Saryu Nayyar, CEO and Founder of Gurucul – Interview Series

Saryu Nayyar is an internationally recognized cybersecurity expert, author, speaker and member of the Forbes Technology Council. She has more than 15 years of experience in the information security, identity and access management, IT risk and compliance, and security risk management sectors.

She was named EY Entrepreneurial Winning Women in 2017. She has held leadership roles in security products and services strategy at Oracle, Simeio, Sun Microsystems, Vaau (acquired by Sun) and Disney. Saryu also spent several years in senior positions at the technology security and risk management practice of Ernst & Young.

Gurucul is a cybersecurity company that specializes in behavior-based security and risk analytics. Its platform leverages machine learning, AI, and big data to detect insider threats, account compromise, and advanced attacks across hybrid environments. Gurucul is known for its Unified Security and Risk Analytics Platform, which integrates SIEM, UEBA (User and Entity Behavior Analytics), XDR, and identity analytics to provide real-time threat detection and response. The company serves enterprises, governments, and MSSPs, aiming to reduce false positives and accelerate threat remediation through intelligent automation.

What inspired you to start Gurucul in 2010, and what problem were you aiming to solve in the cybersecurity landscape?

Gurucul was founded to help Security Operations and Insider Risk Management teams obtain clarity into the most critical cyber risks impacting their business. Since 2010 we’ve taken a behavioral and predictive analytics approach, rather than rules-based, which has generated over 4,000+ machine learning models that put user and entity anomalies into context across a variety of different attack and risk scenarios. We’ve built upon this as our foundation, moving from helping large Fortune 50 companies solve Insider Risk challenges, to helping companies gain radical clarity into ALL cyber risk. This is the promise of REVEAL, our unified and AI-Driven Data and Security Analytics platform. Now we’re building on our AI mission with a vision to deliver a Self-Driving Security Analytics platform, using Machine Learning as our foundation but now layering on Generative and Agentic AI capabilities across the entire threat lifecycle. The goal is for analysts and engineers to spend less time in the myriad in complexity and more time focused on meaningful work. Allowing machines to amplify the definition of their day-to-day activities.

Having worked in leadership roles at Oracle, Sun Microsystems, and Ernst & Young, what key lessons did you bring from those experiences into founding Gurucul?

My leadership experience at Oracle, Sun Microsystems, and Ernst & Young strengthened my ability to solve complex security challenges and provided me with an understanding of the challenges that Fortune 100 CEOs and CISOs face. Collectively, it allowed me to gain a front-row seat the technological and business challenges most security leaders face and inspired me to build solutions to bridge those gaps.

How does Gurucul’s REVEAL platform differentiate itself from traditional SIEM (Security Information and Event Management) solutions?

Legacy SIEM solutions depend on static, rule-based approaches that lead to excessive false positives, increased costs, and delayed detection and response. Our REVEAL platform is fully cloud-native and AI-driven, utilizing advanced machine learning, behavioral analytics, and dynamic risk scoring to detect and respond to threats in real time. Unlike traditional platforms, REVEAL continuously adapts to evolving threats and integrates across on-premises, cloud, and hybrid environments for comprehensive security coverage. Recognized as the ‘Most Visionary' SIEM solution in Gartner’s Magic Quadrant for three consecutive years, REVEAL redefines AI-driven SIEM with unmatched precision, speed, and visibility. Furthermore, SIEMs struggle with a data overload problem. They are too expensive to ingest everything needed for complete visibility and even if they do it just adds to the false positive problem. Gurucul understands this problem and it’s why we have a native and AI-driven Data Pipeline Management solution that filters non-critical data to low-cost storage, saving money, while retaining the ability to run federated search across all data. Analytics systems are a “garbage in, garbage out” situation. If the data coming in is bloated, unnecessary or incomplete then the output will not be accurate, actionable or ultimately trusted.

Can you explain how machine learning and behavioral analytics are used to detect threats in real time?

Our platform leverages over 4,000 machine learning models to continuously analyze all relevant datasets and identify anomalies and suspicious behaviors in real time. Unlike legacy security systems that rely on static rules, REVEAL uncovers threats as they emerge. The platform also utilizes User and Entity Behavior Analytics (UEBA) to establish baselines of normal user and entity behavior, detecting deviations that could indicate insider threats, compromised accounts, or malicious activity. This behavior is further contextualized by a big data engine that correlates, enriches and links security, network, IT, IoT, cloud, identity, business application data and both internal and external sourced threat intelligence. This informs a dynamic risk scoring engine that assigns real-time risk scores that help prioritize responses to critical threats. Together, these capabilities provide a comprehensive, AI-driven approach to real-time threat detection and response that set REVEAL apart from conventional security solutions.

How does Gurucul’s AI-driven approach help reduce false positives compared to conventional cybersecurity systems?

