Raz Rafaeli Has Spent 30 Years Making Passwords Look Old

A password is a tiny private ritual performed in public. We invent it, forget it, reset it, reuse it, and occasionally surrender it to a convincing stranger with an urgent email. For three decades, enterprise software has improved around this ritual while leaving the ritual itself oddly intact. Raz Rafaeli has made a career in the machinery behind corporate computing. Since 2015, he has applied that career to a plain but obstinate ambition: remove the password from work.

Rafaeli is CEO, CRO and co-founder of Secret Double Octopus, the Menlo Park cybersecurity company whose name sounds like a Cold War code phrase dreamed up at an aquarium. The whimsy is useful. In 2017, he explained the name by picturing an octopus holding another octopus across all its arms, passing divided pieces of data from one side to the other. The image describes secret sharing, the cryptographic idea at the company's foundation: distribute information so that no single piece gives away the whole.

The mathematics emerged from research at Ben-Gurion University by Shlomi Dolev and Shimrit Tzur-David. Rafaeli and Chen Tetelman joined them as entrepreneurs, and the four founded Secret Double Octopus in 2015. It was an unusually literal marriage of research and operations. The researchers had a way to divide trust. Rafaeli had spent more than twenty years learning what happens when elegant technology meets customers, budgets, inherited systems, and deadlines.

Before the password became the villain

There is a useful clue in Rafaeli's earliest public technical work. In July 1997, he appeared at the fifth USENIX Tcl/Tk Workshop as a co-author of GeNMSim, a commercial simulator for SNMP network agents. Network-management developers often needed to test software before the physical device they were meant to manage existed. GeNMSim created the missing device in software, shrinking a bottleneck in development.

It is niche, practical work. It also establishes a pattern. Rafaeli's products tend to live in the seam between what a system expects and what the world can conveniently provide. A simulated agent stands in for unfinished hardware. Decades later, passwordless software stands between a user and an application that may still expect a password. The technologies are unrelated; the operator's instinct is recognizable.

Milestone Software & Systems, where Rafaeli was co-founder and CEO from the mid-1990s into the early 2000s, made tools for network-management developers. In 1999, as the company moved part of its operation from northern Israel to New Jersey, he gave a brisk explanation: the United States was its largest market, and active investors were nearby. The comment carries no romance. Geography followed customers and capital.

He went on to found and lead Business Entry, then held corporate-solutions and business roles at SanDisk and Spansion. In 2009 he became CEO of MiniFrame, a software company that let multiple users work independently on one computer. By the time he left in 2015, he had moved through network management, semiconductors, virtualization, and company building. He also held an MSc in computer science from the Technion. Secret Double Octopus would need both halves of that résumé.

The installed base always gets a vote

Consumer passwordless experiences can feel like magic. A face, a fingerprint, or a device gesture replaces the troublesome string. An enterprise is less obliging. Its employees may begin the day at Windows, pass through a virtual private network, open a cloud service, visit a database, and finish inside a legacy application written before the cloud had a name. Modern authentication on three of those surfaces can leave passwords alive on the rest.

Rafaeli keeps returning to this gap. He has written about Active Directory as an old friend that still governs critical resources, about the authentication weakness of legacy systems, and about the strain remote work places on VPNs. In 2025, his formulation became a headline: “Halfway security is no security.” The phrase distills his product thesis. An attacker does not admire the steel front door. An attacker looks for the open window.

This is why Secret Double Octopus aims for coverage rather than a single dazzling login. Its platform is presented as a layer across workstations, cloud services, remote access, on-premises infrastructure, and software that still speaks in passwords. The employee authenticates with a device or other strong factor; the system handles what lies behind the curtain. Security improves partly because there is less reusable knowledge for the employee to lose, type into a false page, or dictate to a help desk.

There is a humane observation hiding inside the architecture. People are bad custodians of long, unique, frequently changed secrets because the assignment is incompatible with ordinary memory. Treating every reset, reuse, and sticky note as a moral failure produces more training and a thriving reset queue. Rafaeli's position makes the system responsible. If a dangerous secret does not need to be managed by an employee, stop giving it to the employee.

A decade of translation

Secret Double Octopus began with the language of keyless security and multi-shield connectivity. Over time, its story narrowed around workforce authentication and the ZeroPassword idea. That shift is a familiar startup act: preserve the technical advantage while translating it into a problem a buyer already feels. Cryptography may open a conversation. A flood of password resets, a phishing audit, or a legacy application exposed to credential theft tends to fund it.

The financing came in stages. A $6 million Series A arrived in 2017 to expand development and growth in the United States and Europe. In April 2020, during the sudden move to remote work, the company raised a $15 million Series B. Rafaeli said the moment made simple, rapid protection for remote organizations more urgent, alongside the cost of managing employee passwords. A further $15 million Series C was announced in January 2024, followed in October by strategic investment from SBI Holdings in the round's second tranche.

Partnerships became another form of translation. A 2022 agreement with ForgeRock connected Secret Double Octopus technology to a larger identity platform. Rafaeli described the aim as making authentication “more seamless and eventually passwordless.” SBI's 2024 investment carried a similar operating logic, using a strategic relationship to expand in new markets and industries. Enterprise infrastructure rarely changes through a single heroic replacement. It changes through integrations, channel partners, pilots, and enough proof to satisfy the next committee.

Rafaeli appears suited to that patient machinery. A former colleague's public recommendation calls him intelligent, hands-on, analytical, customer-oriented, and strong with people. His own writing favors concrete objects: doors and windows, old friends, help-desk backlogs. Even the octopus makes the abstract physical. This is not merely a communication style. In security, the ability to show where a threat travels can determine whether anyone fixes it.

The argument beneath the login box

Passwordless authentication is now a busy category, with platform companies and standards bodies pushing passkeys and phishing-resistant factors. Rafaeli's more specific argument is about completeness. A modern sign-in for a cloud app does not retire the password hiding in the rest of the estate. Companies do not live in product demos. They live in migrations that overlap for years.

That makes his story less about predicting a passwordless future than negotiating with a password-filled present. It is the work of an operator who has seen infrastructure age in place. Every generation of software inherits the previous generation's unfinished business. The old system remains because it is useful, expensive to replace, or both. The security product that acknowledges this may look less pristine. It may also get deployed.

The company's stated vision is a world without passwords, followed by a characteristically impatient line: “The only question about going passwordless is when, and we say now.” After ten years, “now” has become less a date than a discipline. It means supporting the awkward application, the hybrid directory, the remote desktop, and the user who would rather begin work than perform a small memory exam.

Rafaeli's career offers a compact lesson for builders. Start with an ambitious change, then respect every dull reason it cannot happen. The customer has old software. The buyer has a compliance mandate. The user has forgotten the password. None of these are distractions from the product. Together, they are the product.

The password has survived predictions, breaches, policy manuals, and countless notes stuck beneath keyboards. Its persistence is almost admirable. Rafaeli has chosen the slower weapon: compatibility. One application, one workstation, one inherited corner at a time, he is trying to make the old credential unnecessary. There are more theatrical crusades in technology. Few begin so many mornings.