Ask ten architects how a system is configured and receive twenty answers. Mike Baukes used that arithmetic to describe life inside complicated companies. It is a splendid result for a debating society. For a business trying to keep its technology working, it presents difficulties. Someone must decide which answer describes the equipment the company actually owns, rather than the equipment everyone remembers ordering.
Before he co-founded UpGuard, Baukes worked in the machinery of financial services. His career crossed architecture, engineering, operations and technology strategy, with roles at organizations including Lloyds Banking Group, Commonwealth Bank and E*TRADE. He knew the problem from several seats around the table. Each team could understand its own responsibilities while the business struggled to understand the whole.
That experience gives his entrepreneurial story its particular shape. Baukes keeps returning to a question that sounds almost embarrassingly elementary: what have we got? Fourteen years after UpGuard's founding in 2012, the question stretches across suppliers, internet-facing systems and employees' use of AI. The inventory has become more complicated. The need for an intelligible answer has survived every change of vocabulary.
A corporate education, followed by twenty interviews
Baukes and fellow founder Alan Sharp-Paul were engineers at Colonial First State in Sydney long before their company attracted international investment. Their familiarity with big institutions gave them a problem worth working on. It also gave them habits they would have to reconsider. Corporate life comes with established procedures. A young business must discover which procedures it needs while finding somebody willing to pay.
The early product was called ScriptRock. By the time the founders applied to Startmate's 2012 intake, they had spent a year consulting around a basic version. Baukes had watched the progress of BugHerd, a company from the accelerator's first cohort. He wanted experienced outsiders to test whether their own idea deserved a more serious commitment.
The application involved twenty interviews. Later, he described the encounters as exhausting. The same mentors who made admission uncomfortable became useful once the team was inside. A conversation over drinks with Startmate founder Niki Scevak and Atlassian co-founder Mike Cannon-Brookes helped shift attention from the idea's appeal to the work of executing it.
In August 2012, a team of five moved to Palo Alto. Australian clients renewed despite the relocation. It was an early lesson in the difference between the thing a founder fears and the thing customers actually mind.
- 2012Startmate in Sydney
- 2012Five people move to Palo Alto
- 2021US$19m Series B-1
- 2026US$75m Series C
The code can work. The organization can still fail.
Baukes was talking about cooperation before AI became a convenient addition to every software pitch. In a 2014 interview, he defined DevOps with unusual economy: “It's just collaboration with a shared goal.” Developers, operations staff and security teams needed to understand how their work joined up. Buying another tool did not relieve them of that obligation.
He had participated in projects where automation satisfied an immediate technical requirement yet failed to achieve the organizational change behind it. The work could be completed and then left unused. That admission matters. Here was someone selling software who could describe circumstances in which producing more software had missed the point.
By 2016, he and Sharp-Paul were explaining UpGuard in terms of digital resilience. Their starting point was visibility into development and operations. From there came understanding a system's purpose, its users and its place in the business. Baukes's account of the company's origins centered on the difficulty of getting security, business and operations to cooperate.
He also warned that adopting fast-moving open-source technology brought obligations: maintenance, updates and an understanding of the community producing it. A new component could arrive quickly. The knowledge needed to look after it did not arrive automatically in the same download. For Baukes, resilience included adapting as both technology and business requirements changed.
“It's just collaboration with a shared goal.”Mike Baukes, on DevOps, 2014
A number that has to earn its keep
Security ratings offered one way to carry technical detail into a business conversation. In 2016, Baukes argued that an external security assessment based on public information should be available free. The difficult work included connecting that outside view to what an organization understood about its internal systems.
A rating could give people a starting point without pretending that a public scan saw everything. The distinction was essential. An executive might find a single number convenient; the team responsible for improving it still needed the underlying detail. Otherwise, the number risked becoming another item that looked reassuring in a presentation.
In a 2017 account, Baukes described a company that had used its assessment to guide repairs, improving its score by about 400 points. Changes included securing email delivery and strengthening website and domain settings. The attraction of the example was its practical scale. Somebody had received information, understood it and changed something.
