S12 E2: Pukar Hamal, SecurityPal AI

Speaker A: The first version of the product was basically me behind an email address and some automation that I had built out using tools like Airtable and Google Apps Script and Google Sheets. It was a uh, very early, very basic tool because what I wanted to nail was I wanted to nail the customer experience because you can spend tons of time and money just like validating an idea, but unless it delivers value and really gives the customers what they want, and what our customers wanted was they were about to close a really large enterprise. But these due diligence forms that were just getting in the way of that deal closing with all these questions about their security compliance risk and all this other posture. And these are seemingly complex questions that actually have a very straightforward answer if you just know where to look. My name is Pukar Hamal and I'm the founder and CEO of Security Pal AI.

Speaker B: This is Code Story, a podcast bringing you interviews with tech visionaries.

Speaker A: Six months moonlighting, nothing on the back end.

Speaker B: Who share what it takes to change an industry.

Speaker A: I don't exactly know what to do next. So many goes to get right.

Speaker B: Who built the teams that have their back.

Speaker A: The company is its people. The teams help each other achieve it.

Speaker B: Most proud of our team keeping scalability top of mind.

Speaker A: All that infrastructure was up there. Yes, we've been fighting it as we grow. Total waste of time.

Speaker B: The stories you don't read in the headlines.

Speaker A: It's not an easy thing to achieve.

Speaker B: My took it off the shelf and

Speaker A: dusted it off and tried it again

Speaker B: to ride the ups and downs of the startup life.

Speaker A: You need to really want it. It's not just about technology.

Speaker B: All this and m on Code Story. I'm your host Noah Labhart and today how Pukar Humal is making your customer assurance 100 times faster, enabling you to navigate the terrain with an all in one platform. Pukar Humal was born in 1991 and is originally from Kathmandu, Nepal. He grew up with no plumbing and no electricity prior to moving to the States to grow up in Queensland. Eventually he moved to the Bay area to attend Stanford and fell in love with the area and the forward thinking culture. But outside of tech, he's been married for a few years. He enjoys listening to podcasts about tech, finance and economics along with playing tennis every now and again. In his past venture, Pukar was on the one yard line from making a deal for his company. Before it could close, his team was hit with a security due diligence questionnaire that halted the process. Having that experience drove him to build something to speed up the Execution and experience of customer assurance. This is the creation story of Security Pal AI.

