The breach that built a company
In 2015, Rohan Sathe joined Uber Eats as a founding engineer before anyone had heard of Uber Eats. He built the backend systems - ETA prediction, supply-demand forecasting - that helped scale the service to $7 billion in revenue and 200 engineers. He handled petabytes. He watched how data moved across thousands of SaaS tools and infrastructure services in real time. And then he watched it get exposed.
Uber's 2016 breach became a case study in credential sprawl: API keys left on GitHub, leveraged to reach AWS, and 57 million records gone. Sathe was close enough to feel the blast radius. Most engineers would write it off as someone else's failure to fix. He wrote it off as a systemic design problem that nobody had seriously solved.
That observation - that sensitive data scattered across fragmented systems will inevitably leak - became the founding thesis of Nightfall AI, which Sathe co-founded with Isaac Madan in 2018. They originally called it Watchtower AI. The name changed. The mission didn't.
When you have data scattered across numerous fragmented systems, not to mention people communicating in real time, it's inevitable that sensitive information will get sprayed.
- Rohan SatheThe DLP problem nobody wanted to admit
Data Loss Prevention existed long before Nightfall. The established vendors - Symantec, McAfee, the enterprise stalwarts - had been selling DLP for two decades. The technology worked, technically. What it didn't do was work without an army of security analysts, thousands of false positives, and architectural assumptions built for a world where data lived on-premises and traveled predictably.
Cloud changed everything. SaaS changed everything. GenAI changed everything again. Legacy DLP was designed for a world where you controlled the perimeter. That world is gone.
"The kind of legacy approach to DLP was riddled with false positives and architecturally very complex," Sathe has said. Nightfall's bet was that machine learning could fix both - building detection models that understood context, not just pattern-matching on credit card numbers or social security digits. The difference between a false positive and a true detection isn't the data. It's the context around it.
The Samsung Moment
In 2023, Samsung engineers pasted proprietary source code into ChatGPT. That code ended up in OpenAI's training data - a textbook DLP failure in the age of generative AI. Sathe had been warning about exactly this vector for years. "That's a textbook DLP failure," he said flatly. Shadow AI - AI tools adopted without security oversight - became one of Nightfall's core use cases almost overnight.
What Nightfall actually does
Nightfall positions itself as the first DLP platform purpose-built for the AI era. The platform scans text and files for sensitive data - PII, PHI, PCI, secrets, credentials, API keys - across SaaS applications, endpoints, browsers, and AI workflows. It doesn't just detect. It classifies with ML models, enforces policies in real time, and can automatically remediate.
The product applies AI across three distinct layers: content classification, behavioral risk scoring, and forensic investigation. The detection engine reportedly outperforms Google and Microsoft DLP APIs by 10x in accuracy. Nightfall Nyx, the autonomous platform launched under Sathe's leadership, achieves 95% detection precision - the kind of number that eliminates the analyst fatigue problem at its root.
Building the business differently
Sathe runs a notably unconventional go-to-market. While competitors reserve budget for conference booths at RSA and Black Hat, Nightfall redirects that spend into private executive suites and intimate CISO dinners - gatherings of 8 people, focused on industry topics, not product pitches. The sales motion is quiet, credibility-first, relationship-driven.
He also hires former DLP security operations analysts as quota-carrying account executives. Not ex-SDRs who learned cybersecurity talking points. People who used DLP platforms for a living and know what actually breaks in production. The bet: in a category where buyers are deeply skeptical and legacy failure is fresh, practitioner credibility beats polish.
"If you can hire practitioners, in our case former DLP security operations analysts to be part of the deal cycle in some way - be it an actual AE or be it a solutions architect - then seeing a trend there as well," Sathe explained.
On AI in the sales cycle itself, he's candid about uncertainty: "I just don't know if that traditional sales hiring model makes sense in this AI-driven world." Nightfall appears to be running the experiment in real time.
We're no longer a company that's telling you don't do this - it's, yes, we want to enable AI.
- Rohan Sathe