The REVEAL platform reduces false positives by leveraging AI-driven contextual analysis, behavioral insights, and machine learning to distinguish legitimate user activity from actual threats. Unlike conventional solutions, REVEAL refines its detection capabilities over time, improving accuracy while minimizing noise. Its UEBA detects deviations from baseline activity with high accuracy, allowing security teams to focus on legitimate security risks rather than being overwhelmed by false alarms. While Machine Learning is a foundational aspect, generative and agentic AI play a significant role in further appending context in natural language to help analysts understand exactly what is happening around an alert and even automate the response to said alerts.

What role does adversarial AI play in modern cybersecurity threats, and how does Gurucul combat these evolving risks?

First all we’re already seeing adversarial AI being applied to the lowest hanging fruit, the human vector and identity-based threats. This is why behavioral, and identity analytics are critical to being able to identify anomalous behaviors, put them into context and predict malicious behavior before it proliferates further. Furthermore, adversarial AI is the nail in the coffin for signature-based detection methods. Adversaries are using AI to evade these TTP defined detection rules, but again they can’t evade the behavioral based detections in the same way. SOC teams are not resourced adequately to continue to write rules to keep pace and will require a modern approach to threat detection, investigation and response. Behavior and context are the key ingredients.  Finally, platforms like REVEAL depend on a continuous feedback loop and we’re constantly applying AI to help us refine our detection models, recommend new models and inform new threat intelligence our entire ecosystem of customers can benefit from.

How does Gurucul’s risk-based scoring system improve security teams’ ability to prioritize threats?

Our platform's dynamic risk scoring system assigns real-time risk scores to users, entities, and actions based on observed behaviors and contextual insights. This enables security teams to prioritize critical threats, reducing response times and optimizing resources. By quantifying risk on a 0–100 scale, REVEAL ensures that organizations focus on the most pressing incidents rather than being overwhelmed by low-priority alerts. With a unified risk score spanning all enterprise data sources, security teams gain greater visibility and control, leading to faster, more informed decision-making.

In an age of increasing data breaches, how can AI-driven security solutions help organizations prevent insider threats?

Insider threats are an especially challenging security risk due to their subtle nature and the access that employees possess. REVEAL’s UEBA detects deviations from established behavioral baselines, identifying risky activities such as unauthorized data access, unusual login times, and privilege misuse. Dynamic risk scoring also continuously assesses behaviors in real time, assigning risk levels to prioritize the most pressing insider risks. These AI-driven capabilities enable security teams to proactively detect and mitigate insider threats before they escalate into breaches. Given the predictive nature of behavioral analytics Insider Risk Management is race against the clock. Insider Risk Management teams need to be able to respond and collaborate quickly, with privacy top-of-mind. Context again is critical here and appending behavioral deviations with context from identity systems, HR applications and all other relevant data sources gives these teams the ammunition to quickly build and defend a case of evidence so the business can respond and remediate before data exfiltration occurs.

How does Gurucul’s identity analytics solution enhance security compared to traditional IAM (identity and access management) tools?

Traditional IAM solutions focus on access control and authentication but lack the intelligence and visibility to detect compromised accounts or privilege abuse in real time. REVEAL goes beyond these limitations by leveraging AI-powered behavioral analytics to continuously assess user risk, dynamically adjust risk scores, and enforce adaptive access entitlements, minimizing misuse and illegitimate privileges. By integrating with existing IAM frameworks and enforcing least-privilege access, our solution enhances identity security and reduces the attack surface. The problem with IAM governance is identity system sprawl and the lack of interconnectedness between different identity systems. Gurucul gives teams a 360° view of their identity risks across all identity infrastructure. Now they can stop rubber stamping access but rather take risk-oriented approach to access policies. Furthermore, they can expedite the compliance aspect of IAM and demonstrate a continuous monitoring and fully holistic approach to access controls across the organization.

What are the key cybersecurity threats you foresee in the next five years, and how can AI help mitigate them?

Identity-based threats will continue to proliferate, because they have worked. Adversaries are going to double-down on gaining access by logging in either via compromising insiders or attacking identity infrastructure. Naturally insider threats will continue to be a key risk vector for many businesses, especially as shadow IT continues. Whether malicious or negligent, companies will increasingly need visibility into insider risk. Furthermore, AI will accelerate the variations of conventional TTPs, because adversaries know that is how they will be able to evade detections by doing so and it will be low cost for them to creative adaptive tactics, technics and protocols. Hence again why focusing on behavior in context and having detection systems capable of adapting just as fast will be crucial for the foreseeable future.

Thank you for the great interview, readers who wish to learn more should visit Gurucul. 

The post Saryu Nayyar, CEO and Founder of Gurucul – Interview Series appeared first on Unite.AI.