DataTribe Challenge Finalist: Ackuity.ai

Welcome to the Cybersecurity Go to Market podcast for a special showcase episode where we are talking with leaders of the company selected for the 2025 Data Tribe Challenge, where Data Tribe, the foundry for cybersecurity, have identified five startups which they believe are the most highly innovative in cybersecurity today. I am your host, Andrew Monahan, and today we're talking with Rajat Mohanti, CEO and co-founder at Ecuity AI. Rajat, welcome to the podcast.

Thank you for having me here, Andrew.

Yeah, I'm looking forward to this episode. It's an exciting time for you as you're in your second go around building a company. So I'm keen to understand as you're going around the second time how things are going and how things doing things differently. But let's go right back to the start. What's the story behind you first getting into cybersecurity?

Yeah, take me almost uh 25 years back. Uh this is in the year 2000. I was living in India at that time. And you know, that that was the internet boom era. So many things are happening around the internet. I was just out of my college in my first job and dreaming to become an entrepreneur. But I had no clue which business to be into. So what I was doing was reading up everything that I could, browsing the whole day, looking at what's happening in the internet world. And one phrase kept coming again and again, the gold rush. And I started digging around, digging not for gold, but digging into the Google to see what this means. And I learned about the gold rush of California in the 1850s. It was a distant thing for me sitting in India and reading about California that day, that time. But that was an aha moment for me. What I learned was the businesses that succeeded in the gold rush were people who were supplying things like shovels, the tents, the clothes, the famous Levi's jeans that came up from the gold rush, right? And that gave me a direction that, okay, if the internet is going to be here, what's the internet's version of showels or the Levi's, right? And again, I kept searching, and security in my mind was a very logical thing that if everybody else is building uh websites, apps, platforms, they all will need something to keep bad guys out, right? And and I thought I should be the guy selling the digital locks and all the alarm systems to everybody in the internet. And that's how I got into cybersecurity, trying to sell, I would say, showels to everybody. And that's the same thing I'm doing now. Now it's a different rush, it's an AI rush.

And in 25 years, cyber's changed so much as well, right?

It's right. When we started, uh many people confused me as security, are you a security guard? Winding in front of a door. Yeah.

That's funny. Well, what's the story of the founding of Acuity? When you and your co-founder were sitting somewhere at a point in time going, you know what? I think we should start a company doing this. Where were you? Take us back to that time.

Yeah. So, like you said, this is our second stint doing a startup. My previous startup was Palladian, which was into managed detection and response. Uh, we were one of the early vendors in managed detection and response when Gartner created that category way back in 2014, 2015. We were one of the handful of vendors there. And also we were one of the early exit in managed detection and response, the NDR market, uh, when we sold it to Atos, the French multinational, way back in 2020. Then we we were looking at models to do after that. Again, the same thing, digging around, no idea what to do. But we knew we had a background in detection and response, and we needed to do something around that. And then in 2023, Chat GPT happened, right? And it was like again an aha moment. You could talk to computers as if you're talking to friends. And by 2024, these guys were not only just chatting, these were becoming quite adept in thinking, planning, reasoning, and essentially acting on their own. So that the whole concept of agents came up last year, 2024, because all these LNMs became so mature in terms of thinking and planning. And then we realized that what we had built as detection and response would be needed now for these agents. Because these agents are going to be your biggest insider threat. You haven't seen this kind of insider threat in the past. And enterprises have no visibility into these agents. They don't have tools right now to know what these agents can do and cannot do. And that was our genesis of we know monitoring. Now let's apply it to these agents.

And do they recognize the gap they have in visibility and control? Is it just something they just intuitively get, or is there education that you have to do as well?

There is a bit of education because it's early days. It's a kind of a little bit of dichotomy. The security teams need to know more about AI and how AI works and agents work. And the AI team, of course, need to know more about security. And somebody has to do that bridging. And that's that's that's what we are seeing everywhere. We need to be the guy to bridge AI for security and security for AI.

