Anirban Mukherji and the arithmetic of the long race

Anirban Mukherji went to Maastricht with a plan. The bicycle portion of his 2017 Ironman took 47 minutes longer than he had expected. His account of the race records the discrepancy, the wind, the route, and the calculations that followed. Even in a story about crossing a finish line, he wanted to understand where the minutes had gone. The celebration could wait for the arithmetic.

He had been preparing for roughly two years, following a half-distance race in Vichy. Swimming was familiar territory; cycling was a more recent acquisition. His race report gives each discipline its own reckoning. By the end, he had completed the marathon in 5 hours and 26 minutes and was delighted with it. The pleasure survives in his writing, alongside the split times. Here is a founder who can enjoy a result while keeping the spreadsheet open.

That attention to the particulars offers a way into Mukherji’s other long undertaking. He founded miniOrange in October 2012. By 2026, miniOrange reported growth from four team members to about 800, serving more than 30,000 customers. Between those numbers lies a career spent on an apparently modest question: who should be allowed in?

A career at the login screen

Before miniOrange, Mukherji worked at RSA Security and IBM. His professional territory was identity and access management, the machinery that checks credentials and decides what follows a successful login. It is work people encounter constantly and usually notice only when it obstructs them. A sign-in box is a very small stage for a very large argument about trust.

His engineering background reaches into the protocols beneath that box. He has worked with authors of SAML, OAuth, and OpenID, alongside developing expertise in the authentication protocols used by network equipment. His experience also includes architecting adaptive authentication. These are the connections in his career that matter: the people and systems behind the everyday act of proving who you are.

He emphasizes usable multifactor authentication. The adjective deserves its place. Security has to accommodate the employee who wants to finish a task as well as the administrator who wants to limit risk. Mukherji’s professional problem has always contained both people. A protective measure that nobody can bear to use has a rather limited social life.

By 2024, his conference work also included consumer fraud awareness, with a particular interest in Asia and the Gulf. He was drawing connections between attacks on individuals and attacks on companies. The distinction looks tidy on an organization chart. A stolen identity has less respect for the chart.

Four people, and a product to build

Mukherji’s move into founding gave that technical experience a different set of obligations. A product needed customers, integrations, support, and people willing to keep improving it. Pune became the base for building a business that would sell abroad. Its customers are concentrated across North America, Europe, the Middle East, and India. The geography of the work was international even when the engineering team was close to home.

miniOrange describes itself as completely bootstrapped. It also makes a point of continuity in its management team and direct human customer support. Those choices are part of Mukherji’s pitch to buyers. He asks them to consider who built a security vendor, whether those people remain available, and how the business’s ownership influences its priorities. In a market full of feature lists, he wants the customer to inspect the company behind the features.

“A company built by engineers and built to last!”

Anirban Mukherji, writing from Infosecurity Europe

His public language can be briskly commercial. A post from London makes the case for engineering, support, and pricing, then invites the reader to try the product. There is little mystery about the transaction. He believes an engineer-led company can win business by doing the work well and charging a price customers can accept. It is an argument with invoices attached.

The Pune address travels well

When Mukherji discusses building from India, he talks about engineering depth, cost efficiency, and the ability to integrate products into customers’ existing systems. He also acknowledges friction. An Indian technology business selling its own software must sometimes work against expectations formed by the country’s much larger services industry. A familiar national success story can become an awkward introduction to a different kind of business.

His answer is to keep investing in product engineering. Revenue from products can return to research and development, giving the next version somewhere to begin. He has spent years advocating that cycle from Pune, where the company’s work has grown beyond its original identity focus into a wider security portfolio. The ambition is to own and develop technology that organizations elsewhere choose to buy.

His views on passwords are similarly practical. He expects them to become less central rather than vanish on schedule. He favors authentication that responds to context: the device, the behavior, the transaction, and the risk. He also argues for human oversight of consequential AI-assisted decisions. For someone selling security software, he is comfortable describing a future with several moving parts and no single ceremonial replacement for the password.

A different sort of podium

The sports story has its own ambitions. Mukherji was a national-level swimmer during his student years and later became part of the core group behind Recreational Triathletes. He wanted Indian competitors to progress beyond completing overseas races to winning them. By 2019, that desire had become practical support for athletes, with miniOrange paying most of the cost of a competition bicycle for Saikhom Bishworjit.

Bishworjit went on to win Ironman 70.3 Goa that year. The effort around him involved other amateur triathletes, contributions from the community, and the athlete’s own training. Mukherji’s place in it was concrete: helping provide an opportunity and equipment. It is easier to appreciate the intervention when it has handlebars.

His own competitive life continued. At the Goa Swimathon in March 2022, Mukherji won the men’s 40–59 category in the two-kilometre race, with a time of 39 minutes and 14 seconds. This is a useful detail in a founder profile because it gives the sports interest a stopwatch. He participates in the activity he supports.

The miniOrange Sports Academy states an Olympic gold medal as its goal. That remains an aspiration, with a very particular sound attached: India’s national anthem at a medal ceremony. The wish is larger than his own finishing time. Somewhere along the way, the race report became an interest in making room for other people’s results.

Security needs a room of its own

Mukherji’s work on IdentityShield follows another interest in building an environment around a problem. Having attended cybersecurity conferences abroad, he wanted a platform in India where technical professionals, enterprise leaders, government participants, and others could exchange what they knew. The audience he describes extends beyond the people who can authorize a software purchase.

He has argued that public awareness belongs beside technical defenses. Fraudsters exploit fear and confusion as readily as weak systems, and ordinary users need information they can understand and act on. In his account, collaboration also needs to cross organizational boundaries. Criminal operations share methods; defenders have reason to share knowledge.

His explanation of IdentityShield includes an insistence that it serve the wider industry. That is a more demanding ambition than gathering an audience for a product presentation. It asks a founder to put competitors and potential customers into a conversation whose usefulness exceeds his own company’s sales cycle. The event is part of his effort to give digital identity a regular meeting place in India.

He describes digital safety as a public good. This helps explain why a career in enterprise authentication has led him toward citizen awareness and community events. The person at the other end of a login can be an employee, a small-business owner, or someone who has never heard the phrase “identity governance.” The practical consequences still arrive.

Now the software wants an identity

In October 2026, Mukherji brought his familiar question to AI agents. Software that can open applications, call tools, and move information needs an identity of its own, he argues. Borrowing a developer’s credentials blurs responsibility. The organization should be able to establish which agent acted and who authorized it. A new kind of worker has arrived with an old administrative problem.

His proposed response is specific: give agents defined owners, limited permissions, and credentials that do not remain useful forever. Observe their behavior, adjust access when their responsibilities change, and remove it when the work ends. The agent may be novel. The need to keep track of who has the keys is familiar.

His September appearances in Dubai and Ahmedabad put private AI, governance, and data protection on the agenda alongside the company’s history. At BSides, the account of his talk highlighted hard work, discipline, initiative, ownership, and meritocracy. These are his stated values, and they place responsibility with the people building and operating the systems. Even when the subject is autonomous software, somebody has work to do.

The Maastricht report ends with satisfaction at a marathon completed better than he had hoped. Years later, his professional questions still favor particulars: the owner of an account, the scope of a permission, the person answering a customer. Mukherji’s story accumulates through such details. A company grows, an athlete gets a bicycle, an agent gets an identity. Each result begins with someone taking the trouble to work out what is needed next.