Sandip Kumar Panda had a curious answer to a staffing problem. At a company selling security, he gave employees more freedom. They could work from home. They could take a holiday when they wanted. For a business concerned with permissions, this was an unusually relaxed approach to the office door.
In 2016, Panda explained the reasoning plainly. Hiring for a business selling to other businesses was difficult enough; cybersecurity added another shortage of skilled people. Keeping them meant making the workplace worth staying in. The policy was practical, rather than ornamental. A startup could scarcely afford to spend its days finding replacements for the people it had just persuaded to join.
Meanwhile, the software those people were building took a far less generous view of admission. InstaSafe, which Panda co-founded in Bengaluru in 2012, asked enterprises to reconsider a familiar assumption: that being inside a network made a person or device sufficiently trustworthy. His working life has revolved around that question ever since. How much access does somebody actually need?
A salesman meets a disappearing boundary
Panda arrived at entrepreneurship with experience of how technology reached its buyers. His career included channel management at Wipro and Symantec, country sales at Blue Coat Systems, and establishing an Indian presence for Nevales Networks as vice president. These were jobs involving partners, customers and the work of making a technical proposition intelligible to someone with a budget.
His education joined computer science with management: an engineering qualification and an MBA from Xavier Institute of Management, Bhubaneswar. The combination fits the problem he would spend years explaining. Security had to work in software, but it also had to survive a purchasing conversation. An elegant design without a willing customer remains a rather expensive private conviction.
The emerging difficulty was geographical. Employees, contractors and applications no longer fitted neatly inside the same corporate boundary. A person could need a business application without sitting in the office; an application could run beyond the company's own premises. Making everything accessible risked granting more access than the job required. Locking everything down frustrated the people trying to do the job.
Panda founded InstaSafe with colleagues including Biju George and Prashanth Guruswamy. Early accounts also name Deepak Panigrahy among its founders. The proposition was cloud-delivered security sold as a service, reducing dependence on appliances that customers had to buy and manage. It was a technical choice with a commercial consequence: customers could pay for a service instead of making another hardware purchase.
Before the product came the explanation
By August 2015, Indian Angel Network and CIO Angel Network had invested. Vishal Khare and Alok Agarwal led the round on IAN's behalf. The plans for that capital were recognisably unglamorous: sales, marketing, product engineering and hiring. A company trying to change an enterprise habit needed people who could build the alternative and people who could explain it.
Panda's ambition already extended beyond India. He wanted the platform to help people work securely across organisations, applications and devices, wherever they happened to be. That aspiration matters because it predates the later enthusiasm for distributed work. Remote access was embedded in the original business proposition, rather than attached as an extra use case years afterwards.
The obstacle was often the conversation itself. Buyers had existing systems and understandable reasons for keeping them. Panda recalled having to explain both what the new approach meant and why a customer should spend money changing. An unfamiliar security model carries a peculiar sales burden: the customer must understand a weakness before paying to reduce it.
That makes his previous career more than a list of employers. Channel management and country sales put someone close to the distance between a product's design and a customer's decision. InstaSafe's early challenge occupied precisely that distance. Getting the architecture right did not make the explanation optional. The brochure still had to survive the question, “Why change?”
“The irony here is, due to that excessive trust between machines, we cannot trust our own networks.”Sandip Kumar Panda, 2021
A smaller key ring
Panda's argument can be understood without memorising the industry's initials. A verified employee may need one application. That need does not automatically justify access to everything nearby. His preferred model checks the user, the device and the circumstances of a request, then connects that user to the application they are permitted to use. The permission is deliberately specific.
Imagine an office key ring containing every key in the building. It is convenient until it goes missing. Granting narrower access changes the consequences of a compromised account or device. This is an illustration of the principle behind Panda's argument, rather than a claim that any security product can make an organisation immune to attack.
Verify identity
Check the request
Limit the permission
A conceptual guide to the approach Panda advocates.
In a 2022 discussion, Panda described the operational detail behind that principle: administrators need to see who is logged in, from where, using which device and accessing which application. They can then apply conditions to access. The appeal is partly visibility. A rule is more useful when someone can see whether the conditions supporting it still hold.
The language sounds suspicious. The intended working day is rather ordinary. Someone needs to open a file, reach an internal application or make a call. Panda's challenge is to place the scrutiny where it helps without turning every routine task into an encounter with a particularly officious reception desk.
Five days, 35,000 users
A deployment Panda described in 2022 gives that ambition a concrete scale. A business process outsourcing and IT consulting customer needed remote access that could support its call centre's voice traffic. He said InstaSafe helped it expand from 500 users to more than 35,000 in five days.
Users supported in five days, according to Panda's account.
The problem combined several ordinary requirements that become difficult together: file sharing, intranet access, voice calls, authentication and records of activity. In Panda's account, the solution brought these into a unified secure-access arrangement, including encryption of voice data. A call centre, after all, does not become useful simply because everyone has successfully logged in. People still have to hear one another.
The figure describes one customer's rollout. Its interest lies in the pressure it placed on the product: thousands of people needed to continue working, quickly. It gives Panda's repeated emphasis on simplicity something more demanding than a slogan to answer to. Ease of use has consequences when an organisation has only days to make a change.
The hackers were invited
InstaSafe also developed SafeHats, a managed bug bounty programme. The premise was to enlist hackers to identify vulnerabilities in enterprise applications in return for rewards. It approached security from another direction: ask people skilled at finding weaknesses to reveal them through an organised process, giving the organisation a chance to respond.
Panda has described product development as an ongoing exchange with customers. Feedback leads to revisions, rather than merely a testimonial at the end of a sale. In his 2021 account of the team, cross-functional work and ideas drawn from Kaizen supported incremental improvement. The working method is less cinematic than a founder unveiling a finished invention. It involves returning to something that already exists and making it work better.
Recognition arrived along the way. InstaSafe received CIO Choice recognition in cloud security in 2015 and again in 2016. In December 2021, it announced the Data Security Council of India's Security Product Company of the Year award. These were company achievements, earned by a team whose work Panda represented publicly. His role joined the engineering effort to the people expected to buy it.
A habit that travels beyond software
At the Make In Odisha conclave in 2016, Panda offered advice prompted by a prominent social account breach. His points included using two-factor authentication and changing shared passwords when a team member leaves. Beside the elaborate language of enterprise architecture, the advice was almost domestic: remember who still has a key.
He carried a similarly practical emphasis into a 2022 article on manufacturing security. Connected factories depend on suppliers and other partners. Panda urged businesses to assess cloud providers, look at patching practices and rehearse their readiness through mock intrusions. The argument extended his access concerns into the relationships surrounding a business. An organisation's working dependencies deserve attention alongside its own systems.
His 2026 product agenda broadens that concern again. Panda describes a portfolio spanning application and network access, authentication, DNS filtering, identity management and secure browsing. He also puts customer control over data near the centre of the argument. His stated direction is to bring these capabilities together and expand through channel partners in India and international markets.
That leaves him with an enduring founder's assignment: make a complex proposition understandable enough for people to choose it, and usable enough for them to keep choosing it. The early leave policy supplies a useful companion to the access rules. People needed freedom to do their work. Systems needed carefully considered permissions. Panda has spent years building a business in the space between those two requirements.