Pathfounders Live: With Richa Kaul, Founder & CEO of Complyance

0:00Mike Butcher:So tonight we're joined by Richa Kaul, who's founder and CEO of Compliance with a Y, Compliance with a Y, not with an I, which is an AI-native governance risk and compliance platform that recently raised a$20 million Series A led by Google Ventures. Richa describes herself as a data privacy nut, perhaps the kind of person who will ask you if you have locked your phone down properly, switched on your two-factor authentication, all that kind of thing. I jest, but she actually appears to have stumbled upon her startup journey with this sort of idea about journeying from this idea. And the best way to actually protect consumer data is to help secure the enterprises that hold that world's data.

0:49Mike Butcher:And that became compliance, software that uses AI agents to help companies continuously monitor risk, compliance, and third-party vendors, etc., turning what used to take weeks or months into something much closer to real time. And dare say in a few years' time, there'll be compliance people on the street asking for some spare change after her startup. So tonight, we're going to talk to her about her founder journey, how she spotted the opportunity, why AI has suddenly pushed risk and compliance front and center into the boardroom, and the clever strategy that she used to raise funding and the big question hanging over the software industry right now is SAS dead or is it being rebuilt around AI agents Richard welcome to past founders

1:38Mike Butcher:the privacy setting at parties is it a true story it is a very true story and not just at parties I will go around and ask my friends and family if their privacy configurations on their phone are up to par all the time. Right. You definitely are that person then. I am that person. Marvelous. You must be a riot at parties. I am. I am. I think it's good for everyone to be a little bit safer. That's all. That's all. That's where this all kind of started. It's a good conversation opener, that's for sure. Yeah. I'm not sure. Some people are a little startled when I tell them to go to settings on their phone and open microphone and look at which apps they have microphone on for.

2:15but if you do it, you will be surprised. It'll only take you a couple seconds, and you'll be more secure for it.

2:21Mike Butcher:I think people are actually starting to do that. I've just seen somebody do that. I'm just saying. You want to know why you get ads about things you talk about? It's because your microphone is on for a bunch of apps that you didn't know. So are you saying that rumor about Facebook and listening to you all the time is true? Just look at your phone. You will see it. Your microphone is turned on. Why is it turned on? Mark, we love you, wherever you are. Turn that off. Turn it all off. It's literally all on. And for what? So it's actually a real tip. Do the same thing with camera. I feel I actually can just leave now because that's all that I actually wanted to do here, everybody, is let you all know that one thing.

2:57Mike Butcher:We don't want you to leave right now. We want to continue the podcast. And so what happened to you? Did you have this sort of little kind of idea about privacy? Because tell us a little bit about your personal story, you know, what you've been doing. Tell us a little more. Yeah, I'm happy to. And, you know, it's funny. I think it really was a personal start to compliance with a why. One of my very good friends was part of a really big data breach that happened. It was the Equifax breach, which happened now a number of years ago. Some of you may remember it. At that time, it was big news because, obviously, there weren't as many data breaches as there are today.

3:40Today, I feel like that type of breach may not even hit you guys, hit your newsfeeds, because there's breaches all the time. But it was the first really big breach that happened that made a lot of people kind of feel concerned that their data was not necessarily being kept as safely as they would want it to be. And there's no breach shaming here, as I like to say. It happens. If you have the right security policies in place, there's still things that can happen. but I think it was the human impact of it that really got me. One of my very close friends had their identity stolen because of that breach, and it made me kind of think about, you know, why is it that this can happen?

4:19Like, how is it that we as consumers are, you know, almost required to trust so many companies with our data every day? Just think about it. You would have to be a hermit to actually not give your data out all the time. But that data is so valuable, and, you know, The breach of it has such an impact on each of us. And I started thinking about it as the best way. Again, I began by saying, okay, I'm going to get my stuff in order. I'm going to get my configurations ready. I'm going to get about my passwords, do all of this stuff. Then I started telling my friends. You kind of get to a point where you realize that the most efficient way to protect consumers is actually to help protect the companies who hold the world's data.

5:01And that is literally how compliance with the Y was born.

