Latest / Deep Tech Germany – AI, Robotics & Frontier Innovation by Startuprad.io™ / AI Agent Identity Security: UnoSecur on Agentic Attackers
Transcript
- WEBVTT 1 00:00:00.160 --> 00:00:03.800 In this episode of Startup Rate IO we dive into AI 2 00:00:03.800 --> 00:00:07.600 powered future of identity and access management where 3 00:00:07.600 --> 00:00:11.360 real time cloud security, agentless deployment and 4 00:00:11.440 --> 00:00:15.120 non human identity protection are becoming essential 5 00:00:15.120 --> 00:00:17.760 for enterprises. If you found a 6 00:00:18.320 --> 00:00:21.680 CISO investor or enterprise IT leader 7 00:00:22.000 --> 00:00:25.840 navigating the zero trust area, this conversation with 8 00:00:25.840 --> 00:00:29.660 unosecore CEO will give you a front row 9 00:00:29.660 --> 00:00:33.340 seat to how the next wave of identity threat detection, 10 00:00:33.660 --> 00:00:37.460 cloud compliance and SaaS security innovation is 11 00:00:37.460 --> 00:00:41.220 being built in Berlin and where every B2B SaaS startup 12 00:00:41.220 --> 00:00:42.620 should be paying attention. 13 00:00:48.780 --> 00:00:51.820 Welcome to startup Rad IO, 14 00:00:52.380 --> 00:00:55.960 your podcast and YouTube blog covering the German 15 00:00:55.960 --> 00:00:59.400 startup scene with news interviews and 16 00:00:59.640 --> 00:01:00.920 live events. 17 00:01:03.480 --> 00:01:07.200 Today I'm joined by Santos how to pronounce your family 18 00:01:07.200 --> 00:01:10.840 name? I would say Y. Yaya Prakash. 19 00:01:11.960 --> 00:01:14.200 No, it's. It's Jaya Prakash. 20 00:01:16.600 --> 00:01:20.280 Jaya Prakash. Sorry for butchering your name. The 21 00:01:20.280 --> 00:01:23.640 founder and COO of unosecure, a Berlin based 22 00:01:23.800 --> 00:01:27.490 cybersecurity startup that's really rethinking identity 23 00:01:27.490 --> 00:01:31.170 security in the age of AI because every AI can 24 00:01:31.170 --> 00:01:35.010 more or less impersonate a person. Santosh is no stranger to 25 00:01:35.010 --> 00:01:38.730 the challenge of cloud security. Before Uno Secure 26 00:01:38.970 --> 00:01:42.329 he built and scaled anchor cloud, helping 27 00:01:42.329 --> 00:01:45.930 enterprises transition to the public cloud. But it was 28 00:01:45.930 --> 00:01:49.210 during those engagements that he spotted a critical 29 00:01:49.370 --> 00:01:52.810 vulnerability. Nearly every company clawed 30 00:01:53.410 --> 00:01:56.690 the chaotic sprawl of user identities 31 00:01:56.930 --> 00:02:00.570 across cloud environments with no unified system 32 00:02:00.570 --> 00:02:04.010 to manage them securely. That realization led to 33 00:02:04.010 --> 00:02:07.650 unosecure, an agentless identity security 34 00:02:07.970 --> 00:02:11.570 platform that now helps companies detect 35 00:02:11.650 --> 00:02:15.330 real time threats, manage non human identities 36 00:02:15.810 --> 00:02:19.370 and automate AIM risk remediation 37 00:02:19.530 --> 00:02:23.210 across AWS, Azure, Azure and beyond. 38 00:02:23.690 --> 00:02:27.010 Backed by 5 million seed round and already trusted by major 39 00:02:27.010 --> 00:02:30.650 enterprises customer Uno Secure is quickly 40 00:02:30.650 --> 00:02:34.410 becoming one of Europe's most exciting deep tech security 41 00:02:34.649 --> 00:02:38.370 startups and Santosh is the visionary leading the 42 00:02:38.370 --> 00:02:42.130 charge. Welcome. Thank you so much for the kind 43 00:02:42.130 --> 00:02:45.810 invitation Jo. Totally my pleasure. We already heard a 44 00:02:45.810 --> 00:02:49.530 lot about you. Let me start with the first question. How 45 00:02:49.530 --> 00:02:52.930 did your can you tell us a little bit about your personal 46 00:02:52.930 --> 00:02:55.090 journey and how did this 47 00:02:56.530 --> 00:03:00.130 as a founder lead to the creation of Uno 48 00:03:00.130 --> 00:03:03.930 Secure? We had a little bit teaser in. The intro so yeah, I'm 49 00:03:03.930 --> 00:03:07.570 Santosh Jay Prakash and I'm from India but been in 50 00:03:07.570 --> 00:03:11.330 Germany for the last seven years. This is my third venture so I'm 51 00:03:11.410 --> 00:03:14.450 not a rookie entrepreneur I should say. This is 52 00:03:16.370 --> 00:03:20.060 18 years in ID infrastructure. I started my 53 00:03:20.060 --> 00:03:23.820 first company in 2015 was called PowerUp Cloud, very early 54 00:03:23.820 --> 00:03:27.340 in the game of cloud data AI. So I built a company called 55 00:03:27.340 --> 00:03:31.180 PowerUp Cloud based out of India, scaled it to Singapore, then to us, 56 00:03:31.180 --> 00:03:33.860 then to Netherlands and then got acquired by a Large 57 00:03:35.380 --> 00:03:38.580 NASDAQ listed company. This was my first 58 00:03:38.820 --> 00:03:42.180 entrepreneur experience. Build a 200 people team in three years. So that was 59 00:03:42.500 --> 00:03:46.140 built something like Datadog, maybe you heard of this platform, which is in 60 00:03:46.140 --> 00:03:49.730 cloud observability. So pretty early in the game then. My wife is 61 00:03:49.730 --> 00:03:53.130 Deutsch, so that brings me to Germany. We lived in India for five years, 62 00:03:53.210 --> 00:03:57.050 2013-18, and she invited me to come here. 63 00:03:57.050 --> 00:04:00.490 So I came here. Then I started another company called Ankar Cloud, 64 00:04:00.970 --> 00:04:04.769 which I still own. As of today it's 140 people, does 65 00:04:04.769 --> 00:04:08.570 15 million in revenues, profitable runs by itself. I have a leadership team who run 66 00:04:08.570 --> 00:04:12.250 the company during this process. I always 67 00:04:12.250 --> 00:04:16.010 wanted to build something global, ambitious, and I thought, okay, why not 68 00:04:16.400 --> 00:04:19.800 a security company coming from Germany, based out of Berlin. So that's how 69 00:04:19.800 --> 00:04:23.480 Unuse was born. And I started this couple of years ago as a 70 00:04:23.480 --> 00:04:27.320 research project. It came out of Anka Cloud when we worked with a lot of 71 00:04:27.320 --> 00:04:30.640 customers migrating to the cloud. And then the whole 72 00:04:30.640 --> 00:04:34.280 curiosity was how do you stop evil while it's happening 73 00:04:34.280 --> 00:04:38.080 in the cloud? You know, that's kind of the hook, that's the hypothesis 74 00:04:38.080 --> 00:04:41.640 I started chasing and which led to the company. It's also 75 00:04:41.640 --> 00:04:45.400 interesting because you could start human hackers with 76 00:04:45.400 --> 00:04:48.900 human speed, but in the age of AI, I think that that's something 77 00:04:48.900 --> 00:04:52.660 completely different. But before we move on with our questions, I 78 00:04:52.660 --> 00:04:56.500 have two less serious questions. I want your honest opinion 79 00:04:56.500 --> 00:04:58.380 of the state of Indian food in Germany. 