An intruder finds a credential. It looks useful. Perhaps it opens a server, perhaps a valuable account. The intruder tries it, and the attempt gives the defender a signal. The credential was bait. This is an illustrative encounter, but it captures the business Ram Varadarajan has spent his Acalvio years building: security that makes an attacker’s curiosity expensive.
There is something pleasingly impolite about the idea. The visitor has arrived with unwelcome intentions and expects the furniture to be where the map says it is. Varadarajan would like to rearrange the furniture. A company that understands its own network can plant deceptive assets inside it, then watch for someone taking an interest in things legitimate work should leave alone.
The co-founder and CEO of Acalvio Technologies came to that proposition after helping build a business concerned with a different question: whether an online customer really was the person making a purchase. Arcot Systems worked on authentication and fraud prevention. Acalvio works on exposing adversaries. Across both ventures runs a sustained interest in the distance between an identity someone presents and the intentions behind it.
A chemical engineer enters the computer room
Varadarajan grew up in a middle-class Mumbai neighborhood where education mattered. He credits his mother with resolve, his father with his love of mathematics, and his sister with keeping him grounded. Entrepreneurship was not his childhood plan. The route into it began with engineering, then widened into computing.
He graduated from IIT Bombay in chemical engineering in 1982. At Louisiana State University, he earned a master’s in chemical engineering in 1984 and another in computer science in 1986. The sequence is a useful corrective to the tidy founder biography in which every school subject appears to point toward the eventual company. His training crossed a departmental border before his working life crossed several more.
His early career took him to Odyssey Research in Ithaca, New York, working on government-funded security and distributed-systems projects. He later joined Informix in Silicon Valley. There, his work brought database engineering together with security, including multilevel-secure databases. Before he was selling a security business, he was working on the systems that needed securing.
A book supplied another kind of education. Clifford Stoll’s The Cuckoo’s Egg caught his imagination because it followed an attacker beyond the immediate intrusion. He was interested in understanding the person on the other side: motives, methods, origins. That curiosity helps explain why his later work would make room for observing an adversary after the perimeter had failed.
Chemical engineering
Founded
Founded
The checkout counter, and a $200 million exit
In 1997, Varadarajan founded Arcot Systems. Online commerce posed an awkward practical problem. A bank, a merchant and a shopper needed enough confidence in one another to complete a transaction without turning every purchase into an ordeal. Security had to work at the moment people wanted to get on with something else.
Arcot helped develop the authentication technology associated with Verified by Visa and MasterCard SecureCode. The achievement belonged to a team and its partners. Varadarajan’s role was to lead a company whose work became part of the machinery behind online shopping. Such machinery attracts little applause when it works. The customer tends to remember the shoes.
The commercial result was more conspicuous. On October 5, 2010, CA Technologies announced the completion of its $200 million, all-cash acquisition of Arcot. The buyer wanted authentication and fraud prevention to strengthen its identity and access management offerings, including services delivered from the cloud. The price measured the transaction; the strategic fit explained why the transaction happened.
For Varadarajan, the sale led to an operating role inside CA. He served as a senior vice president and general manager and established its New Business Innovation unit and Silicon Valley research and development center. In a 2013 conversation at CA World, he was discussing how a large software company could create new businesses. He had moved from founding a company to encouraging innovation inside a much larger one.
Three minutes to explain a maze
Acalvio was founded in 2015. Its founding team includes Varadarajan, chief architect Raj Gopalakrishna and chief product officer Sreenivas Gukal. The company’s ShadowPlex platform puts deception into enterprise environments, including networks and cloud deployments. The working premise gives the defender a useful advantage: knowledge of the territory.
Imagine a set of credentials created for no genuine employee task. Their use deserves attention precisely because there is no ordinary business reason to use them. A deceptive service or server can serve a similar purpose. The exact deployment matters, but the idea is legible without a computer science degree. Someone has opened a door that exists to record who opens it.
