The former Microsoft PM believes she can oust CyberArk within 18 months

Today’s Internet has a permissions problem. As nonhumans—chatbots, AI agents, and automated systems—proliferate on the Internet, so has the need to provide them with credentials, permissions, and identities. This is one of the main reasons why identity and access management startups, which help manage this new type of digital workforce, are raising venture capital.

Now, a 35-person Israeli-American startup called Venezia is emerging from obscurity with new money and a bold claim: that it is already replacing industry stalwarts like CyberArk and Okta at Fortune 500 companies.

Venice, founded just over two years ago, says it raised $20 million in Series A funding in December, led by IVP, with participation from Index Ventures, which led its previous seed round.

Unlike many of its well-funded competitors — including Persona (which raised a $200 million Series D last April), Veza (which closed a $108 million Series D last May), and GitGuardian SAS (which raised $50 million last week) — Venice handles both cloud-based and on-premises environments, a technology choice that has made building the product more difficult but has positioned it to win over larger companies that still run legacy systems alongside modern cloud infrastructure.

It’s headed by 31-year-old Rotem Lurie, whose path to entrepreneurship ticks all the boxes on venture capital checklists. Lori, the daughter of programmer parents in Israel (her mother was one of the country’s first software engineers), spent four and a half years as a lieutenant in Unit 8200, Israel’s elite intelligence corps, before joining Microsoft as a product manager working on what later became Identity Defender.

She later became the first producer to be hired at Axis Security, an access management startup that was sold to Hewlett Packard Enterprise for $500 million in 2022. Just before that acquisition closed, Lori left to join YL Ventures, a venture firm focused on cybersecurity.

That short stint at YL Ventures proved particularly beneficial. “Every day, I would meet with a team of three 23-year-olds,” Lowry says live over a Zoom call. “Most of these companies build their own technology to be acquired. The whole strategy is around the problem you solve and how you penetrate the market — it’s a completely different approach.”

To replace incumbents like CyberArk, which had long dominated the privileged access management market, Lori knew she would need to play a longer game. This means building technology deep and comprehensive enough to support the complex, hybrid IT environments of most large organizations.

The technical challenge facing Lurie was this: Most identity and access management teams use approximately 10 different tools to manage who and who has access to company systems. The Venice platform consolidates this extension into a single system that handles privileged access across on-premises servers, SaaS applications, and cloud infrastructure for humans and non-human entities alike.

“Tying everything together was what mattered most to customers,” says Lowry. In fact, Venice operates a SaaS subscription model, but Lowry insists it doesn’t compete on price. “We are lowering costs, but not because we are lowering prices,” she explains.

“That’s because we save all the overhead [associated with many of today’s offerings]especially professional services” – consultant fees and lengthy implementation processes have become an almost unavoidable tax for enterprise security deployments.

And the bet seems to be paying off. Lurie says Venice is now “completely replacing” legacy vendors at Fortune 500 and Fortune 1000 clients, cutting implementation time to just a week and a half, from a typical six months to two years, thanks to AI-powered automation. Although she declined to name the clients signed up, she informally told TechCrunch that they included a publicly traded 170-year-old manufacturing giant as well as a global music conglomerate.

Lowry stood out, says Cack Wilhelm, a partner at IVP who led the Series A in Venice. “The problem with most cybersecurity shows is that everyone is dealing with something that is too small to be physical at all,” Wilhelm says. “When you look at the huge exits — CrowdStrike, Palo Alto Networks — they were doing bold things from the beginning. Rotem is the same.”

Wilhelm points to the urgency created by AI agents as a key factor driving IVP’s investment thesis. “If each individual has dozens of agents working on their behalf, and privileged access tools are designed for a fixed world of IT professionals, then we need our concept of identity to adapt to that,” Wilhelm said. “Often, when [companies] It was hacked, hacked by people who simply logged in using someone else’s credentials. You can solve this problem with just-in-time permissions that fit the individual and the moment.”

Despite its congestion, the market seems eager to find new solutions. Spending on identity and access management is expected to exceed $24 billion in 2025, an increase of 13% from the previous year, according to an industry group called the Identity Management Institute.

The rifle team is split between Israel, where the R&D is based, and North America, where the go-to-market team operates. Notably, nearly half of cybersecurity companies are female, which is a rarity in one of the most male-dominated technology sectors.

Lurie’s co-founder, Or Vaknin, serves as CTO (he’s pictured with Lurie, above). The company’s investors include Assaf Rappaport, co-founder and CEO of Wiz, and Raaz Herzberg, CMO of Wiz and a former colleague of Lurie from their days as interns at Microsoft.

For Lori, who says she’s spent much of her career as “the only woman in the room,” creating a more balanced team wasn’t a calculated act. “You can never see yourself doing something if you don’t see someone like you doing it,” she says. “This is something that attracts other women — to feel like they can be a part of it.”

The question now is whether Venice’s start two years ago and its early wins in the Fortune 500 will be enough to stave off deep-pocketed rivals as they chase the same institutional buyers. Can the market support multiple winners? Or will identity management follow the path of other security categories and consolidate around one or two dominant players?