SecurityPal AI sells the relief of a finished security review

In 2018, Pukar C. Hamal was about to close the largest enterprise deal his startup had attempted. Then the buyer sent a security questionnaire approaching 200 pages. According to SecurityPal’s company history, his team spent the night answering it. A commercial triumph had acquired the evening plans of a tax audit.

The form that ate the evening

SecurityPal, founded in 2020, occupies an awkward junction between selling software and proving that software can be trusted. Buyers ask about controls, privacy, policies and evidence. Sellers must answer accurately, often in somebody else’s spreadsheet or portal. Security engineers become clerks; salespeople become chasers. The deal waits for both.

Hamal had lived the problem as a founder and revenue leader. In the company’s 2022 funding announcement, he described disappointing attempts to solve it with existing AI software. SecurityPal’s response was to combine a platform with a concierge service that would complete the review. The business was selling relief from a recurring obligation.

By September 2022, SecurityPal reported more than 200 customers and seven-figure annual recurring revenue while bootstrapped. It emerged from stealth with a $21 million Series A led by Craft Ventures. The announced spending priorities were product development and further investment in delivery. Its early roster included Figma, Monday.com and Loom: businesses familiar with enterprise buying committees.

A queue is a better story than a demo

The revealing customer story belongs to Iterable. In SecurityPal’s published account, Customer Trust Lead Heather McDonough inherited a team using RFPIO for RFPs and questionnaires. Adoption was low, the process was inefficient, and 40-60 requests could sit open. Buying software had failed to settle who would do the work and how.

“Without process, a tool is bound to fail.”Heather McDonough · Customer Trust Lead, Iterable

McDonough already knew SecurityPal from Perforce. At Iterable, she started with a Trust Center so buyers could obtain documentation themselves. Questionnaire Concierge supplied expert-reviewed responses, while the browser extension and knowledge tools brought approved material into daily work. Her team retained quality checks. Reporting made the backlog visible to leadership.

The case study reports the queue falling below 10 and average responses improving by one business day. It also attributes $3.3 million in sales enabled within weeks to faster access to trust documentation. Those are vendor-published customer results. They illustrate a workflow improvement, rather than establish what every buyer will earn.

Tavus supplies a second test. As the AI-video company moved upmarket, reviews involving sensitive biometric data pulled in its CEO and engineering leader. Spreadsheets became inadequate once enterprise portals entered the picture. The customer account says ChatGPT introduced accuracy and consistency problems. Faster prose had left the assurance problem intact.

Tavus adopted SecurityPal’s Knowledge Library, Questionnaire Concierge and Trust Center. The published results describe enterprise sales cycles halved and 90% of questionnaires completed within 48 hours. The change also removed routine reviews from senior leadership. For a small company, a recovered executive afternoon can be as consequential as a faster form.

The people behind the machine

The delivery model has a physical address far from the usual software geography. SecurityPal opened its Kathmandu command center in February 2023, with U.S. Ambassador Dean R. Thompson taking part in the inauguration. Now called the Security Assurance Command Center, it provides round-the-clock support from analysts and other specialists.

That operation is central to the proposition. AI can draft; people handle interpretation, risk and exceptions. SecurityPal advertises certified expertise and an analyst accountable for deliverables in its assisted service. Its stated company principles emphasize human-centered innovation and ownership. These values have a practical expression: somebody must stand behind an answer that a buyer may treat as a commitment.

Libby has a library to run

The product has broadened from questionnaire completion into assurance management. The July 2024 Customer Assurance Suite brought related functions together. Today’s Cybersecurity Assurance Management Platform covers questionnaires, vendor assessments, a Trust Center, knowledge management, tasks and workflow orchestration. It serves security and GRC teams alongside the revenue teams waiting for approvals.

The Knowledge Library governs answers, controls and supporting documents. The Trust Center gives buyers controlled access to security material, including NDA-gated sharing. Vendor Assess reverses the direction of scrutiny: it helps a company evaluate its suppliers’ security documentation and risks. Together, these products address both giving assurance and demanding it.

In December 2025, SecurityPal launched Concierge Agents, beginning with Libby, its Knowledge Librarian. Agents can work through familiar channels such as Slack, Teams and email, drawing on vetted organizational knowledge. The launch described tiered autonomy: predictable tasks get automation; sensitive interpretation gets human oversight. The names are playful. The responsibility is considerably less so.

Pricing follows the scope of delegation. Current tiers run from Basecamp’s self-service software through Summit’s AI-and-analyst delivery to Everest’s managed operation. The agent announcement describes usage as the main pricing driver, rather than user seats. Buyers therefore need to compare the work covered, escalation rules and delivery commitments when evaluating a quote.

Copy the handoff, then count the queue

SecurityPal competes with questionnaire and trust-center products such as Conveyor and Whistic, as well as internal teams and consultants. Human review alone is no exclusive invention; Conveyor also provides review controls. SecurityPal’s particular emphasis is the option to hand over execution, supported by an always-on analyst operation.

The transferable lesson is organizational. Create a maintained store of approved evidence. Let buyers retrieve routine documents. Give exceptions a named owner. Track open requests and response time alongside completed questionnaires. Iterable’s account also stresses executive backing and cooperation across Sales, Security and Compliance. A platform needs those relationships to function.

This approach depends on truthful, current inputs and a team willing to resolve gaps. It cannot make an absent security control real or guarantee that a buyer accepts the response. With thin evidence or unresolved ownership, automation merely moves uncertainty faster. SecurityPal’s most persuasive idea is that the work ends only when somebody has taken responsibility for finishing it.