#87 - Meet the Startup Changing How We Authenticate Everything

Welcome back to The Tech Optimist, where we don't just talk about the future, we celebrate it. I'm your host. My name is Samantha Herrick, and I am your guide to game-changing ideas, bold founders, and the breakthroughs redefining what's possible in our today. Here we cut through the noise, explore the why behind certain innovations, and break it down so you get the full picture. From cybersecurity to AI and beyond, if it's shaping tomorrow, We're talking about it today. All right, welcome back everyone. We hope you had a fantastic holiday and a happy new year. Let's take 2025 by the horns. Let's dive in. Cyber threats are evolving, and so is the way we defend against them. Enter UnixEye, a cybersecurity startup that's making waves in the fight against social engineering attacks, one of the most dangerous and deceptive tactics used by hackers today. Headquartered in Wilmington, Delaware, with a global presence, UnixEye is on a mission to protect enterprises from phishing, credential theft, and other identity-based cyber threats. Their patented technology takes a unique integration-less approach to identity security, giving businesses seamless protection without the usual complexity. Despite being a lean and agile team of 11 to about 50 employees, UnixEye has already caught the attention of top cybersecurity investors and is gaining momentum in industries that demand the highest level of security: healthcare, finance, and beyond. So what makes UnixEye different? And how is it changing the cybersecurity landscape? Let's hear it from the mind behind the mission itself, Chad, the CEO of UnixEye.

What UnixEye does in a very simple way, it's providing the professional security people within an organization, first of all, visibility. So UnixEye automatically discovers every single application that the users are trying to use. Sometimes organizations really don't know what they have, and if you don't know what you have, you don't really know what you're protecting, right? So shadow SaaS, it's a term in cybersecurity that it's really, really trending lately. And what Unixai provides is the visibility to see everything. Not only do we provide visibility, we're also providing control and governance.

Chad Gerstenzang, the co-founder and CEO of Unixai, our guest today, brings a deep background in offensive security. Having led cybersecurity teams across both military and civilian sectors, his expertise in tackling some of the toughest security challenges has shaped UnixEye's approach to stopping cybercriminals before they even strike. Beyond his leadership, Chad is an active voice in the cybersecurity space, sharing insights on phishing, human vulnerabilities, and cyber defense strategies. He's not just building this company, he's shaping the future of cybersecurity.

The real Holy grail of what we provide is the universal SSO. So in simple terms, you know passwords, right? We need to use them. Nobody likes them. Sometimes you use password managers and sometimes you just forget your password, I guess. Someone can steal those credentials and just try to log in to a certain website using your own passwords, right? This is what happens. It's like 98% of cybersecurity attacks. So what Unix-like provides is the universal SSO. SSO stands for single sign-on. You sign into Unix-like and that's it. You don't have any passwords to use anywhere.

So, so, so let's double-click into that, 'cause I, 'cause I wanna drive home kind of exactly how that works.

Now, venture capital isn't just about funding. It's about insight, strategy, and the people who make it happen. And today we have one of those key players with us, Lukas Pasch, a senior principal at Alumni This is the first time he's on this podcast, so welcome, Lucas. Lucas has an MBA from Northwestern's Kellogg School of Management and a background that spans investment banking, startups, and of course venture capital. He's led business operations at Let's Get Checked, co-founded a startup, and worked in strategy for emerging companies, all before diving into the world of VC. At Alumni Ventures, Lucas focuses on early-stage SaaS investments, bringing an operator's mindset to the table. And he's worked across digital health, prop tech, and retail, helping founders navigate the complexities of scaling their businesses. Today, we're going to tap into his expertise along with Chad's insights and what he looks for in startups, how venture capital is sort of evolving within this space, and what founders may need to know.

Do you have a venture capital portfolio of cutting-edge startups? Without one, you could be missing out on enormous value creation and a more diversified personal portfolio. Alumni Ventures, ranked a top 20 VC firm by CB Insights, is the leading VC firm for individual investors. Believe in investing in innovation? Visit av.vc/foundation to get started.

