Compliance has a theatrical habit. Everyone rehearses furiously before the auditor arrives, the evidence is arranged in neat rows, and the company performs its controls under bright light. Then the curtain falls. The spreadsheets age. Systems change. Somebody leaves. A policy drifts out of step with the business it is supposed to describe.
Phillip Liu looks at this annual drama and sees a familiar engineering failure: the monitoring is too late. Long before he founded Trustero, Liu worked on systems that could not afford to wait for a quarterly review. At Facebook, where he served as a software architect from 2008 to 2012, infrastructure produced signals at a scale that made yesterday’s report feel quaint. The useful question was what the system was doing now.
That question has followed Liu through a career in distributed systems, from early engineering roles at TRW Financial Systems and Marimba to chief architect at Opsware, a post he carried into HP Software. Hewlett Packard named him a Distinguished Technologist. The title sounds ceremonial; the work was not. Large fleets of machines must be configured, observed and corrected without expecting a patient human to inspect every moving part.
The signal inside the chore
At Facebook, Liu built configuration-monitoring tools and helped develop infrastructure and application-management systems. In 2013, he co-founded SignalFx with Karthik Rau. The proposition was tuned to the cloud era: stream operational data in real time, analyze it as it arrives, and find the few signals that deserve attention among billions or trillions of transactions.
SignalFx eventually became a clean Silicon Valley headline. Splunk acquired the company for roughly $1.05 billion in 2019. Liu prefers to leave some dirt on the story. In a founder interview, he recalled raising about $8 million on roughly seven slides, then discovering that the market response was not what the team had hoped. SignalFx began with a smaller-business sales motion and moved toward enterprises, where more sophisticated buyers already understood the data science behind the product.
“Innovation clearly is not enough. It takes grit to basically make your innovative idea to become reality and to become a winning business.”Phillip Liu on building SignalFx
The sentence is useful because it declines to turn technical invention into destiny. SignalFx had pedigree, capital and an idea born at Facebook scale. It still had to locate the customer prepared to care. Product-market fit arrived partly by choosing a market equal to the machinery.
Meanwhile, a less glamorous task had lodged itself in Liu’s mind. SignalFx needed SOC 2 compliance. As the company worked through controls and evidence, Liu noticed that the process resembled monitoring. Infrastructure monitoring watches the physical and virtual systems behind an application. Compliance monitoring watches the business processes around it. Both are dynamic. Both generate evidence. Both punish a stale picture.
An unfinished extension becomes a company
Liu imagined compliance as a possible extension of SignalFx’s analytics platform, but the company never built it. After the acquisition, the omitted idea remained. “I think the minute SignalFx exited, I kind of thought about, what am I going to do next?” he later said. Trustero, founded in 2020, became the answer: not a reprise of infrastructure monitoring, but the transfer of its logic to governance, risk and compliance.
The category is commonly abbreviated GRC, perhaps because saying “governance, risk and compliance” out loud is itself a mild endurance test. Its work is consequential and repetitive: map policies to frameworks, collect evidence, test whether controls operate, answer security questionnaires, find gaps, plan remediation and produce reports. Traditional platforms have been good at holding these objects. Liu argues that holding them is different from understanding them.
evidence
controls
operation
and repeat
Trustero started before the present fever for generative AI. Liu describes a technical progression from natural-language processing with BERT in 2020, to retrieval-augmented generation in 2021, to a multi-agent architecture in 2024. That chronology supports the company’s preferred distinction: AI is not a chat window glued to a document repository. It is meant to carry a bounded task from request to result.
One agent can work on controls, another on evidence, another on policies, another on risk. They cooperate across a company’s GRC material and show their reasoning against the underlying record. This insistence on traceability matters. In compliance, a fluent answer without a trail is not intelligence. It is an unusually confident intern.
The enterprise scar tissue
Trustero’s own path has carried a lesson from SignalFx: sophisticated software needs a buyer with a sufficiently developed problem. In November 2024, the company announced a $10.35 million Series A led by Bright Pixel Capital, with Engineering Capital, Zetta Venture Partners and Vertex Ventures US returning. The round brought reported funding above $18 million. Liu said the money would support scaling, hiring and further AI work in GRC.
