Aleksandr Yampolskiy and the trouble with a perfect answer

The supplier had passed the questionnaire. Forty pages of it. Aleksandr Yampolskiy had met the people, asked the questions and received the reassuring answers. The service was meant to help Gilt Groupe, the online retailer where he ran security, spot ecommerce fraud. Then, as integration approached, came an awkward discovery: the supplier was holding customer data without encryption.

A product bought to reduce one kind of risk had introduced another. In his telling, the discovery frightened him. He could do his own job diligently and still be exposed by somebody else’s carelessness. The completed paperwork offered remarkably little comfort. A questionnaire, it turned out, could be beautifully filled in and quite useless at keeping a secret.

That experience sits at the center of Yampolskiy’s career. He had trained to investigate hard mathematical questions. Now he had a practical one: how could a business judge the security of another business without simply taking its word for it? He would build SecurityScorecard with Sam Kassoumeh around that question. Their answer began with something almost offensively familiar to anyone who had attended school: a letter grade.

A borrowed game, with something extra

Long before the questionnaires, there was a floppy disk. At twelve, Yampolskiy received a copy of Prince of Persia from a friend. The disk also carried a virus. His response was curiosity mixed with a desire to get even. He began learning how computers could be made to misbehave, studying code and the mechanics of breaking and protecting systems.

It is an origin story with a useful lack of grandeur. No childhood declaration about changing the world was required. A friend had interfered with his computer, and he wanted to understand how. The irritating little extra on the disk supplied a question that the game itself could never answer.

Born in Moscow, he moved to the United States with his family as a teenager. New York became home. He earned a bachelor’s degree in mathematics and computer science at New York University, followed by a doctorate at Yale in 2006. His education took that early interest in misbehavior into the more demanding territory of proving what a system could withstand.

The mathematics of depending on strangers

One strand of his academic work makes the later business particularly interesting. With James Aspnes and Kevin Chang, Yampolskiy studied how computer users decide whether to protect themselves against a virus spreading through a network. Each participant weighs the cost of protection against the possible cost of infection. The difficulty is that one person’s decision changes the risk faced by others.

Their paper, published in the Journal of Computer and System Sciences in 2006, showed how individually rational choices could produce a poor collective outcome. The setting was mathematical, with nodes and graphs rather than procurement meetings. Still, the resemblance to his later concern is striking: everyone can make a decision that seems sensible locally while leaving the wider network exposed.

Another collaboration, with cryptographer Yevgeniy Dodis, produced the 2005 paper A Verifiable Random Function with Short Proofs and Keys. In broad terms, such a function lets someone demonstrate that an apparently random output was generated correctly. The paper received a best paper award and, in 2021, a Public Key Cryptography Test of Time award.

There is a pleasing continuity here. The academic question asks how a result can be checked. The founder’s question asks how a promise can be checked. The problems require different tools, but both make room for doubt. Being told that something is trustworthy leaves the interesting work unfinished.

When the perimeter moved out of the building

Yampolskiy’s career took him through technology roles at Microsoft, Oracle and Goldman Sachs. He worked on identity and authentication, the machinery through which a system decides who somebody is and what they may do. Later came security leadership at Gilt Groupe and the chief technology officer role at Cinchcast and BlogTalkRadio.

Those jobs put him on both sides of an enterprise’s appetite for technology. New services could help a company grow; connecting them also created dependencies. Someone had to make the commercial ambition and the security obligations coexist. A business could delegate a task to a supplier much more easily than it could delegate the consequences of a failure.

SecurityScorecard emerged in 2013 from Yampolskiy and Kassoumeh’s experience as security practitioners. The premise was that evidence visible from outside an organization could help assess its security. Rather than asking only what a supplier claimed to do, they could examine observable signals and turn them into a rating.

The grade gave the idea a form that traveled. A board member, a buyer and a technical team could at least begin a conversation using the same symbol. The engineering sat underneath; the person making a business decision did not need a doctorate to recognize an F.

A grade has to earn its keep

His ambition extends beyond putting a label on a company. His public biography describes a desire to make security measurable and understandable across an organization, including the people outside the technical department. He also wrote The Perfect Scorecard: Getting an “A” in Cybersecurity from Your Board of Directors, published in 2021. The title makes his intended audience fairly clear.

The underlying communication problem is easy to recognize. A security team can explain what it installed, while a director wants to know what the spending accomplished. A list of products answers the first question. It can leave the second untouched. Yampolskiy’s work keeps returning to that gap between doing something and demonstrating its value.

By December 2024, he was publicly arguing that security ratings alone would not save a software supply chain. For the leader of a ratings business, that is a consequential position. His argument concerned the work left after assessment: supplier questionnaires, staffing demands and the effort required to turn information into fewer problems.

A rating can make a conversation possible. Somebody still has to contact the supplier, investigate the finding and get the issue fixed. Otherwise, a dashboard risks becoming a particularly expensive way to watch trouble approach.

Even a queen needs colleagues

Chess offers a more personal route into his thinking. He competed during college and has continued to play. In explaining leadership, he points to a beginner’s habit of asking the queen to do too much. The strongest piece becomes responsible for protecting everything, while the rest of the board remains poorly developed.

Applied to a company, the lesson is delegation with some discipline behind it. The chief executive needs people with the appropriate abilities in the appropriate positions. A powerful individual can become a bottleneck as readily as an advantage. His chess analogy gives that management problem a picture: plenty of pieces available, one of them exhausted.

His public life also contains a less managerial chess anecdote. In an August 2026 podcast conversation, he described how chess helped him get a date with the woman who became his wife, although she had never played. It is a welcome interruption to the usual founder chronology. A game can furnish a theory of organizational design and still be an excuse to meet somebody.

His preferences about communication are similarly concrete. He has said SecurityScorecard moved toward written narratives in place of PowerPoint, and that he wants board presentations to become shorter while carrying as much information. For someone whose business compresses complicated evidence into a grade, the dislike of unnecessary slides has a certain consistency.

The founder gets a new exam

In March 2026, SecurityScorecard announced TITAN AI at the RSA Conference. The platform brought together continuous monitoring, automated assessment and workflows for dealing with supplier exposures. The company described a shared working layer through which enterprises and vendors could coordinate when problems appeared.

The direction follows the original frustration at Gilt. Information has to arrive early enough to matter, and a team has to be able to act on it. An assessment that sits waiting for the next review meeting has its own kind of expiry date. The new product places more of the work after detection inside the same process.

September brought an organizational change: Sarah Walker, previously Slack’s chief operating officer, joined as president, partnering with Yampolskiy. Her remit covered the global business and operating functions. He remained founder and CEO. The appointment put another experienced operator beside a founder whose responsibilities had grown far beyond the first security question.

By October, Yampolskiy was applying a familiar skepticism to AI inside software companies. In an essay dated October 14, he asked what would stop a customer from using a general AI model to bypass a vendor’s product. His proposed test for AI initiatives was compact: show me the before and after.

“Show me the before and after.”

Aleksandr Yampolskiy · October 2026

He wanted evidence in customer outcomes and business performance, including retention, resolution times and useful software delivered. Producing more code was insufficient if the next stage of the process simply jammed. That observation makes the essay sound recognizably like the security executive who had once stared at a satisfactory questionnaire and an unsatisfactory reality.

The floppy disk, the cryptography papers, the supplier assessment and the AI initiative all leave him with versions of the same problem. An answer may look convincing. A system may appear to work. Yampolskiy has made a career of asking what happens when somebody checks. After forty reassuring pages, it is a reasonable habit to acquire.