80 00:05:00.460 --> 00:05:04.180 Indian food in Germany. I think I 81 00:05:04.180 --> 00:05:07.900 should say the answer is no. Comments. Yeah, I mean, not even remotely 82 00:05:07.900 --> 00:05:11.620 close, but still. There are some good spots in Berlin and I'm in 83 00:05:11.620 --> 00:05:15.140 South Germany in Frankfurt. It's too good. I've tasted some good food even in 84 00:05:15.140 --> 00:05:18.960 Munich. Yeah, big cities. Actually what I like here 85 00:05:18.960 --> 00:05:22.480 in Germany, in Frankfurt especially, is Savanna 86 00:05:22.480 --> 00:05:26.200 Bavan. Yeah, exactly. That's where I was going to. Right. So that 87 00:05:26.200 --> 00:05:29.920 was a good one in Frankfurt. Strong recommendation, very small hidden place. 88 00:05:29.920 --> 00:05:33.760 Metamasala. But before 89 00:05:33.760 --> 00:05:37.520 we get into the next serious question, what more I usually do? When you moved 90 00:05:37.520 --> 00:05:40.480 here from India, did you bring warm socks? 91 00:05:42.960 --> 00:05:46.440 Yeah, that's a good question. Right. I had funny jackets rather than bad 92 00:05:46.440 --> 00:05:50.180 socks. Right. So I had to throw away all my funny jackets and 93 00:05:50.180 --> 00:05:53.380 then I had to get it. And funnily enough, I've never seen snow in my 94 00:05:53.380 --> 00:05:56.820 life. So only in Germany I get to see first time when I was like 95 00:05:56.820 --> 00:06:00.580 26 or 27. Right. How do you like driving in snow and 96 00:06:00.580 --> 00:06:03.020 ice? Oh, that's a good question. So 97 00:06:03.820 --> 00:06:07.500 definitely not enjoyable or relaxing. Right. 98 00:06:07.500 --> 00:06:11.340 So I think my Wife still does those duties, Right? So I'm 99 00:06:11.340 --> 00:06:13.340 still a bad driver in Germany. 100 00:06:15.180 --> 00:06:18.860 I think it's the same case for many people. When you are ice on snow, 101 00:06:19.020 --> 00:06:22.840 usually your smartwatch watch sounds the alarm, right? I know that 102 00:06:22.840 --> 00:06:26.200 feeling. For those in our audience 103 00:06:26.200 --> 00:06:29.840 unfamiliar with what exactly do you 104 00:06:29.840 --> 00:06:33.600 guys as UNO secure do and why is 105 00:06:33.600 --> 00:06:37.280 it relevant now? Can you do a little bit of explaining here? 106 00:06:37.280 --> 00:06:40.680 Can you break it down Bonnie style? Awesome, Joe? So 107 00:06:42.520 --> 00:06:46.320 the simplest way I can explain is there are bad guys 108 00:06:46.320 --> 00:06:49.750 everywhere, right? So let's take the scenario of somebody 109 00:06:49.910 --> 00:06:53.630 has got keys to your house. He's a bad guy, he will find hundred 110 00:06:53.630 --> 00:06:57.390 ways to get keys to your house, right? So if he wants to rob your 111 00:06:57.390 --> 00:07:00.950 house, they find ways to find the keys. So as 112 00:07:00.950 --> 00:07:04.670 a, as a bad guy or an adversary, what 113 00:07:04.670 --> 00:07:07.590 do I do? I take the keys, I come to your home, put it in 114 00:07:07.590 --> 00:07:11.390 the door, open the door, and then, yeah, I do my job of cleaning the 115 00:07:11.390 --> 00:07:15.070 house and take all the valuables and run away. So this is typically how it 116 00:07:15.070 --> 00:07:18.860 works. So now apply the same scenario in the context 117 00:07:19.170 --> 00:07:22.970 of technology, right? So your passwords, your keys are stored in different 118 00:07:22.970 --> 00:07:26.450 systems. There are hacker groups who are looking for these keys and 119 00:07:26.450 --> 00:07:29.850 credentials, and that's all they need, right? So they log into your 120 00:07:29.850 --> 00:07:33.130 systems and then they steal your data. So there's like bitcoin 121 00:07:33.130 --> 00:07:36.970 mining, data theft, or ransomware attacks. So the whole 122 00:07:36.970 --> 00:07:40.410 idea is, what is your defense mechanism is how soon can you 123 00:07:40.410 --> 00:07:43.930 detect, or like, let's say in your home you have a security system which 124 00:07:43.930 --> 00:07:47.640 detects. So in 10 minutes, if you're able to get the robber run away 125 00:07:47.640 --> 00:07:51.480 or chase him out, or make some noise, or the neighbors help you somehow, 126 00:07:51.480 --> 00:07:55.320 you have some mechanism that you can safeguard your property. But 127 00:07:55.320 --> 00:07:59.120 in technology we apply the same. So there's no system which 128 00:07:59.120 --> 00:08:02.720 is able to detect this in real time and what these guys are doing inside 129 00:08:02.720 --> 00:08:06.560 a system. And that's the best analogy I can give you. It's like somebody 130 00:08:06.560 --> 00:08:09.720 has keys to your house. How soon can you detect and respond? 131 00:08:10.200 --> 00:08:13.750 So that's exactly when you apply in the technology world these 132 00:08:13.750 --> 00:08:17.470 days. All attacks, 80% of all the attacks that you see 133 00:08:17.470 --> 00:08:21.230 in the last two years are credential theft. Somebody 134 00:08:21.230 --> 00:08:24.990 has keys to your kingdom. They just log in. They don't break 135 00:08:24.990 --> 00:08:28.550 in or write cryptography or exploits anymore. 136 00:08:30.470 --> 00:08:34.190 We are kind of the layer which comes in which can detect and 137 00:08:34.190 --> 00:08:37.830 stop those attacks and avoid those bad guys 138 00:08:37.830 --> 00:08:41.590 to harm anything that's happening into your system. Before we get into 139 00:08:41.590 --> 00:08:44.480 the next question, I was wondering, you have 140 00:08:44.960 --> 00:08:48.000 somebody who for whatever reason lost or got his 141 00:08:48.640 --> 00:08:52.360 credentials stolen. Could be as simple as a 142 00:08:52.360 --> 00:08:56.000 trojan on their home computer or in the network or something. 143 00:08:57.280 --> 00:09:00.079 How can you as unicecore 144 00:09:01.600 --> 00:09:05.200 detect that it's not the person that is supposed to log in? 145 00:09:05.200 --> 00:09:08.880 Because I would assume if the alarms are 146 00:09:08.880 --> 00:09:12.600 raised, if those credentials are stolen, they wouldn't work. But 147 00:09:12.600 --> 00:09:16.110 if you have working credentials, how does the intuo alarm bell 148 00:09:16.110 --> 00:09:19.470 ring? Cool. So we connect to all these core 149 00:09:19.470 --> 00:09:23.110 systems like your cloud, your on premise, 150 00:09:23.110 --> 00:09:26.670 your identity providers like Microsoft Entra or 151 00:09:26.670 --> 00:09:30.030 Okta, and also to your SaaS platforms. So based on which 152 00:09:31.390 --> 00:09:34.670 we've done a lot of threat hunting, based on which we detect. So there's a 153 00:09:34.670 --> 00:09:38.070 framework called mitre, ATT and ck. So where we detect like credential theft, 154 00:09:38.070 --> 00:09:41.870 initial access, privilege escalation, privilege refund, 155 00:09:41.870 --> 00:09:45.330 all those things and we take a bunch of signals which is based on 156 00:09:45.330 --> 00:09:48.850 ip, based on where this identity is 157 00:09:48.850 --> 00:09:51.970 accessing things from. There are multiple signals that we create 158 00:09:52.370 --> 00:09:56.090 or we call it the risks. And based on all those combinations 159 00:09:56.090 --> 00:09:59.330 we create an issue. So that's the R and D we did for two years 160 00:09:59.330 --> 00:10:02.930 during the early days of unasecore. We have this 161 00:10:02.930 --> 00:10:06.530 unique research driven approach where we build toxic 162 00:10:06.530 --> 00:10:10.290 combinations or we call it conflicting combinations based on which we detect. 