In 2018, Acalvio became one of ten finalists in the RSA Conference Innovation Sandbox contest. The format allowed each company three minutes to present before judges and an audience. A business built around elaborate environments had to make its case against a very small clock. BigID ultimately won the competition.
The questions Acalvio faced were practical ones: deployment complexity, false positives and whether it had arrived late to the market. Its answer emphasized decoys maintained away from production systems and connected through software-defined networking. The underlying challenge was making deception manageable for the organization buying it. A clever trap that requires constant tending can become another full-time job.
That operational problem remains part of Varadarajan’s public conversation. In a 2023 Cloud N Clear episode with SADA’s Rocky Giglio, he discussed deception and Google Cloud integration. In 2025, he joined The Security Strategist to discuss the assumed-breach approach and putting deception to work. The progression from concept to deployment is where a security product has to earn its place.
When the visitor is an AI agent
By 2026, Varadarajan was directing more of his attention toward autonomous software. In January, he argued that defenders had to reconsider systems designed around the pace and behavior of human attackers. His concern was what happens when reconnaissance, credential testing and movement through a network become an adaptive, automated sequence.
In March, he wrote about the limits of relying on AI alignment to provide security guarantees. He distinguished between human attackers, people using AI to amplify their capabilities, and AI systems whose behavior departs from their intended objectives. His proposed response put deceptive tripwires into the environments where those actors operate. The emphasis was on behavior during use.
His May essay, The Ghost in Your AI Stack, brought the concern down to everyday enterprise materials: logs, tickets, documents and other inputs an AI assistant might read. He urged security teams to map their AI integrations, examine the trust boundaries around those inputs, and instrument the data those systems consume. The question becomes uncomfortably domestic: what is your helpful assistant reading, and who was allowed to write it?
Acalvio introduced Deception Guardrails in July 2026, extending its deception approach into AI-agent workflows. The company described fake credentials, decoy infrastructure and other deceptive resources intended to reveal compromised agents. These are the company’s stated purposes for the capability, rather than a promise that any one control can settle the problem.
In a July Black Hat interview, Varadarajan also focused on the clues an attacker can assemble from an environment: identity relationships, permissions, services and configuration residue. His argument was that defenders need to consider what those clues allow an adversary to infer. An inventory of assets and an attacker’s working map answer different questions.
A September explanation of 360 Deception extended that thinking. Varadarajan described changing what an automated attacker can perceive and trust, including making genuine assets look deceptive and deceptive ones look genuine. It is an attempt to interfere with the assumptions behind the next move. The intruder may have speed; Varadarajan wants the intruder to hesitate about the directions.
“AI-native security” only matters if it changes the security model, not just the interface.
Ram Varadarajan · July 2026
A field beyond the network
Cricket provides a less technical way into his life. Varadarajan established the New Inning Foundation to support young people in the United States. Its name belongs comfortably in the vocabulary of a sport he follows, and its activity has included support for recognition of the grounds on which American cricket is played.
The foundation backed the Claude Worrell Best Cricket Ground award. The Woodley Cricket Complex in Van Nuys, Los Angeles, was selected through a popular vote described in the award coverage. The recognition extended to people and organizations maintaining the facility. Here, the useful infrastructure was grass and a place to play. It still needed someone to care about keeping it in working order.
That detail broadens a career easily reduced to acquisition prices and product names. He has worked on databases, authentication, corporate innovation and deception, while making room for a sport that connects him to life beyond the company. The interests sit alongside one another without requiring cricket to explain every business decision.
His advice to entrepreneurs is compact: “always make the call.” He has also argued that a CEO should personally win the first ten customers. Both ideas put the founder within reach of refusal. An elegant explanation must eventually survive another person’s questions, budget and decision.
The current chapter returns to that test. Varadarajan is asking enterprises to consider how an attacker experiences their systems, then buy a way to alter that experience. It is a particular use of an engineer’s imagination: construct something convincing, anticipate another actor’s choices, and learn from what happens next. Somewhere in the network, a credential waits to be discovered. Its apparent usefulness is the invitation.