Safe Security.

01 / NOWThe room where the dollar number lands

Inside a US bank's quarterly risk meeting, the CISO opens a dashboard. There is no heat map. There is no traffic light. There is a single line: the company's cyber risk exposure, in dollars, updated this morning. The number ticks down. A patch landed overnight. Somebody on the other side of the world fixed an Okta misconfiguration. The board nods. The meeting ends in twenty minutes instead of two hours.

This is what Safe Security wants every cybersecurity meeting to look like. The Palo Alto-headquartered company - formerly called Lucideus, now operating as SAFE - has spent more than a decade insisting that the language of cyber should be money. Not severity. Not red, amber, green. Money.

02 / THE PROBLEMCybersecurity ran out of adjectives

For most of its short life, the cyber industry has communicated in shades. Critical. High. Medium. A risk register reads like a weather forecast written by a committee. Executives nod through the briefing, ask one or two polite questions, and then ask the only one that matters: should we spend more or less, and on what? The honest answer, usually, is a shrug dressed up in a slide template.

That gap - between what security teams measure and what business leaders need to decide - is the problem Safe Security was built around. The team noticed something inconvenient: every other risk discipline at a large enterprise (credit, market, operational) had been speaking in dollars for decades. Cyber was the only one still speaking in colours.

03 / THE BETThree engineers, one stubborn idea

In 2012, three engineers in India - Saket Modi, Vidit Baxi and Rahul Tyagi - started a company called Lucideus. Modi was still finishing his computer science degree. The early business was, by their own admission, ethical hacking services. Useful, billable, unromantic.

The bet came later, and it was a strange one. The founders decided their consultancy was the wrong shape. The world did not need another red team. It needed a way to translate everything a red team learned into a single, defensible, real-time number. They renamed the company SAFE, rebuilt the product around what the FAIR Institute calls quantitative risk analysis, and aimed at a market that did not yet exist.

Cisco's former chairman John Chambers was an early believer; his fund wrote the first significant US check. By 2025 SAFE had raised more than $170 million in total, with a $70 million Series C led by Avataar Ventures landing in July.

04 / THE PRODUCTOne dashboard, a lot of plumbing

What customers actually buy is called SAFE One. Underneath the marketing surface, it is a data platform: ingest signals from every security tool an enterprise already owns - endpoints, cloud, identity, code, third parties - and translate them, through the FAIR model and a lot of company-specific context, into expected financial loss.

SAFE counts the number it processes at roughly three million signals per customer per day. That is a lot of telemetry to keep boring. The point of the boring, though, is exactly the point. A CISO does not want fireworks. A CISO wants the same number, tracked over time, that bends downward when good decisions are made.

Three things SAFE One actually does

First-party risk. Every control you own, scored and priced. Third-party risk. Every vendor, scored without sending another 400-question PDF. Continuous threat exposure. The work between scans, run by agents that don't need to sleep.

05 / THE PROOFWho actually bought it

The customer list is the part of SAFE that does the heavy persuasive lifting. Google. Chevron. T-Mobile. Fidelity. IHG. These are not companies that buy speculative platforms for fun; they have procurement teams whose job is, charitably, to make life unpleasant for vendors.

SAFE says more than half of its existing customers have adopted the third-party risk module since it launched in 2024. That is a quietly aggressive number. Enterprise software's usual cross-sell rate is "we hope." Half is a different sport.

06 / THE MISSIONCyberAGI is a serious word for a serious goal

SAFE's stated ambition is to build what it calls CyberAGI - an agentic AI-native system that does not just measure cyber risk but autonomously discovers, prioritises and remediates it, across an enterprise and every third party it depends on.

It is the kind of phrase that should make any sober reader narrow their eyes. The interesting part is that SAFE is not coming at it from a research lab. It is coming at it from a product that already ingests, by its own count, billions of signals a day from real customers and translates them, in real time, into a single financial number. The vocabulary is new. The plumbing has been shipping for years.

07 / TOMORROWWhy this matters next quarter

Two things are happening at the same time, and they are happening fast. Boards are being asked - by the SEC, by regulators in Europe and India, by their own auditors - to disclose cyber risk in materially honest terms. And AI is making the attack surface bigger than any human team can map by hand.

The first trend is a vacuum. The second is a wind. SAFE happens to be standing exactly in the place where they meet. That is the unromantic, mostly defensible reason a $70 million Series C made sense in the summer of 2025.

Back in that bank's quarterly risk meeting, the line on the dashboard has dipped again. Twenty minutes. Decisions made. Budget reallocated. The cyber team did not get less of it - they got more, and crucially, the room understood why. That is the change SAFE is trying to make at scale: not better security theatre, but a shorter, calmer, more numerate conversation about a thing that used to be impossible to measure.