The company has increasingly positioned itself as an intelligence layer alongside incumbent systems rather than a demand to replace them. An enterprise can keep a system of record such as MetricStream or Archer while Trustero’s agents read across policies, controls and evidence. It is the enterprise equivalent of renovating the kitchen without insisting that the owner abandon the house.
In June 2026, Trustero announced AI-powered Playbooks: reusable, schedulable workflows for jobs such as a weekly controls health check, policy-gap analysis, regulatory-impact assessment or pre-board compliance briefing. A Playbook can be defined once and run continuously. The point is not to produce another place where work waits politely for a person. The point is to complete recurring analysis and return a reviewable result.
The most valuable founder move in Liu’s story is translation: evidence became telemetry, a failed control became an alert, and audit readiness became a state rather than a season.
That translation also explains the continuity in his résumé. Opsware, Facebook, SignalFx and Trustero occupy different shelves in the software library, yet each confronts an unruly system with too many moving parts for manual attention. Liu’s recurring instinct is to make the system observable, then make the observation useful while there is still time to act.
His patents make the thread unusually literal. Liu is a named inventor on systems for quantizing, processing and reporting streams from instrumented software. The titles are not cocktail-party bait, but they describe a durable preoccupation: data arrives at different times, some of it arrives late, and a useful system must decide what still counts. Corporate evidence has the same untidy manners. A screenshot can expire. A control owner can change. A cloud configuration can drift between reviews. The abstraction survives the change of setting.
It also shaped whom Liu built with. SignalFx paired his infrastructure experience with Karthik Rau’s company-building background. At Trustero, returning backers included investors who had already watched him navigate the earlier company: Ashmeet Sidana at Engineering Capital, Jocelyn Goldfein at Zetta Venture Partners and In Sik Rhee at Vertex Ventures US. When the Series A arrived, Liu used the announcement to thank the people around the company and introduce George Totev, formerly a customer-trust leader at Snowflake, as Trustero’s security chief. The engineer-founder had learned that a compliance product needs compliance judgment inside the building.
What the machine leaves to people
Automation rhetoric often treats headcount as the prize. Trustero’s 2026 framing was more specific: agents should absorb evidence collection, report assembly and control testing so practitioners can spend more time on risk decisions, stakeholder relationships and program design. The human role moves from gathering pieces to judging the picture.
There is a practical modesty in that division. Corporate controls are not merely documents waiting to be summarized. They sit inside institutions, where ownership, incentives and judgment matter. A machine can compare a policy with a framework, find a missing passage and assemble the citation. Deciding what risk an organization is willing to carry remains an executive act.
This is where Liu’s two founder stories meet. SignalFx became useful when the team stopped expecting invention alone to pull the market toward it. Trustero will face the corresponding test: an AI system must earn the trust of professionals whose job is to distrust unsupported conclusions. A fast answer is pleasant. A reproducible answer, attached to evidence and consistent on the next run, can enter an operating process. The sales pitch and the architecture therefore share a burden. Both have to show their work.
Liu’s public manner is that of an engineer who has learned to narrate the commercial bruise as well as the technical achievement. A former college and TRW colleague praised his combination of systems architecture and communication. His account of SignalFx supplies the harder complement: he is willing to say that a well-funded product met indifference before it met demand.
The next phase is already less about whether AI can answer questions and more about whether it can run reliable, repeatable work. Liu is scheduled to speak on multi-agent AI and operational efficiency at GRC Day Denver in September 2026. It is a fitting subject for a founder who has spent decades removing the distance between a signal and a decision.
Compliance may never become glamorous. That is probably healthy. Glamour encourages entrances; control systems reward attention. Liu’s wager is that the audit should stop behaving like opening night. The lights stay on, the evidence keeps moving, and the system quietly checks itself before anyone has to panic.