Startup Deep Dive : SAFE Security — it shut down a profitable business to bet on a number few can audit

SAFE Security has raised more than $170 million from investors that include a former Cisco chief executive and Britain’s largest telecom operator, and its co-founder has said in interviews that the company is now worth “thousands of crores” of rupees. The only number anyone outside the company can actually check tells a much smaller story: the last audited accounts filed anywhere in the world for its original Indian entity, for the year to March 2022, show revenue of ₹86 lakh (roughly $90,000 at ₹96 to the dollar) and a net loss on top of it.

That gap is not necessarily a red flag. It is closer to a map of how the company was rebuilt. In 2018-19, co-founder Saket Modi shut down a services business bringing in ₹40 crore a year to build a product instead, walked its revenue to zero on purpose, and re-emerged in 2020 as an AI-driven platform for putting a dollar figure on cyber risk — one that Fortune 500 boards, and increasingly cyber insurers, now pay for out of a headquarters in Palo Alto rather than Delhi. This piece traces that rebuild: the founding insight, the near-deaths, the funding, and the parts of the story that still cannot be independently verified.

Quick facts

What they do

SAFE Security sells a platform, also called SAFE (Security Assessment Framework for Enterprises), that pulls in signals from a company’s own security tools, its cloud and network assets, its employees, and its third-party vendors, and turns all of it into a single, continuously updated estimate of how much a cyber breach would actually cost in money. The buyer is a large enterprise chief information security officer who needs to tell a board, an auditor or a regulator not just “what is broken” but “what it is worth fixing first” — and, increasingly, a cyber insurance underwriter who wants a data-backed number to price a policy rather than a questionnaire. The company states its customers include Google, Fidelity, T-Mobile, Chevron, IHG and Discover Financial Services, and that its Cyber Risk Cloud of Clouds processes more than three billion signals a day, figures that come from SAFE’s own press materials and have not been independently audited.

The origin

Saket Modi has said in interviews that his interest in security began as a teenager when he broke into a password-protected file, an experience that pulled him toward ethical hacking. He studied computer science at the LNM Institute of Information Technology in Jaipur, and in 2012, during his final year of engineering, co-founded a company with Vidit Baxi and Rahul Tyagi that was incubated at IIT Bombay’s startup programme. The company, first named Lucideus, started as exactly the kind of business its founders’ education pointed toward: red-teaming, penetration testing and boardroom security training, sold as one-off engagements to Fortune 500 companies and their Indian subsidiaries. The founding insight came later, once the services business was working. A penetration test report tells a company what is vulnerable. It does not tell a board, in the language boards actually use — money — how much a given vulnerability is worth closing first. Lucideus began building an internal scoring platform to answer that question, years before it decided to sell the platform itself rather than the testing work that fed it.

The struggle years

The clearest near-death in the company’s history was deliberate. By 2018-19, Lucideus was running a profitable services business generating about ₹40 crore a year with over 100 active client engagements, according to Modi’s own account in an interview with Entrepreneur India. He chose to wind it down anyway, describing the result bluntly: revenue went “from ₹40 crore to zero in one year.” The reasoning was that scaling a services firm the way large Indian IT companies do requires adding headcount roughly in step with revenue, a model he did not want to run, and that the risk-scoring problem he had identified could be solved “at a much bigger scale if we could productise it.” That left the company, for a period, without the income the founders had spent years building.

The second setback was a matter of timing rather than choice. The rebuilt product, SAFE, went to market commercially in January 2020, according to the company’s own chief revenue officer, just weeks before COVID-19 froze enterprise technology budgets worldwide. Selling a brand-new, unproven risk-quantification platform into Fortune 500 security budgets in the middle of a global lockdown, with no existing product revenue to fall back on after the prior year’s wind-down, was the harder version of the same bet Modi had already made.

The turning point

The moment that changed the company’s trajectory was the 2021 funding round: $33 million co-led by BT Group, the UK’s largest telecoms operator, and John Chambers, Cisco’s former chairman and chief executive, according to TechCrunch’s reporting at the time. Before that round, the company was a India-headquartered, recently-relaunched product business with a single prior institutional backer in Chambers and a services heritage it was actively trying to leave behind. After it, the company rebranded from Lucideus to Safe Security, moved its headquarters to Palo Alto, opened offices in New York and London alongside Bengaluru and New Delhi, and said it was growing at roughly 250% year over year. A telecoms group taking a strategic stake, rather than a pure financial investor, gave the new product category — and a company that a year earlier had zero platform revenue — a credibility signal that a services-only track record could not.