And are they doing anything right now at all to control all this and give visibility, or is this all green field for everyone trying to do AI security right now?

So that's an interesting thing to look into. So there are monitoring tools that enterprises have for security, right? But they are all meant to monitor humans interacting with systems. When I say human, it could be an internal employees, contractors, or an attacker. Finally, attacker is also a human. And then all these tools are all about looking at a log and doing some rules. Like if X happens, do Y, right? But when you look at agents, there's no log. There's all natural language. And you have to make sense of it. There is no rule like if X happens, do Y. I usually say it's like this. The current systems are more like you have an Excel sheet, you're reading an Excel sheet and you're doing addition and subtraction. But for an agent, it is like you have to read a novel because all this are all the data that's coming from an agent. It's like reading a novel and trying to predict is and what is going to happen in the story. So it's it's it's a very different way to look at obviously the underlying plumbing is going to be the same. Collect data, do some real-time analytics and all, but it's a difference in how you would read a book versus how you would read an Excel sheet.

And how much was your lear were your learnings from the let's call it the NDR world of the last, you know, between 2005 and 2020? How much of that was applicable to this agentic world? And how much is it, you know, this is so different, we need to start this bit again and re-refigure it out?

Yeah. So uh yeah. So so again, we are still learning, but the underlying infrastructure of collecting data, processing data, storing data, making sense of it, that concept is the same. But like I said, the data is different. And how do you make sense of it is different. So what we are doing here is if you want to really make sense of it, you can't make sense of it just by rules. You have to have three things together. You need to have a semantic understanding. That is what I mean by semantic is when everything is coming as natural language, what the agents are uh talking amongst themselves, what they're reasoning, what the user is asking. When all of that is in natural language, you need a way to understand and make sense of that. Then, of course, you want to have some rules. Agent should not violate something, agent should not go and access somebody else's data. That's rules. So you need to have a rule detection kind of thing. And also you need to have a lot of behavior. These agents can do things very drastically different because one day they just decide to reason something out, right? One day they just decide to go and delete a database. Why? Because they just thought it's a good idea, right? So you need to look at a lot of behavioral analysis also. So those are the different things. I mean what I used to say is in the past, you are just having a kind of a detective looking at it. Now you need a philosopher who is reading what these guys are doing and why they're doing. You need a scientist who is also looking at what else these guys have done in the past. And of course, you need a judge who is looking at all of this and saying, does it make sense? So it's a combination of philosopher, a detective, kind of scientist, and a judge coming together to make sense of what these agents are doing and why they're doing and what should not they do. So that's the difference.

Got it, got it. I'm thinking about a question that I'm sure you get a lot because there's so many security companies and AI, let's call it the wider world right now. So the people ask you, how are you different too? And they'll fill in the blank of which company they they've heard of or whatever in the space. So, you know, famously two and a half years ago at the Innovation Sandbox RSA, Hidden Lair won that. Harmonic was in that same class, I think, as well. And you know, since then there's been an explosion. So, how would you say you're different in in the world of AI security compared to everyone else?

Yeah, so so this Gen AI has evolved. Uh, if you look at two years back, it was all about users chatting with LLMs. So I want a better email to be written. I send an email to the LLM, it writes back a better email and give it gives it to me, right? And there the thread was am I sending some sensitive information to this LLM? So put a firewall which looks at it. And are these LLM sending back something bad to the user? So again, the firewall looks at it and sends it, sends something back. But when you have real agents working in an environment, they are not just a chatting sister, right? They act, they think, they plan. They are like a user. What is that means you would actually replace a role with an agent? May not be 100%, but suppose you have a role like sales, say salesperson, you will replace 70% of that role with an agent. So these agents will do work. And then it's not about just what's happening between an user and an LLM, but what's happening inside these agents. And then the downstream, what are these agents doing to your systems down the line? Using tools, APIs, function calling, direct database access. So I say it's like this. The first generation was all about, if you look back factory and quality control, right? Initially, you said everything that is coming out of factory, I will check that. So the first generation of AI security was like that. Anything that users and LLMs are doing, I will check that. But then the quality control said, that's not right. We have to go deeper into factory, start looking at what's happening in inventory, in assembly line, in shop flow, so that the quality is baked in across. That's the same thing that needs to be done in agent now. Not just between users and agent, but what the agents are doing, what they're thinking, what they're planning, the chain of thought, what they're doing next downstream. So that's that's our product. We are like a full cycle visibility as first. And once you have visibility, then you have all these models. Like the first generation solutions are more about semantic detection, which I call as philosophers looking at it. But you need to marry it with the rule base, the heuristics, the anomalies, and a kind of judge looking at all of that. So that's the second innovation for us. So that's how we are looking at it as we are different from everybody else.

