Why we are building this
A short, honest account of the thesis, the company and the person behind it. No mission statement.
The thesis
Between October 2024 and September 2026, essentially every company built to solve non-human identity was acquired into a larger platform. Astrix went to Cisco, Oasis to Cyera, Entro to SailPoint, Natoma to Snowflake, Permiso to Okta, SGNL to CrowdStrike, and CyberArk — which owns Venafi — to Palo Alto Networks.
Most people read that as a category dying. We read it differently. The acquirers had perfect information about their own customers’ buying behaviour, and they paid substantial premiums. What died was not the problem. What died was the independent mid-market product, because every acquirer sells from roughly $50,000 a year upward, to the Fortune 500 CISO, through channel partners who will not carry anything cheaper.
So a 600-person company with four years of accumulated SaaS integrations and nobody who owns them is now, in a very literal sense, unserved. Not because the tooling is hard to build, but because nobody profitable is trying to reach them.
Second: the arrival of AI agents did not create this problem, it industrialised it. In every documented agent incident of 2025 and 2026 the credential was correctly issued and correctly scoped. What was missing was the ability to say afterwards who was accountable. That is the thing we are building.
Founder
Akshay Dubey
Founder & Chief Executive Officer
Ten years across enterprise go-to-market and operating roles: Sales Director at Simplia Inc., a US SaaS company; GTM Architect at WebCraft IT; Google Ads consultant at Cognizant; and Client Technical Associate at Dell Technologies. Also founded an FMCG business and served as COO of a luxury retail brand — operating experience rather than security experience, and useful for different reasons.
Education: B.Com from DAVV University. AI for Business specialisation from the Wharton School, University of Pennsylvania. AI Foundations for Business Professionals from Saïd Business School, University of Oxford.
Before this product, built and sold an ISO/IEC 42001 implementation toolkit through iso42001toolkit.com, which has earned $5,426 from five customers with no paid acquisition.
Every role and qualification above is checkable: LinkedIn. If anything here does not match, tell us at hello@humanaudit.ai and we will correct it.
What I am not
I am not a security researcher. I have no CVEs, no intelligence-service background and no CISO tenure, and I am not going to imply otherwise on a website read by people who would spot it immediately.
What I do have is ten years of finding out what enterprise buyers actually have budget for, a working knowledge of the compliance frameworks this problem touches, and a demonstrated ability to build something specific and sell it without a marketing budget. The engineering depth this product eventually needs is a gap I am actively hiring against rather than pretending to fill.
Hiring: founding engineer
Backend and integrations, ideally someone who has shipped OAuth integrations against enterprise APIs and cares about doing security infrastructure properly. Bangalore, Pune or remote. Co-founder-level equity for the right person. Get in touch.
Company facts
| Legal entity | HumanAudit Inc., a Delaware C-Corporation |
| Founded | January 2026 |
| Team | One founder, currently hiring a founding engineer |
| Funding | Bootstrapped. No institutional investment to date. |
| Revenue to date | $5,426 from five customers, on a separate ISO/IEC 42001 toolkit product |
| Customers for this product | None yet. Design partners are being onboarded now. |
| Registered office | 1111B S Governors Ave, STE 47918, Dover, DE 19904, United States |
| Certifications | None held. See security. |
| Research | NHI Governance — owned and funded by HumanAudit, and labelled as such |
| Contact | hello@humanaudit.ai · security: security@humanaudit.ai |
Where this goes
The scan is the beginning, not the product. The record it produces becomes useful in proportion to how long you keep it: ownership at a point in time is a fact that decays, and the value is in being able to answer “who owned this in March?” in September.
After that, the sequence is dictated by which identity classes keep arriving rather than by what demonstrates well: SaaS OAuth applications first, because everyone already has them; then CI/CD and pipeline identities; then cloud IAM; then agent identities and the MCP servers they connect through.
The longer-term view, stated as the hypothesis it currently is: if software continues taking consequential actions on delegated human authority, then every one of those actions will eventually need a human it can be traced back to — not for security, for liability. If that turns out to be right, the accountability record stops being a security artefact and becomes something closer to a general ledger for machine action. We are a long way from proving that, and we are not going to pretend otherwise.
The fastest way to understand this is to see your own data
Twenty minutes, read-only, and you keep the report.