Shrav Mehta and the business of getting unstuck

The prospective customer had waited a month. Shrav Mehta had floated an idea: software that would take some of the manual labor out of security compliance. People in his network had sounded interested. Then one of them called back to ask where the product was. Mehta says he quit his job that week. A polite conversation had acquired a deadline.

It is a pleasingly unceremonious beginning for a company concerned with procedures. Before Secureframe, there were spreadsheets, guides and recommendations for auditors. Mehta passed them around to people trying to get through security reviews. The requests kept arriving. Eventually, he began asking whether the recipients would use software to do more of the work.

He co-founded Secureframe with Natasja Nielsen in 2020. By the time an early version was ready, a queue of prospective users had formed. Years later, telling that story, he remained careful about what the queue proved. Interest was encouraging. It still left the rather substantial matter of building something useful.

The customer who called twice

A founder can collect a remarkable number of encouraging conversations without acquiring a customer. People are generous with hypothetical enthusiasm. The return call changed the terms: somebody remembered the proposed solution after the meeting was over and wanted it badly enough to chase it.

Mehta’s own account gives the episode its force. He had experienced the burden himself, helped other people manage it, then tested whether they wanted a tool. His decision followed repeated exposure to the same practical difficulty. The idea already had a small working life in other people’s spreadsheets.

There is something revealing about that route. The person being asked for an auditor recommendation gets to hear the awkward questions before a sales team ever does. How long will this take? What does this requirement mean? Which evidence counts? Secureframe grew out of a position close enough to the work to notice its repetition.

“It was interesting that people needed it.”

Shrav Mehta, 2022

An app store education

Mehta’s first software audience had arrived much earlier. As a teenager, he developed Android applications that reached millions of installs and became profitable. His personal website still gives that experience a prominent place, ahead of a description of helping startups with marketing, sales and engineering.

In a 2024 conversation, he recalled working through thick programming books as a child. Mobile software made the exercise more tangible. A program on a phone was something he could show his friends. The distance between learning a language and making an object somebody wanted to use suddenly looked shorter.

There were distribution and monetization lessons, too. Publishing an application meant finding out whether people would download it and whether its audience could support a business. The app store supplied feedback with very little concern for the developer’s feelings. A download counter is an unusually blunt editor.

That early experience gives his later career a useful continuity. Mehta moved between building software and helping it find customers. His biography includes roles at Hired, Lob, Scale AI and Pilot; he also earned a computer science degree at the University of California, Santa Cruz. Engineering and growth kept appearing together.

A deal held up by a spreadsheet

For a startup, selling to a larger business involves more than demonstrating that the software works. The buyer wants confidence about how its information will be handled. Security reviews, questionnaires and independent assessments become part of the commercial conversation. A promising deal can acquire a very long appendix.

Mehta’s work at startups exposed him to that appendix. At Lob, which handles direct-mail infrastructure, security and compliance requirements were part of serving customers with sensitive data. The experience put him near a recurring collision: a small team trying to move quickly while a larger organization needed detailed assurances.

The underlying questions deserve answers. Businesses ought to know who can access their data and how systems are protected. Yet assembling those answers can consume the people responsible for building and running the product. A process can have a serious purpose and still be organized badly.

Secureframe addressed the practical burden by connecting to the services a business already used, gathering evidence and monitoring controls. In its early funding announcement, Mehta described connections to more than 25 services. The premise was straightforward: fewer repeated requests to human beings for information machines could collect.

His 2021 description of the product’s development returned to screenshots, email and messy spreadsheets. Customers then asked for additional integrations and workflows. Those requests mattered because the work extended beyond a single report. Employee onboarding, vendor management and changes in infrastructure all created new things to check.

For Mehta, the commercial stakes help explain why the subject held his attention. A security requirement arrives with consequences: a customer may need the answer before it can sign. The urgency gives a software builder a very different starting point from a feature somebody might enjoy trying someday.

The people behind the capital

Mehta’s network contributed more than early demand. When Secureframe raised money, the founders made room for operators as well as venture firms. Customers, founders and employees could become investors, bringing introductions, recruiting help and advice alongside their checks.

For the Series A, Secureframe used an AngelList roll-up vehicle to group more than 50 operator investors into a single line on its capitalization table. Participants included Gokul Rajaram, Sam Blond and Webb Stevens. It was a financing choice with a familiar theme: reduce administrative work while keeping the useful relationships.

The figures grew quickly. Secureframe raised an $18 million Series A led by Kleiner Perkins in 2021, then announced a $56 million Series B led by Accomplice in February 2022. Michael Viscuso, a Carbon Black co-founder, joined its board. The company reported tenfold revenue growth and sevenfold customer growth for 2021.

Funding enlarged the resources available to the team. Recognition followed, including Mehta’s place on the 2023 Forbes 30 Under 30 list for Enterprise Technology. These are milestones in the biography. The everyday test remained whether customers could spend less time managing the machinery of an assessment.

The work between audits

As Secureframe expanded, Mehta’s subject became the interval between reviews. A business changes after an assessment: people join and leave, services are added, permissions drift. Evidence about an earlier configuration has a limited shelf life. Keeping it current is an operational task.

The company’s 2023 work included AI-assisted remediation guidance, risk tools, an API and additional integrations. Those developments widened the product around the original evidence-gathering problem. They also moved it closer to the places where a failed check needs a practical response.

By March 2026, that direction included Secureframe Defense for CMMC, aimed at defense contractors. The product combined infrastructure, implementation guidance, documentation and assessment preparation. For Mehta, the customer problem again involved a fragmented process spread across people, tools and outside providers.

The federal work brought the company into a different set of conversations. Its May 2026 virtual cybersecurity summit featured former government security leaders, including Paul Nakasone and Rob Joyce. In June, Secureframe announced it had met FedRAMP 20x Moderate authorization requirements through the Phase Two pilot. The company was undertaking the kind of assessment work it helped customers manage.

These developments also change what running the company asks of him. The teenage app developer could publish a product into a store. A compliance platform has to fit into an organization’s existing systems and the expectations of its assessors. Distribution still matters; so does the less visible work of making each connection dependable.

Give the software a longer shift

Mehta’s recent interest in AI follows that same practical direction. Secureframe launched a hosted Model Context Protocol server in August 2026, letting customers connect assistants to compliance information and supported actions. Existing permissions govern access. The system can help surface failing controls or update work without requiring the user to assemble every answer manually.

In September, he described personally using AI across security, sales, marketing and internal operations. He was particularly interested in agents that could keep pursuing a goal over hours or days. His emphasis was on useful work, clear objectives and boundaries around sensitive systems.

That ambition introduces a responsibility as well as a convenience. Software that can act needs decisions about what it may access, when a person should review its output and where it must stop. Mehta’s discussion of longer-running agents kept human judgment in the picture. More capable tools make those choices more consequential.

The thread back to his first applications is easy to follow. He builds, tries the thing himself and pays attention to the work around it. Secureframe began with people who wanted help getting through a review. Its next chapter depends on how much of that recurring work software can reliably carry.

There is an appealing consistency to the choice of problems. Screenshots, questionnaires and control checks rarely feature in anyone’s childhood idea of an entrepreneurial career. They are, however, things people have to finish before they can do something else. Mehta has spent much of his working life looking closely at those interruptions.

The phone call remains the useful detail. Someone had a problem, remembered his proposed answer and wanted to know when it would arrive. There are more elegant beginnings to a business. This one came with a customer asking him to get on with it.