The money behind it

Across 13 rounds, SAFE Security has raised more than $170 million, according to data tracked by Tracxn and repeated in the company’s own materials. The shape of that funding tracks the company’s own turning points. John Chambers was an early institutional backer from around 2017, lending the fledgling product bet his own name and Cisco-era network before the platform had meaningfully launched. The 2021 round, $33 million co-led by BT Group and Chambers, funded the relaunch, rebrand and US relocation. A $50 million Series B followed in April 2023, led by Sorenson Capital with Eight Roads (Fidelity Investments’ venture arm) and Telstra Ventures participating, timed to the same month the company acquired RiskLens. Most recently, a $70 million Series C closed at the end of July 2025, led by Avataar Ventures with Susquehanna Asia Venture Capital, NextEquity Partners and Prosperity7 Ventures joining existing backers, earmarked for what the company calls “CyberAGI,” an agentic AI push. SAFE Security has not disclosed a valuation for any of these rounds. Data platform Caplight put an estimated valuation of $100 million on the July 2025 raise; this could not be independently corroborated against a second confirmed source, and it is well short of the $1 billion “unicorn” bar that some coverage of Indian-origin cybersecurity startups implies the company is near. That framing should be treated as unverified.

How it makes money

SAFE Security sells enterprise licences to its risk-quantification platform, negotiated per Fortune 500-scale account rather than priced off a public rate card; neither the company nor its investors publish an average contract value or a take rate. Money comes in two forms: direct enterprise contracts with CISOs who use the platform to prioritise security spend and report risk to boards, and, since the 2023 acquisition of RiskLens, a second channel selling into cyber insurance carriers who use the FAIR (Factor Analysis of Information Risk) methodology RiskLens pioneered to underwrite and price policies. Money goes out mainly on engineering and R&D for the “agentic AI” layer the company is building, and on the two acquisitions it has funded through equity rather than disclosed cash flow. Neither gross margin nor cost of revenue has been made public. The part outsiders most often get wrong is treating SAFE as a security scanner that competes with vulnerability-management tools. It is closer to an analytics layer that sits on top of other tools’ data and translates it into a dollar figure — which is also the commercial logic behind buying Balbix in November 2025: SAFE’s quantification engine needed a stronger exposure-discovery engine feeding it, rather than building one from scratch or continuing to rely solely on third-party data feeds.

The numbers

SAFE Security does not publish consolidated global revenue or profit and loss. The closest thing to a multi-year trail combines an unaudited founder statement, two years of audited filings from the original Indian entity before it was folded into the US parent, and the company’s own present-day characterisation, set out below with each figure’s real level of confidence.

The jump between the FY22 Indian filing and the company’s own present-day description is not necessarily a contradiction. After the 2020 relaunch and 2021 US relocation, the commercial entity selling the platform and booking revenue globally is Safe Security Inc. in Palo Alto, not the original Indian company, which was wound down as a going concern and eventually amalgamated. But it does mean that the only audited numbers in the public domain understate the current business by design, not by accident, and that every larger figure describing SAFE Security’s scale today rests on the company’s own word rather than a filed account.

Where the money comes from

The company’s roots and its revenue now sit in different places. It was built and incubated in India, first sold penetration-testing services to Indian subsidiaries of US multinationals, and still runs engineering and operations out of Bengaluru and New Delhi. But since the 2021 relocation, its headquarters, its named enterprise customers (Google, Fidelity, T-Mobile, Chevron, IHG), and its funding are all anchored in the US, UK and the Gulf, via offices in Palo Alto, New York and London and investors such as Prosperity7 Ventures. The surprise is less a geographic split than a channel one: alongside direct enterprise licences to CISOs, the 2023 RiskLens acquisition opened a second, structurally different revenue path through cyber insurance carriers, who license the underlying FAIR risk-quantification methodology — used, RiskLens said at the time of the deal, by more than 14,000 practitioners across roughly half of the Fortune 500 — to underwrite policies. That insurance-facing channel is a meaningfully different buyer and sales motion from selling a CISO a risk dashboard, and the company has said relatively little publicly about how the two now split as a share of revenue.

The risks

The most immediate risk is disclosure itself. Because SAFE Security is private and now books revenue through a US parent, every growth claim — 200%-plus year-over-year growth for three consecutive years, “hundreds of crores” in current revenue, a “thousands of crores” valuation — comes from the company, not from an audited account that outsiders, insurance regulators or customers can check. The only audited figures that exist, for the wound-down Indian entity, are smaller by orders of magnitude than the figures the company now describes, which is explained by the corporate restructuring but is not independently verifiable either way.

A second risk is integration. SAFE Security has bought two companies in under 30 months — RiskLens in July 2023 and Balbix in November 2025 — without disclosing financial terms for either deal. Each brought a distinct engineering stack and customer base (RiskLens’s FAIR methodology and insurance relationships; Balbix’s exposure-scanning and asset-discovery engine) that now has to work as one product marketed under a single “CyberAGI” and agentic-AI pitch, a roll-up execution risk that is separate from, and additional to, the underlying product risk.

