Andy Lunsford and the Trouble with Having a Plan

Andy Lunsford moved from Washington, DC to San Francisco to find a technical co-founder. A mutual friend introduced him to Matt Hartley, a cybersecurity veteran who lived roughly ten miles from Lunsford’s old house. The geography was unhelpful. The introduction worked.

That small comedy of distance makes a fitting opening for a business concerned with people who ought to be working together. At BreachRx, Lunsford and Hartley address the handoffs surrounding a cyber incident: the security investigation, the legal assessment, the messages to customers, the decisions upstairs. An organization can have capable people in every department and still struggle to connect their work.

The co-founder ten miles away

Lunsford’s interest in privacy preceded the startup. He grew up mainly in Fayetteville, Arkansas, after spending some early years in Southern California. As a teenager, he read 1984 and Brave New World. At college, Philosophy of Law became a favorite class; a senior honors thesis explored the right to privacy. The subject stayed with him as an intellectual question before becoming his profession.

A later introduction brought the engineering counterpart. Hartley had worked in security product and engineering leadership at iSIGHT Partners and FireEye, following service in the US Air Force. Lunsford understood the legal work around an incident. Hartley understood the systems and teams responding to it. Their partnership put those experiences in the same conversation.

There is a practical lesson in the circuitous meeting. Finding a partner required a connection between people, rather than simply arriving in the presumed right city. Their eventual product would tackle another version of that problem: getting the right people involved while there is still time for their involvement to help.

A lawyer learns to look past the alarm

Lunsford holds a BA from Washington and Lee, a law degree from the University of Arkansas and an MBA from Wharton. The qualifications span several ways of looking at a company. His working experience supplied the more awkward material: what happens when a business has to explain its conduct after something has gone wrong.

Early in his legal career, he worked on data-breach litigation involving the Federal Trade Commission. He subsequently built a litigation consulting business in Washington with his brother and other partners. At Beacon Group, he served as director for eleven years. Entrepreneurship was already part of his career before he entered software.

He has credited his brother’s encouragement with helping him take that path. Building the consulting firm gave him experience of running a business, along with a reason to believe he could build another. BreachRx grew out of seeing organizations repeatedly struggle with the work around privacy and cybersecurity incidents.

His attention settled on the response itself. An employee loses a laptop. Customer information goes to the wrong email recipient. Someone must establish the facts, involve the right colleagues and record the actions taken. Such events may lack the theatrical appeal of a ransomware headline. They still consume working hours, and they still require a response.

The plan has to survive contact with Tuesday

By his 2023 explanation of BreachRx, Lunsford was describing an alternative to the static incident-response document. The software generated tasks for a particular organization and incident, arranged them into phases and attached deadlines. As the facts changed, the required work could change too.

The distinction matters because a plan is written with the benefit of a quiet room. Its execution happens with missing information, interruptions and other people’s calendars. A document can name a department without identifying the person who will answer. It can describe an escalation without making the escalation happen. Polished prose has no forwarding address.

Lunsford’s approach to practice was similarly incremental. Start with smaller scenarios, such as phishing, stolen laptops or misdirected email. Work toward a larger ransomware exercise after people have tested the procedures and discovered the awkward handoffs. An elaborate executive rehearsal is less useful if the ordinary coordination beneath it has never been tried.

Contracts and insurance requirements also belong in the preparation, alongside regulatory obligations. This widens the cast beyond the security team. The recurring question becomes whether each participant knows which part of the work belongs to them, and whether the organization can see the response taking shape.

Capital, with some familiar faces attached

In April 2024, BreachRx announced a $6.5 million seed round led by SYN Ventures, with Overline participating. It reported more than seventy customers. Joe Sullivan, formerly Uber’s chief security officer, became a senior adviser. Former SAP security chief Tim McKnight joined the board, and former RSA chief executive Art Coviello became a board observer.

The appointments brought people with direct experience of security leadership into the company’s orbit. For Lunsford, whose original vantage point was legal, that experience offered another view of the decisions his software was intended to support. The product’s audience included people expected to explain those decisions afterward.

