Vlad Matsiiako

The plumbing nobody wants to think about

A developer pushes code at 2am, forgets a stray API key sitting in a .env file, and somewhere a bot is already scraping for exactly that mistake. Vlad Matsiiako built a company on the boring, terrifying gap between those two moments.

Infisical, the company he co-founds and runs as CEO, now moves more than 100 million secrets a day. Secrets, in the security sense: the passwords, encryption keys, API tokens, and SSH credentials that let one machine trust another. They are invisible until they leak, and then they are the headline. Vlad's bet is that the thing most engineers treat as an afterthought is actually the center of modern security.

"Secrets are the glue that connects everything," he says. "If they're not there, there's no way for organizations to secure systems." It is a tidy line for a messy problem. Most modern breaches still trace back to mishandled secrets and identities, and the tooling that is supposed to stop that has historically been clunky, enterprise-priced, and allergic to the way developers actually work.

So Infisical did something a security company is not supposed to do: it gave away the code. The product began life inside Y Combinator's Winter 2023 batch as a closed-source SaaS tool. It worked. People just didn't trust it. You cannot ask engineers to hand over their most sensitive credentials and then refuse to show them the lock. The team open-sourced it, and the math changed. "Now, people could actually see the code. They could see how the encryption works. And that was where trust came from."

A four-country run-up

Vlad was born in Ukraine and left it early. He did his undergrad in the Netherlands, in economics and econometrics, and became one of the first data scientists at bunq, the Amsterdam neobank that treats banking like a software problem. Then came a master's at Cornell in operations research and information engineering, and a stint at Figma. By the time he landed in San Francisco, he had collected the kind of resume that reads like a layover itinerary - four countries, finance, data, design tooling - and an instinct for systems that have to scale without breaking.

The Infisical founding trio - Vlad, Tony Dang, and Maidul Islam - met as students at Cornell. They did not start with secrets. They cycled through other ideas first, including a VR marketplace, the way most founding teams audition concepts before one sticks. What kept surfacing was a problem they hit themselves, over and over, on every project: managing secrets was miserable. They talked to enough engineers to realize the misery was universal, and much bigger than they'd assumed.

A name born under a deadline

The story of the company's name is the story of its early days in miniature. Having just gotten into YC as international students, the founders were juggling visas and a ticking clock to incorporate. Under that pressure they jammed two words together - "infinity" and "physical" - and out came Infisical. It is the kind of name you only invent when you are out of time and have to ship something. Fitting, for a company that sells the discipline of not leaving things to the last minute.

The incumbent sold for $6.4 billion. Good timing.

In early 2025, HashiCorp - the long-standing giant of secrets management - was swallowed by IBM for $6.4 billion. For a young open-source challenger, an incumbent disappearing into a conglomerate is less a threat than an opening. Months later, Infisical announced a $16 million Series A led by Elad Gil, with Y Combinator, Gradient, and Dynamic Fund along for the ride, plus angels including Datadog CEO Olivier Pomel. By then the company was cash-flow positive, growing revenue 20x year over year, and counting Hugging Face, Lucid, and LG among its customers.

Infisical has since stretched well past developer secrets into certificate management, SSH key handling, and the freshest frontier of all: securing the credentials that AI agents need to act on a company's behalf. As software starts spinning up its own machine identities by the thousand, the question of who-can-touch-what stops being a developer convenience and becomes existential. Vlad has positioned the company squarely in front of that wave.

Founder, in his own words

He is not precious about access. On hiring, his advice is blunt: "Reach out to the founders or hiring manager directly. I always look at these and often take meetings - it shows effort and interest." He means it - he still reads the cold emails. And he is happy to puncture the founder mythology, posting that the real giveaway of the job is "being more excited to update your profile pic on Slack than on Instagram." His GitHub bio, by the way, is a single lightning bolt. No mission statement. Just the emoji.

What ties it together is a refusal to make security feel like a tax. The legacy approach to secrets was: lock everything down, make it painful, hope developers comply. Infisical's pitch is the opposite - meet engineers where they already are, show them the code, inject the secrets into the app instead of scattering them across .env files, and let the audit logs and rotation happen quietly underneath. Make the safe path the easy one, and you don't have to nag anyone.

The market is moving his way. Secrets management is projected to grow into a multi-billion-dollar category by 2030, propelled by exactly the trends Infisical rides: cloud-native infrastructure, compliance pressure, and a tidal wave of machine and AI identities that each need their own keys. For a founder who built a company around the layer everyone ignores, the timing has turned out to be very good indeed.

There is something honest about choosing this problem. It is not flashy. There is no consumer app, no viral demo, no glamour in being the thing that prevents a headline rather than makes one. But it is the kind of work that compounds quietly - every team that adopts it, every secret it rotates, every leak that never happens. Vlad seems content with that trade. The world's most important infrastructure runs on credentials nobody sees. He decided to be the one watching them.