David Silva spent over a decade testing websites and networks for a living, learning exactly how systems fail, before that experience grew into CyberX, the cybersecurity firm he now leads across two continents. That path recently reached a new milestone when Silva was named Cybersecurity Leader of the Year at Cysec Qatar 2026, a recognition that traces back to a field called offensive security, where a specialist attacks a company’s own systems on purpose, with permission, to find the weaknesses before a real attacker does. That distinction shaped everything Silva built afterward, starting with a pattern he kept noticing across the companies he worked with.
Companies were spending large amounts of money on security: firewalls, monitoringsoftware, compliance checklists. Very few of them had tested whether any of it would stop someone determined to get in.
A company could have an impressive security stack on paper and still have a vulnerability that allowed us to bypass several layers of defense.”
David Silva
That gap, between paying for security and having it, became the idea behind CyberX.
The Years Before the Recognition
CyberX today runs its own technology and operates in Portugal and Qatar, though the company began with far fewer certainties. Silva and his co-founder took on early projects mainly to build a track record, proving through the work itself that CyberX deserved a place in the market.
That period reshaped how Silva understood his own role. Years spent obsessing over a single technical problem, sometimes for days at a time, had prepared him to think like an attacker, but running a company demanded a different kind of attention altogether. “You cannot simply say, ‘That is not my area,’” he says of those early years. “If nobody else is there to solve the problem, it becomes your area very quickly.” Recruitment, partnerships, sales and the daily direction of the company all landed on his desk alongside the technical work, often within the same week.
What stayed constant through that shift was the standard he refused to lower. “Companies do not really buy vulnerabilities. They buy decisions,” Silva says. A technical finding, in his view, only becomes valuable once a client understands exactly what it means, what to fix first, and what can reasonably wait. Holding onto that principle while the company itself was still finding its footing became, in hindsight, the discipline that everything else at CyberX was eventually built on.
Building the Tools the Work Demanded
As CyberX grew and took on more complex engagements, the team encountered a structural limit built into traditional penetration testing. A test measures how secure a system stands at one specific moment. Within weeks, a company might change its code, add new infrastructure, or launch a new service, leaving the system that was tested already outdated.
That limitation pushed CyberX to build its own technology rather than offer testing as a single, isolated service. CyberXtreme AI Pentest runs continuous testing across applications, cloud environments and infrastructure, using artificial intelligence to extend the reach of the company’s ethical hackers while preserving the human judgment a computer cannot replicate. Guardian tracks every vulnerability CyberX finds, covering discovery, remediation and retesting, so nothing gets lost in the handoff between security and development teams. The Omniscient, known internally as The O, gathers intelligence from across the internet about a company’s exposure to threats, surfacing risks before they escalate into incidents.
Each of the three tools emerged from a problem CyberX kept encountering while doing the work manually, rather than from a plan to become a software company. That same attention to how attackers operate shapes how Silva discusses the field more broadly. He points to AI driven impersonation, where an attacker draws on public information about an employee’s role and writing style to craft a message that feels personal rather than generic, as a threat most security teams still underestimate. “Companies need verification processes for sensitive actions, especially payments, credential resets and access requests,” he says.
AI has made impersonation cheaper, faster and considerably more convincing.
A Conference Trip That Became a Second Base
“We came to Qatar for Web Summit as visitors. We left those weeks later already wondering how we could come back and build something here,” he says. Those conversations eventually led CyberX into Qatar Science & Technology Park, making the company the first Portuguese offensive security firm to join the ecosystem.
QSTP offered CyberX far more than a physical base in Doha. It placed the company alongside researchers, universities and other startups building technologies that eventually require securing. Several of those startups have already approached CyberX directly for help protecting their products, often before development reaches completion. “QSTP was particularly attractive because we did not want to come to Qatar simply to open an office and sell our products and services. We wanted to develop technology here,” Silva explains. Proximity to other builders, he says, means CyberX identifies emerging problems earlier and can shape security into a product from its earliest stages, rather than adding it as an afterthought.
That positioning matters inside a market Silva describes as genuinely ambitious. Qatar’s National Cyber Security Strategy 2024-2030 estimated the country’s cybersecurity market at approximately one billion dollars in 2022, projecting growth to 1.6 billion dollars by 2026, an annual growth rate of 12.7 percent. Large organizations have already invested heavily in defensive technology, Silva notes. The next stage of maturity, in his assessment, involves testing whether that investment withstands a genuine attack, precisely the question offensive security exists to answer.
The Award and What It Actually Marks
That trajectory reached a new point this year when Silva won the Cybersecurity Leader of the Year award at Cysec Qatar 2026. For a company that began with proposals priced barely above cost and nights spent reassuring contractors about delayed payments, the recognition reflects a measurable distance traveled.
Silva treats the award as a marker rather than a destination. An award recognizes work already completed. The more demanding question, in his view, concerns what a company does once expectations rise around it. “When excellence is the standard, good enough is never enough,” he says, a principle that has guided CyberX since its earliest projects. Silva still personally reviews every security report the company delivers.
Where CyberX Goes From Here
CyberX’s next phase centers on scaling CyberXtreme, Guardian and The Omniscient to reach a far larger base of clients, while continuing research and development from inside QSTP. Silva also intends for CyberX to play a direct role in strengthening Qatar’s own cybersecurity capabilities, working alongside startups, critical infrastructure providers and the broader ecosystem QSTP has built around research and technology.
The award will remain a fixed point in CyberX’s story. For Silva, the larger story continues to unfold, one report, one client and one uncompromising standard at a time.
CyberX is one of the companies supported through the QSTP ecosystem. Learn more about how QSTP supports founders.
#CyberX #QSTP #CyberSecurity #EthicalHacking #QatarStartups #TechInnovation #DohaTech #Startup