5:05Mike Butcher:So also you were chief strategy officer at ContractPod AI and you worked at McKinsey. Lots of McKinsey-ites become entrepreneurs, I've noticed. And so did the problem pull you into entrepreneurship or had you always wanted to become a founder yourself anyway? I literally did not ever think I was going to be a founder. Up until two months before I started the company, I did not think I would have become a founder. It was really a pull from solving a problem. It was really an analysis of a market. And honestly, a little bit. It was something where I knew I was passionate about the problem, and it felt like something that I could never do.

5:47And that was intriguing to me. I kind of felt like I'm young, and I should try to do something that I don't think I can do. And it worked. Right.

5:59Mike Butcher:So for people in the room who are not GRC governance risk compliance experts, let's hear what compliance with a Y is in plain English. What does it do? Yes. First, I want to say compliance gets such a bad rep. Not compliance with a Y, compliance with an I. Everyone thinks it's boring, but I just am here to say compliance is cool. Compliance is sexy. You just have to figure out why it matters. We actually went through a period many years ago on a title I was on where we came up with Sass is Sexy. That's more believable, I think. Yes, I know. It didn't quite land, but anyway. My point is that compliance is really what enables us to trust the world around us.

6:43If you think about what GRC teams do every day, they are basically focused on creating trust with their organization's customers and protecting their organization. And that's really what it comes down to. They think about all of the different standards that they have to comply with to make sure that their customers can trust them. That can be security standards like SOC 2, like GDPR. They think about the risks that are posed to their organization and how they can mitigate those risks so that we can trust them with our data. They think about the policies they have to put into place to make sure that their teams actually stay aligned to those different rules and controls.

7:22and at the end of the day, you know, that makes us be able to trust them and it protects them.

7:28Mike Butcher:So give us a picture of how it's done at the moment and what the radical change is going on right now because of the rise of AI. Absolutely. Let me give you an example and something that I think we can all kind of relate to. I don't know how many of you all have been in an audit before, any type of audit, right? But if you, you know, we all have kind of been maybe around some type of audit before, had to be pulled in, asked for some type of evidence or something. If you think about what compliance used to be, it used to be point-in-time checks of your data to check if you're compliant. So what that means is, you might say, okay, I want to make sure that every employee has antivirus installed.

8:08Okay, well, what are you going to do about that? You're actually, in the way that it used to work, you would go around and say, I'm going to check 10 out of my 1 ,000 employees, and if they have it, that's good. That's a sample size. I'm fine with that. They're checking 10 out of 1 ,000 at one day in one month of one year. And that's how compliance used to run. You kind of set these policies. You have to trust that everyone followed them. And there was no way to do enough follow through. Just thinking of that one example, which is just one tiny part of compliance, what we do now with agents is complete and continuous monitoring.

8:44We're always making sure that, yes, you're not being exposed to risk because everyone in your organization has antivirus turned on and they have these other configurations on as well. And that's what basically automation plus AI actually enables us to do every day. It gives you visibility where you had none and it gives you risk reduction where before you were really exposed.

9:06Mike Butcher:And how is this moving into sort of the agentic era as well? Yeah, absolutely. So let's think about one more example. One of the biggest risks to enterprises right now is their third-party vendors. So again, we talked about breaches. As a company, you trust your vendors to keep your enterprise's data safe. Well, you can't really monitor them all the time. They're not your internal environment. You have no idea what's going on over there. But AI agents can do a lot of that. So we have AI agents that monitor third-party risk. So they can basically go in, they make sure to ask the vendors the right questions, they continuously monitor those vendors.

9:43any sign of risk, they flag it to you so that you can reconsider what data you're sharing with that vendor, how much you want to share with them, how you're going to interact with them if you want to work with them. And that's fully agentic before you had no coverage on that.

9:59Mike Butcher:Okay. I mean, but can these vendors spoof things in some way? Is it almost like a sort of cyber war scenario where they're trying to come back with, you know, spoof the agent into believing it's everything's fine. There's no one agent to spoof in that way. Like the agent is kind of omnipresent, I suppose, looking at hundreds of data sources, thousands, millions of sources of data at one time. So there is no one way to spoof it. You're covering all bases, basically. Now, what about this aspect about AI surfacing the kinds of risks that perhaps companies weren't previously aware of? You said that AI has brought risk and compliance to the boardroom.