A third is competitive commoditisation. FAIR, the risk-quantification standard RiskLens brought to the company, is an open methodology used industry-wide rather than a SAFE-exclusive patent, and adjacent players in exposure management and security ratings are moving toward the same “risk expressed in dollars” pitch. SAFE’s durable advantage, on the evidence available, rests on the scale of the data it has accumulated inside Fortune 500 accounts and on its relationships with those customers, not on a method no competitor can replicate.

The takeaway

Deliberately taking a profitable business’s revenue to zero to build the thing you actually believe in is one of the more credible signals a founder can send — it is a bet made with real money, not just a slide. But it is a signal about conviction, not proof of financial health, and the two get conflated easily once a company’s growth story, its funding announcements and its headquarters move faster than its audited accounts do. The lesson that travels beyond this one company: when a founder’s public numbers and a company’s filed numbers point in different directions, the honest response is not to pick the more flattering one, but to say plainly which figures are confirmed, which are claimed, and to keep asking for the former.

Frequently asked questions

Is SAFE Security an Indian company or a US company?

It was founded and incubated in India in 2012 and still runs engineering operations out of Bengaluru and New Delhi, but it relocated its headquarters to Palo Alto, California, around its 2021 rebrand, and its enterprise sales, funding and named marquee customers are now anchored in the US, UK and Gulf markets.

What does “cyber risk quantification” actually mean?

It means translating technical security findings — an unpatched server, a risky vendor, a misconfigured cloud account — into an estimated financial cost, so that a board or an insurer can compare cyber risk against other business risks in the same currency, rather than reading a list of technical vulnerabilities with no attached price.

Is SAFE Security a unicorn?

No confirmed public evidence supports that. The company has not disclosed a valuation for its latest, July 2025 funding round; data platform Caplight put an estimated $100 million valuation on that round, well below the $1 billion threshold, and this could not be independently corroborated against a second confirmed source during this research.

What did SAFE Security acquire, and why?

It acquired RiskLens in July 2023 to add the FAIR risk-quantification methodology and its cyber-insurance relationships, and Balbix in November 2025 to add AI-native exposure and vulnerability discovery, aiming to combine “what could go wrong,” “how it’s found,” and “what it would cost” into one platform. Financial terms for both deals were undisclosed.

How much money has SAFE Security raised, and who are its backers?

More than $170 million across 13 rounds since 2012, per Tracxn and the company’s own figures, from backers including John Chambers, BT Group, Sorenson Capital, Eight Roads (Fidelity’s venture arm), Telstra Ventures, Avataar Ventures, Susquehanna Asia Venture Capital, NextEquity Partners and Prosperity7 Ventures.

Sources

Figures are as of September 2026. Currency converted at $1 ≈ ₹96.0 as of 18 September 2026 (Trading Economics).

• Business Standard, “SAFE Security bags $70 mn to build AI tools for autonomous cyber governance,” July 2025
• Entrackr, “Safe Security raises $70 Mn in Series C led by Avataar Ventures,” July 2025
• Inc42, “Safe Security — Funding, Revenue & Investors” company profile, accessed September 2026
• TechCrunch, “Cyber risk startup Safe Security lands $33M from UK telco BT,” July 2021
• PRNewswire, “Safe Security Raises $50 Million Series B Round for AI-Driven Platform to Manage and Mitigate Cyber Risk,” April 2023
• PRNewswire / Safe Security press release, “Safe Security Acquires RiskLens to Become Undisputed Leader in the $4B Cyber Risk Quantification and Management (CRQM) Market,” July 2023
• SiliconANGLE, “SAFE acquires Balbix to unify AI-native exposure management and cyber risk quantification,” November 2025
• Safe Security, “About Us” company page and founding-milestones summary, accessed September 2026
• Entrepreneur India, “Why Indian Cybersecurity Startups Are Struggling to Match Silicon Valley Counterparts: Saket Modi Explains,” accessed September 2026
• ChannelBuzz.ca, “Lucideus rebrands as Safe Security, taking the name of their product as part of move from services to product company,” February 2021
• Tofler, Lucideus Tech Private Limited company financial filings (FY21, FY22), accessed September 2026
• TheCompanyCheck, Lucideus Tech Private Limited financial summary, accessed September 2026
• Caplight, Safe Security valuation and funding profile, accessed September 2026
• Tracxn, Safe Security company profile (total funding, founding year), accessed September 2026

Found an error? Write to us and we’ll correct it in the open, dated, on the piece.