed up development significantly.

Manoj Tandon: So you don’t think AI replaces developers?

Matt Castonguay: Not entirely. At least not anytime soon. Somebody still has to understand architecture, logic, scalability, security, integrations, and business requirements. AI can generate code, but it doesn’t inherently understand business context or strategic intent. What I do think will happen is that smaller teams will become dramatically more productive.

Manoj Tandon: That’s actually a little terrifying from an employment standpoint.

Matt Castonguay: It could be disruptive, yes. But every major technological shift has been disruptive. The internet was disruptive. Cloud computing was disruptive. Mobile phones were disruptive. AI is simply the next major leap.

Manoj Tandon: I think one thing that’s fascinating about AI is how quickly it’s evolving. It feels faster than prior technological shifts.

Matt Castonguay: It absolutely is. Because unlike previous technology shifts, AI accelerates its own development indirectly. It helps people create faster. That compounds innovation speed tremendously.

Manoj Tandon: That’s actually a very important point. AI isn’t just another tool; it’s a force multiplier.

Matt Castonguay: Exactly. And when you combine AI with cloud computing, scalable infrastructure, and globally accessible APIs, you lower the barrier to entry for startups dramatically. Today, a small team can build things that previously required enormous engineering departments.

Manoj Tandon: Which creates both opportunity and chaos.

Matt Castonguay: That’s the technology industry in general. Constant opportunity mixed with constant disruption.

Manoj Tandon: Do you think cloud computing accelerated entrepreneurship?

Matt Castonguay: Absolutely. Without question. Before cloud infrastructure, you needed physical servers, physical infrastructure, networking equipment, colocation costs, redundancy planning—it was expensive. Today, someone can deploy a scalable global application from a laptop using AWS, Azure, or Google Cloud.

Manoj Tandon: That dramatically changes startup economics.

Matt Castonguay: Completely. It democratized development and infrastructure. The downside is that it also dramatically increased competition because barriers to entry became lower.

Manoj Tandon: That’s probably why differentiation and value innovation matter more than ever.

Matt Castonguay: Exactly. Which brings us back to what we discussed earlier: you need something unique. Technology alone is not enough anymore because technology has become more accessible.

Manoj Tandon: So where do you think technology is going over the next decade?

Matt Castonguay: I think we’re moving toward deeper automation, AI-assisted everything, smarter integrations between systems, and less friction overall. People want simplicity. They want systems to talk to each other seamlessly. They don’t want complexity exposed to them anymore.

Manoj Tandon: Almost like invisible technology.

Matt Castonguay: Exactly. The best technology increasingly disappears into the background. You stop noticing it because it works so naturally.

Manoj Tandon: Kind of like electricity.

Matt Castonguay: That’s actually a perfect analogy. Nobody thinks about electricity anymore until it stops working. Technology is heading in that direction. AI assistants, automation, cloud services—they’ll increasingly become invisible layers supporting everyday life.

Manoj Tandon: That also means cybersecurity becomes more important because people will trust these invisible systems without fully understanding them.

Matt Castonguay: One hundred percent. The more interconnected systems become, the more critical security becomes. Most users don’t think about cybersecurity until something bad happens. But behind the scenes, security needs to be built into everything from day one.

Manoj Tandon: That’s probably one of the biggest mistakes startups make. They move fast and treat security as an afterthought.

Matt Castonguay: Exactly. And then later they realize retrofitting security is much more painful and expensive than building it properly from the start.

Manoj Tandon: Before we wrap up here, what advice would you give someone wanting to get into development or entrepreneurship today?

Matt Castonguay: Start building things. Don’t spend all your time watching tutorials or reading articles. Build things. Fail. Learn. Iterate. The best way to learn development is by developing. The best way to learn entrepreneurship is by trying to build something. You don’t need a perfect plan to begin.

Manoj Tandon: That’s fantastic advice because analysis paralysis stops so many people before they even start.

Matt Castonguay: Exactly. And don’t wait for perfection. Perfection is usually the enemy of progress.

Manoj Tandon: Matt, this was a fantastic discussion. Thank you for joining us and sharing your insights on development, entrepreneurship, technology, and where the industry is heading.

Matt Castonguay: Thanks for having me. It was a lot of fun.

Manoj Tandon: And thank you to everyone listening. We appreciate all your support. Be sure to subscribe, follow us for future episodes, and we’ll see you next time on Security Confidential.