A Porto-Built Startup Wins Black Hat's First Global Security Prize for Automating How Banks Grant Access

A cybersecurity startup whose engineering is done in Porto has won the first global edition of one of the industry's most closely watched startup contests — a result confirmed not by the company's own publicity but by the organiser's post-event press release.

Opnova was named winner of the Global Startup Spotlight Competition at Black Hat USA 2026, the security industry's flagship conference, held at the Mandalay Bay Convention Center in Las Vegas. Black Hat runs the contest for companies whose products are already on the market and in use by institutional clients — it is judged by the chief information security officers of major banks and by Silicon Valley venture partners, not a pitch competition for ideas. Opnova won the United States final on 4 August and then took the inaugural global round against regional winners drawn from Black Hat's Asia, Europe and Middle East events and from SecTor in Toronto.

The company was founded around two years ago and employs roughly 20 people, split between commercial offices in San Francisco and Boston and a research-and-engineering hub in Porto. Of its four co-founders, three are Portuguese: chief executive Sinan Eren, an American and a Silicon Valley veteran, sits alongside Pedro Saleiro, the chief AI officer and former head of AI research at the Portuguese unicorn Feedzai, and José Luís Pereira. "The technology that won in Las Vegas was built in Portugal," Saleiro said.

What Opnova builds is a set of "computer-use" artificial-intelligence agents for identity and access management inside banks — the unglamorous but critical work of granting and revoking employees' access to software as they are hired, promoted or moved. A large bank can run more than 800 separate applications, many of them incompatible or decades old, and most of that provisioning is still done by hand. Opnova's agent operates the software the way a person would, reading the screen and using a keyboard and mouse, including on legacy "green-screen" terminals such as the IBM AS/400. A human records the task once; the agent then repeats it around the clock and leaves an audit trail, running inside the bank's own systems so sensitive data never leaves.

Saleiro frames the underlying problem — legacy banking systems that will not talk to one another — as one that has stayed open for more than 20 years. The company says a patented design it calls "Reflexive Memory" lets the agent act deterministically on screens it has seen before, claiming fully predictable behaviour and an 85% cut in computing costs, and it expects its largest client, described only as one of the 40 biggest US banks, to save more than 11,500 hours of manual work a year. Those performance figures are the company's own, and the hours saved a projection rather than a booked result.

The hard numbers are more modest and better corroborated: a five-million-dollar pre-seed round, about 20 staff, and more than a dozen banks in production, roughly 80% of them US-regulated lenders, with further clients in Japan and Portugal. The win adds to a strong stretch for Portuguese technology — from the drone maker Tekever's climb to a €5.5 billion valuation to Porto's health-tech unicorn Sword Health — and to a startup scene the government has courted with schemes such as a dedicated startup visa for foreign founders. "I see Opnova with at least one client in the top 10 US banks," Saleiro said of the next 18 months, "an expanded Porto team, and clients outside banking." For now, the milestone is narrower but real — a young firm engineered in the north of Portugal beating the field at the security world's biggest gathering. On the Portuguese banking and lusophone-Africa tape, our report on Banco BPI selling its last 33.35 percent of Banco de Fomento de Angola to the Carrinho group's Congolian Financial for 388.5 million euros, twenty-four years after founding the bank sets the latest reference.