Veza blasts out of stealth with cybersecurity approach, Google Cloud partnership

Editor's note: As part of the Bay Area Inno Awards, the San Francisco Business Times and Silicon Valley Business Journal are highlighting nine startups from nine categories across the innovation space. We chose these firms based on their ability to fundamentally change the game in their respective fields, grow quickly and durably and develop useful products to solve compelling problems. Here's the honoree in the cybersecurity category.

When Veza Technologies Inc. came out of the shadows in April after two years of working in stealth on a cybersecurity play, it did so with the announcement it had raised $50 million in venture backing. Not long after, its total venture haul would hit $110 million.

That’s an impressive showing for a startup entering a crowded space where, by one count in 2021, 30 cybersecurity startups had hit unicorn status with a valuation of more than $1 billion. But the team behind Veza — a Los Gatos-based startup that started in 2020 with the name Cookie.ai — was convinced they had a winning product because they were boiling cybersecurity down to a simple core.

“How come we don’t have a search engine in the world which can say what Sonya has access to?” said Tarun Thakur, the co-founder and CEO of Veza. “Organizations need it so that they can control it and trust it.”

What Veza has done is create software that uses the metadata that gets passed through the various applications and systems companies use to identify specific team members and link them with the resources and permissions they need to perform their jobs.

“The biggest threat to securing your data is an abuse: somebody getting access to something they should never get,” Thakur said. The biggest data breaches in the past few years — including attacks against Palo Alto Networks Inc. and Cisco Systems Inc. — were “rooted in somebody getting access to something they should never have.”

For example, when oil transporter Colonial Pipeline Co. was hacked last year, it was deemed a national security threat. That hack occurred after an employee took the same password used to access Colonial’s corporate network and reused it in another location.

“An ex-employee left the department, he still had access to something, and half of the U.S. energy (market) was shut down,” Shet said. “That really is a problem we’re going after.”

Thakur developed Veza, which is the word for “reveal” in the Zulu language, with two colleagues from his time at Datos IO, another cybersecurity startup he co-founded in 2014 that was sold to Rubrik Inc. in 2018. The co-founders — Maohua Lu, who Thakur first met when they worked together at IBM Research in 2005; and Rob Whitcher, who Thakur worked with at EMC Corp. starting in 2009 after EMC bought the first startup Thakur founded, Data Domain — left Rubrik along with Thakur in 2020 to start Veza. Lu is now Veza’s chief technology officer and Whitcher its chief architect.

The three realized that the shift of data from being stored in private servers to being stored in the cloud made it more vulnerable to attacks because data was being distributed to more places than ever before. Companies could better protect their data if they could know at all times who in their organizations had access, Thakur said.

Developing Veza in stealth mode, something Thakur had done previously with Datos IO, was crucial. “If you want to build something of value and something enduring, you want to take your time to build the company,” he said. “You’re not just building your product, you’re building all the facets.”

Today, Veza has about 50 customers, which usually sign multi-year contracts of no longer than three years, Thakur said. He declined to state a range of fees charged by Veza, but said the company is aiming its service toward both enterprises and companies with 5,000 or fewer employees. “That bimodal go-to-market gives us a very broad business opportunity,” he said.

Last month, Veza announced a partnership with Google Cloud, the Alphabet Inc. subsidiary’s competitor to Amazon Web Services. Google Cloud customers can use Veza’s software to analyze who is using applications and systems, and better manage permissions.

Since Veza is addressing cybersecurity with a dual focus on identifying users and protecting data systems, its total addressable market (TAM) is huge, Thakur said.

“We bring those silos together, and nobody has ever done that,” the CEO said. “Long-term, as we look at the next decade ahead of us, our TAM is a hundred billion-plus.”

Veza Technologies Inc.