As a reminder, the Tech Optimist podcast is for informational purposes only. It is not personalized advice and it is not an offer to buy or sell securities. For additional important details, please see the text description accompanying this episode. Now that we've covered the big picture, who our guests are, what they do, and why their work matters, but now let's get into the real magic, the technology behind it all. UnixEye, as we already know, is pushing boundaries in their field. So how is UnixEye defending enterprises from social engineering attacks? Lukas and Chad, walk us through it.

And, you know, we're not going to do a demo on the screen here, but we did this the first time that you pitched me. Explain what you did. You showed me your password, you know, one of your logins. Take it from there. What exactly did you tell me to do?

Sure. We have a very interesting way on explaining the algorithm which stands behind our single sign-on. And just as we did with you, Lukasz, we're providing a username and password to HubSpot. You can actually go right now to our website, scroll down, and you will see the video of me giving away the HubSpot and PayPal account. We have a PayPal account with like $10,000 and asking people to try to sign in. And I can jump on a call and show you me using those credentials right now. And you can see those old credentials actually works. But if you try to do it from your end, you won't be able to. And the reason is that you— I have my very own UnixEye extension installed in my browser, and that's the only difference between me and you. And that's the reason why I managed to sign into HubSpot when we did a demo together.

Yeah. So, so on your end you have your HubSpot credentials and because you have this extension, you enter your, your username, your password, but the extension is scrambling it in some way, shape, or form to where you don't even know what it actually is. And so if I steal your credentials, your credentials,

I

don't have that thing on my browser. And so it's the wrong password. And so I get rejected.

The simple way, you can think about like an old Swiss bank, right? You came with a key, and the banker provided another key. And only by combining those 2 keys, you managed to open the vault. This is what Unisight does in this demonstration. You're providing your key, which is the password, and we scramble that password and create something completely different, which is essentially opening the vault.

Yep, yep. So tell us, who are your primary customers and kind of what industries or types of organizations benefit the most from from your company solutions?

Honestly, every single company can benefit from Unix Slice because every company, well, given that you're using the internet, right? Every company has a phishing threat on them. But we do usually aim for companies at about 1,000 employees and above, just because we found that those types of companies are usually a bit more mature and a bit more ready and a bit more understandable regarding the security posture. So we do aim for these sides of a company. Now, we currently today have plenty of customers within the medical sector, within the medical industry and the healthcare industry. In addition to that, finance. But honestly, we are industry agnostic. It just happened to be those industries that we started off with.

Now, if you think cyberattacks are just an occasional nuisance, think again. The numbers that I'm about to share with you are staggering. By 2025, the global cost of cybercrime is projected to hit around $10.5 trillion annually. That's more than the GDP of most countries. And the attacks themselves? Relentless. A new one happens every 39 seconds, putting businesses and personal data at constant risk. And it's not just small-scale breaches. The average global data breach now costs a company $4.45 million. Meanwhile, ransomware damages alone are expected to soar to $265 billion per year by 2031. These attacks are growing more frequent, more sophisticated, and more expensive than ever. In 2024, UK businesses alone faced an average of 753,341 attempted breaches, meaning a new cyber threat emerged every 42 seconds. And for those who fall victim to DDoS attacks, the downtime can cost up to $22,000 per minute. We're also seeing a huge rise in encrypted threats, a 92% increase in 2024, signaling that hackers are adapting faster than security defenses. And supply chain attacks? They impacted 183,000 customers this year, a 33% jump from last year. So what does this all mean? It means that cybersecurity isn't optional anymore. It's a necessity. Companies, governments, and individuals need to be thinking not just about reacting to cyber threats, but preventing them altogether. Wink wink, UnixEye. So that's why we're excited to explore how— UnixEye's cutting-edge cybersecurity technology can help businesses stay ahead of attackers. So hold on, stick with us as we break down how modern cybersecurity works and what's being done to combat these growing threats. With cyber threats evolving, many companies turn to identity and access management solutions like Okta. But what happens when those solutions don't cover everything? That's where UnixEye stands apart. Chad is going to start to break down how UnixEye offers universal SSO without complicated integrations, or added costs in this next chapter of the interview. So let's get into what makes UnixEye different and why it's built to handle security challenges competitors can't.