Got it, got it. And and what have you learned so far about your ICP for this?

Yeah, so right now agents are getting rolled out for large enterprises. So, so large enterprise in the financial sector, healthcare, tech, all these places, right? Because that's where usually these big investments are happening. So they are our ICP right now. But having said that, agents will be used everywhere down the line, right? You may not know it, but you'll start using agents because every application that we have today, whether it's an ERP application, CRM application, your tech Salesforce, SAP, HubSpot, anything, any application you, or in even your Microsoft Outlook and all, all these applications are adding agents. So you would end up using agents without maybe realizing it. So right now over ICP is the last guys, but very soon it'll be everybody, mid-market, upper mid-market, wherever there are agents, they will need a security and a security visibility layer on top of that.

Yeah, it feels like there's a whole wave of companies out there who are helping mid-market and lower enterprise to figure out and adopt AI. And they'll be leaning in towards agents, agentic things to do, as opposed to one-off tools here and there, right? Because that's going to be where the bigger impact is going to be. And that's probably going to be the catalyst for a real explosion in that space.

Right, right. Because the way we are seeing it is if you are a company and agents are there working somewhere inside your company, you need a fundamental layer of visibility and monitoring into these agents. And then it'll tell you that layer will tell you where are the weaknesses. This agent did something wrong. Then you go and correct that. But you need that fundamental layer that helps you not only to control these agents, but also to know where else you should be improving if these agents are going wrong.

Yeah. One thing that structs that strikes me in the AI world is in general in cyber, funding for cybersecurity tends to lag the threat, right? It's not often that funding goes into something where there's a perceived threat. It tends to follow when there is a threat. And sometimes there's a big public thing that happens, right? I'm thinking like uh ransomware, for example, right? Funding for investments in cybersecurity to protect ransomware came after everyone got scared about what was happening to other companies and it came with that. What's going on? I just don't know. I mean, what's going on right now in the real threat experiences around AI? Are there things out there that there's stories out there of companies really getting hit by AI-related or a gentic-related uh threats, or is that still something that the industry is kind of waiting to happen because we know it's going to happen at some point?

Yeah, yeah. So that's an interesting point because there are there are companies who are quite mature. The CISOs are mature, the security team is mature, the risk management framework is well established. They usually don't chase this uh threats. They are more like, we need to have better security, irrespective of what I read in the newspaper about threats. But having said that, the larger portion of the market is, I haven't heard about a threat, so I don't know if I invest, right? Because all of a sudden then, security doesn't increase your revenue or reduces your cost. It's a risk reduction. And the way to quantify your risk reduction is are there threats happening? And can I go back to my management and tell them this is this is this was a news item, right? So, so so sadly that's a reality or a truth for the majority of the market in security and funding, therefore, follows that. So, right now, if you look at the AI market, the threats have started getting reported, reported. There are some of them like EcoLeaks, which is Microsoft Co-Pilot threat. Recently, database agent replete that got reported. The agent on its own decided one day that I should just go and delete a database. So those are getting reported. The risks, as we know, means we are in the security industry. We have been trying to enumerate these risks. OASP has been doing some work. Atlas might uh miter Atlas has been doing the work, but it is still early stage. We haven't, as an industry, understood all the risks. So, so so yeah, so funding will happen, but it'll be a little bit lagging because the risks are still to be fully understood.

