Rohyt Belani's suspicious faith in people

At 7:15 one morning, Rohyt Belani found the sort of email designed to make a founder reach for the attachment in a hurry. His chief technology officer appeared to be reporting a critical bug in a newly released product. Beta customers needed a rollback. The explanation was in a Word document. For someone selling protection against phishing, this was a particularly personal invitation to embarrassment.

Belani almost opened it. Then two details bothered him. Aaron Higbee, his co-founder and CTO, would call about a problem that serious, whatever the hour. And Higbee did not begin emails to him with “Dear.” The message had borrowed the right emergency and the wrong manners. Belani reported it as suspicious. It proved malicious.

The episode explains an idea that would occupy much of his career. A colleague knows things an email filter may never know: how someone speaks, when they telephone, what would be strange on an ordinary Tuesday. Belani wanted to give that knowledge somewhere useful to go.

The professor who took a detour

He had not set out to run a cybersecurity company. Raised in Mumbai, Belani studied engineering in India and moved to the United States in 2000 for graduate school at Carnegie Mellon. The Information Networking Institute brought together computing, engineering and business. His ambition was academic. He wanted a doctorate, then a professor's life.

His introduction to security came through an unexpected telephone call. A professor he had never studied with said he had Belani's résumé and an internship to offer at the Software Engineering Institute. Belani initially wondered whether the approach was a hoax. The future phishing entrepreneur had an early encounter with the problem of deciding whether an unsolicited opportunity was real. He interviewed the next day and got the position.

The doctorate looked less certain when his prospective supervisor's funding dried up. Graduation was roughly eight weeks away. Belani had assumed the academic route would work and had passed up the normal recruiting season. Suddenly, the aspiring professor needed an employer.

A campus encounter supplied one. He spoke with a security-company founder who also taught at Carnegie Mellon. Belani was wearing shorts and flip-flops and had gone several days without shaving. He did not realize the conversation amounted to an interview. After about 45 minutes, he had a job offer from Foundstone. Career advice generally recommends polishing one's shoes. His experience allowed a little room for exceptions.

Foundstone put him to work testing defenses, including breaking into networks with permission. Following its acquisition by McAfee in 2004, he joined Kevin Mandia's young company, Mandiant, and helped establish its New York office. He was learning how attacks worked from the people obliged to deal with their aftermath. That knowledge would eventually supply both a consulting practice and a product.

A test that could teach

In early 2007, Belani and Higbee started Intrepidus Group. Mobile security was part of its focus before the first iPhone had even gone on sale. They had experience, clients and a business that could earn money through their expertise. Alongside it, another pattern was becoming hard to ignore.

Customers kept asking the consultants to run phishing exercises against employees. They wanted to know where they stood. Belani and Higbee wrote scripts and small tools to automate the work. The resulting measurements were useful, but repeating an exercise each year and returning another dispiriting score seemed an incomplete service.

They began using the simulated mistake as a teaching opportunity. Someone who fell for the test could receive a short, relevant lesson immediately afterward. Repetition gave people further practice, while measurements showed whether behavior changed. The uncomfortable click became the beginning of an education. There was a certain economy to teaching someone about a trap while the memory of stepping into it was still fresh.

PhishMe took shape inside Intrepidus before becoming an independent company in 2011. Its early development is sometimes dated to 2008; the consulting work preceded the separate business. Belani's path into software therefore came with an unusual advantage: customers had already been paying for the underlying activity.

The separation still required care. With about 20 customers, PhishMe spent a year as an Intrepidus subsidiary, sharing financials while the founders worked out what independence would cost. They sold annual subscriptions from the beginning. Consulting revenue helped support the product before the first institutional financing arrived in 2012. The transition involved a budget and a timetable as well as an idea.

The price tag and the small print

Belani proved less enchanted by financing theater than the usual startup narrative might suggest. He considered valuation alongside the rest of the deal, including liquidation preferences that could make an impressive headline less attractive. His question was, “What’s the deal holistically?” A founder who spends his working life inspecting apparently attractive messages has some reason to read the small print.

The first funding helped expand sales and marketing. PhishMe had already won large corporate customers, including a Fortune 10 business. Belani remained based in New York while the company was headquartered in Virginia. The operation could sell to enterprises without requiring its chief executive to relocate to the address on the company stationery.

By 2015, he reported more than 600 customers and over 150 full-time employees. The simulator business was doing about $25 million in annual billings. Offices stretched from London to Dubai, Singapore and Canada. These figures describe a particular moment in its growth, when the founders' consulting tools had become a business with customers and colleagues spread across borders.

In February 2018, a private equity syndicate including BlackRock and Pamplona acquired PhishMe in a transaction valuing it at approximately $400 million. Early investor Paladin had led its first institutional round when the company had 14 employees. By the transaction, it had more than 400. Along the way, the business had raised over $58 million.

The change of ownership came with a new name: Cofense. The company served more than 1,700 enterprise, mid-market and government customers by then. PhishMe neatly described its simulation origins, but the product range had grown. The new identity accompanied a business concerned with what happened after an employee encountered a real attack, as well as how to prepare for one.

One inbox, many witnesses

Belani's explanation of phishing left room for ordinary human decency to become a vulnerability. In one example, an attacker pretends to be a conference acquaintance, offers slides, sends an attachment and follows up to check whether it arrived. The exchanges make the malicious document feel like a small obligation between professionals. Being helpful supplies the momentum.

That is why he questioned the value of merely putting another warning poster in a hallway. Awareness needed to show up in behavior, at the moment an email arrived. He and Higbee described themselves as “geeks in suits,” a modestly comic uniform for the task of persuading businesses to change how they thought about employees.

“We believe that people are smart.”

Rohyt Belani, on the premise behind Cofense

The product approach connected observation with a wider response. Employees reported suspicious messages. Those reports could be analyzed, related threats removed and useful intelligence shared through the network. By 2023, that network encompassed more than 35 million users. The scale made the original insight more interesting: something noticed in one inbox could help protect people elsewhere.

Human judgment still needed machinery around it. Reports could contain mistakes; security teams needed a way to sort and investigate them. Training, reporting and response had to work together. Belani's contribution was to treat the employee's observation as input worth organizing, then build a business around the process that made it actionable.

Back at the lectern

In May 2023, Belani returned to the Information Networking Institute as its commencement keynote speaker. He had also been named a Tartan on the Rise. Twenty-one years after earning his master's degree, the former would-be doctoral student faced a graduating class from the other side of the lectern.

He told the graduates they had finished the tests and grades, before adding that “life is one heck of a long exam.” He talked about the confidence and tenacity their education had developed. The joke had an experienced speaker's timing and a former student's sympathy. His own career had supplied enough unexpected questions to make the analogy credible.

His work now extends beyond the company he co-founded. Fortreum lists him as executive chairman. In September 2025, Morphisec appointed him strategic advisor, with an emphasis on market expansion and relationships with managed security service providers. That announcement also identified him as managing partner of Litmus Advisors, helping technology businesses with growth and fundraising.

There is an educational thread outside cybersecurity, too. He serves on the boards of Manhattan School of Music, Shanti Bhavan and the Rudolf Steiner School of New York. His connection with Carnegie Mellon continues through its engineering dean's advocacy council. The professor's career never unfolded as planned, but learning has remained a recurring assignment.

The email with the wrong greeting makes a fitting measure of the business he helped create. Belani knew his co-founder well enough to hesitate. He had a way to report that hesitation. Someone could investigate it. An apparently minor piece of human knowledge became useful because the organization was prepared to receive it. For all the money and software in the story, its working parts include a familiar voice, a pause and a question.