 Hello, and welcome to SiliconANGLE News coverage. I'm John Furrier, your host of theCUBE and with SiliconANGLE News. We've got a great story here. Personally on .ai, raised $60.5 million in funding to launch this multi-cloud privilege access management platform designed for secure cloud access for DevOps teams and developers or platform users, trusted platform module technology, authenticate devices and identity management provides to map their user identity and resource to what they need. Eliminating the need for password changes, all kinds of vaults. This is where identity and security come together. This is about multi-cloud security and we have Akesh Agarwal, chief business offer, part of the founding team at Procyon. Akesh, great to see you. Cube alumni, welcome to the SiliconANGLE News segment. Appreciate it. Oh, thanks John, great to be here. So congratulations on the funding. Procyon.ai is the URL, but Procyon is the name of the company. Modest round, 6.5 million, not a mega round. It's not like 60 million series A, but good funding. Tell us about the company. What's the funding used for? Well, you know, I think things have changed. Everyone's getting a little bit more realistic. You know, we are obviously a young company and we're fortunate we raised money from lobby capital. And, you know, we're a classic Silicon Valley startup that's thriving because workloads are rapidly moving to the cloud. And one of the big areas in moving your workloads to the cloud is security. And within the security there are many different aspects of security. One is around managing access to who has what resource available to them. So the, you know, entitlement, what are you accessing, whether you are not getting overprivileged and you're not leaving those credentials behind sharing them with your DevOps engineers. That leads to compromise. So we're trying to solve that problem because what has happened is while cloud computing is great, it's also increased the threat vector dramatically because there's so many permissions and privileges out there. So talking about the problem, zero in on the problem that you saw specifically and what is the problem? What's the bullseye? Well, the bullseye is that if you think about it in the olden days, you know, you had a systems administrator and the systems administrator would take care of certain actions. And those actions were sort of limited to a certain group of people. Like for example, a database administrator would be a systems administrator. So that person would kind of go out and set up your environment for you. Now fast forward, you know, you can argue that everyone's a privileged user. Everyone has access to so many resources. And we have removed the friction with this CICD development that's going on and people are developing at a rapid pace. So what ends up happening is one, there are more people developing, they're developing faster. And number three, what's happening is the number of privileges and accesses and roles inside these cloud infrastructure systems has dramatically increased. So what happens is you basically have a zoo of actions and activities that need to be managed and monitored. You can't just rely on an old jump box with a systems administrator updating certain database files or logs and things like that. Now you want to be able to kind of give people, give the developers, you know, free access, but you also want to make sure that everything that they're doing is controlled, everything that's not getting spilled over. So that's sort of the problem we're solving. It's a very big problem for any company that has more than 100 engineers, really. Well, I mean, it's a core problem for all companies that with access to systems, with keys, passwords, because there are more services coming online and as you get the multi-cloud and super cloud and edge, you're going to have resources everywhere that need to be managed, almost on a micro level. Before we get into more of the bigger picture, I want to get some data on the team. Talk about the founder, the founding team, you're on the founding team. Talk about the company leadership, the origination story. How did it all come together? Yeah, so I met these guys through a friend of mine that I played tennis with. He had made an investment in the company during the seed phase. I got involved, started working with them in a consulting capacity, and I'm sort of bringing the business and the sort of sales leadership into the company. I'm one of the older guys there. They're three young guys. These guys worked at various networking and security companies, so they sort of at the nexus of networking and security. A couple of them worked at Pensando Systems, Cisco, Juniper, Intel. So they've got deep security chops and deep enterprise skills, and then they're layering on networking. As you know, cloud is all about the network, so they're basically bringing both those things together to the table. So they're all very heavy engineering and product driven, and our company right now is, we've finished the product, we're in a customer adoptions phase of the company, so it's kind of a fun place to be. And so those guys are doing development, you're handling all the business ops and sales and