Sachin Nayyar had arranged his working life around a geographical inconvenience. Securonix was based in the Dallas area. Saviynt was in Los Angeles, where he lived. For years, he was chief executive of both. A business biography usually gives each company its own chapter. His chapters overlapped, and the commute did some of the punctuation.
The arrangement makes more sense when you look past the two company names. Both businesses concerned the permissions and behavior of people inside complicated organizations. Saviynt helped govern access. Securonix analyzed activity for signs of danger. A person could have perfectly legitimate credentials and still do something an organization ought to notice. Nayyar had found enough work in that gap to occupy two companies.
By February 2022, Securonix had attracted a growth investment of more than $1 billion led by Vista Equity Partners. By July 2026, Saviynt was reporting annual recurring revenue above $300 million. These are company figures, with different meanings and different dates. Together, they suggest why Nayyar kept returning to an unglamorous piece of corporate life: the question of who gets access to what.
get access?Identity governance
after they do?Behavioral analytics
A lesson traded for a website
Before the two-company calendar came a smaller exchange at California State University, Northridge. Nayyar wanted to improve his writing. Fellow student Rishma Shariff had the English-language skills he needed. He asked her to tutor him and offered website-design lessons in return. They eventually married. In his recollection, the website offer was the part “which I think sealed the deal.” Technical expertise can have surprisingly broad applications.
He graduated from the university’s David Nazarian College of Business and Economics in 1999. Years later, his connection continued through its advisory board and an appearance as keynote speaker at the Jeff Marine Bull Ring New Venture Competition in April 2024. The student who had once needed help with prose returned with advice for people hoping to start companies.
Nayyar was born in New Delhi and came to the United States at 16. He recalls a childhood household shared with grandparents, aunts and uncles, and credits that crowded domestic education with helping him understand people. His account of leadership begins there, with the experience of different personalities under one roof, rather than with a theory borrowed from a management book.
His early work at Ernst & Young introduced him to enterprise technology and compliance. The distinction matters. Auditing asks whether a business can demonstrate that its controls work. Technology has to make those controls function amid daily activity. For a future software founder, that is a useful place to stand: close enough to the rules to understand them, and close enough to the systems to see the difficulties.
The credentials were only the beginning
Vaau, where Nayyar was founder and CEO, built software for enterprise role management and identity compliance. Its purpose included discovering, defining and managing user access. Sun Microsystems announced an agreement to acquire it in November 2007; the terms were undisclosed. At Sun, Nayyar became chief identity strategist, working on the direction of its security portfolio.
Role management sounds like an office filing system until you imagine the things being filed. An employee’s job determines which systems that person needs. A promotion, departure or move between departments changes the answer. Software must keep the permissions aligned with the person’s actual responsibilities. An old permission can remain useful to someone long after it has ceased to be appropriate.
With Securonix, co-founded with Tanuj Gulati in 2008, Nayyar pursued a related question about behavior. He later described the idea as building a picture of normal activity for users and machines, then looking for anomalies. The resulting approach became associated with user and entity behavior analytics, usually shortened to UEBA. Security, apparently, also requires a permissions system for the number of acronyms it creates.
By 2017, Securonix had about 300 employees and was generating more than $50 million in revenue. Its technology used behavioral analysis to help identify insider threats and other attacks. The attraction was practical: security teams faced large quantities of activity, and needed a way to distinguish the unusual from the merely busy. Collecting more records was useful only if somebody could make sense of them.
One founder. Two operating tracks.
¹ First CEO tenure. Tracks show milestones, not a time scale.
Two ways to ask about trust
Saviynt developed alongside that effort. Nayyar led it until 2018, then moved to executive chairman while continuing as CEO at Securonix. The products approached enterprise security from different directions. Governance concerned the access an organization granted. Analytics concerned what happened after access existed. Holding both ideas in view helps explain the continuity in a career that can otherwise look like a succession of separate startups.
His professional relationships also carried across company boundaries. Henrique Teixeira, who later joined Saviynt in a strategy role, had known Nayyar since the Vaau period and implemented its role-management software in Brazil. Teixeira remembered Nayyar’s interest in using analytics for cybersecurity. Products changed owners and colleagues changed jobs; the underlying conversation kept going.