163 00:10:10.470 --> 00:10:13.670 And we do that. And now maybe I can also give an add on. So 164 00:10:13.670 --> 00:10:17.030 now with AI, so with humans you can have like a single sign on system 165 00:10:17.030 --> 00:10:20.830 or an mfa. Like for example, like you log into a system, there's 166 00:10:20.830 --> 00:10:24.190 a second alert where you have to confirm, right. But when it comes to machines 167 00:10:24.190 --> 00:10:27.950 or AI, you cannot protect the front door so you're fully exposed. 168 00:10:27.950 --> 00:10:31.550 Right. So the problem becomes like crazy big when it comes to non human 169 00:10:31.550 --> 00:10:35.390 identities or AI agents and all those kind of modern day systems. Right. For 170 00:10:35.390 --> 00:10:37.990 everybody who's not like a technical 171 00:10:38.880 --> 00:10:42.560 genius, like obviously you are, basically 172 00:10:42.560 --> 00:10:46.160 the issue is that now you do have programs, 173 00:10:46.240 --> 00:10:49.840 computer software that are talking to each other. Plus you 174 00:10:49.840 --> 00:10:53.640 have also increasingly, I think we're just at the 175 00:10:53.640 --> 00:10:57.400 first step of that AI agent that doing something on 176 00:10:57.400 --> 00:11:00.840 behalf of their coders, of their 177 00:11:00.840 --> 00:11:04.400 owners, however you want to call it. That's basically the problem when you 178 00:11:04.720 --> 00:11:08.400 need to distinguish between a proper AI agent 179 00:11:08.400 --> 00:11:11.880 from client X and a non proper AI 180 00:11:11.880 --> 00:11:15.680 agent from hacker Y. Right? Kind 181 00:11:15.680 --> 00:11:19.360 of. Right. So maybe I'll also try to simplify things. Joe. So it's like, 182 00:11:19.360 --> 00:11:22.960 let's take, I mean how do a company consume AI today? 183 00:11:22.960 --> 00:11:26.480 Right. There are three different ways, right? One, they buy 184 00:11:27.120 --> 00:11:30.520 coding tools which is like, you know, which you come across like cursor 185 00:11:30.520 --> 00:11:34.330 replit, windsurf, Google, GitHub, copilot, 186 00:11:34.330 --> 00:11:37.970 these kind of tools, that's one way they consume it. And second, 187 00:11:38.290 --> 00:11:39.490 they buy 188 00:11:41.970 --> 00:11:45.410 their internal teams built using anthropic or OpenAI 189 00:11:45.410 --> 00:11:49.210 frameworks. So basically Claude or all those kind of tools. And the 190 00:11:49.210 --> 00:11:52.850 third way is all the SaaS platforms selling their own agents like Salesforce 191 00:11:52.850 --> 00:11:56.370 Agent or ServiceNow Agent. So these are the only three different ways today 192 00:11:56.450 --> 00:12:00.090 companies consume AI or like, you know, there's no other way they do it. Now 193 00:12:00.090 --> 00:12:03.410 if you speak to a security team or the C level folks 194 00:12:03.650 --> 00:12:07.250 now how do they authenticate between each other? What are they doing? 195 00:12:07.490 --> 00:12:11.170 There's absolutely no clue. Right, so that's where we come in. Right. 196 00:12:11.170 --> 00:12:14.850 So now how do they authenticate? How? What kind of permissions they get, 197 00:12:15.090 --> 00:12:18.170 what kind of access they have so that they can. This is the future, right? 198 00:12:18.170 --> 00:12:21.130 So this is. We are building it for the future. Right. So these are some 199 00:12:21.130 --> 00:12:24.850 of the problems we solve with AI because currently there's no mechanism existing for. 200 00:12:25.290 --> 00:12:28.970 And even if companies like Okta and others are coming up with 201 00:12:28.970 --> 00:12:32.810 authentication protocols, but then you have MCP or from 202 00:12:32.810 --> 00:12:36.570 a layman's standpoint, how do you even have view 203 00:12:36.570 --> 00:12:40.210 into what these identities are doing? What are these agents doing? How are they 204 00:12:40.210 --> 00:12:43.890 authenticating with each other, what kind of access they have? Are they over 205 00:12:43.890 --> 00:12:47.450 privileged? Do they have more access than what they need to do their 206 00:12:47.450 --> 00:12:51.130 jobs? If an attacker 207 00:12:51.130 --> 00:12:54.770 comes in, how do you even detect that? Okay, it's really Joe or somebody 208 00:12:54.770 --> 00:12:57.900 behaving like Joe. So all those kind of scenarios is what 209 00:12:58.540 --> 00:13:01.900 we kind of do with uno. Yeah. 210 00:13:02.220 --> 00:13:05.820 And thing is, I do 211 00:13:05.820 --> 00:13:09.260 see the challenge for the future for everybody. 212 00:13:09.740 --> 00:13:12.940 I was wondering what was your aha moment 213 00:13:13.660 --> 00:13:17.500 when you realized identity was the new security 214 00:13:17.660 --> 00:13:20.940 parameter here? Yeah. So 215 00:13:23.300 --> 00:13:25.980 in the realm of the modern day. So if you look at back in the 216 00:13:25.980 --> 00:13:29.740 day, it was network was the perimeter. So some years ago, then it 217 00:13:29.740 --> 00:13:33.220 became all the infrastructure and now it's the identity. 218 00:13:33.300 --> 00:13:37.100 Because almost every system all you do is log in. So 219 00:13:37.100 --> 00:13:40.900 now logging into a system is just like 220 00:13:40.900 --> 00:13:44.740 you use some kind of, let's say an authentication mechanism to get 221 00:13:44.740 --> 00:13:48.540 into the system. The wall factor here is that, 222 00:13:48.540 --> 00:13:52.320 okay, if you're a big company, you have different 223 00:13:52.400 --> 00:13:56.160 systems. Now for a ciso, I don't know what I don't 224 00:13:56.160 --> 00:14:00.000 know, that's their problem. They don't have a vantage point visibility of what's going on 225 00:14:00.000 --> 00:14:03.800 in all these different systems though. They have different tools doing different 226 00:14:03.800 --> 00:14:07.560 jobs like app security, product security, identity was 3 227 00:14:07.560 --> 00:14:10.880 years ago still an IT teams problem. Not A security problem. 228 00:14:11.280 --> 00:14:15.000 Now identity is a security team's problem. So these are 229 00:14:15.000 --> 00:14:18.530 kind of the things that, the kind of things that you can uncover connecting a 230 00:14:18.530 --> 00:14:21.370 system like us or like, you know, platforms which can 231 00:14:21.770 --> 00:14:25.210 communicate or authenticate between each other. So that's where 232 00:14:25.850 --> 00:14:29.490 like, you know, same day ROI, you just connect within 15 233 00:14:29.490 --> 00:14:33.250 minutes engineless deployment. And you can connect even like find an AWS 234 00:14:33.250 --> 00:14:36.610 accounts or like, you know, all your different systems and you're able to get a 235 00:14:36.610 --> 00:14:40.290 vantage point view of what are these identities, what are they 236 00:14:40.290 --> 00:14:43.870 doing and are they over police or not? Are 237 00:14:43.870 --> 00:14:47.590 they accessing? Is it really me or 238 00:14:47.590 --> 00:14:51.270 somebody? So all those kind of perspectives 239 00:14:51.270 --> 00:14:54.950 or the visibility aspects that we uncover creates those aha 240 00:14:54.950 --> 00:14:58.750 moments for customers. So that's one of the reasons why this problem 241 00:14:58.829 --> 00:15:01.950 is becoming more increasing. And with more and more 242 00:15:02.990 --> 00:15:06.510 systems and tools moving to the cloud and companies adopting 243 00:15:06.510 --> 00:15:10.110 AI, we don't see this. This 244 00:15:10.110 --> 00:15:13.950 becomes the only perimeter that companies will have to invest in protecting. 