The most useful part of Harshit Agarwal's story arrives before the security platform, before the enterprise customers and before anyone could sensibly put the word "founder" in front of his name. It happens in his father's shop. Both of Agarwal's parents ran businesses, and he spent time there as a child, helping with sales and watching customers. He learned to anticipate what someone might want. He noticed that people remembered extra attention. Long before customer discovery acquired sticky notes and a workshop fee, he had seen its practical version across a counter.
He was already sure he wanted to build a company. Richard Branson's biographies supplied some of the romance. Reality supplied the editing. Agarwal studied Information Technology at KIIT University from 2008 to 2012, where he met people who would later shape Appknox: Subho Halder, a friend from their first year, and Prateek Panda, a senior. Agarwal and a friend would sit on a small hill during his daily jogging routine and discuss possible businesses. There are grander places to plot an empire. Few are cheaper.
Two startup attempts followed and failed. One of his later projects, FreeFood, tried to make takeaway meals effectively free by pairing orders with shopping coupons. It had ambition, arithmetic and a name that dared the universe to object. By the time Appknox began, Agarwal understood starting better than he understood surviving. That distinction would become expensive.
01 / The useful intrusion
A product gets opened in seconds
After college, Agarwal and Halder shared accommodation in Bangalore. Halder worked in cybersecurity and trained people in mobile application security. In one retelling of the company's origin, Halder hacked a product Agarwal had worked on in front of him. The demonstration was brief and impolite in the productive way. Something that had taken real effort to build could be opened up in seconds.
At the same time, mobile was becoming the front door to banking, shopping and work. The pair saw an awkward mismatch. App teams were shipping quickly, but security testing was still often slow, manual and late. They began discussing a company in December 2013 and started Appknox in 2014. The earliest name was XyScan. During the JFDI accelerator in Singapore, another founder helped them find a name that echoed Fort Knox. Branding, like security, sometimes improves when another person attacks the first version.
The company raised an early round. Agarwal later described it as $750,000 from a Singapore-based investor and said it remained Appknox's only outside round through 2022. The funding did not buy a shortcut. Appknox spent roughly two years building before its product launched in 2016. Mobile security testing asked for more than an attractive dashboard. The system needed to examine compiled Android and iOS applications, automate repeatable checks and produce results that enterprise teams could act on.
02 / The nearly empty account
A large market with no sharp edge
The premise was sound: every company with a mobile app should care about security. As a market definition, however, "every company" has the consistency of fog. A young developer with one app, an ecommerce business and a global bank may share a technical concern while possessing entirely different budgets, release processes and consequences.
By 2018, Appknox had reached the dangerous stage where a company can be correct in theory and still run out of money in practice. In a later interview, Agarwal said the bank balance fell to about $30,000. The team was around 22 people. Monthly recurring revenue was roughly $18,000. The company came close to shutting down.
The rescue was not a new logo, a larger fundraising round or a sudden affection for motivational stationery. Appknox narrowed its customer. Banks, non-bank financial companies and large enterprises did not merely have an app. They had estates of apps, frequent releases, compliance requirements and a queueing problem. A traditional manual test could take five to seven days while some teams shipped updates every week or two. Security risk was recurring, costly and attached to an operating rhythm.
Once that customer became clear, other choices lined up behind it. Pricing could reflect enterprise value. Messaging could speak to release cycles and portfolios rather than abstract danger. Sales scripts could address the security leader's actual problem. Appknox could automate about 80 percent of vulnerability assessment, with specialists handling the remainder. The company also offered on-premise deployments for organizations unwilling to upload sensitive applications to a cloud service.
Historical figures described by Agarwal in a July 2022 interview, not current financial guidance.
Distribution followed the same logic. Channel partners already knew local banks, governments and enterprises. Agarwal said in 2022 that roughly half to three-fifths of revenue came through channels, with partners across Southeast Asia, the Middle East, Africa, Europe and Latin America. The narrow product wedge travelled through broad relationships.
03 / The machine meets the phone
Why the physical device mattered
One of Appknox's product distinctions was wonderfully literal: it used real phones. A simulator can reproduce much of a mobile environment, but it cannot always reproduce the whole awkward physical life of a phone. A banking app may depend on a SIM card for two-factor authentication. For a bank in the Middle East and a government ministry in the Gulf, Appknox deployed real devices on-site so the test could include that flow.
This is what a good niche does to a product. It replaces the imaginary median customer with difficult, specific cases. An enterprise with hundreds of apps needs repeated tests that fit into software delivery. A government agency may require the system to remain on its premises. A bank may need a device capable of receiving an actual text message. Each constraint sounds inconvenient. Together they become a moat made of chores.
Pick a consequential workflow
Appknox focused on customers for whom mobile security recurred across many releases and many apps.
Automate the repeatable
Machines handled much of the standard assessment while specialists remained available for business-logic testing.
Respect the awkward edge
Real devices and on-premise deployments addressed constraints that a generic cloud scanner could miss.
Borrow trusted routes
Regional channel partners carried the platform into institutions where local relationships mattered.
By April 2022, Agarwal reported that Appknox had reached $1.7 million in annual recurring revenue, up from about $65,000 in monthly recurring revenue a year earlier. It had 76 paying enterprise customers, 103 percent net revenue retention and a small monthly operating profit. Those numbers are a historical snapshot rather than a present valuation. Their interest lies in the route between them and the 2018 bank balance.
04 / The founder as late student
Experience arrives after enthusiasm
Agarwal's most revealing reflection is not about security. Looking back, he said he had undervalued experience until 2018. He wondered whether learning inside a strong company before founding his own might have made the journey faster and easier. It is an unusually useful confession from someone who had wanted to be an entrepreneur since school. The dream survived contact with hindsight, but hindsight revised the syllabus.
His public writing and appearances now range across application security, hiring researchers, DevSecOps and the relationship between AI and software risk. In 2026, Appknox introduced KnoxIQ, an AI-native layer meant to help teams prioritize vulnerabilities by exploitability rather than add another heap of alerts. Agarwal described the shift as one from detection toward decision-making. The wording fits his company history. Appknox had no shortage of market signals in 2018. It needed to decide which signal deserved action.
He also spoke at India DevSec Show in Mumbai about automating security without slowing releases. That tension has been present since the beginning: software teams want speed; security teams want assurance; customers would prefer both before lunch. Appknox's answer combines automated static, dynamic and API testing with human penetration testing. It is less a victory of machine over expert than an arrangement about who should do which chore.
The company Agarwal helped build now serves enterprises across regions and industries. Yet the durable lesson remains pleasingly small. His father's shop taught him to watch the customer. Two failed startups taught him that desire is not evidence. A live hack made the problem vivid. A near-shutdown forced the customer into focus. The later numbers followed only after the sentence describing the buyer became shorter.
Founders are often told to think bigger. Agarwal's journey offers the missing footnote: think big about the change, and be exact about the first person who urgently needs it. A wide ambition can live inside a narrow entry point. Fort Knox, after all, is famous because the valuable thing is kept in one very particular place.