Articles by Indus
Activity
28K followers
-
Indus Khaitan shared thisMaybe security needs worse UX. For years identity has optimized for fewer clicks. - SSO - Passwordless - Seamless access Click here, click there and you get access. This is great for employees and also great for attackers once they convince one employee to click. If the reporting on McKesson is accurate, two employees were voice-phished. Later their IdP identities opened Salesforce and Snowflake, and roughly 1TB of data was exfoliated over four days. We need deliberate friction when blast-radius changes. There should be a category of account that says, “No SSO for you. Run two mikes on a company supplied treadmill before your credentials are accepted.” And lastly how does 1TB leave without someone noticing? APIs have failed us and this topic doesn’t get any love when you submit a session at industry conferences. I feel that as an industry we disproportionately spend time on shiny objects, a la AI Security, while ignoring the basics. PS> If you are at Identity Week in DC in the next few days, hmu to riff on the politics of SSO. Puneet Bhatnagar Steve Zalewski Suresh Batchu
-
Indus Khaitan shared thisMore than a decade living in America, and I have somehow never been to Washington DC. That changes next week. I’ll be there for IdentityWeek. Outside the conference, my ambitions are modest: - See the Capitol - Sit at the Lincoln Memorial late at night - Get lost in one Smithsonian Walk around a city I’ve mostly known through history books, action movies, and news. Looking forward to this bigly.
-
Indus Khaitan shared thisI don't think you can separate the agent from the harness yet. Most open source agent harnesses I investigated are basically building the walls of the barrel. Sandboxing, permissions, tool allowlists, and maybe kill switches. All useful, but that is containment. It keeps the motorcycle or the Maruti 800 DX inside the barrel. It does not keep them from falling off the wall. I grew up seeing the Well of Death during Durga Puja. The annual festivities build out would start just around this time. Back then I was mostly wondering how the guy did not fall off. More than just physics, that is also a useful question for agent systems. The harder problem is execution reliability. State, retries, validation, idempotency, recovery, aborts, evidence. Those have to be designed with the agent because the system needs to understand what the agent is trying to do, what state it is in, and what success or failure actually means. It is a bit like saying transaction processing can be completely separated from the database and some external layer will guarantee ACID. You cannot put a transaction manager in front of an arbitrary database and suddenly get ACID. The database itself has to implement the primitives for commit, rollback, isolation, recovery, etc. Agents are still figuring out the equivalent primitives. We haven't even agreed on what BEGIN, COMMIT, ROLLBACK, and ABORT mean for an agent. We are in the very early innings of figuring this out. PS> If you are building an agent harness and disagree with me, I’d love to partner. Let’s see how much of the Redblock agent runtime we can actually externalize.
-
Indus Khaitan shared thisI hope AI fastracks the path towards AGI so I no longer need to drive on the expensive roads of the Bay Area. I can live in the Sierra foothills on a patch of land, power a flour mill with the kinetic energy of a stream, grow my own food, and have a few AI agents deal with civilization on my behalf. Maybe the ultimate promise of technology is not abundance. Maybe it is finally earning the right to opt out. No commute. No toll lanes. No badge swipes. No Calendly to give out. Just me, the stream, and an autonomous agent periodically explaining to DMV that yes, I am still alive. And maybe 2,000 feet of grass to land a 172 when the stream gets boring. We spent a trillion dollars building artificial intelligence so all of us could eventually return to the 1800s.
-
Indus Khaitan shared thisWhen I was learning to fly, flying from Livermore Airport to the Sausalito VOR and back was a favorite route with views of Golden Gate Bridge. I flew visually and did not file a flight plan. My flight instructor and I were the only ones that knew where I intended to go. The aviation system could observe our state, but not our intent. That old flight is how I think about intent-based security for AI agents today: directionally right, but not mature yet. Modern commercial aviation has evolved and externalizes both intent & state. A flight plan states where an aircraft intends to go. ADS-B Out continuously broadcasts its identity, position, and altitude. But, AI agents do not yet have the equivalent of a standardized flight plan. Their intent remains buried across API triggers, prompts, context, memory, policies, and a plan that can change during execution.