245 00:15:14.910 --> 00:15:18.270 I was wondering what makes your agentless 246 00:15:18.590 --> 00:15:21.790 identity security platform stand out from all the other 247 00:15:22.190 --> 00:15:25.470 identity and access management tools. Great. 248 00:15:26.110 --> 00:15:29.630 So traditionally identity is one word 249 00:15:29.630 --> 00:15:33.470 overused. There are like 200 different variations within that. Like 250 00:15:35.470 --> 00:15:39.070 there are three different scenarios. Authentication, authorization and accounting. 251 00:15:39.610 --> 00:15:43.330 So we come in after somebody logs in. So 252 00:15:43.330 --> 00:15:46.810 we don't protect the front door. So there are companies like Microsoft, 253 00:15:47.050 --> 00:15:50.610 Okta and others who really master the game. So the biggest 254 00:15:50.610 --> 00:15:52.810 USP is we come in 255 00:15:54.170 --> 00:15:57.930 after somebody logs into the system. We study kind of like 256 00:15:57.930 --> 00:16:01.570 we do something called as activity based access control. And for AI we do 257 00:16:01.570 --> 00:16:05.290 task based access control. So these are the kind of scenarios that we come in. 258 00:16:05.830 --> 00:16:09.630 So we do agentless. The reason because no attacker waits 24 hours. If 259 00:16:09.630 --> 00:16:13.270 you have to achieve right, you have to get 260 00:16:13.270 --> 00:16:16.350 runtime visibility. You need to be fast, you need to be there to make sure 261 00:16:16.350 --> 00:16:19.910 that you get customers the visibility into what's going on. So 262 00:16:19.910 --> 00:16:23.510 getting runtime at that scale, that needs a lot of technology 263 00:16:23.750 --> 00:16:27.350 and you need to be novel and technically defensible. So 264 00:16:27.590 --> 00:16:30.550 that's how we operate. So you connect and then you get going. 265 00:16:30.950 --> 00:16:34.680 That's you just make connections to the platform and then 266 00:16:34.760 --> 00:16:38.440 you're able to get the visibility and start solving your first problems. 267 00:16:42.840 --> 00:16:46.120 And you just said you 268 00:16:46.280 --> 00:16:49.880 detect the potential threat 269 00:16:50.120 --> 00:16:53.720 after the login. And how do you detect 270 00:16:54.040 --> 00:16:57.880 that in real time without completely overloading the 271 00:16:57.880 --> 00:17:01.690 security team or the systems? Yeah, so we kind of 272 00:17:01.690 --> 00:17:05.330 connect to. An average enterprise will 273 00:17:05.330 --> 00:17:08.810 have thousands of AWS accounts or at least 200 274 00:17:08.810 --> 00:17:12.410 SaaS applications from Salesforce to all these differences, 275 00:17:12.650 --> 00:17:16.170 they have at least two Identity providers. Now 276 00:17:16.490 --> 00:17:19.610 we connect to all these different systems and 277 00:17:20.250 --> 00:17:24.010 it's completely agentless. No installations, no sidecars, you 278 00:17:24.010 --> 00:17:27.629 just connect. So we have those onboarding workflows built in. So 279 00:17:27.949 --> 00:17:31.749 we set up a tenant for a customer and they can make connections. We 280 00:17:31.749 --> 00:17:35.149 take only read only writes if they use our SaaS platform 281 00:17:35.949 --> 00:17:39.309 and immediately the data starts coming in so we consume only the 282 00:17:39.309 --> 00:17:42.749 metadata so we don't get into the PI or the sensitive side of things. 283 00:17:42.988 --> 00:17:46.749 We kind of consume those logs so through which we are able to bring those 284 00:17:46.749 --> 00:17:50.389 correlations and visibility for the customers. So you just makes 285 00:17:50.389 --> 00:17:54.080 connections through different onboarding workflows that we have 286 00:17:54.080 --> 00:17:57.800 built and there is no installations, no sidecars, 287 00:17:58.280 --> 00:18:01.240 there's nothing that customers will have to do other than that. So we set up 288 00:18:01.240 --> 00:18:04.960 a tenant. So getting started is super fast. We made that very easy for our 289 00:18:04.960 --> 00:18:08.759 customers. Very fortunate, especially for the non 290 00:18:08.759 --> 00:18:12.600 technical guys like me. For our audience I was 291 00:18:12.920 --> 00:18:15.960 wondering do you think identity sprawl across 292 00:18:16.040 --> 00:18:19.640 platforms is the number one security risk and prices 293 00:18:19.960 --> 00:18:23.480 face right now or are we overestimating it? 294 00:18:23.640 --> 00:18:27.400 Drop your take in the comments. Have you seen this problem in 295 00:18:27.480 --> 00:18:31.240 your organization or portfolio companies? We've been talking 296 00:18:31.240 --> 00:18:35.080 a little bit about theory here Santosh, even though a lot 297 00:18:35.080 --> 00:18:38.760 went already over my head. But can you walk us through 298 00:18:38.760 --> 00:18:42.520 a real world use case perhaps in Fintech or healthcare that 299 00:18:42.520 --> 00:18:45.800 do protect especially sense sensitive 300 00:18:46.040 --> 00:18:49.240 data where unisecure made a critical impact. 301 00:18:50.580 --> 00:18:54.260 Cool. So we have a lot of customers in the financial 302 00:18:54.340 --> 00:18:58.140 services, a lot of banks, some of our banks, we 303 00:18:58.140 --> 00:19:01.940 have even production banking customers. We work with a lot of healthcare 304 00:19:02.020 --> 00:19:05.700 and these are the two most regulated industries. So with 305 00:19:05.700 --> 00:19:08.500 finance and health, when it comes to and for them 306 00:19:10.660 --> 00:19:14.460 regulators are not fun. So if 307 00:19:14.460 --> 00:19:18.170 you speak to any CISO and then how do you manage the data? 308 00:19:18.170 --> 00:19:21.210 So it's not the easiest jobs they have. Now 309 00:19:22.170 --> 00:19:26.010 in all the scenarios, 80% of any kind 310 00:19:26.010 --> 00:19:29.050 of issues they come across is all identity related. 311 00:19:29.690 --> 00:19:33.530 So every auditor wants to know how is Santos using his access? What did 312 00:19:33.530 --> 00:19:36.250 he do in the last six months? Did he have access to this or not? 313 00:19:36.250 --> 00:19:40.090 How do you get all this information? So this is a tedious work 314 00:19:40.090 --> 00:19:43.450 and I'm just giving you one simple example of what's going on in such 315 00:19:43.770 --> 00:19:47.450 companies. So we have a lot of customers especially when it comes to healthcare 316 00:19:47.800 --> 00:19:51.520 or like banking, like ISO, SoC2, NASC now 317 00:19:51.520 --> 00:19:55.160 these days, Dora and all those kind of compliances that comes up with 318 00:19:55.240 --> 00:19:58.880 80, 90% of the questions are identity related. And there is 319 00:19:58.880 --> 00:20:02.520 a like if you look at OWASP top 10, I don't want to go 320 00:20:02.520 --> 00:20:06.200 super technical but you know, OWASP top 10 is like the, like 321 00:20:06.200 --> 00:20:10.040 the top security issues, right. So the number 322 00:20:10.040 --> 00:20:13.880 one spot has been identity for I think at least for the last seven years. 