WideField Watched What Happened After Login - Then Cisco Bought the View

The first thing to know about WideField Security is that it was not trying to make your login screen more suspicious of you. It cared about the next five minutes, the next five hours, and the API token that remained useful long after everyone forgot who created it. Authentication says an identity passed the test. WideField asked whether that identity then behaved like itself.

That distinction sounds narrow until the modern office enters the frame. A person signs into Microsoft 365. A service account calls Snowflake from a cloud workload. An OAuth app reads Salesforce. An AI agent inherits permission to search mail, edit a calendar, and call a repository. Each action can be valid in isolation. The trouble lives in the relationships: an old credential, a policy exception, a token used from the wrong place, or a session that changes character without technically breaking a rule.

WideField connected to identity, SaaS, and cloud systems through APIs, then assembled those scattered signals into a living view of accounts, credentials, privileges, authentication events, sessions, and behavior. It found unmanaged local accounts and stale secrets. It looked for MFA gaps and policy drift. It tracked interactive and automated activity after login. When the evidence crossed a threshold, a security team could investigate and remediate manually, by policy, or through an API.

The breach that would not leave them alone

Abhay Kulkarni and Kartik Kumar founded WideField in 2023 after senior engineering work at Netskope, where they had watched enterprises move into cloud and SaaS at enormous scale. The origin story they later published starts with an ugly little paradox. A videoconferencing service suffered a denial-of-service incident from a single IP address. The culprit was a former employee using a stolen API key that had not been rotated.

The operational failure came first: credential hygiene. The strategic failure was larger. The organization had tools for identity and access, yet it could not see the useful life of that credential in context. Kulkarni and Kumar studied more than 300 publicly disclosed breaches and kept finding variations of the same plot: an account without MFA, a service identity nobody owned, a bearer token replayed elsewhere, or a legitimate session taken over after authentication.

What changed their minds from experienced operators into founders was not one exotic exploit. It was repetition. Security teams had bought SSO, MFA, identity governance, privileged-access management, cloud controls, and a SIEM. The gaps survived between categories. The founders concluded that a customer should not need to hand-stitch five products and a pile of logs simply to answer who acted, with which credential, inside which session, and with what reach.

“Authentication was never the finish line, but that's where most tools stop.”Abhay Kulkarni, co-founder and CEO

A product built like a timeline

WideField's clearest idea was also its most portable: identity has states. At rest, the platform mapped accounts, entitlements, privileges, credentials, and risky relationships. In motion, it checked authentication journeys, MFA enforcement, conditional access, and policy escapes. In use, it modeled active sessions and non-interactive calls, looking for impossible travel, unusual token use, permission abuse, data movement, and other departures from expected behavior.

The buyers were not consumers protecting a password vault. They were enterprise CISOs, identity teams, and security-operations analysts. IAM teams could discover non-federated or privileged human and machine accounts that never appeared in the primary identity provider. SOC analysts could open one identity record and move from posture to recent behavior, active sessions, historic sessions, and third-party automation without assembling a case from separate consoles.

For executives, WideField offered a daily identity-risk assessment. The company said it aggregated more than 60 signals across five categories into an organization-wide score with prioritized findings. That is useful triage, not prophecy. A score cannot decide whether a strange call is malicious, and behavioral models need enough clean telemetry to learn what ordinary looks like. The more interesting product was the context underneath the number.

The company launched publicly at the RSA Conference in 2025. Its founders later wrote that security leaders recognized the post-authentication gap because they had already lived through it. That reception mattered. The problem was no longer a private frustration shared by two engineers; buyers could name the manual audits, missing token views, and scattered machine identities in their own environments. WideField had found language for a budget that was already leaking through seams.

The customer is the team between teams

Public customer references included NOV, American Express Global Business Travel, and Moveworks. NOV CISO John McLeod described the old job plainly: auditing and monitoring active sessions was difficult and costly. WideField's appeal was not that it eliminated authentication controls. It made those controls observable after the fact, including machine identities, while freeing engineers from manual inspection.

Internally, the company advertised six values: bias for action, ownership, urgency, innovation, trust, and customer obsession. The wording had the briskness of a small security team that expects the pager to ring. More revealing was the founders' dislike of “security theater” and category clutter. They preferred a practical outcome - fewer risky accounts, cleaner credentials, enforced policy, visible sessions - over winning an acronym argument. The product architecture reflected that impatience.

The business model was enterprise SaaS with a sales-led deployment. Customers connected their stack by API instead of installing an endpoint agent everywhere, which reduced initial friction. Public list pricing never appeared, so the exact cost of a license remains private. The more consequential price is architectural: the product needed access to useful telemetry across enough cloud and SaaS systems to correlate behavior. Thin logs produce thin conclusions.

That also explains where WideField sat in the market. It overlapped with identity threat detection and response, identity security posture management, non-human identity security, SaaS security, and behavioral analytics. Alternatives ranged from Permiso, Silverfort, Obsidian, and Semperis to identity features inside Microsoft, Okta, CrowdStrike, and Cisco. A company could also build the workflow from IAM, SIEM, and cloud logs. WideField's argument was that the assembly tax was the vulnerability.

AI agents made the old gap move faster

By early 2026, WideField had expanded its platform to autonomous AI agents. The logic was less fashionable than it sounded. Agents borrow identity. They operate with delegated authority, long-lived tokens, and access to mailboxes, files, calendars, repositories, and enterprise APIs. A trusted agent can still take an unsafe action in the wrong context, and it can do so at machine speed.

WideField built behavioral models from user, device, and application telemetry, extending the same lifecycle approach from people and service accounts to bots. In March, Cisco Investments joined the Series A and WideField announced that new coverage. John Hurley, then chief revenue officer of Optiv, joined its board. Three months later, Cisco announced an agreement to buy the company.

The acquisition price was not disclosed. It should not be confused with the $11.3 million Series A led by Crosspoint Capital Partners in October 2025, with Engineering Capital and others participating. On July 31, 2026, Cisco completed the acquisition. WideField ended sales and new licensing of the standalone product that day, while promising contracted support to existing customers.

Why Cisco wanted the view

Cisco's plan gives the product thesis a larger destination. WideField's technology is being integrated into Cisco Identity Intelligence, the Cisco Data Fabric, and Splunk security products. For Splunk's Agentic SOC, the prize is normalized context: which human, machine, or AI agent acted; under which authority; using which credential and session; and with what possible blast radius.

That context matters if a security agent is expected to investigate or respond automatically. An anomaly alone is not permission to revoke a chief executive's access, kill a production service account, or block a useful AI workflow. Automated security needs evidence that can survive a human asking, “Why did you do that?” WideField's session lineage could help turn a suspicious event into an explainable case.

There are conditions where this approach will disappoint. An air-gapped estate or a small company with a handful of well-controlled apps may not justify a broad correlation layer. Systems without APIs or detailed session telemetry remain dark. Behavioral analytics can mistake a role change, travel, or a new automation for abuse. Automated remediation can amplify a false positive. The method works best in a sprawling enterprise that has identity sprawl, supported integrations, enough history to establish patterns, and humans who set careful response boundaries.

The most reusable lesson is not “add AI to identity.” It is to draw the workflow after the industry's apparent finish line. WideField looked beyond the green check mark at login and found a company-sized problem in everything that followed. Cisco is betting that the same evidence will help Splunk's agents reason before they act. The telescope is changing owners, but its field of view is getting wider.

Keep exploring