I'm really interested in your answer to this next question, Raja, because you do have experience of Palladium and what you've learned from that process over the years. What's most important these days? Product or distribution?

Yeah, I I know, I know this is a question that's going around. And and people are leaning more towards distribution right now. I I've heard this uh argument. They say that with all this software, automation tools, and copilot agents and all, writing code is easy. But because of the clutter in the market, reaching out to your ICP and customer is difficult. So, so also distribution is a bigger thing. I have a slightly different day. I I know distribution is a big thing in the long run. As you mature, as you grow, distribution beats everything. We know Microsoft can beat anybody the day they decide to add a product, distribution is there. But that's that's slightly longer term. When you're starting a journey, you want your early customers to be raving about you. You want them to be your real champion. You want to put them up in front of your prospects as a reference, as a testimonial, as a ref call, right? Reference call. And you you want these guys to do it again and again and again for your prospects. That's how you grow in the very early stage. You you don't hire hundreds of salespeople and knock doors and show them products. You grow with, get a few guys, and they become your raving users, advocates, and they go and talk word of mouth. And then you bring new prospects and make these prospects talk to these guys. And that's where your early stage product has to shine. And then you add the distribution after that.

A couple of things struck me as you were talking there. One is, you know, it used to be the case 10, 15 years ago, that people would say, if you're not embarrassed by your MVP, you're not embarrassed by your first product, you're you've waited too long to ship, right? I feel like these days, with how far people can get, I wonder if that's still true, right? I mean, to your point, right? If you if you have to delight someone, your first five customers, you can't delight someone with something that's barely stuck together with scotch tape, right? It's gonna, it's gonna be some sort of experience that makes them feel delighted by working with you. So they are they are raving. Because the bar has could have been, what is it, lowered, I guess, about what it takes to get a product out there. The question is, well, how does your one stand out from the other 45 that got released in the last couple of months by someone sitting there with with Bolt or with uh with Replit or whatever, just saying, oh, yeah, we let me Vive Code a security tool. It feels like maybe there's a slight shift in the in the thinking needs to be done there. Would you agree or disagree with that? I I completely agree with that.

I mean the MVP concept has been overblown. I think you obviously need to create a minimum product, but it has to be a minimum lovable product.

Oh, I like that. MLP. Yes. MLP. Yes. I'm gonna write that down.

Because you want your early customer, and especially in B2B sales, we have done this, right? Every time you approach a new prospect, they'll ask, can I talk to somebody? And if your current customer is not willing to pick up a phone, not the first time, but the 10th time also, you will not gain your new custom. So how do you make your current customer talk the to the 10th guy, to the 20th guy, to the 25th guy, only if they really love your product?

Yeah, yeah, I love that. Minimal lovable product as opposed to viable product. A good concept, like that a lot. What does the rest of 2025 and into 2026 hold for you and for acuity, Roger?

Yeah, so we see 2026 as a year of agents. I mean right now, lots of companies have been experimenting, piloting. I think a lot of this will go out in production next year, all the agents, both custom agents built inside, as well as agents from the third-party products, like all these application providers, right? And there we want our platform to be a platform of choice for monitoring and observability of these agents and all. So that's one part of our goal for 2026. And that's probably related to your question on distribution. We want to have a good distribution so that it becomes a platform of choice for people rolling out agents. But having said that, we also know that these agents will become more uh mature, more autonomous, more smarter, I would say. The intelligence is only going to grow in every next release of LLM. And then that means these guys will become more riskier. If they can reason more, they can also do more wrong reasoning, right? So that's where the product comes in. So that's our second focus for us in 2026 is to make sure that we are deepening our detection capabilities and making the product really, really innovative in terms of monitoring all these advanced agents and their behavior. So that's the two goal.

Well, Rajat, I wish you, Vinod, and the whole QT team huge success for the rest of the year for the Data Stripe Challenge and also for 2026. Thanks for joining us today.

Thank you so much for having me. It was a pleasure and uh really excited to talk about what we are doing. So good to meet you today.