So identity and access man— those types of companies with, with, you know, 1,000 people plus have some kind of identity and access management solutions kind of built into their cyber stack already. It's a, it's a relatively crowded space. So what gaps were you seeing in the market from existing solutions? You know, the one that comes to mind first, and maybe a lot of our listeners have heard of, is Okta, kind of the 800-pound gorilla in the room. What kind of gaps did you see in solutions like Okta's that inspired you to build UnixEye?

Well, Okta is a very good product. I really like their product. It's very easy and it's very, very convenient. Now, the main gaps that Okta have is the coverage that they can provide, meaning that Okta built in a way of exchanging tokens. And in order to do this exchange, they need the third-party application to have SAML protocol. Otherwise, they won't be able to do this exchange. And according to your researches, Only about 20% of SaaS enterprise applications are able to have SAML protocol installed or currently have SAML. And while it is true that it's a bit of a crowded space, the identity and access management, but it's crowded for those 20%. Because of the ways that UnixLay built, we built completely integrationless. The third-party application doesn't really even know that we exist. Thus, it's allowing us to provide coverage to those remaining 80%. And I only know one company that provides SSO to the remaining of 80%, and that's Unisight. So honestly, it's not as crowded.

Tell me about this term SSO tax and what that is and how your company kind of helps organizations avoid it.

Sure. Try to think that, for example, you went out and bought a car, right? You have the car and everything works out great. But then Toyota, whatever you bought the car from, asks you extra for the airbags, right? Perfect. So if you went out there and bought a SaaS application, right now you have the SaaS application, you can use it and everything works fine and everything is well. But if you want SSO, single sign-on, to this specific application, you will need to buy the premium package. It really is a scandal. It's like they're holding you in jail to have SSO, which is a security measure. And it's just really interesting for me that those vendors decided to take away security in order to make more profit. Yeah. But well, it is what it is. Obviously with Unix side, because we're integrationless and the third-party vendor doesn't really know that we exist, you don't pay any SSO tax because what we do in really the big picture is telling you do not trust on the third-party application to have good security. We all saw that they taking SSO, you know, and putting you in a jail to pay extra just for security. Do rely on Unicite, and we provide you SSO to every single application, whether the application has SAML, whether the application puts SSO behind the SSO tags, we don't care about it. We provide you the SSO for whatever you need.

Yeah, I love that positioning to a pretty universal problem across enterprises.

Every groundbreaking and innovative company has a story, and UnixEye is no different. Chad's journey from military cybersecurity to startup founder gives UnixEye a unique edge, thinking like hackers to stay ahead of them. And with backing from some of the biggest names in cybersecurity, the company is poised for serious impact. Now, in this next chapter of this episode, let's hear about the team behind UnixEye and the vision driving its future. But before we dive headfirst into that, here's a quick message from our sponsor.

Exceptional value creation comes from solving hard things. Alumni Ventures Deep Tech Fund is a portfolio of 20 to 30 ventures run by exceptional teams who are tackling huge opportunities in AI, space, energy, transportation, cybersecurity, and more. These game-changing ventures have strong lead venture investors And practical approaches to creating shareholder value. If you are interested in investing in the future of deep tech, visit av.vc/deep-tech to learn more.