-
Indus Khaitan reposted thisManaging access across apps that don't integrate with standard IAM stacks is a pain point almost every enterprise faces. Love seeing how Redblock is tackling this problem head-on with AI execution. Come and meet the team onsite at Identity Week America - Stand S32 - September 2-3, 2026, Washington D.C.! Are you building something innovative in the identity space? Drop me a PM to find out more about getting involved in our Start-Up CityIndus Khaitan reposted thisWe're excited to welcome Redblock to Identity Week America 2026. Redblock is a cybersecurity company using Agentic AI to secure the 80–90% of business applications that sit outside traditional IAM coverage. Their platform automates complex identity decisions - such as Joiner-Mover-Leaver updates, access provisioning, and entitlement aggregation - directly inside legacy, disconnected, or custom apps. Designed to close the "last-mile" identity gap without requiring multi-year custom connector projects, Redblock eliminates the need for manual tickets and spreadsheets, helping organizations instantly remove access and halt entitlement creep. Meet the team in the start-up city at Stand S32 at Identity Week America 2026 and discover how they're bringing continuous, automated governance to the entire application estate. Get your pass now: https://lnkd.in/eEcCMN-j #IdentityWeekAmerica #StartUpCity #IAM #IdentitySecurity #AgenticAI #IdentityGovernance #Cybersecurity #Innovation
-
Indus Khaitan reposted thisIndus Khaitan reposted thisBlackhat wraps today. I went back through the Briefings agenda looking for identity security and came up nearly empty. Indus Khaitan flagged the same gap, and once you both notice it independently, it stops looking like a coincidence. AI dominated almost every track, autonomous fuzzing, LLM exploit agents, agentic offense. Identity got a passing mention here and there. No track. No real weight in the program. I don't think that's an oversight, and honestly I think it's a mistake the industry keeps making. Briefings reward a good zero-day. Identity misconfiguration doesn't produce one. It produces something slower and more dangerous: standing access nobody remembers granting, service accounts that outlived the project they were built for, permissions piling up quietly until the day they're the reason a breach went from "contained" to "catastrophic." That's not a research paper. That's just Tuesday in most enterprise environments, and it's exactly why most breaches that make headlines had a boring identity failure sitting underneath the exciting exploit everyone wrote about. Here's the part nobody wants to say out loud: SOCs aren't failing because they lack tooling or headcount. They're failing because the denominator keeps growing. Every standing entitlement, every unused permission, every identity nobody's revisited since onboarding adds to the pile of things worth watching. You cannot hire your way out of a denominator problem. And every session on that same agenda about agentic AI is about to make the denominator problem exponentially worse. Every agent spun up gets an identity. Every agent that calls another agent creates a permission relationship nobody provisioned by hand and nobody's reviewing on a quarterly cycle. A human joins a company once and leaves once. An agent can be instantiated a thousand times a day, each instance inheriting scopes, each one a new line item in the denominator, and most of them will outlive whatever task justified creating them. The math that already didn't work for human identity governance is about to run at machine speed. That's not a future risk. That's the actual subject of half the talks on this agenda, and almost none of them are naming it as an identity problem. The only lever that scales is shrinking the denominator itself, collapsing blast radius by tying access to real-time context instead of a provisioning decision made eight months ago and never revisited. That's true for humans. It's non-negotiable for agents. This is the exact gap ACP was built to close. Identity, permission, intent, and context aren't four bolted-together controls, they're one authority decision, made well or made badly. A5 of the series drops soon, going deeper into where context and the SOC's blind spots actually meet. Identity is the control plane. Agentic AI just made ignoring that unsustainable. #AuthorityAsControlPlane #IdentitySecurity #BlackHat2026 #AgenticAI #SOC
-