His writing pursued the human arrangements around that work. Articles published under his name examined vendor trust, contractor risk, authentication and the way technology trouble becomes people trouble. Even his choice of subjects kept bringing cybersecurity back into ordinary management territory: who is responsible, what do they know, and can anyone else rely on them?
The founder at the breakfast table
There is a more domestic version of Baukes's argument for sharing responsibility. In a 2016 description of his routine, he said delegating work had made more time with his wife and two children possible. Earlier stretches of company-building had consumed mornings and evenings. Giving colleagues more responsibility made room to hear what was happening at home.
He described management through the things it could remove from other people's days. Company-wide check-ins exposed obstacles. Meetings connected the week's tasks to strategy. Lunch arrived at the office. Around it, people ate, played games or picked up a guitar. The details make an office feel inhabited rather than photographed for a recruitment brochure.
These were his descriptions of that period, when the company had grown to roughly sixty people. They show a founder learning to distribute work instead of collecting it. Family time and better management appear in the same account because, for him, one had helped make the other possible.
The risk belongs to the business
The company gradually put more of its attention on exposure beyond a customer's own systems. Baukes has described a 2018 pivot toward security posture, attack surface management and vendor risk. The reasoning followed the problem outward: a company could depend on another organization without controlling how that organization protected its technology.
By June 2021, UpGuard announced a US$19 million Series B-1 round. Existing backers included IAG Firemark Ventures, Pelion Venture Partners, Square Peg Capital and August Capital. Baukes framed the investment around the importance of monitoring vendors. The company was also expanding a managed research service, bringing human investigation alongside its software.
There is an occupational logic to that combination. A dashboard can expose an issue; someone still needs to determine what it means and what to do. Baukes had spent years discussing the gap between knowing that something exists and understanding it well enough to act. Vendor risk gave that gap commercial urgency.
His public conversations have included people working on different sides of the problem. An Innovation Bay cybersecurity panel paired him with Bugcrowd founder Casey Ellis, investor James Cameron and entrepreneur Jessica Glenn. The setting suited a subject that involves product builders, capital, customers and organizational behavior. No single profession gets to finish the conversation alone.
More capital, less busywork
In March 2024, UpGuard introduced Managed Vendor Assessments and Trust Exchange, using AI to assist assessment work and security questionnaires. It also appointed Harsh Sureka as chief operating officer, Jackie Ariston as chief revenue officer and Kevin Levine as chief financial officer. Product expansion came with a wider distribution of executive responsibility.
The financing grew again in February 2026: a US$75 million Series C led by Springcoast Partners. UpGuard said the money would support its cyber risk posture management platform, global commercial expansion and potential acquisitions. The platform brought vendor exposure, external systems and workforce risks into a common view.
In his public response, Baukes credited the team across fourteen countries and thanked customers. He described the aim as bridging risk and security, with less manual overhead for lean teams. The terminology had expanded since ScriptRock. The intended customer still needed help making sense of too much information.
A March 2026 company survey gave that frustration a number. Among 400 security leaders surveyed across North America, APAC and India, UpGuard reported that manual context gathering consumed 43 percent of investigation time. It is a survey finding, rather than a measurement of every security team. Even so, it puts a familiar problem into working hours: before fixing an alert, somebody has to work out what it is about.
of investigation time spent gathering context manually, according to UpGuard's 2026 survey.
A policy before the next surprise
The next developments were prosaic in a useful way. In August 2026, UpGuard became available through Google Cloud Marketplace, allowing customers to buy it against existing cloud commitments. In September, it gathered free security resources into a tools hub, including an AI policy generator, security reports, a website scanner and editable templates.
Those announcements addressed the work surrounding security as well as the detection itself. Procurement can delay a tool. A missing policy can leave people improvising rules. A vendor check can wait because nobody has a quick way to begin. Each creates another interval between noticing a problem and dealing with it.
Baukes's public ambition remains tied to that interval. He wants technical risk to make sense to the people running a business, and he wants small security teams to spend less time assembling context by hand. The company now operates from Hobart and Mountain View; his own public professional profile places him in Hobart.
His career offers a particular test for any new layer of technology: does it help people understand what they are responsible for? It is a good question for an engineer, a chief executive or a roomful of architects. Especially the architects. They already have quite enough answers.