This former Microsoft PM thinks she can unseat CyberArk in 18 months

The internet has a permissions problem — and it's getting worse. As non-humans like chatbots, AI agents, and automated systems multiply across the web, companies increasingly have to issue them credentials, assign permissions, and manage identities at scale. That shift is a big reason identity and access management startups — built to manage this new kind of digital workforce — are attracting major venture funding.

Now a 35-person Israeli-American startup called Venice is coming out of stealth with fresh capital and a bold message: it says it's already displacing established names like CyberArk and Okta inside Fortune 500 environments.

Venice, founded a little over two years ago, says it raised $20 million in Series A financing in December, led by IVP, with participation from Index Ventures, which led the company's earlier seed round.

While many heavily funded peers — including Persona (which raised a $200 million Series D last April), Veza (which closed a $108 million Series D last May), and GitGuardian SAS (which raised $50 million last week) — focus primarily on cloud-first approaches, Venice is going after both cloud-based and on-premises setups. That decision has made the product tougher to engineer, but it also positions Venice to appeal to large enterprises still operating legacy systems alongside modern cloud infrastructure.

Leading the company is 31-year-old Rotem Lurie, whose path to entrepreneurship checks nearly every box investors tend to like. Raised in Israel by two programmer parents (her mother was among the country's earliest female software engineers), Lurie spent four-and-a-half years as a lieutenant in Unit 8200, Israel's elite intelligence corps, before joining Microsoft as a product manager on what would later become Defender for Identity.

She then became the first product hire at Axis Security, an access management startup that Hewlett Packard Enterprise acquired for $500 million in 2022. Shortly before that acquisition wrapped up, Lurie left to join YL Ventures, a cybersecurity-focused venture firm.

That short stretch at YL Ventures directly shaped her thinking. "Every day, I used to meet a team of three 23-year-old boys," Lurie says plainly over a Zoom call. "Most of those companies build their technology to be acquired. The entire strategy around what problem you're solving and how you penetrate the market — it's a completely different approach."

If she wanted to take on entrenched leaders like CyberArk, which has long dominated the privileged access management category, Lurie concluded she'd need a longer-term play. That meant building technology that was deep and comprehensive enough to serve the messy, hybrid IT reality in most large enterprises.

Here was the technical puzzle, as Lurie describes it: identity and access management teams often juggle around 10 different tools to control who — and what — can access corporate systems. Venice's platform aims to collapse that sprawl into a single system that manages privileged access across on-premises servers, SaaS applications, and cloud infrastructure, covering both human users and non-human entities.

"Tying everything together was what mattered to customers the most," Lurie says. Venice runs a SaaS subscription model, but she insists the company isn't trying to win by underpricing everyone. "We reduce the cost, but it's not because we go cheap on pricing," she explains.

"It's because we spare all the overhead [associated with many of today's offerings], especially the professional services" — the consultant-heavy fees and long implementation cycles that have become close to unavoidable in enterprise security rollouts.

Lurie says the approach is working. She claims Venice is now "completely replacing" older vendors among Fortune 500 and Fortune 1000 customers — and shrinking deployment timelines to about a week-and-a-half, down from the more typical six months to two years, by using AI-powered automation. She declined to name customers publicly, but said off the record, they include a 170-year-old, publicly traded manufacturing giant and a global music conglomerate.

Cack Wilhelm, the IVP partner who led Venice's Series A, says Lurie's ambition stood out. "The problem with most cybersecurity pitches is everyone's tackling something too small ever to be material," Wilhelm says. "When you look at the massive exits — CrowdStrike, Palo Alto Networks — they were doing audacious things from the beginning. Rotem is the same."

Wilhelm points to the urgency created by AI agents as a key driver behind IVP's thesis. "If every individual is going to have tens of agents working on their behalf, and privileged access tools were built for a static world of IT professionals, we need our identity concept to adjust to that," Wilhelm said. "Very often, when [companies] are breached, they're breached by people simply logging in with someone else's credentials. You solve that with just-in-time permissions that are scoped to the individual and the moment."

Even in a crowded landscape, demand appears strong. Identity and access management spending was expected to exceed $24 billion in 2025, up 13% from the year before, according to the Identity Management Institute.

Venice's team is split between Israel, where R&D is based, and North America, where the go-to-market organisation operates. Notably, nearly half of the company's employees are women — still unusual in cybersecurity, one of tech's most persistently male-heavy sectors.

Lurie's co-founder, Or Vaknin, serves as CTO (he's pictured with Lurie, above). Investors include Assaf Rappaport, co-founder and CEO of Wiz, and Raaz Herzberg, Wiz's CMO and a former Microsoft colleague of Lurie's from their intern days.

For Lurie, who says she has often been "the only woman in the room," building a more balanced team wasn't a deliberate statement. "You can never see yourself doing something if you didn't see someone like you doing it," she says. "This is something that attracts other women — to feel like they can be part of it."

The question now is whether Venice's two-year head start — and its early Fortune 500 traction — will be enough as deep-pocketed competitors pursue the same enterprise buyers. Can the category support multiple winners? Or will identity management mirror other security markets and consolidate around one or two dominant players?