So I started my— well, honestly, I grew up as an Orthodox Jew, so I didn't really touch a lot of the computer stuff. The first experience that I really had with computers, it's in the IDF. I joined the IDF at the age of 18, and I worked as a security researcher. I did specifically DFIR. And I also managed to work quite often with the FBI. I actually really, really blessed by the opportunities that I had working a lot with the FBI. And after that, I joined a company named ComSec, which there I was offensive cybersecurity expert, did a lot of red team and penetration testing. And this is also where I actually met my co-founder, Reuven. We were both— he actually was my boss. We were both offensive cybersecurity experts. And the reason why we started UnixSign was because we noticed that the way to intrude companies was by stealing credentials. And we tried to understand why is this problem still exist? It doesn't make any sense. If you were at the 1980 you still was worried about phishing, and nowadays you're worried about phishing as well. It just doesn't make any sense, and nobody really addresses the issues but the SSL providers. Yes, you can try to do, to have MFA and so on, but as I told you, coming from offensive security background, it's very easy to bypass those MFAs. It's just another step. And I think that because we're coming from offensive cybersecurity, it's also really helping us think outside of the box, right? Because this is what you do when you try to hack into company. You're thinking outside of the box. And this is why UnixLai is so unique and it's so different because Reuven, my CTO, and myself are coming from offensive security.

Yeah, makes sense. And for the audience, when you say offensive security, it means that kind of in your background, when you were at ComSec and other places, you were essentially paid to put yourselves in the shoes of the hacker and kind of try to exploit vulnerabilities and then help the company overcome those. Is that accurate?

Yeah, well, if you pay a lot of money to have a very good defense, you want to make sure that this defense actually works. And this is when you call a guy like me that have the skills of a hacker, but try to use them for a good purpose. And we try to hack into your organization and, well, telling you, well, your defense mechanism is very, very good, or you need to replace the vendor.

Yeah, awesome. And so you've been backed so far by some really talented cybersecurity investors, experts, and practitioners, Hyperwise Ventures, who we're very close with here at Alumni Ventures. Shlomo Kramer, an industry giant, is one of your key angels. What do these folks' involvement kind of mean for your company and its growth trajectory?

Well, Shlomo Kramer isn't only an investor, he's also a mentor of mine. I have regular meetings with him and I feel very, very honored and humbled to have those giants invest in me.

Give us more background. Who is Shlomo Kramer?

Well, Shlomo Kramer is probably one of the biggest names in the Israeli cybersecurity industry. He came up with Check Point. He came up with Imperva. He's currently the CEO of Cato. So all of those unicorns of cybersecurity companies, it's just him and his team, of course. And I feel as if I have unfair advantage towards other companies because I get to consult with him so much. Every time I have a very important strategic issue that I want to consult with, I know that he's just a phone call away. And I know that I have those regular meetings where I can Presenting with this issue and asking his opinion. And not only Shlomo, I also have Nathan, which is an amazing person to consult with. And then we have Nadir and Evgeny from Aries. And just we surrounded by so many talented people, Dean Zismar from Axonius, that we can consult with. And it really just give us an unfair advantage towards anyone else. And it also shows that the vision of UnixEye And the vision of integrationless, it's something that a lot of experts really believe in.

Yeah, love that. So let's wrap up with one final question. If someone listening today is part of an organization grappling with identity and access management issues, what is the one message you'd like to leave them with today? Regarding UnixEye?

I think that whenever you're starting to build your identity security posture, the first thing that you need to do is to know what you have. This is what the discovery features come in. After you know what you have, you need to control over it and maybe even, you know, freeze. Don't add any new SaaS applications before you start managing whatever you already have. Yeah. So by the governance feature, you can do that. And it's almost like you stop time, right? And you can start managing whatever you already have. And you manage those by having the universal SSO. First thing to take the biggest threat out, take the phishing threat out of the way. So you have visibility across what you had, you have control of what you currently have and what's coming. And then you also have universal SSO to every single application.

Love it. I think that that's a good wrap-up point for us. Chad, thank you so much for taking the time and walking our audience through what you've been building. We're very proud supporters of Unexi, and just we're proud to be on your rocket ship.

Thanks for having me, Lukas. Thank you so much for backing us up as well.

All right, thanks, Chad. Take care.

Thanks again for tuning in to The Tech Optimist. If you enjoyed this episode, we'd really appreciate it if you'd give us a rating on whichever podcast app you're using, and remember to subscribe to keep up with each episode. The Tech Optimist welcomes any questions, comments, or segment suggestions, so please email us at info@techoptimist.vc with any of those, and be sure to visit our website website at av.vc. As always, keep building.