Speaker A: My path to building Security Pal AI is perhaps like a little bit different than maybe some of the other other folks. I didn't really set out to build a company. I think I always wanted to do it, but it always felt like a far fetched dream, almost an impossibility in some ways especially to like uh, a relatively successful one. I can say at least we've gotten to some level of success here at Security Pal AI. When I was at my previous company, we were really close to closing a really large deal with a large enterprise and it was going to change the trajectory of that company. And as we were about to go for signature and close the deal, we got hit with a really large security due diligence questionnaire. 200 pages of questions about our security posture, security controls, compliance, all these things. And it absolutely just put the deal dead on its tracks and just crushed it and crushed a lot of the momentum that the business had. And that was really my first introduction to this idea of hey, if you're trying to sell your product to customers, it's great if you have built a great product and it's great that they want to use that and they want to buy and they have budget. But unless you can get through this due diligence, the security due diligence which has become oh so important today, especially because of the sensitivity around data, unless you can get through that hurdle, you're not going to close deals and you're certainly not going to win the trust of the customer that you're going to be working with. And so that really led me down this path of just wow, like why, why do companies ask all these questions? What do they want to know? How are startups even supposed to comply with a lot of these onerous requirements? And so that was really like the spark that forced me to double click in the space. And In March of 2020 I decided to go full time on the company because there was a friend of mine who was building a company and they were getting hit with a lot of these security questionnaires and security reviews. And I basically told them, hey, listen, just hire me as a contractor, I'll fill. And what I wanted to do is I wanted to figure out what the right UX was, user experience, customer experience was. And I quickly realized that the ability to turn these around really quickly and answer them in a high quality manner with a little bit of research and due diligence, you could actually greatly reduce the amount of time it Takes for this company and a lot of companies to actually respond to these security questionnaires, due diligence requests during the last mile of the commercial transaction. That customer gave me the chance, ended up executing really well for them. And then we were able to quickly sell to uh, companies like airtable, Figma and now we work with some of the leading brands in the world. Fortune 500s and P500 companies, Global 2000 enterprises, companies like OpenAI and others as well. Started out of the corner of my apartment like literally during the onset of the pandemic. And now we have three offices, one in San Francisco, one in New York. And then we have a large center of excellence, global capability center that we built out in Capitol and do Nepal, which is my birthplace. And one of the insights I had was there's just a tremendous amount of hidden talent in the, nestled amongst the Himalayas there. And a, uh, lot of these folks are tier one, top tier cybersecurity, ethical hackers, security consultants that work with some of the best companies but just weren't known that well. And so being able to build a team out there and to, to uh, accelerate commercial transactions for some of the best companies in the world, that's been really meaningful. And so we have a team of about almost 200 people there. We have a team about 15, 20 people in the US uh and so we continue to march forward at scale. And so yeah, and another thing I'm like really passionate about is actually bringing, I think Silicon Valley is one of the greatest things ever. Just the ecosystem and the community that Silicon Valley has, it's so rare, it's so hard to replicate. So many places I've tried and now there's all these like silicon, there's like Silicon Sands in San Diego, there's a Silicon beach and I guess I think that's Santa Monica. Uh, there's all these like different like hubs that are being built out. And I wanted to establish Kathmandu. And at least the region against the Himalayas is Silicon Peaks, because you've got some of the highest and tallest mountains in that region, including Mount Everest. And that was. So that inspired me to actually coin the term Silicon Peaks by the domain SiliconPeaks.com and we're championing a lot of the talent in that region as well. And now there's 5 to 10 US publicly traded companies that actually have a global capability center there. It's right next in between Bangalore and Singapore and just a lot of the up and coming regions there. And so really excited about that.

Speaker B: Foreign, let's dive into what you would consider the MVP for security pal. AI. So that first version of the product you built, how long did it take to build and what sort of tools were you using to bring it to life?

Speaker A: The first version of the product was basically me behind an email address and some automation that I had built out using tools like Airtable and Google Apps Script and Google Sheets. And it was very, uh, early, very basic tool because what I wanted to nail was I wanted to nail the, the ux, the, the customer experience because you can spend tons of time and money just like validating an idea, but unless, until it, unless it delivers value and really gives the customers what they want. And what our customers wanted was they were about to close a really large enterprise. All things were lined up but this, these forms, these due, uh, diligence for these security questionnaires, due diligence forms that were just getting in the way of that deal, closing with all these questions about their security compliance risk and all this other posture. And these are seemingly complex questions that actually have a very straightforward answer if you just know where to look and how to design the right answer and with the right set of policies and stuff. And so what we effectively did was we ended up, it was just me in the beginning. Like companies would send an email to conciergeecuritypalleyspeed.com it would feel like automation to them, but it was just me being the ventriloquist in the back on that and just routing it, managing it on airtable, managing it on some of the Google Sheets flows, and then routing the completed document back to the customer and to them. It felt like magic. It was like, oh, like here I send a 300 question questionnaire, Excel sheet to this email and I wake up the next day and it comes back and that's magical experience. And so then it just became, okay, how do we scale that? But in the beginning I would stay up all night to do this stuff

Speaker B: from that point, right? It was just you early on. Maybe it's not just you, but it's, it's that solution early on. I'm curious about how you progressed it and matured it from that point. And to wrap in a box a little bit, you know what I'm kind of getting at is how did you build your roadmap? How did you go about deciding that, okay, this is the next most important thing to build or to address with security pal.

