Rig Security

**Product and the problem it solves.** Rig Security addresses a specific failure in modern enterprise defense: organizations have many identity systems, cloud accounts, HR records, SaaS applications, endpoint tools, and security logs, but no continuously reconciled view of what each person, machine, service account, or AI agent can actually reach. The result is identity sprawl, orphaned accounts, excessive permissions, toxic combinations of access, and attack paths that cross boundaries owned by different teams. Rig presents itself as an end-to-end identity-protection platform rather than a single access-management feature. Its public product materials describe one living map for human, non-human, and AI identities, with the ability to correlate ownership, attributes, behavior, permissions, and cross-platform lateral movement. The concrete buyer problem is not simply discovering another account; it is helping a security team decide which identity path creates material risk, who owns it, what the blast radius is, and how to reduce that risk without accidentally breaking production operations.

**Core technology and how it works.** Rig says it connects through APIs to cloud, HR, IT, business, and security systems, including GitHub and Snowflake, while ingesting SIEM events and telemetry from tools such as Wiz and CrowdStrike. That architecture is important because it aims to enrich identity data with actual usage and threat context instead of treating a directory record or permission list as sufficient evidence. The platform's four publicly described functions are unified identity visibility and inventory, agentic identity-posture risk mitigation, AI-driven threat detection and response, and compliance or least-privilege enforcement. Its product blog describes an identity graph that can show every identity and dangerous access path, attribute ownership, model the impact of proposed fixes, and provide AI-assisted remediation. The company also describes near-real-time threat detection and runtime AI enforcement, but the public material does not disclose model architecture, training data, detection benchmarks, or whether remediation is deterministic policy automation, a human-approved workflow, or autonomous action in each deployment. Those implementation details are central diligence questions rather than assumptions.

**Market, customers, and go-to-market.** Rig sells into the enterprise identity-security and cloud-security market, where the buyer is likely a CISO, identity team, cloud-security team, or security-operations leader responsible for reducing access risk across a heterogeneous estate. The category spans identity governance and administration, identity-threat detection and response, cloud infrastructure entitlement management, privileged access, non-human identity security, and the newer problem of AI-agent governance. Rig's API-only positioning is a practical go-to-market choice: a customer can connect existing systems and create a unified view without replacing its identity provider or deploying a new inline network appliance. The official site includes an anonymous customer-style outcome statement about reducing manual investigation and safely adopting AI, but it does not identify that organization, disclose contract size, or publish a case study with independently measurable results. A public Information Security Media Group discussion placed CEO Guy Kozliner alongside a Delta Dental Plans Association CISO to discuss human and non-human identities, which demonstrates category engagement but should not be treated as proof that Delta Dental is a Rig customer. Public sources reviewed do not establish a named production customer list, pricing model, renewal rate, or sales cycle.

**Traction, funding, and third-party validation.** Rig was incorporated in Israel as RIG SECURITY LTD on October 13, 2024, according to a public company-registry record, and Dealroom lists an October 2024 launch date, Tel Aviv headquarters, and a 2-10 employee band. The company appears to be early and actively building its commercial footprint. It was listed among the startups selected for the 2025 AWS and CrowdStrike Cybersecurity Startup Accelerator, a program described by CrowdStrike as providing mentorship, technical support, and go-to-market guidance, with NVIDIA support. Crunchbase identifies True Ventures and the AWS/CrowdStrike accelerator among Rig's investors or backers, but public sources reviewed do not disclose an equity round amount, valuation, or cap table that can be treated as confirmed. Rig's official site shows investor or ecosystem marks without a detailed financing announcement. The Cybertech Global Tel Aviv 2026 catalog independently describes Rig as an AI-native identity-security company that unifies fragmented identity data into a living, actionable view. These are useful validation signals, but they are not substitutes for security efficacy benchmarks, named reference deployments, revenue evidence, or independently audited operating metrics.

