This former Microsoft PM thinks she can unseat CyberArk in 18 months

The internet today has a permissions problem. As non-humans — chatbots, AI agents, and automated systems — have proliferated on the web, so has the need to provide them with credentials, permissions, and identities. That’s one major reason identity and access management startups that help manage this new kind of digital workforce are raking in venture capital.

Now, a 35-person Israeli-American startup called Venice is emerging from stealth with fresh cash and a plucky claim: that it’s already replacing industry stalwarts like CyberArk and Okta at Fortune 500 companies.

Venice, founded just over two years ago, says it raised $20 million in Series A funding in December, led by IVP, with participation from Index Ventures, which led its earlier seed round.

Unlike many of its well-funded rivals — which include Persona (raised a $200 million Series D last April), Veza (closed a $108 million Series D last May), and GitGuardian SAS (raised $50 million last week) — Venice is tackling both cloud-based and on-premises environments, a technical choice that has made the product harder to build but positioned it to win over the large enterprises still running legacy systems alongside modern cloud infrastructure.

At its helm sits 31-year-old Rotem Lurie, whose path to entrepreneurship pretty much ticks every box on VCs’ checklists. The daughter of two programmer parents in Israel (her mother was one of the country’s first female software engineers), Lurie spent four-and-a-half years as a lieutenant in Unit 8200, Israel’s elite intelligence corps, before joining Microsoft as a product manager working on what would become Defender for Identity.

She later became the first product hire at Axis Security, an access management startup that sold to Hewlett Packard Enterprise for $500 million in 2022. Just before that acquisition closed, Lurie left to join YL Ventures, a cybersecurity-focused venture firm.

That brief stint at YL Ventures proved particularly instructive. “Every day, I used to meet a team of three 23-year-old boys,” Lurie says straightforwardly over a Zoom call. “Most of those companies build their technology to be acquired. The entire strategy around what problem you’re solving and how you penetrate the market — it’s a completely different approach.”

To replace incumbents like CyberArk, which has long dominated the privileged access management market, Lurie realized she’d need to play a longer game. That meant building technology that’s both deep and comprehensive enough to support the complex, hybrid IT environments of most large enterprises.

The technical challenge ahead of Lurie went thus: Most identity and access management teams juggle roughly 10 different tools to manage who and what has access to corporate systems. Venice’s platform consolidates that sprawl into a single system that handles privileged access across on-premises servers, SaaS applications, and cloud infrastructure for humans and non-human entities alike.

“Tying everything together was what mattered to customers the most,” Lurie says. Indeed, Venice operates a SaaS subscription model, but Lurie insists it isn’t competing on price. “We reduce the cost, but it’s not because we go cheap on pricing,” she explains.

“It’s because we spare all the overhead [associated with many of today’s offerings], especially the professional services” — the consultant fees and lengthy implementations that have become an almost unavoidable tax for enterprise security deployments.

The bet appears to be paying off. Lurie says Venice is now “completely replacing” legacy vendors at Fortune 500 and Fortune 1000 customers, and cutting implementation time to just a week-and-a-half, from the typical six months to two years, thanks to AI-powered automation. While she declined to name customers on the record, she told TechCrunch off the record that they include a 170-year-old, publicly traded manufacturing giant as well as a global music conglomerate.

Cack Wilhelm, the partner at IVP who led Venice’s Series A, says Lurie stood out. “The problem with most cybersecurity pitches is everyone’s tackling something too small to ever be material,” Wilhelm says. “When you look at the massive exits — CrowdStrike, Palo Alto Networks — they were doing audacious things from the beginning. Rotem is the same.”

Wilhelm points to the urgency created by AI agents as a key factor driving IVP’s investment thesis. “If every individual is going to have tens of agents working on their behalf, and privileged access tools were built for a static world of IT professionals, we need our identity concept to adjust to that,” Wilhelm said. “Very often, when [companies] are breached, they’re breached by people simply logging in with someone else’s credentials. You solve that with just-in-time permissions that are scoped to the individual and the moment.”

Though crowded, the market seems eager for new solutions. Identity and access management spending was expected to exceed $24 billion in 2025, increasing by 13% from a year earlier, according to an industry group called Identity Management Institute.

Venice’s team is split between Israel, where R&D is based, and North America, where the go-to-market team operates. Notably, nearly half of the cybersecurity company is women, a rarity in one of tech’s most stubbornly male-dominated sectors.

Lurie’s co-founder, Or Vaknin, serves as CTO (he’s pictured with Lurie, above). The company’s investors include Assaf Rappaport, co-founder and CEO of Wiz, and Raaz Herzberg, CMO at Wiz and Lurie’s former colleague from their days as interns at Microsoft.

For Lurie, who says she has spent much of her career as “the only woman in the room,” creating a more balanced team wasn’t a calculated act. “You can never see yourself doing something if you didn’t see someone like you doing it,” she says. “This is something that attracts other women — to feel like they can be part of it.”

The question now is whether Venice’s two-year head start and early Fortune 500 wins will be enough to fend off deep-pocketed competitors as they chase the same enterprise buyers. Can the market support multiple winners? Or, will identity management follow the path of other security categories and consolidate around one or two dominant players?