Anand Adya and the trouble with a green light

Anand Adya once found himself explaining his company to an interviewer who refused to wave him through. It was April 2016. He was running Greenlight Technologies, and Sramana Mitra was pressing him on what, precisely, made its security technology different. She challenged his account of the competition. He narrowed the argument to applications and the transactions passing through them. The exchange had the useful friction of a meeting in which somebody has actually read the proposal.

Then came a small admission with a long shelf life: “We’re learning, literally, by the hour.” For a founder selling control, it was an appealing concession to uncertainty. He also welcomed unsparing criticism. A sharper explanation could help him build a sharper business. There is something rather fitting about a compliance entrepreneur submitting his own pitch to inspection.

The trouble begins after the login

Adya founded Greenlight in 2004. The problem that drew him in was hardly theatrical. Companies were spending time and effort checking compliance through manual work and limited samples. Those checks could leave large stretches of business activity unexamined. His proposed alternative was software that watched transactions across applications as they happened, helping businesses detect and prevent violations. The ambition was comprehensive observation, applied to the ordinary machinery of a company.

That machinery matters because a business application is where an intention becomes an action. A purchasing decision becomes an order. An approval becomes a payment. Permission to enter a system says something about the user’s authority; the subsequent activity says something about how that authority is being exercised. Adya’s working territory sits between those two questions. The office door may open perfectly. The accounts still require attention.

His preparation combined consulting and technology. His career includes PwC and Andersen Consulting, and his more recent company biography also names Bell Labs. He earned an MBA at Wharton and studied at the Indian Institute of Management Ahmedabad. Before Greenlight, he had participated in two technology startups. By the time he described himself to Mitra, he was looking back on roughly two decades in technology, rather than discovering enterprise software through a particularly tiresome expense claim.

He was also careful about the customers behind the technology. In 2016, he explained that large enterprises had historically supplied most of the business, with their scale making the problem more acute. Smaller companies faced related pressures, but reaching them involved different delivery and pricing choices. It was a useful distinction for a founder: a widespread need does not give every customer the same budget, purchasing process or appetite for a complicated implementation.

A risk should come with a price tag

Greenlight’s approach had a useful translation built into it: show exposure in dollars. A risk score can mean a great deal to the person who designed the scale and rather less to the executive holding the budget. Money supplies a common unit. The company described views of exposure by employee, department, business unit and purchasing organization, making the consequences of access and activity easier to discuss with the people responsible for them.

It also worked across applications. SAP became a reseller, using Greenlight to extend access and business-process monitoring into SAP and other software. Greenlight’s headquarters were in Flemington, New Jersey, with offices in Pune and Walldorf. The geography suits the business: close to the enterprise systems and the teams that make them work. There is no requirement that a software company’s origin story begin beside a Californian espresso machine.

The partnership had people behind it. In a later public note to SAP executive Lloyd Adams, Adya thanked him for supporting Greenlight during the relationship’s formative period. He remembered the meetings and credited Adams with helping lay its foundation. It is a small, specific glimpse of a founder remembering the work behind an alliance announcement. Distribution arrives through agreements; it often begins with someone being willing to take another meeting.

Seventeen years, then a new name

In March 2021, Greenlight became Pathlock, accompanied by a $20 million strategic investment from Vertica Capital Partners. The announcement tied the money to product development and insider-threat prevention. The name change also captured a widening brief: govern access across the growing collection of applications that enterprises were adopting, including cloud services. A company might modernize one system while accumulating several new places where permissions needed watching.

Adya’s explanation was practical. Digital transformation was increasing application adoption and automation, sometimes beyond the IT department’s immediate view. The business could move faster while becoming harder to supervise. Pathlock’s proposed answer joined access information, activity and data in one platform. The product work included identifying suspicious sessions and removing unused access. Even the abandoned account, a minor character in office life, had acquired a security role.

The surrounding team changed, too. In April, Pathlock announced Kevin Dunne as president, alongside appointments in product, marketing and worldwide sales. Rick Howard, whose experience included serving as Palo Alto Networks’ chief security officer, joined the board. Adya emphasized the importance of technical and industry knowledge throughout the organization. The founder’s problem had grown large enough to require more people who could interrogate it from different directions.

By November, Pathlock had joined the Microsoft Intelligent Security Association. Its integration with Azure Active Directory addressed provisioning, access reviews and separation of duties. Those are unglamorous phrases for consequential decisions: who gets an account, who checks it later, and which powers should remain apart. Partnership also meant working inside systems customers already used. An enterprise rarely welcomes a security improvement that begins by demanding an entirely new enterprise.

The office door may open perfectly. The accounts still require attention.

The access problem, in everyday terms

The CFO belongs in this conversation

In June 2021, Adya joined the Forbes Technology Council. He described an agenda centered on the financial consequences of cybersecurity and the CFO’s part in responding. His speaking engagements had already taken him into finance and audit settings, including Rutgers, Financial Executives International, IIA and ISACA events. He was taking a technical subject to the people who would have to account for its consequences.

His published work followed that route. An October 2021 article argued for closer cooperation among the CFO, CIO and CISO in the cloud era. A January 2022 piece examined the business value of well-defined controls. Together, they show the commercial argument he wanted to make: controls belong in discussions of performance and efficiency as well as compliance. The finance executive has a reason to attend before something expensive goes wrong.

A much earlier example makes the point tangible. In 2013, Greenlight announced real-time policy enforcement for enterprise resource planning systems. Sharp Electronics Corporation of the Americas described implementing automation in its general ledger, procurement and payment processes. Its stated objective was protection that operated within the business process without obstructing it. That is a demanding brief for any control system: intervene when necessary, while letting the purchasing department finish purchasing.

When the company became a combination

May 2022 brought a different scale of change. Pathlock announced a merger with Appsian and Security Weaver, along with the acquisition of CSI Tools and SAST Solutions. A $200 million capital raise led by Vertica accompanied the transactions. The combination brought together application governance, ERP data security and SAP controls. It also changed the leadership: former Appsian CEO Piyush Pandey became CEO of the combined Pathlock.

The newly assembled business reported more than 1,200 customers and offices across the United States, Belgium, the United Kingdom, Germany, Israel and India. These were company figures at the time of the transaction. They describe the reach of the organization into which Adya’s original venture had grown. They also mark the point where a founder’s biography and a company’s continuing history need separate sentences.

The report is green. What does it prove?

Adya’s newer venture, BroadVision, places him in another part of the enterprise. Its company page identifies him as founder and CEO and describes a focus on connecting strategy with evidence about execution. His earlier business examined what happened inside applications. This one asks how the information scattered across an organization can help leaders judge whether the intended business result is still within reach.

BroadVision describes tools for enterprise alignment, transformation risk, delivery evidence and customer revenue protection. Its SAP offering addresses requirements, contracts, scope, delivery dependencies and resource pressure. These are the ingredients of a program that can look orderly in a presentation while becoming progressively harder to finish. The company’s stated aim is earlier recognition and intervention. That is a product proposition, rather than a claim that a software dashboard can abolish difficult decisions.

The continuity is interesting. In Adya’s Greenlight years, the recurring issue was whether access and transactions added up to acceptable risk. At BroadVision, the stated concern is whether execution evidence supports the promised outcome. Across both, there is an impatience with reassurance that has become detached from the underlying work. An approved permission and an approved status report each invite a second question.

That makes the 2016 interview an apt scene to return to. An answer was challenged; the explanation became more precise. Adya has spent much of his career building businesses around checking what is really happening. On that occasion, he was the person being checked. The green light had to wait for a better answer.