Speaker A: AI cliche to say this now, but just first principles. The first principle number one was like, get revenue in the door. Because I was Bootstrapped. I didn't have venture financing. I was using my own savings to fund this business and had had to pay for rent, had to pay for food, and so had to optimize for those things. And so in the beginning, like, it was just a matter of figuring out, okay, how can I run this business in a way that actually generates money, generates capital that I can like, bring into the business, and then I'll figure out a way to hire and scale from there. And in terms of roadmaping, it was really just a matter of, okay, what we need to do is we need to get revenue and we need to like, scale. And so the next set of things we need to figure out is, okay, I can't stay up all night for all the customers that we're closing. How do we hire another person, train them up like me to use the internal tools that we've built and then bring another person on? Bring another person on. That was basically what it ended up being. And then beyond that, beyond on, on the sort of like technical side of the roadmap. And then it just became a matter of asking customers, hey, what are you looking for? Customers wanted more transparency. They wanted like an Uber, like experience for you. Like an Uber, you know exactly where, how far your ride is, when it's coming, details. And so our customers wanted that level of transparency when they sent the documents to us. They wanted to know the status of it, where it is, what's going on, what level of the of completion is it at? Is it a 50%, 40%, 80%, 90%. Now we consistently get like 95, 99% completion on most of these assessments, whether quality checks are being done properly, like a lot of these things, like, it was a matter of delivering to customers what they wanted. I think it's make something people want is very easy to say, but actually understanding what they want is much harder because a lot of times users don't know what they want. If I had asked customers what they wanted in the beginning, a lot of them would have said they wanted. They would want a tool to like, make it easy to fill it out. But really what customers wanted was they just wanted the documents to be done. And so you have to be, have that ability to understand, like, okay, like, what is. Like the continue to double click and figure out what is it ultimately that the question that the customer wants, wants transparency. So find a way to build that into the roadmap. The customer wants like, understanding and clarity around quality metrics and other things. They want some level of predictability. As well. And so these are all things that, that we worked on and to solve for it at the very beginning.

Speaker B: So you're saying we. And you know, in your description of the company, you describe the team and areas of the team. I'm curious how you built that team, what you look for in those people to indicate that they were the winning horses to join you.

Speaker A: Building a team is like one of the hardest things you'll do when building a startup. Because it's just, it's all a matter of building a startup. You're trying to will this idea into existence. And it's a, it's. I don't, I don't want to compare it to Warren, stuff like that, other people compared to Wall. But in some ways you're trying to build a team to like to go to battle with, right? To somebody to fight alongside you, uh, because you're trying to go after an underserved market. There's competition, there's big players. So like, you have to, like, you have to be willing to, how do you say, you have to be willing to like, interview tons of people and understand folks, motivation, why they're joining and all these other things. And so the fundamental sort of idea here for me in terms of building the team was, okay, how do I find somebody who's actually motivated by the work? Because I'm not going to be able to pay them a lot, I'm not going to be able to like, do much here, but I need to find somebody that's motivated by the actual work and contributions. I ended up looking to my alma mater, Stanford for some new grads there. Ended up looking into my network to hire our first like salesperson. And then for the team that I built out in Nepal, it really went through some trusted folks to, to build out an initial team there. And we were able to do like a pretty good job of, of that. And it's required lots of conversations, it required trust, it required going into the network, referrals, always make the best hires. And so those are. That, uh, that's the path that I went down to, to build that initial team.

Speaker B: Let's talk about scalability, right? And this is an important piece of, you know, what you're building and how you're processing this information and you know, the types of folks you're working with. I'm curious how you approach scale in the beginning. And I know in the very beginning, you know, scale wasn't a thing. It was more like, how do, how do we do this and prove that it works? But I'M curious about past that point, how you thought about scale and if there's been interesting areas where you've had to fight it as you've grown.

