Vrajesh Bhavsar and the art of stopping things in time

Most of Vrajesh Bhavsar’s friends were playing cricket. He chose karate. Growing up in India, he travelled around the country to compete and collected state and national championship wins. It was an education in the inconvenience of other people: an opponent has plans, too, and feels no obligation to respect yours.

Years later, the co-founder and CEO of Operant AI would draw on that experience to explain leadership. Prepare, pay attention, and accept that a carefully arranged strategy may need revising. There is something pleasingly unceremonious about this account of entrepreneurship. A business plan, however handsomely typeset, cannot block a punch.

His professional life has followed another kind of contest: the effort to protect useful technology as its uses multiply. He worked on the foundations of Apple’s operating systems, on Android security at Qualcomm, and on machine learning at Arm. Now his company is trying to put controls around AI agents while they act. The recurring question is one of timing. How close to a consequential action can protection get?

An engineer beneath the screen

Bhavsar’s career began well below the polished surfaces most people associate with technology. His work history includes systems engineering at Mindspeed Technologies from 2005 to 2007, followed by embedded kernel engineering at Apple from 2007 to 2011. The kernel is the machinery underneath an operating system, coordinating access to a device’s resources. It is rarely invited into product photographs.

With a master’s degree in computer science from the University of Southern California, he built a career in the parts of computing where reliability and access matter. His Apple work included Dynamic Tracing, Data Protection and Secure Enclave. He holds eight patents across distributed systems, data and security. These are concrete roots for a founder now selling protection for a much more conversational kind of software.

At Qualcomm, where he worked in research and product management between 2012 and 2014, Bhavsar worked with Priyanka Tembey on applying AI and machine learning to Android security. Their working relationship predates Operant by years. The problem was already familiar: a rapidly expanding application ecosystem was useful precisely because so many people could build for it, including people with less agreeable intentions.

At Arm, his remit moved toward the machine learning ecosystem and partnerships. He helped build its ML/AI business unit, extending the engineering story into the business of getting technology adopted. A later role at Scaled Inference covered product and business development. The sequence matters: by the time he became a founder, he had worked on both the technology and the negotiations required to put it to use.

The company inside the cloud

In 2021, Bhavsar, Tembey and Ashley Roof came together as Operant’s founding team. Tembey brought experience in distributed cloud systems, including work at VMware. Roof brought sales and marketing experience that began at Google. Today, their roles are CEO, CTO and COO respectively. A company intended to reach enterprise buyers would need engineering, an explanation customers could understand, and an organization capable of delivering it.

Their starting environment was cloud-native software: applications assembled from services, interfaces and infrastructure that change as they run. In his account of the company’s early thinking, Bhavsar emphasized practical protection and ease of use. An elegant technical idea still had to survive contact with the people expected to install it. Security teams already had work to do; supplying them with another elaborate chore was a questionable gift.

Operant’s approach puts discovery, detection and defense together. Discovery establishes what is operating and communicating. Detection identifies potentially dangerous behavior. Defense applies a control to the live activity. The company calls this its 3D approach. The vocabulary is compact, but its ambition is demanding: observe a changing environment closely enough to intervene while an unwanted action can still be stopped.

Runtime is the useful term here. A program can be checked before deployment, yet its behavior still depends on what it encounters after deployment. AI agents make that distinction especially visible. They receive instructions, read material and call tools across multiple steps. A permission that makes sense in one context can become hazardous when the instructions or the context change.

Seven people on a demo call

Bhavsar’s description of the entrepreneurial journey includes a less glamorous qualification than his employers’ names might suggest. Breaking into cybersecurity without the usual security-vendor pedigree was difficult. Experience at Apple and Arm did not automatically settle the question of whether a buyer should trust a new company with live defenses. The prospective customer still had to see a reason to care.

Early design partners helped narrow the company’s broad starting vision toward security. Operant also committed to a Kubernetes-native foundation and utility-based pricing. Those were choices about where software would run and how customers would consume it, made before the current rush to put agents into production. They gave the company a particular technical and commercial shape.

