Lightbeam

Here is a fact that sounds too dumb to be true, and is true anyway: a lot of large organizations do not know where their sensitive data is. Not in a vague, philosophical sense. In the literal sense that if you asked the general counsel of a mid-sized bank to point to every place a customer's Social Security number lives, she could not do it, and neither could anyone she works with, and the honest answer is a spreadsheet, some cloud buckets, a few forgotten exports, and a shrug.

This is the problem Lightbeam was built to fix, and it's worth pausing on why the founders believed it, because they didn't read about it in a McKinsey deck. Himanshu Shukla, Aditya Ramesh, and Priyadarshi Prasad were engineers at Nutanix, the enterprise infrastructure company, and they kept running into the same wall from the inside: they couldn't reliably discover, classify, and secure their own sensitive data. When the people whose job is building serious infrastructure can't find their own data, that's not a skills gap. That's a category of software that doesn't exist yet.

So in 2020 they left and built it. The insight they carried over from Nutanix wasn't technical so much as architectural. Nutanix made its name by converging things that used to be separate boxes - compute, storage, virtualization - into one system. Lightbeam's bet is that data security has the same problem: you buy a discovery tool, a privacy tool, an access governance tool, and an AI governance tool, and now you have four dashboards that don't talk to each other and a team too tired to look at any of them. Converge them, the argument goes, and the blind spots between the boxes disappear.

The reframe underneath all of it is the interesting part. Most security software thinks in files: this document is sensitive, that folder is not, put a lock here. Lightbeam thinks in people. Its pitch is that data is identity - that every scattered fragment, the email in one system and the account number in another and the medical note in a third, belongs to a specific human being, and that the right unit of protection is the person, not the file. Its engine, called Spectra, does the unglamorous stitching: it co-references fragments across systems and reconstructs an identity-centric graph, so that "protect this person's data" becomes a query you can actually run.

What you can do with it is roughly what you'd hope. Point Lightbeam at your cloud, SaaS, and on-prem systems and it discovers the sensitive data you have, classifies it, tells you who can touch it, and flags who shouldn't be able to. If a regulator or a customer files a data subject request under GDPR or CCPA, the workflow to find and produce everything about that person is automated rather than a two-week scavenger hunt. If someone - or, increasingly, some AI agent - starts encrypting or hoovering up files in a way that looks like ransomware or theft, the system is designed to notice and contain it. The customer numbers Lightbeam likes to cite (99% discovery accuracy, a 40% cut in total cost of ownership, 75% faster GDPR compliance) are the kind of figures every vendor cites, so take them as claims rather than gospel; the more telling data point is that one customer, a benefits firm, ran the tool and discovered roughly 200 million sensitive attributes it hadn't known it was storing.

The timing has been kind. When Lightbeam started, "where is our sensitive data" was a compliance chore. Then generative AI arrived and turned it into an emergency, because an enterprise AI assistant is, functionally, a very fast reader with access to whatever you've given it. If your Microsoft Copilot can read an unprotected HR folder, then so can anyone who knows how to ask Copilot a question. Lightbeam moved into that gap early, extending its governance to control what Copilot, ChatGPT Enterprise, and Google Gemini are allowed to see - which is either a natural extension of "protect the person behind the data" or an extremely well-timed pivot, and is probably both.

Investors bought the story. In February 2024 the company closed an oversubscribed $17.8 million Series A led by Vertex Ventures US, with Dropbox Ventures, 8VC, and Village Global along for the ride. Sandeep Bhadra of Vertex framed the thesis with unusual candor about where the value sits: this is a team that "drew on their experience working together at Nutanix and combined it with the latest innovations in deep-learning." Translated: they lived the problem, and they can build the machine learning to solve it. The company says its customer base grew nearly 300% in the year around the raise, across banking, insurance, healthcare, tech, and retail - the industries where getting data wrong is not embarrassing but litigable.

None of this makes Lightbeam a sure thing. The category is crowded - BigID, Securiti, Cyera, Varonis, and a half-dozen others are selling adjacent promises to the same nervous CISOs - and "we converge four tools into one" is a pitch that has to keep being true as those tools evolve. But there's a coherence to what the company is doing that's rarer than it should be. The founders identified a problem by suffering it, chose an architecture they'd already watched work once, and built the whole product around a single stubborn idea: that behind every row in every table is a person with a name, and the software should act like it knows that.