323 00:20:14.320 --> 00:20:17.800 Right. So it's still not solved. So that's, that's kind of the 324 00:20:17.800 --> 00:20:21.520 opportunity we go after. Right? Because it's, it's 325 00:20:22.080 --> 00:20:25.840 the pain is so big, customers face it day in 326 00:20:25.840 --> 00:20:29.480 and day out and then skill gap is also big. Right. 327 00:20:29.480 --> 00:20:33.280 So big companies, if you look at them, how do you. It 328 00:20:33.280 --> 00:20:37.080 becomes a siloed problem. They have like different tools currently they, everybody 329 00:20:37.080 --> 00:20:40.910 has invested in authentication and identity management but the missing piece 330 00:20:40.910 --> 00:20:44.750 is identity security. They don't have toolings which helps them achieve the 331 00:20:44.750 --> 00:20:48.390 identity security that protects their sensitive data. 332 00:20:48.630 --> 00:20:52.310 All the PII and all the different kinds of data. That's 333 00:20:52.630 --> 00:20:56.390 where we come in. We have customers who use us 334 00:20:57.990 --> 00:21:01.550 for multiple purposes. We have more than 40, 45 different use cases that you can 335 00:21:01.550 --> 00:21:04.630 achieve out of it. Starting from a simple visibility 336 00:21:05.110 --> 00:21:08.770 to even auto remediation. Right. So all these kind of different 337 00:21:08.770 --> 00:21:12.570 scenarios, we help customers, we have achieved them actually reduce their identity 338 00:21:12.570 --> 00:21:16.050 sprawl. We have increased some of their 339 00:21:16.530 --> 00:21:20.290 engineering and feature velocity because they could 340 00:21:20.370 --> 00:21:23.930 govern just in time access, just enough privileges for their engineers. 341 00:21:23.930 --> 00:21:27.570 Nobody needs admin rights. You come across multiple scenarios 342 00:21:27.570 --> 00:21:31.170 in different customers. So yeah, healthcare and 343 00:21:31.330 --> 00:21:34.870 financial services, banking are some of us from Uno 344 00:21:34.870 --> 00:21:37.950 Sekur sweet spot. And these are the kind of customers that we work with currently 345 00:21:37.950 --> 00:21:41.670 as well. Before we move into market 346 00:21:41.670 --> 00:21:45.430 and the business model. I was wondering how often do people or 347 00:21:45.670 --> 00:21:47.910 AIs attempt to hack you? A week. 348 00:21:50.070 --> 00:21:53.830 Yeah. So I mean he's smiling, he's smiling. A lot of people 349 00:21:54.150 --> 00:21:57.670 will just listen to it. That's why I need to tell them he's 350 00:21:57.670 --> 00:22:01.190 smiling. So I think AI. So 351 00:22:01.190 --> 00:22:04.830 AI is good. I mean but there are also bad guys using 352 00:22:04.830 --> 00:22:08.650 AI. So definitely bad guys. You see AI 353 00:22:08.650 --> 00:22:12.450 is these days more than less. So it's easy 354 00:22:12.450 --> 00:22:14.450 for them as I said. So if you go a lot of 355 00:22:16.050 --> 00:22:19.490 companies suffer. Like for example there's this concept called info 356 00:22:19.490 --> 00:22:23.090 stealers. I mean if you Google it, you'll see it. That's a very common way 357 00:22:23.090 --> 00:22:26.370 that people use. And then they use AI for social engineering 358 00:22:26.370 --> 00:22:30.050 phishing kind of attacks to grab credentials so they can get into 359 00:22:30.050 --> 00:22:33.340 system. So there are 360 00:22:33.660 --> 00:22:37.020 AI security companies helping with prompt 361 00:22:37.020 --> 00:22:40.820 injection, LLM jacking and these kind of like if you look at Israel 362 00:22:40.820 --> 00:22:44.540 US or India US there are a lot of companies which are doing that. 363 00:22:44.700 --> 00:22:48.500 But still identity takes the front seat, right? So 364 00:22:48.500 --> 00:22:52.220 with AI again, it's going to be identity. Yeah, AI can be used for 365 00:22:52.220 --> 00:22:55.820 good and for bad, but offlet there's a lot of bad guys using it 366 00:22:55.820 --> 00:22:59.420 and they've been pretty successful with it. Maybe I'll put it that way. 367 00:22:59.900 --> 00:23:03.100 You didn't give us a number. So 368 00:23:03.980 --> 00:23:07.808 I mean it sounds like I would say at least 40, 369 00:23:07.912 --> 00:23:11.620 50% of attacks that you come across are like some kind 370 00:23:11.620 --> 00:23:15.460 of like, you know, like even these days we came across one 371 00:23:15.460 --> 00:23:18.780 scenario where there was a DDoS attack. They tried using AI 372 00:23:19.020 --> 00:23:22.620 so like pumping IPs and creating these repeated models. 373 00:23:22.700 --> 00:23:26.220 So yeah, there's a lot of many studies. I mean 374 00:23:26.220 --> 00:23:29.460 OWASP is a very good place to look at those 375 00:23:29.460 --> 00:23:33.300 metrics. So OWASP has also released 376 00:23:33.300 --> 00:23:37.100 quite a lot of AI driven threads and stuff. I'm happy 377 00:23:37.100 --> 00:23:40.340 to share more there. And actually 378 00:23:40.740 --> 00:23:44.220 Sandosh, you know what, I think at one point there will be a 379 00:23:44.220 --> 00:23:47.700 hacker dark AI and it will be called 380 00:23:47.860 --> 00:23:49.140 Darth GPT. 381 00:23:54.500 --> 00:23:57.300 Probably somebody already bought those domains, right? 382 00:24:00.100 --> 00:24:03.640 I'm very confident. Confident. Let's talk a little bit about the market and the business 383 00:24:03.640 --> 00:24:07.400 model. So what was the hardest feature to build and what 384 00:24:07.400 --> 00:24:11.200 trade offs did you face in building it? So 385 00:24:11.520 --> 00:24:15.320 definitely achieving runtime capabilities, 386 00:24:15.320 --> 00:24:19.160 which is real time by doing it in real time is one of the 387 00:24:19.160 --> 00:24:23.000 hardest because static scanning. Yeah, I mean 388 00:24:23.000 --> 00:24:26.840 a lot of companies do that. I mean as I said, no attacker waits 24 389 00:24:26.840 --> 00:24:30.470 hours. Now if I'm not able to find things 390 00:24:30.470 --> 00:24:34.150 while it's happening, the curiosity of how do I stop it. And 391 00:24:34.150 --> 00:24:37.990 processing that level of data, that scale and still your 392 00:24:37.990 --> 00:24:40.950 system capturing all those different things, 393 00:24:41.270 --> 00:24:45.110 correlating all the information and doing that. So achieving that 394 00:24:46.150 --> 00:24:49.910 we did something called as test driven development. We tested 395 00:24:49.910 --> 00:24:53.600 based on last 90 days of data for 12 years and that's how we 396 00:24:53.600 --> 00:24:57.280 actually I would say that's the most hardest feature. But then everything else 397 00:24:57.760 --> 00:25:01.440 building on top of it first, much easier. So that's why 398 00:25:01.920 --> 00:25:05.720 the first 2, 3 year of formation was more about how 399 00:25:05.720 --> 00:25:08.600 do we get to runtime, how do we get to real time, how can we 400 00:25:08.600 --> 00:25:12.440 get those visibility of risks at that speed. So those were kind 401 00:25:12.440 --> 00:25:14.640 of the difficult features I would say. 402 00:25:16.000 --> 00:25:19.720 Guys, we will be back after short ad break but stay tuned. 