Speaker A: Yeah, in some ways, like we're in the middle of scaling right now and what the challenge today is like how do you scale the company without, without ballooning the costs? Right. We are venture backed, but we're not raising any more venture capital. So like we have to operate off of the cash flows that we have. And so we have these like hard constraints, which I think is great. It forces a lot of creativity when you have these hard constraints. So we're trying to get really creative. Regards. Okay, like how do we, like how do we deliver for 3x the number of customers, 5x the number of customers, 10x the number of customers over the next 12, uh, to 18 months. How do we do that with our existing team? And a lot of the questions we're asking is how do we decompose a lot of the steps and deconstruct them and then, and then try to build them back up in the right way by leveraging things like AI, by using a lot of the internal tools that we have access to and then of course like the rearranging, uh, the orgs and the talent structure within the company to effectively be able to be more aerodynamic in this environment, to move faster while also not adding tons of complexity. So like those are the things that we're like thinking about all day, every day. And uh, there's no easy answers. But I think one thing that you can certainly do is if you think backwards from what is the value that you're trying to deliver to the customer fundamentally and then how do we continue to maintain that value and how do we deliver that value in fewer steps and how do we remove steps, how do we embed again AI, how do we embed faster processes, more scalable processes? Those are some of the things that we're looking at.

Speaker B: So as you step out on the balcony, you look across all that you've built thus far, what are you most proud of with security pal?

Speaker A: The thing that I'm most proud of is just the ability to help some of our customers scale really rapidly in really complex markets. Made me really proud to see figma go public. Makes me really proud to see all the success that like OpenAI is having companies, uh, like airtable, other companies that we work with. Just when customers win, we feel like we're winning. Right. I think if you can teach yourself, if you can, if the dopamine reward function for your company is fundamentally driven by customers, your customers succeeding and their happiness then greatly like increases the chance of success, doesn't guarantee it, but it certainly like greatly increases the chance that you're like doing the right things, so to speak. And for me I'm really proud of the uh, of what we've helped our customers do and the customer and the customers that we have a chance to work with. Beyond that, I'm really proud of the team that we've built and the leaders that I've had the really awesome pleasure working alongside our GM and the leader in Nepal who runs our sort of largest operation there. Our go to market customer leaders, people, uh, leaders here on the US side. Engineering team. We really started out as a, as more of a services business in the beginning and then being able to evolve that like slowly and methodically into a true AI uh technology company with a full fledged engineering team, engineering roadmap and lots of cutting edge tools that are used by some of the most advanced companies in the world world that makes me like incredibly uh, excited. And then of course surviving like multiple like changes. Right. Navigating the terrain of uh, Covid as an early stage bootstrap company and then the great sash crash of 2022 and then the sort of upheaval that's caused by AI today. Right. Like we've found a way to really adapt to this changing environment and position ourselves to be maximally successful in all of these like environments. And that is something that I'm truly proud of and I'm really excited by.

Speaker B: Let's flip the script a little bit. Tell me about a mistake you made and how you and your team responded to it.

Speaker A: One thing that we've like just been so thoughtful of now is effectively like ensuring that we are bringing the right leaders in the business. I'm a huge fan of Keith Roboy's Are you ammunition or are you a barrel? There's some folks that are ammunition. They can just go and execute and they're great but they're. But what you really need to scale is you need barrels and you need barrels that are like 100% aligned with you. And through, through some trial and error and hiring like the. We've hired some folks that weren't quite like the right fit for us. Right. And so being able to truly step back and put ourselves in a position where we can be incredibly thoughtful about the leaders that we bring in the business. I think for any CEO, the job of the CEO is one make sure the company doesn't run out of Money. Right. Especially at a startup. Right. So that's like the number one job for me. And two, make sure that we have the right leadership team to go execute the plan. Those end up being like the most important things. Obviously having a plan, having a vision, that's important as well. But assuming that you have that, assuming you have a great vision, you have a great strategic plan, then it all becomes about having the capital and having the right team. I think we've done a great job with capital management, especially for somebody that's only raised around one round of funding. Getting to a place of financial sustainability has been huge for us. But I think the biggest sort of like lessons all come from not hiring the right leader for the right role. And we've just been much more thoughtful about making sure that we're the right person in the right leadership roles today.