marketing and whatnot. That's right, yeah, all the business ops, sales, marketing, everything. We just launched recently. We've got about a dozen customers, and there's a lot of fun that we're having trying to solve this problem. What's it like for you? The big company with SAP, last time you were on the queue, we were at Sapphire, SAP, huge multinational global company. Well, you know, they say, can an old dog learn new tricks? Well, I would say that, at least I'm trying. Look, it sort of happens sort of indebtously, and SAP's a great company, learned a lot of good stuff, they're moving to the cloud. I've been in startups before, so it wasn't unfamiliar territory. And look, everyone's having to reinvent themselves, and I think it's a good challenge. I know I can always kind of work in the large enterprise, but right now it's trying to build something, has its own exciting sort of challenges ahead of it. You know, it's interesting the young guns coming up in startup lands and also inventing stuff, whether it's AI and or security at network layers, huge multi-cloud, for instance, super cloud. A lot of the old dogs, like us, been around systems people. It's a systems architecture now, we're seeing a lot of systems mindset. So it's kind of a nice mix between young and old entrepreneurs and executives and operators coming together, because the cloud and now edge and security, this is a distributed computing complex system problem. And a lot of the successes are starting to see new things come up that have that kind of complex systems mindset. And networking and security are going hand in hand, you've seen a lot of network virtualization, now you've got containers, you've got Kubernetes. How do you guys see all this emerging as you see access management certainly changing, and some cases being automated? Yeah, I mean, look, I think, you know, at least the way our company is looking at the problem is that you need to have an understanding of both the underlying resource and then how is that resource being delivered? The resource is being delivered over the network, whether the network's the public internet or a private virtualized network, you have to understand how data moves, because when data is in transit or data is stationary, it's vulnerable to attack. So I think from a privileged perspective, you're carrying a credential to kind of access your system and that access can happen, well, it's not will happen, it happens all the time over the network. So I think security is very networking dependent. I think we don't need to name the names, but you know Palo Alto Networks, their name is Networks Zscaler. I mean, all of these companies have a very heavy networking element to them. And I think that the area that we're in, privileged access management, you're accessing systems remotely, work from home is just another way, but even when you're inside your office, you're not sitting next to the computer. I have to ask you, how do you guys differ from the traditional privileged access management systems out there? Good question, yeah. So the way we differ is, look, fundamentally the architecture has changed, everything's become an API, so you're accessing API-based stuff. So developers have to kind of, and their managers and other personnel have to figure out who has access to what. In the olden days, as I mentioned, you would be accessing stuff through a jump box. You'd have an intermediate system, the systems administrator would sort of lock that, and he or she would go and access that. Fast forward now, everything inside is defined as an API. So if you take a look at AWS, for example, it's got over 13,000 privileges and 1,200 roles. So imagine trying to allocate, and they're all defined using an API. Imagine trying to kind of allocate who has access to what. You can't do it through a centralized system. So what we do is we inject all those APIs, put them inside of a system, and we give the DevOps manager or the IAM manager an experience like a shopping cart where they can define a workflow, and select which role and which user has access to what resource. It's always been a challenge to me. I always thought that access management and identity systems, it's like each one for each cloud has their own kind of thing. You mentioned Amazon has their own, Azure has their own, all kind of different. How do you guys look at the integration across different access management systems? Is that a challenge? Do you guys have anything there? Yeah, absolutely. Look, we are predicated on the fact that you're going to have many different access planes and points, whether it's multi-cloud, whether you're going after databases. I mean, even today, Snowflake has a range of privileges and accesses. So anything that you may have in the backend of the infrastructure that's API based, our goal is to be able to support that. Just like Okta was doing single sign-on for SaaS applications and they started off doing a few applications around your sales and analytics application and then, boom, they started supporting the entire enterprise apps. So similarly, we're supporting the major clouds right now, SSH databases and a few other services, but the goal is to slowly add on all the infrastructure. What's the