Risk, in a large company, has a mischievous habit of changing shape as it crosses the conference room. The security chief sees vulnerabilities. The privacy officer sees exposure. The finance chief sees potential loss. The board sees a color on a heat map and, quite reasonably, asks what it is supposed to do next. AJ Sarkar built a company around the space between those interpretations.
Sarkar is the founder and CEO of RiskOpsAI, the San Diego software business previously known as OptimEyes AI. Its promise is less poetic than practical: discover risk, measure it, prioritize it, predict what may come next, and organize the work of fixing it. Cybersecurity, data privacy, compliance, third-party exposure and AI governance are meant to appear in one connected model rather than as five unrelated emergencies.
The product began with an unusually long act of listening. Sarkar says he started the OptimEyes journey in 2018 by speaking with hundreds of companies and C-suite executives. One account puts the number above 800; company material later described approximately 1,000 CXO conversations. The precise tally matters less than the method. He did not begin by polishing a feature list. He began by collecting disagreements.
“The journey of OptimEyes began in 2018 when I spoke to hundreds of companies and CXOs.”AJ Sarkar, on the company's origin
The product brief hiding in an argument
Those interviews exposed a durable enterprise problem. Organizations had plenty of risk data, but no dependable common language for its business impact. A severe technical flaw might be financially modest. A mundane vendor dependency might be quietly existential. High, medium and low could become a small traffic-light opera, performed quarterly, with everyone applauding a different ending.
Sarkar's answer was integrated risk modeling and decisioning. The platform connects risk signals to goals, appetite and potential financial consequences. The important move is translation: from a list of issues to a view of exposure, from technical evidence to a decision that a chief information security officer, chief risk officer or CFO can debate on common ground.
This was not Sarkar's first encounter with complicated organizations. His public biography describes more than two decades building companies. He founded and sold a business-process-management software company, then established an IT consulting business. He trained as a computer scientist, earning a master's degree from the University of Pune, but his current job sits squarely at the border of software design, sales, client management and business development.
That mix matters. Business-process software teaches a founder where work actually gets stuck. Consulting teaches how differently two companies can describe the same task. Risk management adds an extra cruelty: the cost of confusion may stay invisible until the day it becomes painfully obvious.
A narrow sentence after a long career
Founders are often advised to explain a company in one breath. RiskOpsAI can now do that: an AI-driven platform for integrated risk modeling and decisioning. Getting to the sentence took Sarkar through several versions of the underlying problem. Business-process management concerned how work moved. IT consulting concerned how systems supported that work. The nonprofit concerned how leaders shared what they had learned. Enterprise risk brings all three together, then adds a clock and a consequence.
His Forbes Councils profile describes experience in software design and business development, several founded companies and several patents. It also says his responsibilities at OptimEyes included client management, sales and business development. This is less the biography of a founder disappearing into a laboratory than one walking repeatedly between the product team and the people expected to buy, explain and defend the product.
That walking matters in risk software because the buyer is rarely the only user and the user is rarely the only person accountable. A security team may operate the system. A risk leader may set thresholds. Finance may challenge the quantification. An auditor may ask for evidence. The board may want the conclusion before it wants the method, then demand the method the moment the conclusion becomes inconvenient. Designing for that chain requires more than accuracy. It requires a visible trail from signal to assumption to decision.
A founder who keeps building rooms
There is another pattern in Sarkar's career: when information is fragmented, he builds a place for people to compare notes. In 2010 he founded the Industry Council for Competitiveness and Globalization, a 501(c)(6) nonprofit created to improve local competitiveness in a global economy. Its proposed work included interviewing Fortune 1000 executives and turning the results into a shared knowledge pool. The stated benefit was wonderfully plain: leaders could learn from one another and avoid reinventing the wheel.
The same instinct surrounds RiskOpsAI. The company has assembled advisory groups with technology, security, finance, privacy and risk leaders. More recently, it has promoted a Chief AI Officer forum focused on practical governance. Advisory boards can become handsome collections of names. Sarkar's stated product history suggests a more useful intention: treat executive experience as an input, then let the software absorb what repeats.
How the listening loop becomes a product
This consultative style also explains his public tone. Sarkar often frames his work as unfinished learning rather than a completed doctrine. He asks how organizations should assign ownership when AI systems act autonomously. He talks about hundreds of conversations with security, risk and governance leaders. Even his recent formulation ends with an open admission: “We're still learning what effective oversight looks like in a world of autonomous AI.”
When the risk register starts moving
The problem has become harder since 2018. Traditional governance assumes that technology enters an organization through a managed door. A vendor is reviewed. Controls are assigned. Ownership is recorded. Auditors return on a schedule. Agentic AI disturbs that tidy sequence. Models can call tools, interact with other systems and change an organization's exposure between assessments. Employees can adopt unsanctioned services faster than procurement can schedule a meeting.
Sarkar's current thesis is that point-in-time governance cannot supervise continuously changing systems. RiskOpsAI now describes three connected layers: shadow AI monitoring and runtime governance; an AI-native risk register with remediation; and AI compliance and audit. The company's broader framing is secure, protect and govern. Underneath the branding sits a clear operational idea: the risk picture should update while the system changes, not several months later.
The appeal is obvious. The caution is equally important. Using AI to govern AI creates its own accountability questions. Automated findings still need owners. Recommended remediation still needs judgment. A model that quantifies exposure must be explainable enough for someone to challenge it. Sarkar's emphasis on human ownership in AI decision-making acknowledges the tension. Continuous does not mean unquestioned.
When customers disagree about a basic category, do not rush to automate the disagreement. First build a shared model that lets each participant see how the others arrived at a decision.
The boardroom as a design surface
Many enterprise founders talk about selling to the board. Sarkar's approach is closer to designing for the conversation that happens there. The dashboard is useful only if it helps a group decide which exposure matters, what it may cost, who owns it and what should happen next. Otherwise it is merely a decorative aquarium full of red fish.
His published writing has stayed close to that theme. He has argued for building privacy controls early, before a product or market launch makes errors more expensive. He has written about scrutiny of cybersecurity by customers and stakeholders. In interviews, he has linked risk directly to business goals and objectives. The recurring concern is not whether an organization possesses data. It is whether the data arrives in time, in context and in a form that changes behavior.
RiskOpsAI's public evolution reflects that concern. OptimEyes was a name about seeing. RiskOpsAI is a name about operating. The shift suits a product moving from integrated visibility toward automated testing, third-party threat exposure management, near real-time monitoring and remediation. Sight remains necessary. The verb has changed.
“It is critical to link the impact of risk on an organization's business goals and objectives.”AJ Sarkar, discussing integrated risk modeling
The humane detail in Sarkar's story is that the grand platform grew from a simple social act: asking people where their work broke down and listening long enough to notice the pattern. The computer scientist built models. The operator built workflows. The founder built rooms where executives could admit that their definitions did not match.
Now AI is making the mismatch move faster. Sarkar's bet is that governance can move with it while remaining legible to humans. That is a difficult balance, and perhaps the right kind of difficulty for a founder who has spent his career translating process into software. Every organization already has a risk story. His work is to make sure the ending is not written by the spreadsheet nobody opened.