10:45Mike Butcher:What is going on there? So I think the first thing I'll say is that AI has made risk and compliance a language of everybody. I think that before, again, unless you're involved in an audit or have worked within an organization, that's gone through a number of audits, you may not have quite understood what is risk management? Why do I need to care about this? But I think what's happened with AI is that we all more implicitly understand the risks of sharing our data with a company. We put in a lot of information into ChatGPT and Claude. I know I do. I'm sure you all do too. My friends tell me they use it for taxes.

11:24They use it for health. They vent. There's a lot of information. relationships relationships I mean you you give you put so much of your personal data in and I think for the first time we're all kind of realizing like oh my god this is really personal people are telling me they're upgrading to paid subscriptions so that they can have more protections like these things are becoming the language of everybody whereas before I feel like they were almost niche points so just right off the bat we've kind of all become more equipped to speak in the language of risk. The second thing I'll say is that before you have, again, sample testing that raises risks across the environment and you rely on people raising the risk or your sample testing catching the risk.

12:10What's happening now is that you have full visibility as a default. So you're not spending your time sampling or searching for risk. You're spending your time addressing risk. And that risk visibility is surfacing the things and you decide what to raise to your board but before you had no no visibility and now all of a sudden you can see and you're spending your time being like look we need to deal with these problems. Not spending your time saying I think we're okay these are some potential issues that we might have and boards prefer that.

12:40Mike Butcher:Is that leading to some kind of heads being blown off moments with some of the companies you speak to going, oh my god, we had no idea what was going on? I do think so in some cases, yes. I think there are a lot of companies out there who can kind of, I think, benefit a lot from the risk that they can see now and they can close them before they become vulnerabilities, which is really the main goal of all this. I mean, is the size of the market must be running into billions, I guess? Billions and billions and billions, yes. The market is huge and it's growing. Every company, every company in the world has risk.

13:18And they're now getting to a point where every company has compliance needs as well. And so, yes, it's a huge market. It's a good space to be in.

13:26Mike Butcher:And I think, is it changing companies in how they deal with it in terms of governance? Are they forming special kind of departments now as a result of this? Or what's going on? They have had departments already for it. Sure, but I mean, different things? Yeah, those departments are often thought of as the people who nag us. It's almost like GRC people always feel very, like they owe the rest of the company because they feel bad because they're always chasing you for something, signing your policy, doing your security training. And so I'm sure you've all been on the receiving end of it. So I think GRC people often feel a bit like, oh, no, we're being annoying to our organization.

14:06But now with AI, they're spending less time doing that because the agents are doing so much of that manual work, which relieves the work for the business owners as well as the GRC team. And now they can feel more elevated in the org. They're having more strategic conversations. So I think they're getting elevated in a way that they just were not before.

14:23Mike Butcher:And is it changing the companies themselves in how employees behave? Is it, I don't know, heightening awareness in some way? So interesting you bring that up because I think we may be seeing the opposite a bit. A lot of companies are using shadow AI right now. It's a very big problem. What that means is employees, I am certainly guilty of it as I'm up here on my high horse talking about this. I'm so guilty of this. I use a couple of AI tools that I know are not necessarily going through the company's norm. I don't put confidential information in them, but I'm using them. I'm sure we're all using tools as well.

15:02And you kind of create a web of shadow AI that's happening. Because your employees, especially at large orgs, you can't control everything that they're doing in terms of their software.

15:13Mike Butcher:You mean they're putting stuff that's going on inside the company into their personal Claude account? To do a better job, right? They're doing it for efficiency. And they want to get a raise. They're doing it, maybe, yes, exactly. But they're doing it because sometimes their organization hasn't caught up yet. They haven't yet signed up for enterprise AI tools or something like that. And so they're feeling hungry. They want the benefit. And so they're kind of setting up accounts and they're doing some of these things. And at more mature companies, there's kind of security configurations on the endpoints.