403 00:25:19.720 --> 00:25:23.240 Right after we'll dive into how Unosecure's B2B SaaS 404 00:25:23.240 --> 00:25:26.950 model scales fast without friction, where enterprise 405 00:25:26.950 --> 00:25:30.230 buyers are betting on their agentless identity fabric 406 00:25:30.470 --> 00:25:34.270 even in a cautious market. And how new innovations like 407 00:25:34.270 --> 00:25:37.710 UNO Copilot and UNO Board are 408 00:25:37.710 --> 00:25:41.430 redefining what real time identity control looks like. 409 00:25:41.990 --> 00:25:45.670 You won't want to miss how they're turning compliance into Live 410 00:25:45.670 --> 00:25:49.270 Dashboard and why their 5 million seed round is just the 411 00:25:49.350 --> 00:25:50.070 beginning. 412 00:25:55.870 --> 00:25:59.630 Welcome back from the ad break and I still have Santosh here with me. 413 00:25:59.790 --> 00:26:02.990 And let's dive in straight into the question because 414 00:26:03.390 --> 00:26:07.150 we've been teasing your B2B SaaS business model. How 415 00:26:07.230 --> 00:26:10.750 do you scale that with customers and what's your core 416 00:26:10.830 --> 00:26:14.110 GTM strategy? Yeah, so currently we 417 00:26:14.430 --> 00:26:18.110 offer it AS a security SaaS platform because it's easy to 418 00:26:18.110 --> 00:26:21.910 onboard. But with regulated business we also do private instance deployments 419 00:26:22.150 --> 00:26:25.910 within their environments. Sometimes then we charge them 2x3x 420 00:26:25.910 --> 00:26:28.150 because we are sharing our IP. But typically 421 00:26:30.230 --> 00:26:34.030 the SaaS model works and even if you look at AI companies, all 422 00:26:34.030 --> 00:26:36.150 the AI ones are also subscription models. 423 00:26:38.230 --> 00:26:41.590 So this model is scalability to be charged based on 424 00:26:41.830 --> 00:26:45.670 number of accounts they connect to the platforms like number of connections they make 425 00:26:46.040 --> 00:26:49.720 instead of number of identities. Because humans you can measure, non 426 00:26:49.720 --> 00:26:53.560 humans you cannot because some engineer will create something 427 00:26:53.800 --> 00:26:57.440 and then it's there in the system. So there's no way. So our pricing works 428 00:26:57.440 --> 00:27:01.280 based on the number of connections organizations make to the 429 00:27:01.280 --> 00:27:05.120 platform and it's scalable. I mean even the 430 00:27:05.120 --> 00:27:08.880 largest retailer in the world is one of our biggest 431 00:27:08.880 --> 00:27:12.720 reference. So if we are able to handle that scale, I think we can handle 432 00:27:12.720 --> 00:27:15.880 anybody's scale. You know we have achieved those kind of 433 00:27:16.220 --> 00:27:19.860 capabilities already. That helps customers to like it's fully 434 00:27:19.860 --> 00:27:23.540 enterprise ready. We already have all the credentials that's needed like a 435 00:27:23.540 --> 00:27:27.220 Soc2 ISO and also GDPR like all the 436 00:27:27.220 --> 00:27:30.900 different kind of penetration testing reports. We went through so many vendor 437 00:27:30.900 --> 00:27:34.060 questionnaires with already our large customers. 438 00:27:34.460 --> 00:27:38.140 So yeah, so we offer it in SaaS but for case to 439 00:27:38.140 --> 00:27:41.980 case for large banking and very regulated businesses, we 440 00:27:41.980 --> 00:27:45.420 also do private instance deployments in their 441 00:27:45.420 --> 00:27:49.180 environments. It's not necessarily that they are boring 442 00:27:49.180 --> 00:27:53.020 but as you said, the regulators, they don't understand any fun in 443 00:27:53.020 --> 00:27:56.620 this area. You have very high hurdles to jump over in 444 00:27:56.620 --> 00:28:00.460 order to do some security, some 445 00:28:00.460 --> 00:28:02.540 AI or any other stuff. So 446 00:28:04.300 --> 00:28:08.140 the main focus of banks is security, security, security. 447 00:28:09.100 --> 00:28:11.900 That explains a lot of the on premise stuff. 448 00:28:12.980 --> 00:28:16.580 What makes you appealing to enterprise buyers in 449 00:28:16.580 --> 00:28:18.740 today's cautious funding climate? 450 00:28:20.580 --> 00:28:22.820 Good question. Again we try our best. 451 00:28:24.420 --> 00:28:27.780 So like, I mean I think 452 00:28:28.579 --> 00:28:32.220 security investments I think every company has to make 453 00:28:32.220 --> 00:28:36.060 because and they all carry budgets and identity 454 00:28:36.060 --> 00:28:39.820 security is in every boardroom these days. There's approvals for 455 00:28:39.820 --> 00:28:43.380 everybody. So so far we've not come across a 456 00:28:43.380 --> 00:28:47.020 customer who said okay, I don't have budget for this platform. Usually it's 457 00:28:47.020 --> 00:28:50.820 Even if they don't have its rolling budgets, they try to find budgets in the 458 00:28:50.820 --> 00:28:54.580 next budget runs. With enterprises especially they have 12 month 459 00:28:54.580 --> 00:28:58.220 financial ratio. So you start a POE and then 460 00:28:58.700 --> 00:29:02.460 if they, I mean based on the ROA and like you know the business 461 00:29:02.460 --> 00:29:05.500 case that we could build, they always find budgets for the next years. 462 00:29:06.060 --> 00:29:09.820 And when it comes to identity security, I mean even two 463 00:29:09.820 --> 00:29:13.060 years ago it was a lot of education that I had to do. 464 00:29:13.220 --> 00:29:16.980 Customers didn't understand because they'll say hey, I have cloud security platforms, why 465 00:29:16.980 --> 00:29:20.740 do I need you? But since last year the things have changed, right? So 466 00:29:21.700 --> 00:29:25.540 it's much more easier now. It's not, I should say it's not 467 00:29:25.540 --> 00:29:29.180 that difficult to explain to a customer why it's needed. And since 468 00:29:29.180 --> 00:29:32.980 a platform like us is not a replacement sale where we are not kicking out 469 00:29:32.980 --> 00:29:36.570 platform X and getting in, it's more an educational sale. 470 00:29:36.570 --> 00:29:39.850 Usually we are in addition to their existing security 471 00:29:40.090 --> 00:29:43.650 stack. So it's always finding budgets. 472 00:29:43.650 --> 00:29:47.170 Definitely the funding climate 473 00:29:47.170 --> 00:29:50.250 is difficult in the market but generally 474 00:29:50.650 --> 00:29:54.490 customers have budgets for security because they have to invest. 475 00:29:56.010 --> 00:29:59.770 That's why after AI security is the hottest market in the world. 