Loading
Loading
Phill Keaney-Bolland· Co-founder and Designer, Yaya2 min readWith Itzik Alvas (Opens in a new tab), Co-founder and CEO, Entro
Itzik was CISO of a large healthcare services company, and before that was responsible for the formal security of Microsoft Defender Cloud and Office 365. He had been on the receiving end of non-human identity breaches before the industry had settled on a name for them. That is a materially different starting position from studying a market and picking a gap.
Non-human identities are the credentials applications use to authenticate against resources, databases and infrastructure. They are now the second most frequent attack vector in cybersecurity. In a company of 1,000 people, that is roughly 144,000 credentials most security teams cannot see, track or manage.
Itzik ran 200 conversations with CISOs and practitioners before building. The interviews did two jobs at once. They confirmed the problem was real and widespread, and they created the relationships that produced Entro’s earliest customers, because the people who had spent an hour describing the problem were the people most motivated to see it solved.
Having made CISO buying decisions himself, Itzik has an unusually clear view of what changes when you move to the other side of the table. He talks through what that taught him about trust, budget cycles and how decisions actually get made, as opposed to how vendors imagine they get made.
Phill Keaney-Bolland
Co-founder and Designer, Yaya
Co-founder and designer at Yaya, and host of the Cult Products podcast. Fifteen years designing products, brands and UX across multiple industries before narrowing to cybersecurity, and lectures on design at Imperial. Works with cybersecurity founders on positioning, strategy and the website that has to carry a launch, across identity, cloud security, AI agents and software supply chain, including Twine out of stealth and Geordie AI, which won the RSA Innovation Sandbox in 2026.
Occasional, evidence-led notes on brand, messaging and websites for security startups. No spam. Unsubscribe any time.
One of the more contrarian points in the episode. Itzik argues for delivering something early and incomplete rather than waiting for a polished beta, because early design partners give you information that no amount of internal refinement will produce.
Every agent an organization deploys is another non-human identity requiring credentials. The direction of travel in AI expanded Entro’s problem space rather than threatening it.