Rahul Tyagi, a co-founder of Safe Security, describes a path from university curiosity to building a company focused on quantifying cyber risk. He discusses how the business moved from training to services and then products, how he plans demanding days across time zones, and why founders must keep learning without becoming a bottleneck as the team grows.
Rahul’s entry into cybersecurity began at university, where curiosity led him to explore the institution’s online platform. After the activity was detected, the chancellor offered him an opportunity to work with the development team alongside his studies. That response helped him see security as a professional field rather than simply an outlet for experimentation.
Saket Modi and Vidit Baxi started the organisation that became Safe Security, and Rahul joined about six months later. The company first delivered training, moved into services, and eventually became a product business. Rahul’s responsibilities included developing Safe Me, a mobile-first approach to security awareness, as well as taking on different functions as the company evolved.
Safe Security’s product direction grew from problems the founders observed while serving customers. Security controls for people, processes, and technology were often managed in silos, making a consolidated view difficult. Organisations also tended to respond after an attack rather than predict where risk was developing.
A third gap concerned business context. Boards, chief financial officers, and other nontechnical stakeholders needed a clear way to understand security posture and the value of investment. Rahul compares this with checking a phone’s battery percentage: the number is easy for anyone to interpret, while the security of the same device is usually described through a list of tools rather than a quantified answer.
Cyber-risk quantification became the company’s way to create a common language across the organisation. The goal was to help technical and business leaders discuss posture, priorities, and budgets through an understandable view rather than disconnected reports.
Rahul begins the day with family, often over tea, coffee, or a walk, because later hours are filled by work across geographies. He catches up on current events and follows a range of content beyond cybersecurity, including interviews and commentary that stimulate useful questions.
The working day is split broadly between India-focused calls earlier and global-team discussions later. Rahul describes entrepreneurship as a long-term commitment that can require 12 to 15 hours on demanding days. To avoid beginning in uncertainty, he chooses the next day’s five most important tasks before going to sleep. The practice is also encouraged within the company: the end of one day includes preparation for the next.
Rahul summarises early entrepreneurship as needing skills from “chapati to CEO.” A founder may have to understand tasks from basic office operations through a board meeting. His own role shifted from audit and training to services and marketing as the organisation’s needs changed.
That breadth cannot remain the operating model forever. As the company grew to around 180 people, specialist team members took on responsibilities and often brought stronger skills than the founders. Knowing a function helps a founder make decisions, but scaling requires giving capable people room to lead it.
Rahul encourages cybersecurity founders to view other companies as contributors to a large market rather than enemies. The more useful competition is with the team’s own ambitious goal. He also stresses choosing work that can sustain genuine interest; long hours are difficult to carry when the field itself feels like a burden.
Mistakes are expected, but repetition is not. A new mistake can produce a lesson, while making the same mistake again suggests that the lesson was not applied. The people around a founder also matter. Customers were among Safe Security’s most important mentors because many product capabilities came from listening closely to what users needed.
Culture supports all of this. Rahul describes one-to-one conversations with team members and using their feedback to revise policies and processes. In his view, ego may force one-time compliance, but it cannot build durable commitment.