476 00:30:01.050 --> 00:30:04.600 If you look at all the VC funding, probably not in Europe and 477 00:30:04.600 --> 00:30:07.520 Dach, but if you look at US and Israel, almost 478 00:30:08.560 --> 00:30:12.160 like security companies raise the. Most after AI companies 479 00:30:13.840 --> 00:30:17.360 totally makes sense if you have seen once the damage a 480 00:30:17.360 --> 00:30:21.200 hack could inflict on any company and if you're a smaller company 481 00:30:21.920 --> 00:30:25.760 that can mean the end of your existence as a company. Let's talk a 482 00:30:25.760 --> 00:30:29.040 little bit. If you look at, I mean the recent one I can share is 483 00:30:29.040 --> 00:30:32.620 Salesforce, right? So I mean there was a sales loft attack 484 00:30:32.620 --> 00:30:36.020 few six, seven weeks ago even a lot of big companies 485 00:30:36.180 --> 00:30:39.860 across the Globe. There were 700 companies affected because of this 486 00:30:39.860 --> 00:30:43.660 one single issue. This was based on a non human 487 00:30:43.660 --> 00:30:46.820 identity and this was, this is something that 488 00:30:46.900 --> 00:30:49.540 Unusuku covers by itself as a feature. 489 00:30:50.820 --> 00:30:54.260 I don't want to know how much damages and 490 00:30:54.660 --> 00:30:57.940 missed revenue this generated. But let us go into growth 491 00:30:58.490 --> 00:31:01.970 and vision. As we already said, you 492 00:31:01.970 --> 00:31:05.130 raised US$5 million. What 493 00:31:05.530 --> 00:31:09.290 are your immediate priorities and where will you 494 00:31:09.290 --> 00:31:13.130 be as a company in 12 to 18 months? So I mean 495 00:31:13.130 --> 00:31:16.810 we are doing like, so I mean we did a 496 00:31:16.810 --> 00:31:20.170 seed round early this year, right? Somewhere around March. Since then 497 00:31:21.050 --> 00:31:24.770 we've been focusing on hiring and sales. Right. So we are purely 498 00:31:24.770 --> 00:31:28.530 doubling on everything that we are doing. So we have at least we 499 00:31:28.530 --> 00:31:32.090 have onboarded a lot of new customers and we have a clear GTA plan. 500 00:31:32.330 --> 00:31:36.170 So the immediate goal is that we raise the cdc. I 501 00:31:36.170 --> 00:31:39.890 think we are close to getting there to kind of 502 00:31:39.890 --> 00:31:43.730 raising our next funding round. And our biggest 503 00:31:43.730 --> 00:31:47.170 vision is how can we become a category winner. There's no clear 504 00:31:47.170 --> 00:31:50.890 category winner in this space yet and why not that be us. 505 00:31:51.210 --> 00:31:54.540 So that's kind of the big vision we carry and 506 00:31:54.780 --> 00:31:57.100 yeah, and we are a Berlin based, 507 00:31:59.020 --> 00:32:02.220 Germany based security company and not many have pulled this off. 508 00:32:02.700 --> 00:32:05.980 So our goal is to already go consecutive markets 509 00:32:06.380 --> 00:32:09.780 and big vision. Right. So we are 510 00:32:09.780 --> 00:32:13.340 nothing pretty ambitious. We already have international customers 511 00:32:13.500 --> 00:32:17.300 and we are going consecutive markets. The end goal would 512 00:32:17.300 --> 00:32:21.090 be how can we be the category winner. Right. So that's, that's kind of the 513 00:32:21.090 --> 00:32:24.650 big vision. Santos, you've hinted at AI 514 00:32:24.650 --> 00:32:28.210 Copilots and UNO board. How do these 515 00:32:28.210 --> 00:32:32.050 innovations change the security game? Oh great. 516 00:32:32.290 --> 00:32:35.930 So this is the future of UNO Seqo. Right. So I mean with 517 00:32:35.930 --> 00:32:39.450 more and more companies and organizations and 518 00:32:39.450 --> 00:32:43.090 everybody using AI and with so much 519 00:32:43.090 --> 00:32:46.740 push in enterprises towards adoptic AI though it's all at 520 00:32:46.740 --> 00:32:50.380 POCS today, in the future we expect this to go 521 00:32:50.380 --> 00:32:53.740 mainstream for us. We need to stay relevant 522 00:32:53.980 --> 00:32:57.460 and we are building for the future. These kind of 523 00:32:57.460 --> 00:33:01.020 futures are going to help customers to secure their AI and 524 00:33:01.020 --> 00:33:03.740 especially from an identity angle. As I said before, 525 00:33:04.860 --> 00:33:08.420 agents to agent authentication and task based access 526 00:33:08.420 --> 00:33:12.060 control. Just in time permissioning for these kind of agents 527 00:33:12.060 --> 00:33:15.910 and what kind of access do they need to do their tasks Rather than giving 528 00:33:15.910 --> 00:33:18.870 them an admin. Right. Which they would easily leverage 529 00:33:19.670 --> 00:33:23.470 all these kind of scenarios. That's what we 530 00:33:23.470 --> 00:33:27.230 are working on. We are also working on converting a SaaS platform 531 00:33:27.230 --> 00:33:30.710 into an agentic platform so it can be more conversational for customers 532 00:33:30.870 --> 00:33:34.630 as well. But when it comes to security, it's still a lot more visibility 533 00:33:34.630 --> 00:33:37.110 that customers need rather than just conversations. 534 00:33:39.510 --> 00:33:43.150 We have something called as a findings database that we have built where 535 00:33:43.150 --> 00:33:46.950 we bring all this vantage point view and there are a lot of AI 536 00:33:46.950 --> 00:33:50.510 features that we have planned. For example, in the future we are expecting 537 00:33:51.070 --> 00:33:54.750 we will launch an agent which will automate an IAM engineer's 538 00:33:55.470 --> 00:33:59.310 task. And these profiles are very sparsely found 539 00:33:59.390 --> 00:34:03.190 in the market and companies struggle to hire these talent. For example, how can an 540 00:34:03.190 --> 00:34:06.830 agent do the task of enforcing least privilege? 541 00:34:07.070 --> 00:34:10.800 How can an agent do lifecycle management of an identity? 542 00:34:10.800 --> 00:34:14.640 So you'll be lodging all those independent agents which will be doing separate 543 00:34:14.640 --> 00:34:18.400 tasks and helping those IAM engineers 544 00:34:18.400 --> 00:34:21.840 and security analysts to improve their identity security 545 00:34:21.920 --> 00:34:25.480 posture. For 546 00:34:25.480 --> 00:34:28.880 our audience, Santosh is talking a lot about 547 00:34:29.200 --> 00:34:32.840 AI in cybersecurity, but our audience, I would be 548 00:34:32.840 --> 00:34:36.329 curious guys, do you think AI will solve more 549 00:34:36.329 --> 00:34:39.849 problems or create more problems in 550 00:34:39.849 --> 00:34:42.929 cybersecurity. Comment down here in the show notes. 551 00:34:44.369 --> 00:34:47.929 Santos, what's your long term vision for Uno 552 00:34:47.929 --> 00:34:50.929 Secure? Could this become the next 553 00:34:51.169 --> 00:34:54.289 category defining security company? 