Luca Cicada is a software engineer, entrepreneur, and independent builder with over 20 years of experience across cybersecurity, software development, SaaS, finance, and international trade.
It didn't start with a plan. As a kid, Luca had a computer he didn't particularly like — and couldn't understand. That frustration became an obsession. He spent every day at it, learning to code from books and floppy disks, then figuring out how the internet worked, then how programs were cracked and how systems could be broken into.
He was a curious, slightly problematic kid. He'd sneak into the library by putting tape over the door latch. He learned how to open bus doors. With a friend, he figured out how to generate codes for vending machines. None of it was malicious — it was the same instinct: understand how things work, then see what you can do with that understanding.
That instinct led to his first paid job. A company selling vending machines needed someone to investigate a fraud — a programmer had buried hidden code in the system to grant free credits to family and friends through supermarket loyalty cards. Luca found it. That was the beginning.
Freelancing followed, though not by design. It was a friend of a friend situation, not a real business. He wasn't trying to scale it, and he didn't. What changed things was joining a friend's company as a programmer — that pulled him out of freelance work and into the world of consulting and security more seriously. He learned how that kind of business operated from the inside, then started his own.
From that point, Luca ran his own cybersecurity operation. The work ranged from the routine to the extraordinary. He reviewed and helped remediate the TLS 1.0 vulnerability. He conducted a physical penetration test for the Bank of Paris — walking into a building, not just attacking a network. He performed intelligence gathering for ultra-high-net-worth individuals. When someone needed something, he generally said yes and figured it out.
Moving into software products felt like a natural extension, not a dramatic pivot. He had been inside companies long enough to see how they worked — and to know he could do it himself. It wasn't frustration with any particular employer. It was simpler: being told what to build, then watching it fail for reasons that had nothing to do with the product, is demoralising. He wanted ownership over the whole thing.
Over the years, Luca has built a lot:
He has also quietly served as CTO for several digital agencies — the kind of role where your name isn't on the website but your decisions are in the product.
The frustration behind DataSpark was real. SQL Server Management Studio and every tool like it were bloated, complex, and designed for the 5% of use cases that most developers almost never touched. The other 95% of the time, you just needed to add a column, rename a field, edit a row, or import a CSV. Nobody made something simple for that.
The second problem was code generation. At the time, writing SQL queries meant typing table names and field names by hand, as strings — which opened the door to SQL injection the moment a variable ended up where it shouldn't. DataSpark generated code with real table references, not string concatenation, and made it much harder to introduce that class of vulnerability by accident.
It also handled organisation and export in a way that made practical sense. You could rename a table virtually — so when you exported data, a field could come out with a different name than what it was stored as internally. Useful for integrations, useful for client-facing exports, useful for any situation where your internal naming conventions don't match what the outside world expects.
The antivirus market had a gap that ZeroVirus was designed to fill. Most security tools of the era were reactive — they detected threats after the fact, or blocked known signatures. ZeroVirus took a different approach: a sandbox-based private protection system that locked a portion of the OS's files and folders at the kernel level, so that programs simply could not touch them. Ransomware wasn't yet the threat it would become, but viruses that deleted or corrupted files were common. The idea was to make the files physically unreachable — either encrypted or inaccessible — regardless of what was running on the machine.
The engineering underneath it was layered. An existing, licensed antivirus engine provided the detection layer. On top of that, Luca built the core infrastructure in C++, then used C bindings to connect it to a custom UI. It was a real product — sold to business clients through his own company, not a side project.
Built on Nuxt/Vue on the frontend with Cloudflare Workers handling the API layer, and both are modular by design — the core insight being that businesses often don't have a clean, single payment setup. They might have two Stripe accounts for historical or structural reasons. They might need to bring their own provider. They might need to switch mid-operation. The gateways were built to handle that reality: bring your own API keys, connect multiple providers, route transactions through whichever configuration makes sense for your business.
One gateway is oriented around B2C flows, the other around B2B. The first version failed commercially — not because the technology was wrong, but because the sales motion was wrong. Tech adoption is hard, and assuming customers will recognise the value of a modular approach without a very specific story around it turned out to be an expensive lesson. The second gateway incorporated what the first one taught.
TeachPlay is a video streaming platform built specifically for digital educators — and deliberately narrow in scope. Where platforms like Teachable or Vimeo try to do everything, TeachPlay does very few things and does them properly: course creation, lesson organisation, categories, and video upload. That's the surface.
The depth is in the features that matter to serious course creators. Watch-map tracking shows exactly how much of each lesson a student has consumed. Blocking logic means a student can be prevented from progressing until they've actually watched what comes before. Unlock controls let an administrator grant a student access to a specific course directly from the UI — no custom code required, no workaround needed. Customer management is built in. It was built developer-first, for people who know what they want and don't want a visual page builder to get in the way.
The commercial failures were real and educational. The payment gateway in particular hit hard. He thought he understood what customers wanted. The market disagreed. Tech adoption is genuinely difficult, and no amount of engineering fixes a product that the market isn't ready to buy in the way you're selling it. Fundraising in Italy added a different kind of pain — a system where getting capital often means finding the right person who knows the right person who sits on the right committee. Several attempts, very little to show for it.
He also tried, and failed, to open a business in Japan. He didn't speak the language, didn't fully understand the culture, and made the classic mistake of assuming that working harder than everyone else would be enough. It wasn't. Japan has its own rules, its own rhythms, and a foreigners who misread the culture — even with good intentions — will find every step harder than it needs to be. He learned this the hard way and moved on.
The Japan connection started with a trip. He went with friends, met a local who showed him around like a real guide, and came back with a bag full of things that simply didn't exist in Italy at the time: handmade clothes, rare figurines, painted items, wigs, handcrafted gadgets — the kind of stuff made by local artists in small quantities that never left the country. He posted photos online. People wanted to buy them. There was no Amazon, no Wish, nothing like that yet. So he built his own shop.
The difficulties were extensive. Logistics was a constant nightmare — shipping took forever to figure out, and every step had to be learned from scratch. Sourcing depended entirely on his contact in Japan, which created a bottleneck he could never fully solve. Margins were brutal; pricing the goods correctly was nearly impossible, and he ended up taking losses rather than sell things at prices that felt wrong.
The hardest problem was authenticity. Some of what ended up in the supply chain was Chinese, not Japanese. Customers would notice. He had to build a validation process from the ground up — photographs of the artist's original drawings, handwritten signatures, real-life media, proof of origin — all assembled manually to demonstrate that what he was selling was genuinely what he said it was. It was exhausting. In the end it worked, and the people who bought from him trusted him. But it took far more effort than anyone from the outside would have guessed.
Trading started as a personal interest. He could code, he understood systems and logic, and the idea of applying that to markets was an obvious experiment. The results were good enough that when a friend working in private equity suggested he join, it didn't take long to say yes.
Managing other people's money is a different experience from managing your own. The pressure is real and it's constant. When a strategy underperforms, the decision of whether to hold, adapt, or exit has to be made fast — and it has to be made with someone else's capital on the line. It is, in ways that surprised him, a lot like nursing: the technical work matters, but so does how you manage the person in front of you.
In 2024, Luca worked as an investment strategist for a private equity firm. He personally delivered a +50% net profit for clients within six months, and a consistent +110% return over the full year. The strategy-based portfolio he managed grew from $200,000 to $1.2 million.
There are a few things in motion. A KYC SaaS product — the reasons are his own for now. His own private equity operation. And the work of consolidating PayOn and PayOnWire into a single, stronger platform that doesn't carry the compromises of either predecessor.