Zia Hayat and the Problem with Being Believed

A bank robbery generally offers a young observer a choice of interests: the money, the chase, perhaps the outrageous confidence. Zia Hayat became interested in the connection. The story of Vladimir Levin’s attack on Citibank, associated with 1994, showed him that a person could reach into a financial institution through the internet. A dial-up modem had made the distance between a criminal and a bank look alarmingly small.

Hayat’s eventual response was to make a career out of that distance. He would study engineering, earn a doctorate in security, work inside large institutions and co-found Callsign. The work gathered around a deceptively ordinary question: when someone turns up online claiming to be you, what should count as evidence?

We meet that question in miniature every day. A box requests a password. Another requests a code. A perfectly innocent attempt to do something useful begins to resemble an audition. Hayat has spent years working on the judgement behind those boxes: how an organisation decides whom to believe, and how much trouble it causes along the way.

A robbery without a getaway car

In his account of becoming interested in security, the fascination lay in the method. Someone using basic communications technology could attack systems in New York without going anywhere near the bank. The tools that promised convenience also offered a route for theft. That uncomfortable pairing would become familiar territory.

It is a fitting beginning for a founder whose eventual business would concentrate on recognition. The physical branch had its own routines for deciding who belonged. Online, institutions needed evidence that could travel through a connection. Knowing the right secret was useful. It also created a problem whenever someone else learned the secret.

Hayat pursued the subject through formal study. He completed a degree in electrical and electronic engineering at Manchester in 2003, followed by a PhD in Information Systems Security at Southampton in 2006. The sequence put both engineering and security into his preparation before the demands of running a company entered the picture.

An engineer learns the bank’s vocabulary

His early career crossed several kinds of organisation. At BAE Systems, he worked as an information security research engineer. Accenture followed, then a role advising the Government of Abu Dhabi on information security. By 2010, he was working at Lloyds Banking Group as an internet banking security architect.

Those jobs put the security problem in different settings. A research question, a consulting engagement and a bank’s operating system each come with their own constraints. For a founder, there is an advantage in encountering those constraints before proposing to sell a solution to the people who live with them.

At Lloyds, Hayat came to see identification as a persistent banking problem. His explanation of leaving was pointed: a large institution has limits on how often an employee can keep asking why. Building a company offered him a way to keep pursuing the question. Callsign emerged from that decision.

Hayat and Ian Welch founded the business in London in 2012. Its early focus was employee authentication. The customer-facing product came later. That progression matters: asking a worker to satisfy a company security routine is one thing; persuading customers to tolerate the same inconvenience while reaching their own accounts is another.

The password’s poor alibi

In 2017, Hayat described the gap between possessing a password and being the person entitled to use it. Possessing a credential and establishing identity are different achievements. A stolen password can perform its part perfectly. The person supplying it remains the unresolved issue.

Callsign’s approach brought information about a session into the authentication decision. Device, location and patterns of interaction can provide context around a login. The practical aim is to help an organisation decide when to let a person proceed and when to ask for further evidence.

The judgement has consequences in both directions. A genuine customer subjected to repeated checks may give up. An impostor allowed through can cause damage. Security designers have to care about the ordinary person’s patience as well as the attacker’s persistence. Everyone would like the computer to be more suspicious of somebody else.

Hayat’s product argument is that authentication should respond to circumstances. The action being attempted, the available context and the evidence about the user should influence the journey. There is a human point underneath the technical vocabulary: a useful system has to accommodate people getting on with their day.

“Even if someone has your password it doesn’t mean it’s you.”

Zia Hayat, 2017

Choosing the difficult customers

In July 2017, Callsign announced a $35 million Series A co-led by Accel and PTB Ventures, with Allegis Capital and NightDragon Security participating. David DeWalt, whose career included leading McAfee, joined as vice chairman. The funding supported expansion and recruitment across engineering and commercial roles.

The money brought a wider circle around Hayat’s project. The board additions included Accel’s Harry Nelis, Allegis Capital’s Bob Ackerman and PTB Ventures’ Dave Fields. The company named Lloyds and Deutsche Bank among its clients. Hayat had moved from designing security inside a bank to supplying the institutions themselves.

Large banks are demanding customers for a young business. In a 2021 conversation with HSBC’s Catherine Zhou, Hayat explained why Callsign had pursued them: working through institutions that hold people’s money offered a way to protect people at scale. The complexity came with access to a large population.

HSBC was both a client and an investor. Hayat described working across its different businesses and geographies as an accelerated education. A global bank contains many environments inside one name. For a security company, that means learning how the same basic question behaves when the setting changes.

The appeal of that explanation is its practicality. Hayat’s ambition needed distribution. An authentication product cannot help customers it never reaches. Institutional relationships brought demands on the business, but they also placed its work where many people already conducted their financial lives.

Trust acquires an address

By 2021, Callsign’s expansion included Abu Dhabi. An announcement with the Abu Dhabi Investment Office set out plans for technical and operational centres of excellence. Hayat described the UAE as the company’s primary hub outside the UK and said senior management would relocate as part of the commitment.

That announcement was a plan for building capability, including local recruitment and work in machine learning and artificial intelligence. It helps explain the geography of Hayat’s career: Abu Dhabi had appeared in his earlier advisory work and now featured in the development of the business he co-founded.

His public discussion of AI also reached the less photogenic work of governance. In comments about Singapore’s Model AI Governance Framework, he explained that increasingly complex models required internal structures and measures for accountability. The framework offered another way to examine decisions and support discussion among the people responsible for them.

For an identity business, that concern follows naturally from the product. Software can influence whether someone gets through a digital door. The organisation operating it needs to consider how its judgements are made. A confident answer on a screen still leaves people responsible for the machinery behind it.

Another kind of access

There is a second entry problem in Hayat’s public work: who gets a chance to build the technology. He has advocated a broader talent pipeline, arguing for engagement with young people and opportunities for people from different backgrounds. The argument asks employers to look beyond the immediate vacancy.

In 2022, Callsign worked with Making The Leap to launch a Social Mobility Start-up of the Year award. Its scope included the inclusivity of products and services alongside employment opportunities such as apprenticeships, paid internships and community training. A startup could be assessed on how it opened doors inside the organisation, too.

The timing was part of the idea. Young companies are still establishing routines. Recruitment, training and product decisions can become assumptions before anyone has written them down. Encouraging social mobility early asks founders to treat opportunity as an operating choice while those habits are being formed.

Hayat’s contribution to the discussion of diversity also included support for school prizes and university partnerships. These are specific routes into a field that can otherwise appear remote to a student. A career in security needs preparation; access to that preparation deserves attention of its own.

Still asking to be believed

At Callsign’s Identity First event in 2022, Hayat opened a programme that also featured Timnit Gebru and James Comey. The conversation had widened to digital trust and accountability. The underlying concern remained recognisable: what evidence allows people and institutions to deal with one another with confidence?

For Hayat, the route into that question ran through a bank hack, engineering, research and the practical frustrations of banking security. It led to investors, international offices and a company required to translate a technical judgement into something a customer could live with.

For the customer, the desired ending is wonderfully modest. Reach the account. Complete the task. Close the screen. A career spent on identity finds its everyday test in those few unremarkable moments, when the right person is believed and allowed to carry on.