Speaker B: I'm curious about what the future looks like for Security Pal. AI so for the product, for the company, what you see in the industry. Tell me about all the things, the

Speaker A: way that the world is evolving. Right. The way that we see the future of Security Pal is what we really see is we're in the middle of a pretty epic tug of war between nation states and companies. Nation states are fairly new, right. It was not too long ago that the concept of a country actually became like a thing. Right. It was the treaty Westphalia in 1648 that actually established a modern definition of a country as 500 years, right. That this has really been around and companies have become incredibly powerful. Right? Companies today are trillion dollar behemoths, global Enterprises and the Mag 7, Mag 9, these, these top 10 companies, they're more powerful than most of the countries around the world. And part of the reason why they've become so powerful is because historically it was countries that nation states that actually were stewards of data and stewards of information. But with the Internet, more and more information and data is actually routed through companies and through private enterprise. What's happening today is you basically have this epic tug of war where companies, um, are the stewards of data. And so thus they have great leverage in the game. But countries want to reassert dominance right in that relationship. And so they're trying to effectively create rules and regulations to take back control, wrestle that control. And that has ended up in, in the manifestation and creation of all of these really complex cybersecurity and data laws that control like where data is stored, where data is kept, how it's processed, how it's shared back and forth, how it's transported from One place to another. You know, there's a uh, GDPR in Europe. There's lots of like different rules and regulations across the different states that we have. In the US many countries have their own jurisdictions and uh, as well and data regulations. There's actually 160 jurisdictions, countries that building their own data protection, data privacy laws. And this is really an attempt of the nation state to reassert control against companies. But what that effectively means is it obviously creates an enormous barrier for commercial transactions, right? And for every commercial uh, transaction today, data is definitely at stake, right? You're using the Internet, you're transferring data back and forth and that creates these onerous requirements that companies have to comply with. And companies are required to assess their vendors, to assess anybody that partner with, you know, because they're obligated by law, laws, rules, regulations, and then companies must comply with all these like laws, rules and regulations. There is this entire sort of what we call, to call like a global assurance super cycle that we're living in the midst of. And nobody's talking about it, right? Everyone talks about software eating the world. Obviously AI is accelerating it, but there's this hidden trend which is just like there are more speed bumps and points of friction during the commercial transaction today than ever before. More things to respond to, more evidence, evidence to prove out, more things to comply with and that this, this sort of urgency and for assurance really to assure customers that their data is in safe hands, to assure governments that they're good stewards of data. And then of course to make sure that you do a good job of assessing the vendors and partners that you're bringing on. This assurance work is really goes way beyond just like the questionnaires that we started out doing. So in terms of the future roadmap, it's like how do we become the assurance management platform? It's not just about security questionnaires, right? It's not just about filling out these forms when you're selling a deal. It's also about the flip side, which is like, how do we help companies assess vendors really quickly? It's also about trust center management. It's also about audits and new regulations that are coming out in all these different jurisdictions. So helping companies navigate each and every step along the way definitely creates just a tremendous amount of like surface area for us to go and attack. And so we think there's just going to be so much demand for our services and we're seeing it proven out by the accelerated growth that we're experiencing over the past year as we head into 2026. And so I'm just like really thrilled about the prospect of just doing, of being in the space. And we think it's so critical because fundamentally we don't want commercial transactions to slow down because we believe that the more commercial transactions, the faster the commercial transactions, the more innovation there is because companies and companies can try different, different tools, different products, people can innovate, people can iterate much faster. Technology is all about like how quickly do you do, uh, you run into an insight and then execute against that insight. And the slower the commercial transaction, it just, it just slows down the amount of insights that you can generate. It slows down the amount of activity in the system. Right? It's almost, it's almost like lowering the temperature on, just like this, on all this energy in the ecosystem. And what we want to do is we want to maintain that momentum and we really want to be the company that becomes that sort of accelerant to re, accelerate commercial transactions. And so we like to say we're on a mission to accelerate GDP growth by helping organizations deliver greater security assurance and through superior security assurance. That's our fundamental mission as a company, right? To accelerate GDP growth by solving complex security assurance challenges for both buyers and sellers. And so we are, we're very passionate about, about that.