secret sauce to the platform? Well, the secret sauce of the platform is really two areas. One is that we're making it drop dead simple. We do the heavy lifting of injecting these APIs and simplifying them into a simple self-service portal. That's one. And number two, I think you mentioned in the beginning, we are making this whole experience passwordless. And the way we're making this experience passwordless is we're using this technology called Trusted Platform Module. It's the chip that's inside your iPhone. It's the chip that's inside your laptop. Apple calls that chip secure enclave. And what we're able to do is cryptographically use that chip to bind your identity so that we can create a passwordless experience to access your infrastructure. So today, you and me as a user don't really have to type our passwords on our phone or on that. We're using... I love that, by the way. We need to get there. Yeah, well, developers need that. So the thing about it is we want to give the experience to a developer to seemingly go from one infrastructure access point to another. And that's kind of the goal. So there are two benefits to that. One, it removes friction. And second, it makes the CISO sleep well at night because there's no passwords lying around. I think, Akesh, that is to me a big thing. And not as an aside, Apple doesn't get enough props in my opinion for what they've done with the security piece of there. But this really comes in handy around social engineering, for instance, and or user error. You mentioned that earlier. The hackers are coming after people and trying to get through their access methods. That's the hacking. That's the vector that they want. This solves a lot of that problem. Can you talk about that whole social engineering? How this prevents that? Does that fit there in my off base? No, you're right. Social engineering, phishing attacks, and then credentials inadvertently being shared and being left behind. So I'll give you a simple example. Employees leave the company. Unfortunately, we're having a few layoffs right now. And what will happen is they'll take access to your core email and other things off. But what happens is they forget to take the access off to a core infrastructure point. And that privilege or that password or that credential is lying around. That credential can then be misused. It could be sold on the dark web. And that's kind of what happened at Uber, for example. Someone took the credential. Even Okta has had a compromise. If you take a look at some of the attacks that have happened, even at some major tech companies, they've been around identity. That's sort of, there's a lot of people that would say, identity is the new perimeter. So that's a single point of failure from where you can get that. Now, if you do it passwordless, they need to be able to get your computer. They need to be able to do MFA. And then get that. So you know when you lose your iPhone, it's not the end of the world. Yeah, the question I have for you that would come up, question, incident question is scale, reliability. How do you guys look at that problem space? Well, look, we'd like to think that, the founding team has worked at some great companies that have scaled their built products in those companies. So I think we're looking at it from that perspective. We ourselves are leveraging the cloud. So most of our stuff runs on the cloud. So we get a lot of support and help from that. We're not rebuilding a data center. And the other thing is from a cryptographic perspective, we're leveraging the powerhouses of Apple and Intel and others that are building these chips into the system. So you mentioned we're a systems, kind of system software play. So that helps us because we don't need to worry about the core infrastructure because that's very scalable and scaling. David and I both think that security is a do-over. It's happening now. It's going to be reset. Security has to be reset. It has to be platform specific. It has to be a systems. Too many tools are out there. I want to get your thoughts on the USA's White House just published the national cybersecurity strategy document published just this past week in March, 2023. It's really kind of suggesting public-private partnership. Even today, the government's not doing much for companies. There's no, the companies have to fend for themselves. The government's just saying, oh, partner with somebody else. Yeah, a lot of criticism to the government that should do more to protect us from the foreign adversaries. But they say a few things that want to get your reaction. The investment areas are threat intelligence, incident response, regulatory compliance, software supply chain and development practices. Those are the key areas that they summarize. And then the other ones, the key areas that mostly out there now, zero trust, compliance, audit automation, understanding your environment, supply chain, data governance and tech modernization. This is what they want the private sector to focus on emphasizing internet of things, collecting and handling personal data and critical infrastructure. All those have identity kind of weaved into them. They didn't really call them out specifically in the high level bullets. But you