A year later, in May 2025, BreachRx announced a $15 million Series A led by Ballistic Ventures. Kevin Mandia joined the board; cybersecurity journalist and author Nicole Perlroth became a board observer. The company reported more than one hundred customers and annual recurring revenue growth above three times year over year for a second consecutive year.

Those were the company’s figures at that moment. The funding was intended to expand engineering and sales capacity. The board additions also gave the business access to perspectives formed through incident response and reporting on cyberattacks. Lunsford was building around a problem that several of the people joining him had encountered from different sides.

Keeping a record when everyone wants an answer

Lunsford’s legal background remains visible in his insistence on documentation. In conversation with SpotDraft’s Tyler Finn, he argued for a factual account of the response, with privileged legal communications kept separately. His concern is the difference between having acted responsibly and being able to demonstrate what happened.

“If you don’t document your response, you can’t prove you acted responsibly.”Andy Lunsford

A response record gives the organization something more durable than recollection. Decisions can be revisited. Colleagues can establish what was known at a particular moment. The people joining an incident later can follow its progress without asking everyone to reconstruct it from memory.

Lunsford has also argued that the treatment of breached organizations should give greater weight to preparation and transparency. This is his position in the public debate, and it helps explain the emphasis of his company. He wants teams to have the tools and records to account for their work when it comes under scrutiny.

In March 2025, Lunsford appeared in a discussion of incident reporting and communications with Renee Guttmann and Joe Sullivan. Between them, the two former security leaders had held roles at companies including Coca-Cola, Royal Caribbean, Facebook, Uber and Cloudflare. The discussion brought his coordination argument into a conversation with people who had carried responsibility for security inside large organizations.

The choice of topic is revealing. Reporting and communication are work products in their own right, requiring decisions about audience, timing and language. A technical finding must become an explanation other people can use. For Lunsford, a response process needs room for that translation, with a clear relationship between the investigation, the decision and the message that follows.

That is a lawyer’s concern translated into a product requirement. The record has to develop while the work is happening. Waiting until the end leaves a company trying to assemble a coherent sequence from scattered conversations. Memory is an enthusiastic editor; it is less reliable as a clerk.

The rehearsal gets a shorter calendar

On June 25, 2026, BreachRx launched the Rex Platform. The company described an AI incident command center built around Maestro, a coordinating agent, with specialized agents handling such work as regulatory mapping, document processing, reporting and exercises. Its stated premise was that overlapping incidents and faster attacks would increase the coordination burden.

The technology introduced new machinery to Lunsford’s longstanding problem. Instead of expecting participants to reconcile separate streams of activity themselves, the platform was designed to keep ownership, deadlines and the incident record connected. The company presented the agents as a way to carry procedural work while people remained responsible for consequential decisions.

September brought AI Tabletops on Demand, intended to reduce the effort of creating, facilitating and documenting exercises. Teams could build scenarios around changing threats, procedures or personnel. The offering also records what the AI produced and what a person approved, extending the documentation principle into practice sessions.

The aspiration is a more frequent rehearsal. An annual discussion offers one occasion to discover confusion. Smaller exercises offer more occasions to notice when a procedure has aged badly or a responsibility has become ambiguous. For a founder who had advocated starting with manageable incidents years earlier, the emphasis was consistent.

When even the meeting room is compromised

In October 2026, BreachRx announced Out-of-Band Comms, adding email, chat, meetings and collaborative workspaces for situations in which normal corporate systems are unavailable or untrusted. It addressed an inconvenient dependency: the same systems people use to coordinate their response can themselves become part of the incident.

Moving a conversation to a backup channel solves only some of that problem. The assignments, approvals, legal work and record still need somewhere to live. The new capability was designed to keep those activities together outside the affected environment. A meeting can continue, and so can the work it is supposed to organize.

Across these changes, Lunsford’s preoccupation remains recognizable. He began with privacy, spent years around litigation and built a company concerned with how organizations behave after a breach. The software has grown more elaborate. The question at its center remains stubbornly practical: when the alarm sounds, does everyone know what to do next?