Speaker B: Let's switch to you Pukar, who influences the way that you work. A person or many persons are something you look up to and why.

Speaker A: I'm deeply influenced by leaders like Jeff Bezos, Warren Buffett, Elon Musk. I'm influenced by, by uh, some of my mentors. Right. This is incredible entrepreneur Iman Abzaid from Incredible Health, who's a huge inspiration to me, the unicorn health care company. And I'm also just influenced by a lot of, a lot of leaders that have just struggled, struggled for a long period of time to will like their version of the world into existence. Like folks like Nelson Mandela and others that have just, and to myself in some ways, hey, like we're trying to will this, this into existence. In many ways this is the reality is unless we can find a way to re, accelerate commercial transactions, we're not going to have the incredible prop, we're not going to witness the incredible progress that we witnessed over the last uh, century. And we really see it as one of our core responsibilities to help our companies, the companies that we work with, to be able to do that much faster. And, and then of course I'm really inspired by the entrepreneurs that I get to meet and collaborate with in Silicon Peaks. And Kathmandu. In many ways, they have way fewer resources than what I'm fortunate to have in Silicon Valley, building this type of team and company. And so to watch founders and entrepreneurs in that ecosystem, um, build meaningful businesses with far fewer resources, it's is always inspiring.

Speaker B: Last question, Bukar. So you're getting on a plane and you're sitting next to a young entrepreneur who's built the next big thing. They're jazzed about it. They can't wait to show it off to the world. And can't we show it off to you right there on the plane? What advice do you give that person, having gone down this road a bit?

Speaker A: There's no such thing as being too close to the customer. Like, how close of a relationship can you build with the customer? There's no such thing as being too close. Keep driving yourself closer to your customers and really trying to understand what are they trying to accomplish and what are they trying to do and observing them and researching them and their needs and trying to deeply understand, like, what is the end goal that they're driving towards. Listening isn't just about what they're saying. Listening is truly about understanding what they're trying to drive towards. What is the ultimate goal that they're trying to drive towards? It's just, uh, almost maniacal customer obsession. It would be like my, my biggest, it would be the first thing I would share. The second thing is it's not about the technology, it's not about any of that. The fundamental thing to get right as team. If you have incredible customer obsession and if you have the right team, I think you can accomplish anything in B2B.

Speaker B: I think that's fantastic advice. Staying close to the customer. Well, Pukar, thank you for being on the show today and thank you for telling the creation story of security pal AI.

Speaker A: Thank you so much. Thank you for having me. It was a wonderful conversation.

Speaker B: And this concludes another chapter of Code Story. Code Story is hosted and produced by Noah Lamphart. Be sure to subscribe on Apple Podcasts, Spotify or the podcasting app at your choice. And when you get a chance, leave us a review. Both things help us out tremendously. And thanks again for listening.

Speaker A: There's nothing like the American Express Platinum card. Find out your welcome offer after you apply, which could be as high as 175,000 points. Learn more and find out your offer@americanexpress.com explorer Platinum. Um, terms apply.

Speaker C: Capital One's tech team isn't just talking about multi agentic AI. They already deployed one. It's called Chat concierge and it's simplifying car shopping using self reflection and layered reasoning with live API checks. It doesn't just help buyers find a car they love, it helps schedule a test drive, get pre approved for financing and estimate trade in value. Advanced, intuitive and deployed. That's how they stack. That's technology at Capital One.