Nayyar’s own description of his interests is rather less elaborate. “I have no hobbies,” he said. “All I know is identity.” It is an amusingly severe answer to the usual executive-profile question about leisure. It also fits the record: Vaau, Sun, Securonix and Saviynt all gave him different places to work on closely related problems. Repetition, in this case, produced several businesses.
Two companies.
The overlapping years
One question of trust.
A billion dollars, then a change of chair
The February 2022 Securonix investment brought Vista together with existing investors Volition Capital and Eight Roads Ventures. The company planned to expand engineering, threat detection, data science and operations. Nayyar also wanted to take security intelligence further into applications. The money arrived with a substantial list of jobs to do.
“We want to provide better intelligence and detection within the apps,” he said at the time. It was a specific ambition for a very large financing announcement. An application is where much of a company’s work actually happens, and where permissions meet transactions. Following activity there extends the security question closer to the business itself.
In December 2022, Nayaki Nayyar became Securonix CEO and Sachin moved to executive chairman. The two are unrelated, a clarification that the company helpfully included in its announcement. The transition changed his operating responsibilities after years at the helm. It also set up another move, this time back into the company he had continued to chair.
In January 2023, Saviynt announced his return as CEO alongside $205 million in growth financing from AB Private Credit Investors’ Tech Capital Solutions group. Paul Zolfaghari joined as president. The returning founder now had an experienced software operator beside him. Amit Saha, who had been CEO, moved to chief growth officer. The changes gave Saviynt a new division of responsibilities as it sought further growth.
The customer helped pay for the product
One of the more revealing details in Nayyar’s account is how he financed the early work. Services brought his team into customers’ operations, supplied revenue and exposed the problems that a product might solve. Customers could try early software in the environments where it would eventually need to work. Saviynt remained bootstrapped for its first seven years.
That approach puts an unusual price on learning. A founder normally pays to discover whether an idea survives contact with a customer. Nayyar sold expertise while developing software in the same field. The arrangement gave the product work a commercial setting from the beginning. It also meant that a prospective buyer’s requirements arrived as something more concrete than a speculative market forecast.
His later use of private credit reflected a different calculation. Returning to Saviynt in a weaker funding market, he believed an equity valuation would understate the company’s worth. Debt offered another route. By December 2025, the company had announced a $700 million growth-equity round led by KKR at an approximately $3 billion valuation. The financing method changed as the circumstances changed.
That round also included Sixth Street Growth, TenEleven and Carrick Capital Partners. Saviynt planned to accelerate development, tools for migrating from older systems and integrations with other technology providers. The ambition was to make a complicated identity estate easier to govern. More capital could support that work; the software still had to earn its place inside the customer’s organization.
ARR measures recurring revenue on an annualized basis. It is a different measure from capital raised or company valuation.
Now the new colleague is software
By July 2026, the access question had acquired another kind of participant. Saviynt launched Zuma, its platform for AI identity security, while announcing that annual recurring revenue had passed $300 million. Nayyar’s explanation centered on AI agents and other non-human identities that could make decisions and reach systems at machine speed.
The familiar employee-centered model becomes awkward when software can act on someone’s behalf. Who owns the agent? Which permissions should it have? What happens when its task ends? Zuma’s stated design combines governance with controls applied while an agent is running. Saviynt describes the work in terms of ownership, lifecycle management, policy and access decisions.
This is a new setting for the questions Nayyar has pursued since Vaau. A business still needs to know who, or what, may act. It still needs to notice when activity departs from expectations. AI expands the population of actors and changes their pace. It leaves the basic administrative obligation stubbornly intact.
For someone who says he has no hobbies, that is a promising supply of unfinished work. The student who traded website lessons for writing help has spent his career bringing technical knowledge into exchanges with other people: auditors, customers, co-founders, operators and investors. His companies have grown around deciding how those exchanges should work inside software. Now some of the participants are software themselves. The guest list keeps getting longer.