Breaking SecureAuth names Geoffrey Mattson CEO to secure human, machine & AI-agent identity 250M+ identities protected Arculix delivers "invisible MFA" BCIA watches the whole session, not just the door Cloudentity + SessionGuardian folded into one identity fabric 99.99% uptime across 250+ enterprises "MFA is so 80s"
Company Dossier · Identity Security · Est. 2005

SecureAuthis the login really you?

For twenty years, an Irvine company has chased one stubborn question. Now it asks it of people, machines, and the AI agents quietly acting on their behalf.

250M+
Identities
250+
Enterprises
99.99%
Uptime
20 yrs
In the field
SecureAuth brand image with logo and the tagline Continuous Authority, Enterprise Identity Security
SECUREAUTH, IRVINE CA. The logo and its house slogan, "Continuous Authority" - the company's argument that a login should be a conversation, not a one-time door.
The Scene

A badge that keeps checking

Somewhere right now, an employee opens a laptop and is let in without typing a password. A customer taps a phone and a bank account swings open. And quietly, in the background, a software agent - not a person at all - requests access to a system and is handed a scoped, time-boxed permission. Three very different actors. One company deciding, in milliseconds, whether each of them is telling the truth.

That company is SecureAuth. It does not make a product you brag about at dinner. It makes the thing you only notice when it fails - the moment of trust between a user and a system. Its bet, repeated for two decades, is that the password was always the weakest part of that moment, and that the real question isn't "do you know the secret?" but "are you actually who you claim to be, right now, still?"

The slogan on its own brand art says it plainly: Continuous Authority. Most security stops at the door. SecureAuth wants to stay in the room.

identity securitypasswordlessadaptive authzero trustCIAMworkforce IAMAI risk engine
The Long Game

From "MultiFactor Corporation" to AI agents

The name is a tell. SecureAuth began life as MultiFactor Corporation - betting on multi-factor authentication years before "MFA" became a checkbox in every onboarding flow. Founded in 2005 in Irvine, California, it was early to an idea that later became gospel: that authentication should adapt to context, tightening when something looks off and getting out of the way when it doesn't.

That was the seed of risk-based authentication, a category SecureAuth helped define. Instead of treating every login the same, it scored them - device, location, behavior, time of day - and let the safe ones glide through.

The company kept its head down through a private-equity recapitalization led by K1 Investment Management in 2017, the same year it merged with Core Security. Then it went shopping. Acceptto in 2021 brought AI and continuous authentication. Cloudentity in 2024 added API access control and dynamic authorization. SessionGuardian, later that year, brought continuous biometric assurance.

The pattern is patient, not flashy: buy the pieces, stitch them into one fabric, and keep pointing at the same question.

"MFA is so 80s." - SecureAuth, naming a 2023 conference talk after the decade it wanted to leave behind
What It Actually Does

Five ways to prove you're you

SecureAuth organizes its work under two umbrellas - Workforce for employees and CIAM for customers - and powers both with the same AI risk engine. Here is the toolkit.

Flagship

Arculix

Passwordless sign-in, continuous risk-based authentication, and orchestration in one platform. Offers pre-, at-, and post-authorization - "invisible MFA" that runs behind the scenes.

Workforce

SecureAuth IAM

SSO, MFA, and passwordless access for employees and contractors across cloud and hybrid environments - sign in with a mobile app or a FIDO2 key like YubiKey.

Customer

SecureAuth CIAM

Customer identity for consumer apps, expanded by the Cloudentity acquisition to add API access control and fine-grained dynamic authorization.

Biometrics

BCIA

Biometric Continuous Identity Assurance: continuous facial authentication that re-verifies a user throughout a session - built for a remote-first world.

New Frontier

Microperimeter Authorizer

Extends Zero Trust controls to AI agents and automated workflows, so the non-human actors now holding the keys operate under scoped, continuous authority.

Under the hood

AI Risk Engine

Patented machine learning scores every request in real time, powering adaptive decisions for both workforce and customer identity.