One signal of changing demand was wonderfully ordinary: seven people turned up to an initial enterprise demo call. A full team had made room in its calendar. In a business full of extravagant market forecasts, attendance is a refreshingly legible number. Someone had a problem important enough to bring colleagues.

That funding round added Patricia Muoio and Nancy Wang to Operant’s board. Muoio brought an NSA and Department of Defense background; Wang had led data protection work at AWS. For Bhavsar, the financing was an opportunity to expand the reach of an engineering idea. Money and experienced directors could help move it beyond the founding team’s own conversations.

Asked about a favorite company memory, Bhavsar chose the response to an in-line auto-redaction launch ahead of KubeCon in November 2024. Customers recognized a problem they needed solved: sensitive information could be removed before it left their application environment. His account lingered on their relief. For an engineer who had moved into product and then leadership, this was a useful meeting of the disciplines: a technical capability whose value required very little explanation once someone saw it work.

Back to India, forward to agents

In March 2025, Operant announced its entry into India. For Bhavsar, whose engineering journey began in Gujarat, the expansion also had a personal geography. The company planned local hiring, including engineering and go-to-market work. Its intended customers included financial and AI-focused businesses facing the practical consequences of putting new systems into daily use.

His concern was the speed of adoption. Enterprises were taking up new AI technology quickly, often before establishing how to trust and secure it. He argued that security should leave room for innovation. That ambition contains a tension every product decision must resolve: a control has to prevent harmful behavior without making useful work intolerably difficult.

“The idea is to have security that doesn’t slow innovation down.”

Vrajesh Bhavsar, March 2025

By January 2026, his public conversations were addressing attacks on production AI systems and the connections agents use to reach tools. Model Context Protocol, or MCP, gives those connections a common structure. Bhavsar discussed Operant’s Shadow Escape research into attacks involving MCP servers. A system can look orderly from outside while an agent’s interactions inside it carry a very different risk.

In May 2026, Operant launched Endpoint Protector, extending the company’s work onto employee devices. Bhavsar’s product writing described the laptop as an AI workstation: coding agents can read files, run commands and install packages, while chat tools handle material employees paste into them. That is a rather busier desk than the traditional image of a computer waiting patiently for someone to type.

The company says its endpoint product applies controls to those interactions and connects them to the wider production environment. The continuity is the point. An agent developed on a laptop may later run in a cloud application. For a founder whose earlier work involved device security, the return to the endpoint gives his career an intriguing loop.

The action before the action

Operant’s Semantic Firewall announcement in August 2026 pushed the question further. Bhavsar framed the challenge around understanding what an agent is trying to do at the moment it acts. The company describes decisions to allow, block or redact activity based on its meaning and scope. A legitimate tool call can still serve an illegitimate purpose.

His accompanying product writing also addressed agents that drift beyond their assignment or consume resources wastefully. Those examples make the issue broader than an attacker at the door. An agent can create trouble while enthusiastically pursuing a task. Enterprise software has acquired an assistant with initiative; initiative requires boundaries, particularly when it can execute commands.

Bhavsar’s writing about AI responsibility places that engineering work within a wider obligation to the people affected by it. He presents Operant as one contribution to making deployed AI more visible and controllable. His partnership announcement with LangChain brings the argument back to implementation: developers can trace agent behavior through LangSmith while applying Operant’s security policies to the running workflow.

The LangChain work also makes the division of labor tangible. A trace records the sequence of steps an agent took, giving developers a way to inspect its behavior. Operant’s integration adds security decisions to that workflow. In the company’s account, the same record can show an action and the policy response to it. For Bhavsar, this is a route into the tools developers already use, rather than a demand that they reconstruct an application around a new security product. Adoption has been part of his work since his ecosystem and partnership years at Arm; it remains part of the engineering problem.

The scale of the ambition has grown from the operating system to the agent loop. The underlying question remains recognizable. What is this software about to do, who permitted it, and can someone intervene in time? Bhavsar has spent his career moving closer to that moment. His next test will arrive with the next action an agent decides to take.