Indus Khaitan shared thisIn 2023, a team of 10 and I set out to see whether Agents can automate manual cybersecurity tasks. Remove IT Tickets & CSVs. We were bootstrapped for the first 8-9 months. We did not even know that such a thing was possible. Could Agents even predictably perform these mission critical tasks? We were very very nichely focused on Identity governance use cases. Such as, aggregating user/entitlements for rapid access reviews, full-lifecycle operations when APIs or SCIM were not available in web applications. But what ended up happening was that we created Agents that deterministically execute enterprise tasks across IT and Cybersecurity. - Agents that execute based on a policy - Agents that perform tasks, and capture every moment - Agents that are never autonomous - Agents that are meticulous and step-by-step - Agents that recover or fail graciously with forensic evidence What we thought would be a simple contraption for automating any imaginable last-mile task requiring human intervention--took us on a wild-goose chase. We had to build the underlying technology and infrastructure required to make Agents predictable. The niche in Identity governance was the proving ground. And a very lucky proving ground because when the agent is deactivating a user account, there is no margin of failure. We started by automating disconnected identity workflows, but ended up building the execution infrastructure required for agents to perform real enterprise work predictably. Today, the enterprise agent opportunity is about harnessing & constraining the models enough to be trusted with consequential work. In 2023, we did not know whether agents could perform mission-critical work predictably. 24 months later, that question has become the company’s core technical conviction. And a lot more to be done beyond our early adoption. Steve Zalewski Ashok Kakani Puneet Bhatnagar Archit Lohokare Suresh Batchu Manoj Apte Francis Odum Redblock
-
Indus Khaitan posted thisWhile 99% of AI-pilled security practitioners are talking about agents escaping the sandbox, two weeks ago, hackers convinced a Brinks home security employee to convert an attacker into a trusted enterprise identity. Salesforce and Cresta then accepted that trust and exposed everything the identity was authorized to see. They stole more than 4.9 million Salesforce records with PII. Once the adversaries were in, they most likely ran a mass export of these records. Yes, AI is dangerous. Agents should not escape. But the human chain is still a weak link. We should run for fixing the basics, boring, and b'ugly, rather than chasing the asymmetrically lower volume of agent related security. I'm more an more convinced that SaaS is going to be the wild wild west where there are no controls other than guarding the front-door with SSO. In this case even the front-door was compromised! In most SaaS apps, there is little to no monitoring of what happens in the backend, and what data is moving via APIs. When I look back, becomes more and more scary about the overall security weakness of SaaS and how long we have allowed this to exist.
Indus Khaitan replied to a comment
5h
Allen Moffett i thought so too -- if UX is bad, people won't do, but if UX is good -- then eagerly do. Behavior changes.
-
Indus Khaitan liked thisIndus Khaitan liked thisUpdate: Samarth P. and I have joined OpenAI. We started Kairos with a dream that felt too big to say out loud: a personal AGI for everyone. Excited to keep chasing that dream inside Codex and ChatGPT.
-
Indus Khaitan liked thisIndus Khaitan liked thisMinimus raised $51 million. Last week, they handed that money back. The original Twistlock crew built secure-by-default, and Echo just picked up the pieces from the fire sale. I talk to security founders every week. Most think better product means you survive. It doesn’t. The market doesn’t care about your codebase. Look at the market. Failing security startups all leave the same ugly autopsy report. - They try to boil the ocean. Five founders, three markets, and zero focus. They want to build an all-in-one platform for GRC, SecOps, and AppSec. You should pick one or get buried. - They bloat fast. Suddenly there’s a 20-person GTM team selling a product nobody’s buying. Enterprise budgets don’t care about your headcount. - They build on someone else’s rails. Distribution deals are fine, but if your core product lives on another vendor’s stack, good luck convincing buyers you’re not just a feature. - They pitch in buzzwords. If you can’t explain your value in 30 seconds, minus the buzzwords, buyers tune out and mock your deck in Slack. - They ship more alerts, not action. Detection-only is dead. If your product just adds noise instead of enforcing decisions, nobody cares. If your enterprise pipeline is stuck, it’s not the product. It’s your positioning. Wrong message, wrong buyer. Are you building something that actually makes decisions, or just another tool dumping alerts on a CISO’s desk?
