Elevate Security

About Elevate Security

Founded in 2017 by former Salesforce executives Robert Fly and Masha Sedova, Elevate Security carved a niche in the cybersecurity market by focusing on human risk management. The founders brought extensive experience to the venture; Fly had built and matured security programs at both Salesforce and Microsoft, while Sedova led the security engagement team at Salesforce, concentrating on improving the security mindset of stakeholders. Their shared experience at Salesforce, where they witnessed firsthand the challenges of user-generated incidents, inspired them to create a platform that could tailor security measures to individual behaviors. A significant milestone for the company was its acquisition by Mimecast, an email and collaboration security company, in January 2024, a move intended to integrate Elevate's human risk analytics into Mimecast's broader security portfolio.

Elevate Security's business model centers on a SaaS platform that provides enterprises with visibility into employee-related security vulnerabilities. The company posits that a small fraction of a workforce, specifically 8%, is responsible for 80% of security incidents. The platform ingests and analyzes data from a wide array of existing security tools—such as identity platforms, email gateways, and endpoint management solutions—to generate a unique risk score for each user. This data-driven approach allows organizations to move beyond generic, one-size-fits-all security training. Revenue is generated through subscriptions to this platform, which serves clients in sectors like financial services, technology, and healthcare.

The core product is a human risk management platform that identifies, categorizes, and provides tools to mitigate risks associated with employee behavior. It uses behavioral science and a precision risk-scoring algorithm to pinpoint high-risk individuals. Instead of solely relying on traditional awareness training, the platform enables security teams to automate responses and enforce tailored security controls based on an individual's risk profile. For example, it can enforce conditional access policies, accelerate incident response by providing context on user risk, and automate protective controls for the most vulnerable employees. This allows security teams to create targeted interventions and measure behavior change, effectively turning employees into a line of defense.