15:42But, you know, at a mid-sized company, maybe not. And so you're getting kind of the shadow AI network that's happening, which is a huge risk, by the way.

15:51Mike Butcher:Is that something you probably, how can you have visibility into that? It's really, really hard. That's actually where you have to rely more on training, more on awareness. And as I like to say, you know, REI agents allow GRC teams to do some of that stuff because they no longer have to chase everybody for policy signing. So, yeah. Let's get into your journey as an entrepreneur. Now, you didn't just raise a Series A led by Google Ventures out of the box. Tell us a bit about how you got there first. Yes. Very luckily, I would say. So I think one thing is we've been very lucky to have a preemptive seed round and a preemptive series A round, which means that the investors came to us and we didn't have to pitch.

16:35So I haven't made a pitch deck in a long time, which is a really nice thing.

16:39Mike Butcher:A lot of entrepreneurs have been quite flabbergasted at that. I know, I know. And it's a very different model. Absolutely. It's a very, very different model. And I'm happy to talk about a little bit more. But that's the that's the quick story of it. Well, no, I think you're going to have to tell us now because this is a secret a lot of people would like to understand. Yeah. Okay. I think some of my friends asked me this, so I'm going to try to break it down the way that I like to share it with my friends. I think it goes back to whenever I'm thinking about the business, whenever I'm thinking about investments, I'm often thinking about what are the incentives for the person on the other side of the table.

17:19And a lot of it is based on that. And so if you think about earlier stage investors, of course, of course, of course, their incentive is to invest in a company that skyrockets and does great. Don't get me wrong, we all are aware of that. But there's also something at earlier stage where it's about the vibe, right? I'm gonna use a Gen Z phrase that I learned recently. It's like aura. It's like, you know, it's your aura. So if you're an investor, and I know there's some in the room, so maybe you can tell me if I'm right or wrong. as an investor, you also want to get the ins to the companies that no one else got the ins into, right?

17:55You want to have access to the founders and to the information that no one else got. Okay. Well, that's something that's in our control as founders. We can control that. We can control the supply of information out into the investor market and make sure that we can win on some of those incentives. So the investors kind of network out there is a grapevine. You tell someone something, I feel like everyone kind of knows it. And it's good. You know, they're sharing information. That's great for them. But we are founders and we need to protect ourselves and our businesses. So the way I see it is that there's a lot out there that you can't control.

18:32You can't control when an investor has just raised a fund, how much they want to deploy, what their theses are. You just you can't control that as much as we want to. But you can control some things. You can control your aura and therefore the aura that you kind of transitively pass on to the investor when they invest in you. So let's make it really practical. I don't share data about the company with anybody. I don't answer investor emails. When I do, I say, hey, and I'll give you guys the exact word I use. I always say, you know, I'm really underwater right now or I'm really heads down right now and I'll message you when I'm coming up for air.

19:07That's just what I say. I don't give any other information. I don't take any meetings. And what that does is that no one really knows any of the specifics about us out there. They just kind of know that we're not talking to anyone. And then when someone really interesting comes knocking, that person gets the information after a period of relationship building, which I'll get into in a minute. But when they get the information, they know that no one else knows it because the VC community is like so intertwined. Because now you're a black box. Now you're a black box. And they're the ones who got access.

19:38And that's already a win now for you, right? Now that's something that you've controlled in the dynamic between you and this VC. You've not given your information to anyone. When you start speaking with them, don't, I mean, this is one person's opinion. I won't say it, but I would say don't go in with the data room prepped and ready for them. That's not how you win on relationship. Go in and understand, you know, they owe you as much is you owe them. Why did you come to me? Why are you interested? What's your thesis? Why do you think that we're going to win? Ask them the questions. It's an even playing field.

20:13And by doing that, there is just more buy-in that gets developed. You build a relationship. Then you share your numbers and your data once you have also gained the trust and they have gained your trust. And I think that that really changes the dynamic. Way too many founders I know are doing, it's an entire job to just do VC meetings. And they have their data room ready to go. They have their pitch deck ready to go. Why? Why? You have a business to build. Focus on that. I feel very privileged saying all of this, by the way, but it's my personal advice and it's worked for me now for two funding rounds.