-
Indus Khaitan liked thisIndus Khaitan liked thisSeeing more and more $50M-$100M seed (!) rounds lately. These founders don't understand what they're signing up for. Every time you raise money, you close the door to exit opportunities. If you raise at a $100M valuation, you can no longer sell for $80M - which, for you personally, might have been a life-changing amount of money. Yes, with capex-heavy industries like robotics you need more capital. But you can work your way up. There is rarely a situation where you need $100M from the jump. A great example is SpaceX. In 2002, they raised a $12.1M Series A. Seems shockingly low now, but it's a sensible amount for that stage. Start with the capital you need, then work your way up. You keep more optionality on the table this way.
-
Indus Khaitan liked thisIndus Khaitan liked thisBen's movie The Last Man in Tower is finally releasing in India on September 11th. He bought the rights to Arvind Adiga's book more than ten years ago. He was able to secure financing and sign stars like Manoj Bajpai and Boman Irani. A true labor of love and persistence! Proud of you Ben Rekhi!Last Man in Tower - Teaser Release | Manoj Bajpayee | Divya Dutta | Boman IraniLast Man in Tower - Teaser Release | Manoj Bajpayee | Divya Dutta | Boman Irani
-
Indus Khaitan reacted on thisIndus Khaitan reacted on thisIn 1982, Bill Gates, Paul Allen, and Steve Ballmer offered me a job at Microsoft with 4,000 shares (worth ~$570M today). I said no. I was finishing business school at Stanford University Graduate School of Business. Steve had been a year ahead of me, and I'd met Bill at the West Coast Computer Faire. A word processor I’d built for the Apple II was on my résumé. Dave Marquardt, Microsoft’s venture investor and a board member, noticed it and asked me to meet the team. Microsoft flew my wife and me to Seattle, where I interviewed with the team for three days. She was five months pregnant with twins. Steve told me Microsoft would go from $12 million in revenue that year to $50 million the next. I asked Bill if he planned to become CEO. He said no. Microsoft hired Jim Towne instead. A year later, Bill took over and did pretty well. I understood Microsoft could become a very big company. I didn't understand what going from $12 million to $50 million meant for a software company in 1982. Digital Research was recruiting me too, so I heard both sides of how IBM chose Microsoft for the PC operating system, almost in real time. The famous version says Gary Kildall was out flying when IBM arrived. The full story is more complicated, but the decision changed the industry. Both companies made me offers. I passed on both. Two things kept me from taking either job. I wanted to stay near family when the twins were born. I also didn’t want to leave the relationships I’d built in the networking industry, before Ethernet became the standard. I don’t regret putting family first. But that decision has followed me through every investment committee since. You can understand the technology, know the people, and still underestimate the upside. I eventually became managing partner at Mayfield, and Dave and I became friends through the venture business. I missed Microsoft, but the introduction still changed the direction of my life.
Experience & Education
Volunteer Experience
-
Mentor, Guest Lecturer
University of California, Berkeley, Haas School of Business
- 3 years
Education
-
Program co-chair / Black-shirt
nasscom
- 2 years 1 month
Science and Technology
Co-chaired NASSCOM Product Conclave, an annual melee of 1500 entrepreneurs, VCs and product professionals in Bangalore. Worked in a team which created the event, curated the program and played host to hundreds of speakers including Guy Kawasaki, Naveen Jain, Ram Shriram, Vinod Khosla and others.
Publications
-
Building a Web directory & a Search engine using Open Directory and Java
Session at JavaOne
Recommendations received
12 people have recommended Indus
Join now to viewOther similar profiles
Explore more posts
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top contentAdd new skills with these courses
-
2h 19m
AI Product Security: Secure Architecture, Deployment, and Infrastructure
-
13m
A Standalone Project: Build a Program to Encrypt and Decrypt Text Messages Using an Encryption Algorithm to Protect Data from Unauthorized Access
-
40m
AI in Cybersecurity: The Future of Red Teaming and Blue Teaming