By The Numbers

The shape of a quiet incumbent

Identities
250M+
Enterprises
250+
Uptime
99.99%
Total raised
$464M
Years active
20

SecureAuth is not a household name, and that is partly the point. It sells into the places where a bad login is expensive - financial services, healthcare, government, energy and utilities, retail. Roughly 150 to 220 employees. An estimated $55M in annual revenue. Headquartered in Irvine, with a leadership bench drawn from across the security industry.

The competitive set is crowded: Okta and Auth0, Ping Identity, Microsoft Entra, SailPoint, RSA, ForgeRock. SecureAuth's wager is depth on the risk-engine and continuous-authentication side, rather than breadth of brand.

Finance Healthcare Government Energy Retail
The Pivot

When the user isn't a person

In December 2025, SecureAuth named Geoffrey Mattson CEO. His resume reads like a tour of the security industry - former CEO of Xage Security, co-founder of MistNet.ai (acquired by LogRhythm), with earlier engineering roles at Juniper Networks, Huawei, Nortel, and, going all the way back, Bell Labs. He holds patents in AI, cybersecurity, and networking.

The hire signals where the company thinks the puck is going. As enterprises hand real operational authority to AI agents, those agents need identities too - badges, boundaries, and someone accountable when they act. SecureAuth's framing is that identity is becoming the control plane for how humans, machines, and AI agents work together.

"Identity is no longer just about logging people in; it's becoming the control plane for how humans, machines, and AI agents collaborate." - Vik Verma, Board Chairman, SecureAuth
"The rise of AI agents is turning identity into a live, continuously updated map of relationships and authority." - Geoffrey Mattson, CEO, SecureAuth
The Paper Trail

Two decades, abridged

2005

Founded in Irvine, California - originally as MultiFactor Corporation - betting on multi-factor authentication before it was fashionable.

2017 · SEP

Recapitalized by private equity firm K1 Investment Management (~$200M) and merged with Core Security.

2021 · NOV

Acquired Acceptto, bringing AI/ML-driven continuous authentication into the fold.

2024 · APR

Acquired and integrated Cloudentity, expanding CIAM into API access control and dynamic authorization.

2024 · AUG

Relaunched Workforce and CIAM under a new vision with redesigned user experiences.

2024 · DEC

Acquired SessionGuardian and launched Biometric Continuous Identity Assurance (BCIA).

2025 · DEC

Appointed Geoffrey Mattson CEO to lead the push into human, machine, and AI-agent identity.

Marginalia

Five things worth knowing

Footnotes & curiosities

  • SecureAuth's original name, "MultiFactor Corporation," predates the moment MFA became an everyday acronym.
  • Its 2023 conference talk was literally titled "MFA is so 80s."
  • The house slogan, "Continuous Authority," reframes login from a one-time door into a session-long conversation.
  • CEO Geoffrey Mattson's career traces back to Bell Labs - birthplace of the transistor and Unix.
  • SecureAuth now issues identities to AI agents, treating bots as first-class users that need badges and boundaries.
Watch

Interviews & demos

The Scene, Revisited

Back in the room

Return to that opening moment. The employee who didn't type a password. The customer whose account opened with a tap. The software agent handed a scoped key. A few years ago, two of those three would have been a problem - the passwordless employee a risk to manage, the AI agent a thing nobody had a plan for.

SecureAuth's twenty-year argument is that all three belong to the same question, and that the answer can't be a one-time yes. It has to keep being asked, quietly, for as long as the session lasts. The door check became a room watch. The secret you knew became the behavior you can't fake. And the list of who counts as a "user" grew to include things that were never alive.

None of this makes headlines the way a breach does. That is rather the point. The best outcome SecureAuth can deliver is a moment you never think about - a login that simply, continuously, holds.

Find SecureAuth

Official channels & reading

Websitesecureauth.com Our Story20+ years of identity LinkedInSecureAuth Corporation Twitter / X@SecureAuth Facebook/SecureAuth NewsroomNew CEO announcement PressCloudentity acquisition Contactgmattson@secureauth.com

Share this dossier