Raj Mallempati has spent much of his career looking at the space between permission and behavior. A person may be allowed to do a hundred things and routinely do five. A service account can possess authority nobody remembers granting. A new tool can enter the software factory with the manners of a helpful intern and the keys of a building superintendent. In security, the gap between what an identity can do and what it should do is where trouble enjoys the rent-free accommodation.
At BlueFlag Security, the company he co-founded with veteran security technologist Ken Schneider, Mallempati has moved that old problem into a newly crowded room: the software development lifecycle. The inhabitants now include developers, contractors, repositories, build systems, service accounts, code assistants and autonomous AI agents. Each can touch the process that turns an idea into production software. BlueFlag's premise is that inspecting the code is necessary, while governing the identities and tools around it is a separate job.
The idea sounds like the work of a lifelong security specialist. Mallempati's route was more itinerant. He trained as an engineer, earned a master's degree in computer science from the University of Texas, then added an MBA from Wharton. His career moved through engineering, product, strategy, marketing and operations. The mixture matters. BlueFlag is a technical thesis wrapped inside the practical question every enterprise founder eventually meets: can you persuade a cautious customer to trust a young company with an important problem?
The engineer crosses the hallway
Mallempati began in engineering before taking on business and marketing work at Adobe and VMware. At VMware he helped bring virtual desktop infrastructure to market, a category that asked companies to rethink where the familiar office computer actually lived. Later came product marketing leadership at Riverbed Technology, global marketing at MobileIron and, in 2017, an appointment as Malwarebytes' first senior vice president of marketing.
The titles form a tour of enterprise technology's less glamorous, more consequential machinery: virtualization, network performance, mobile management, malware protection. They also reveal an operator learning to translate. Engineers need fidelity to the product. Buyers need a reason to change. Sales teams need language that survives contact with a procurement meeting. The executive in the middle must keep all three accounts reasonably honest.
Selected career path / one technical idea, many operating rooms
CloudKnox Security pulled those languages together. As chief operating officer, Mallempati was responsible for the company's business and go-to-market strategy. The product dealt with cloud infrastructure entitlements: who and what could access a sprawling collection of cloud resources, and whether those permissions matched actual use. In a 2021 interview, he described a dangerous delta between permissions granted and permissions used. The cloud had made new resources easy to create. Permission sprawl came along for the ride, smiling politely.
“In the cloud, an enterprise's security is only as good as its ability to control the access that their human and non-human identities have to their infrastructure.”Raj Mallempati, while COO of CloudKnox Security
Microsoft acquired CloudKnox in 2021, and Mallempati stayed to run operations for its cloud infrastructure entitlement management business. An acquisition is often treated as a founder's full stop. For him it became punctuation of the semicolon variety. He later spent time as an entrepreneur in residence at Maverick Ventures and kept reconsidering where the identity problem would appear next.
The permissions problem learns to code
BlueFlag was founded in 2022 and emerged from stealth in March 2024 with an $11.5 million seed round led by Maverick Ventures and Ten Eleven Ventures, with Pier 88 Investment Partners participating. Mallempati and Schneider framed identity as the connective tissue across development. Code scanners could find a vulnerable dependency. Posture tools could catch a configuration mistake. Neither necessarily explained whether a human or machine identity had excessive access, behaved unusually or retained permissions long after the reason for them had expired.
developers
service accounts
intelligence
build systems
& agents
The distinction becomes sharper with AI. A conventional service account performs a defined function. An agent may receive a goal, decide on steps, open a pull request, call another tool and trigger a workflow. Its usefulness comes from agency; so does the governance headache. The question is no longer limited to whether generated code contains a flaw. Security teams must also know which agent acted, what it could reach, why it took an action and whether anyone still owns the permission.
In March 2026, BlueFlag announced AI-agent governance and developer behavioral risk analysis alongside a Series A that brought total funding to $28 million. The company also reported 300 percent year-over-year revenue growth in 2025 and a fivefold increase in Fortune 500 enterprise customers. Those are company-reported figures, but they give the strategy a visible direction: BlueFlag is following identity as it migrates from employees and service accounts into software actors that can make decisions.
Trust before the sales pitch
The cybersecurity thesis is only half of Mallempati's story. The other half is his adjustment to being a first-time CEO. In a 2024 interview he admitted that hiring the initial team was difficult, long hours happened and the business remained lodged in his thoughts. The candor is useful. Startup profiles often make obsession sound like an attractive desk accessory. In practice it is more like a browser tab that refuses to close.
He also described real joy in creating a new category. To keep that ambition from floating away, he emphasized design partners, advisers and an early investment in technical customer success. His most important move, he said, was to earn customer trust before talking business. That choice fits the product. A company selling visibility into sensitive development environments cannot treat customer success as the department that arrives after the contract. Trust is part of the architecture.
“Our mission is to provide developers with a clean, trustworthy environment.”Raj Mallempati at BlueFlag's 2024 launch
On a 2025 podcast, Mallempati argued for alignment among teams, customers and go-to-market, and for delivering value in the first week rather than the first month. The point carries the fingerprints of his unusual resume. Vision can start a meeting. Alignment gets product, engineering, sales and a design partner to leave it with the same understanding. His time in marketing did not sit opposite engineering; it taught him how easily a good technical idea can be diluted while traveling across a company.
His shorthand for becoming a founder is crawl, walk, run. Focus on solving the problem, he advised, and the money will come. It is an unfashionably patient phrase from a venture-backed CEO. Yet BlueFlag's chronology supports it: years observing permission gaps, time inside an acquirer, an entrepreneur-in-residence interval, design partnerships, a stealth period, then a public launch. The overnight company took the scenic route.
The identity beneath the artifact
Mallempati's central observation is not that code scanning has failed. He continues to treat it as valuable. His argument is about an imbalance. Security programs have become adept at inspecting the artifact while the identities controlling the artifact have multiplied. A compromised contractor credential can use legitimate access. An AI agent can act continuously across tools. A stale token may remain powerful because every individual system sees only its own slice.
BlueFlag therefore sits at a junction of disciplines that enterprises have often managed separately: application security, identity governance, developer tooling and behavioral analysis. The company's opportunity is also its burden. Categories are exhilarating to name and laborious to explain. Mallempati appears to enjoy the naming, but his operating history suggests he understands the explaining.
There is an elegant continuity to his career. At VMware, he helped explain a new location for the desktop. At MobileIron and Malwarebytes, he worked on securing the devices and systems people used. At CloudKnox and Microsoft, he focused on what identities could do in cloud infrastructure. At BlueFlag, the same question moves upstream into the workshop where software is assembled. The cast now includes machines that can improvise.
The software industry likes to say that code is law. Mallempati's work adds a footnote in small, consequential type: someone - or something - still receives permission to write, review, merge and deploy it. BlueFlag's bet is that the future of developer security belongs as much to that identity as to the code it leaves behind.