Nikhil Gupta and the trouble with three customers

The product was beautiful. The prospective customers were unmoved. Around 2000, Nikhil Gupta followed a group of Bell Labs colleagues into a startup, confident in the people and the engineering. The missing ingredient became apparent only when they asked people to use it. There was no market. Elegance, it turned out, could be an expensive hobby.

Gupta has kept that episode in his account of how he became a founder. It supplies a useful opening because the mistake is so ordinary. A team can admire its own work with perfect sincerity. Buyers have other appointments. The distance between those two facts can consume a company.

Today he is the founder and CEO of ArmorCode, a software security company started in July 2020. Its work involves getting information from different security tools into a form that people can act on. Beneath the technical vocabulary sits a familiar managerial difficulty: plenty of information, several teams, and uncertainty about who should do what next.

His advice to founders has an unusually inconvenient starting point. Think past the first three customers. Consider the thirtieth, the three hundredth, or the three thousandth. The first handful might be friends. Their willingness to help can look remarkably like a market, especially to someone who has been waiting years for encouragement.

A long apprenticeship in starting again

Gupta grew up in India, studied computer science at B.M.S. College of Engineering in Bangalore, and moved to the United States for work in 1997. He later pursued a computer science master's and an executive MBA through Columbia and London Business School. His account gives his mother an important role: she encouraged learning and ambitions that stretched beyond familiar territory.

At Bell Labs, which he joined in 1999, that territory included the history of computing. He remembers discovering that the room where he made his daily cappuccino was also where UNIX had been invented. He subsequently worked with Ken Thompson. It is a pleasing collision of the monumental and the mundane: a landmark in computing, encountered on the coffee round.

The career that followed included VMware, Cisco, ForeScout and Ericsson. A list of employers, though, smooths away the awkward parts. In his fifth-anniversary reflection on ArmorCode, Gupta described a venture capitalist dismissing him in 2015 as a would-be entrepreneur, followed by the loss of his job. He had spent years trying to turn ideas into a company.

He also described promising his wife that he would put startups aside until much later. The significance of that detail lies in the negotiation. Entrepreneurship had become a question for a household as well as a career. The ambition was his; the consequences would be shared. The polished founder biography usually has little room for that conversation.

A buyer with a different name

In 2017, Gupta and Ganesh Krishnan co-founded Avid Secure. The business addressed security in public cloud environments, combining analytics, compliance and automation. This time, there was a clear setting for the product: companies were operating across services such as AWS, Azure and Google Cloud, and needed help understanding and protecting those environments.

Sophos acquired Avid Secure in January 2019. The announcement identified Gupta as its CEO and co-founder and described engineering operations in Gurgaon, India, alongside its San Francisco headquarters. Sophos did not disclose the transaction's terms. The concrete achievement was an acquisition by an established security business, with the team and technology joining its cloud security effort.

For Gupta, the next venture would move into the space between software development and security. ArmorCode began in July 2020, as companies were accelerating digital operations. He saw security teams struggling to keep pace with developers and to coordinate work across tools. The accumulated alerts could create another administrative job before anyone got around to fixing the underlying problem.

That observation gives the two businesses a family resemblance. Each tries to make complicated technical environments manageable. The problem changes shape, but the practical question persists: how does an organization turn what it knows into work somebody can finish? A warning that travels no further than a dashboard has a very comfortable retirement.

There is an unusually domestic origin detail in his September 2026 Neon Show appearance: he connects the idea for ArmorCode to a trip to buy toilet paper. He also discusses studying thousands of security companies before starting. The juxtaposition suits the business. An everyday errand and a crowded technical market both require someone to notice what is missing. The interview returns to the difficulty of getting reliable answers from customers, a concern that follows naturally from his earlier experience of building before asking.

The arithmetic of an actual business

Gupta's customer sequence gives that practical streak a memorable form. In a 2022 conversation, he explained why early buyers can be misleading: an experienced person can often recruit three through personal connections, obtain funding and build a product. The harder task is designing a business that can reach customers beyond that circle.

Work backward from the scale you want, he argues. The implication is demanding. Distribution belongs in the early thinking, alongside product design. A founder who wants thousands of enterprise customers needs a plausible route to them. Personal charm has its uses, but even a considerable supply eventually runs into the limits of the calendar.

By December 2023, ArmorCode had announced a $40 million Series B, bringing its reported funding to $65 million. The round was led by HighlandX. Gupta framed the investment around bringing application security and vulnerability management together, rather than leaving customers to assemble separate views of the same software estate.

NGP Capital's investment explanation described a business built above existing scanning tools, with connections into workflows such as Jira and ServiceNow. The distinction matters to understanding Gupta's choice of problem. Enterprises already own security software. The opportunity he pursued was coordination across that installed equipment, where useful findings can otherwise become isolated pieces of unfinished work.

A book acquires a social life

There is a parallel thread outside the product. Gupta helped create the Purple Book Community, which began with a project to write about software security practices and grew into a network of security leaders. AppSecCon followed in 2022. A book project had acquired the sort of recurring conversation that a finished manuscript cannot contain.

For a founder trying to understand how security teams work, that is an interesting place to spend time. Practitioners have to live with the consequences of tools, processes and organizational boundaries. A conversation among them can move quickly from an attractive concept to a stubborn implementation detail. Those details are where a product's promises meet somebody else's working week.

Inside ArmorCode, Gupta describes a culture organized around five Hs: hungry, humble, hardworking, honest and humanity. In his 2024 ASCEND conversation, he connected those values to hiring and company operations. He also emphasized understanding why one wants to start a business, beyond the prospect of making money.

The combination is revealing. Hunger asks for forward motion; humility makes room for correction. Holding both at once is the founder's difficult assignment. Gupta's early product mistake makes the second quality especially relevant. Customers can disappoint a beautiful theory with a short answer. A company needs people prepared to hear it.

“I’m a problem solver at heart.”

Nikhil Gupta · 2022

A recent LinkedIn update offers a small test of that customer arithmetic. Gupta described what he called ArmorCode’s largest deal, reached through a partner, and said he first met the customer on the day it closed. He gave the team credit for getting it there. For a founder who tells others to imagine buyers beyond their own acquaintances, the satisfying detail was his late arrival. The business had made a connection without needing him to start the conversation. That is a different kind of public milestone from a funding announcement, and perhaps a more personal one.

The queue gets longer. The question gets simpler.

In April 2025, Gupta turned his attention to the enthusiasm around AI agents. His opening question was plain: what problem were they supposed to solve? He argued that adding autonomous systems to already fragmented security tools could increase the burden on the people expected to supervise them. His concern was governance across systems, including how those systems communicate and share context.

On March 3, 2026, ArmorCode announced $16 million in strategic funding, bringing its stated total to $81 million. It also appointed Phil Venables to its board. Gupta tied the capital to expanding the company's agentic AI platform and enterprise presence. The announcement puts resources and a new board appointment behind an ambition he had already been describing in public.

The more recent expression arrived on October 20, 2026, when he introduced ArmorCode Zero. Its proposed measure of progress is a shrinking backlog, with the most consequential risks addressed first. The workflow groups findings around fixes, drafts changes through coding agents, and retains human approval. A fix counts after a rescan confirms that the finding has disappeared.

That is a useful place to leave Gupta's story for now: with a test. The early startup discovered too late that customers did not want its elegant product. His advice asks founders to look beyond friendly first buyers. His newest product asks whether the work has actually been completed. Across these different stages, the same impatience emerges. A convincing presentation should eventually survive contact with the people expected to use it.

Follow the questions