**Founders and team background.** Rig's founder profile is a meaningful part of its thesis. Guy Kozliner is identified by the company as co-founder and CEO; his public biography describes prior work on the CTO team at Wiz, software-engineering experience at Cybereason, operating experience at FrontLife, and service as a commander in the Israeli Defense Force's Special Forces intelligence corps. Nissim Bitan is identified in Rig's founding article as co-founder and CTO, with prior engineering and cloud roles at Rookout, Firefly, Aqua Security, and Taboola, plus earlier service in the IDF Mamram technology unit. This pairing combines enterprise-security exposure, cloud architecture, and Israeli military technology experience relevant to identity and access problems. There is a small but important public-record discrepancy: Rig's current About page lists Nokky Goren as CTO, while the company's January 2026 founding article names Bitan as CTO. The most defensible record is therefore that Kozliner and Bitan are public co-founders, while current executive responsibilities and the broader engineering headcount require confirmation. Rig's team pedigree is credible, but the small disclosed employee band creates key-person and execution concentration risk.

**Competitive dynamics.** Rig competes in a crowded field where the product boundary is still moving. Okta and Microsoft Entra ID own major parts of the workforce-identity control plane and can extend native governance, risk, and AI-agent features to installed customers. CyberArk, SailPoint, and Saviynt compete from privileged-access and identity-governance positions, while Israeli specialists such as Astrix Security and Hush Security focus on non-human identities, machine credentials, and secretless access. NewCore is pursuing a security-first identity architecture for humans, machines, and AI agents; Offroad uses agentic investigation and remediation for identity risk; and Oak markets a unified identity operating system for the agentic enterprise. Rig's plausible edge is the combination of a living identity graph, cross-platform attack-path context, AI-assisted remediation, and threat detection in one agentless integration layer. That edge is not yet proven as a durable moat: competitors make overlapping AI-native claims, incumbents have distribution and proprietary telemetry, and identity teams may prefer incremental controls over a new system of record. Rig will need to show lower time-to-value, better risk prioritization, safer remediation, and stronger visibility than point tools and bundled incumbent features.

**Defense, security, and resilience dual-use relevance.** Rig's core technology has credible dual-use relevance because identity compromise is a common pathway into enterprises, defense suppliers, government systems, and critical infrastructure, while machine and AI identities are increasingly embedded in the automation that operates those environments. A continuously reconciled identity graph can help defenders identify over-privileged service accounts, lateral-movement paths, stale contractor access, and autonomous agents with permissions that exceed their mission. Near-real-time detection and policy-based least-privilege enforcement are relevant to zero-trust programs, secure software factories, cloud-hosted mission support, and industrial or public-sector environments where access attribution and rapid revocation matter. The Israeli military and cloud-security backgrounds of the founders reinforce the team's potential fit for high-consequence security problems. The limitation is equally important: public sources reviewed do not document a military contract, classified deployment, government customer, security accreditation, or disconnected or sovereign operating mode. Rig is therefore dual-use through transferable defensive cyber capability and resilience value, not through a verified fielded defense product.

**Growth stage, trajectory, and key diligence risks.** Rig should be classified as early stage. Its incorporation and launch dates are recent, public employee data indicates a small team, and no disclosed financing amount, revenue, named customer, or independently measured product outcome was found in the sources reviewed. The accelerator selection and founder pedigree give it a credible starting position, while the identity-security market is large and strategically urgent as AI agents create more non-human principals and permissions. The trajectory will depend on converting a compelling map-and-remediate narrative into repeatable enterprise deployments. Priority diligence points are: (1) verify current leadership and the Bitan/Goren CTO discrepancy; (2) obtain customer references and quantify time-to-remediation, false-positive rates, and unsafe-change prevention; (3) understand how the identity graph handles incomplete ownership data, shadow identities, and rapidly changing agent permissions; (4) test whether API-only access is sufficient for response or whether customers need enforcement at runtime; (5) confirm security architecture, tenant isolation, data residency, and on-premises or sovereign options; (6) establish funding runway, hiring plan, and unit economics; and (7) assess whether Okta, Microsoft, CyberArk, NewCore, Hush, Offroad, and Oak can compress the product's differentiation. Rig is strategically interesting, but the evidence supports a monitored early-stage company rather than a proven category leader.