554 00:34:54.929 --> 00:34:57.809 Yes, as a founder, that's my ambition. Right. So 555 00:34:58.529 --> 00:35:01.489 definitely, I mean we have all the 556 00:35:02.140 --> 00:35:05.460 right, we have the right team, we have the right structure, we have the right 557 00:35:05.460 --> 00:35:09.180 kind of audience that we are going after. So I personally 558 00:35:09.180 --> 00:35:12.900 think, and also the team believes that if we are able 559 00:35:12.900 --> 00:35:16.660 to execute and the speed of execution that we 560 00:35:16.660 --> 00:35:20.500 are focusing on currently, I think we have 561 00:35:20.500 --> 00:35:24.260 all the foundations that's needed for us to become a large player in 562 00:35:24.260 --> 00:35:28.000 the industry. But at the same time, like any startup, 563 00:35:28.070 --> 00:35:31.430 you'll have to go through those journey. You cannot skip those steps. It's like playing 564 00:35:31.430 --> 00:35:35.270 a video game. Right. So you need to hit certain levels. But 565 00:35:35.270 --> 00:35:38.870 yeah, I mean becoming an independent identity layer 566 00:35:38.950 --> 00:35:42.510 as a company for all the large, all the 567 00:35:42.510 --> 00:35:45.750 customers that we are working with, definitely. Yes. And 568 00:35:46.150 --> 00:35:49.950 the big goal is how to get to like you know, 80, 80 to 100 569 00:35:49.950 --> 00:35:53.590 million in the next four to five years. Right. So that's, that's kind of 570 00:35:53.990 --> 00:35:54.790 what we are chasing. 571 00:35:59.110 --> 00:36:02.750 Looking back, what's one thing you 572 00:36:02.750 --> 00:36:06.550 would do completely different as a founder? I 573 00:36:06.550 --> 00:36:10.110 think entrepreneurship is like a disease, right. You do once and I think you 574 00:36:10.110 --> 00:36:13.950 always want to do it again. So. And I think with my previous 575 00:36:13.950 --> 00:36:17.630 two stints, I had some experience. I think if I have to, if you 576 00:36:17.630 --> 00:36:21.300 specifically ask me from a Nuno Singer angle, what I would have done 577 00:36:21.300 --> 00:36:25.100 differently. I think we were ahead of the game with 578 00:36:25.100 --> 00:36:28.660 our research and what we did. So probably 579 00:36:30.020 --> 00:36:33.300 like, you know, we had to do a lot of education with very less resources 580 00:36:33.700 --> 00:36:37.300 in the industry compared to most other peers from other markets. 581 00:36:37.700 --> 00:36:40.900 So some of those messaging and positioning 582 00:36:40.900 --> 00:36:44.540 exercises would have been different. And I 583 00:36:44.540 --> 00:36:47.960 rushed to start, probably, I would say, I mean, starting in Europe is hard, 584 00:36:48.520 --> 00:36:52.040 but I think starting in Germany is painful. Right. So I think. 585 00:36:52.200 --> 00:36:55.840 So that's all those kind of red tape and bureaucracy stuff that you go 586 00:36:55.840 --> 00:36:59.080 through could have been a bit more easier had I 587 00:36:59.960 --> 00:37:03.400 had a bit more like, you know, some more 588 00:37:03.400 --> 00:37:07.240 experiences or like, you know, I would say rather a bit more 589 00:37:07.560 --> 00:37:10.120 setup changes that I had that could have helped me. 590 00:37:11.640 --> 00:37:15.490 Yeah. But otherwise I think the market is big, opportunity is big. 591 00:37:15.970 --> 00:37:19.810 So I would do, I wouldn't do a lot of things differently, 592 00:37:20.050 --> 00:37:22.770 probably, you know, I would say 593 00:37:23.890 --> 00:37:27.090 those two points that I mentioned. Right. So I would have done it differently. But 594 00:37:28.210 --> 00:37:31.850 then initially I was also a talent was 595 00:37:31.850 --> 00:37:35.010 another problem. Right. So initially when I was looking for people here 596 00:37:35.650 --> 00:37:39.220 to especially in these areas, skill sets 597 00:37:39.530 --> 00:37:43.330 like cloud security and as well as development, finding somebody with 598 00:37:43.330 --> 00:37:47.130 all these three skills was very hard. So that also delayed a lot of 599 00:37:47.130 --> 00:37:50.330 R and D that I wanted to do. Then I started a team in India, 600 00:37:50.410 --> 00:37:54.090 in Bangalore. That kind of accelerated some of my stuff as well. 601 00:37:54.090 --> 00:37:57.610 So a lot of learnings. Right. So if I start again, 602 00:37:57.610 --> 00:38:01.330 definitely I'll apply all these learnings. And when you come to 603 00:38:01.330 --> 00:38:02.810 Germany, bring warm socks. 604 00:38:06.070 --> 00:38:09.670 Absolutely. Getting into 605 00:38:10.470 --> 00:38:14.150 one of the last questions here. What's your bullish prediction for 606 00:38:14.150 --> 00:38:17.670 identity security by 2030? Something 607 00:38:17.830 --> 00:38:20.630 few people right now see coming. 608 00:38:21.509 --> 00:38:25.270 So I think this will be the number one security investment that companies 609 00:38:25.270 --> 00:38:28.030 will make in the coming years and I think this is going to be the 610 00:38:28.030 --> 00:38:31.670 biggest. So identity is taking over and now 611 00:38:31.830 --> 00:38:35.630 when agents like protocols like MCP or Google's 612 00:38:35.630 --> 00:38:39.020 agent to agent, kind of all those things become more 613 00:38:39.020 --> 00:38:42.340 mainstream. I think the investments in this space 614 00:38:43.380 --> 00:38:46.260 has to happen. So I think 615 00:38:47.140 --> 00:38:50.420 this is now currently the number one investment 616 00:38:50.580 --> 00:38:53.460 customers are making. I think in the future it will be the same. Right. So 617 00:38:53.460 --> 00:38:57.300 by 20 to 30 this will still remain an unsolved 618 00:38:57.300 --> 00:39:01.060 problem. Right. So that's kind of the prediction that 619 00:39:01.620 --> 00:39:05.290 I can make. And I think there are 620 00:39:05.290 --> 00:39:09.050 studies that say with agents this problem is going to be 621 00:39:09.050 --> 00:39:12.610 40x more. So 2030 is not very far. 622 00:39:12.610 --> 00:39:15.410 Right. So that gives us 623 00:39:17.330 --> 00:39:20.930 a lot of problem solving and a mission that people should 624 00:39:20.930 --> 00:39:21.810 chase to solve. 625 00:39:26.930 --> 00:39:30.610 Let us get to the conclusion with the usual 626 00:39:30.610 --> 00:39:33.680 questions. Are you open to talk to new investors? 627 00:39:34.080 --> 00:39:36.560 Definitely yes. Definitely yes. 628 00:39:37.680 --> 00:39:41.120 We link down here in the show notes your LinkedIn profile so people can reach 629 00:39:41.120 --> 00:39:44.760 out to you directly. And of course the second question, are 630 00:39:44.760 --> 00:39:48.480 you looking for smart people to join unusecure also? Yes, 631 00:39:48.480 --> 00:39:51.440 definitely. We are hiring currently for different roles 632 00:39:52.000 --> 00:39:55.840 across Europe and we will also enter 633 00:39:55.840 --> 00:39:59.640 us. So there's a lot of open positions that we want 634 00:39:59.640 --> 00:40:03.340 to fill. Awesome. Santosh, 635 00:40:03.340 --> 00:40:06.660 thank you very much. Was a pleasure having you as a guest. Hope to have 636 00:40:06.660 --> 00:40:09.740 you back soon. Thanks Gio. Likewise. And thanks for hosting me. 637 00:40:10.380 --> 00:40:11.180 My pleasure. 638 00:40:16.459 --> 00:40:19.980 That's all folks. Find more news, streams, 639 00:40:20.140 --> 00:40:22.460 events and interviews at 640 00:40:22.460 --> 00:40:26.080 www.startuprat IO or 641 00:40:26.230 --> 00:40:28.150 remember, Sherry is caring.