guys have potentially a solution that fits into that narrative. How does that report impact what you guys do? I think the report, firstly, I think it's a great move that the government is really putting their best brains behind this to create this public-private partnership. In fact, there was a great piece in the Harvard Business Review written by Farid Zakaria as well as Hemant Taneja from General Catalyst. And they talk about this thing that the next generation of companies are gonna take longer to build. They will have to have a very significant component from support from the government. Again, they're talking about, if you think about some of the attacks that have happened, they impact the government, they impact the country. It's not a business losing credit cards. It's the pipeline attack that happened and other attacks that likely can happen to the grid and other things like that. So the government is very concerned and cyber warfare is real. So now let's take a look. I think they've identified some of the big things. I actually fortunately have read that report. It came out yesterday, I believe. And section 4.5 of it talks about digital identities. And I think one of the ways is, I think the government in the report is identifying, that's a critical point from where a lot of compromises happen. And I think one of the ways in which the government could move these things forward is to have a national identity system that's electronic right now. We're still carrying around a lot of our cards. You go to Europe and some other countries. Everything's digitally encrypted. So why can't I have my ID built into a TPM chip, for example? It's just a matter of time. It's a matter of time. It hasn't happened. I don't walk around with my credit cards ever. I have my phone, I'm using Apple Pay. That's pretty damn secure. Yes, could it be broken? Yeah, unlikely. But you don't hear of everyday compromises on Apple Pay. But I think digital identity needs to go in that sort of realm. And then fast forward that inside the enterprise, inside the enterprise, you've got developers accessing critical infrastructure. Today they're getting frustrated because they have to use arcane techniques. Why can't they use Face ID? Why can't they use Glide In and Out? And a whole transaction record is sort of... And that's where you guys are focused on. Yeah, that's what we're focused on. We're not trying to solve the digital identity problem. Many other companies are doing that with various techniques. We are focused on accessing cloud-based infrastructure that's API-based to make that easy so that IT or DevOps can administer who has access to what and it's being done in a clean, crisp way without having exposure to passwords. So you guys make all that easier to ingest just so people don't fumble and make a stupid human mistake by leaving. Well, and also you can give fine-grained access. So one of the things that we do is called just-in-time access. So John needs access to the S3 bucket to kind of do this task today, after which that credential needs to be retired. Today, that's not really possible. Either you have a long-lived password or a credential that kind of persists or you're using a secrets manager to kind of map that. But two problems. One, you're getting over-privileged. And second, you're leaving a door open for the bad guys to come in. Akash, great to have you on for the new story here. Great to see you again. Congratulations on the new startup. Is, what are you guys looking to do? Could put a plug in for the company. What's your goals? You got some cash, husband your resources, as they say. You got to make that work, make that round work. What's the next step? Look, if you're deploying cloud-based resources, you've got more than a hundred engineers, give us a shout. And maybe we can help you manage this credential sprawl, manage this privilege access management problem that you're either facing right now and ignoring, or you will face very shortly. So that's kind of what I'll leave you with. And just real quick clarification. You guys are in motions now with customers. Yeah, yeah. The product is shipping. We've got about a dozen customers. And we're moving forward to kind of add to that. And the business model is SAS, buy as you go. Yeah, business model is very simple. It's the number of users accessing or the number of users you're wanting to sort of manage their privileges. So it's a very simple model where a startup, we don't want to make it too complex. Get aiurl.ai. I'm assuming there's some AI involved? Yeah, I mean, OK. We have some AI involved, yes, absolutely. We are looking at all the data that comes in. There's a lot of analytics that's done. And we're leveraging AI, obviously, to be able to get better outcomes from the data that we have. So we can go and find out, for example, what credentials are out there and what would be the right map or the balance of credentials that you should have. You can do a lot of the heavy lifting for you on some of that hard work so you guys could be more focused on getting that right credential. Yeah. OK, it's great to come on. Thanks for coming. Thank you. Thank you, John. OK, I'm John Furrier here with SiliconANGLE News. Thanks for watching.