Company profile · 4 min read
Candor: Context-rich DLP for insider-risk decisions
Candor connects data movement, user behavior and investigation context to help security teams detect and triage insider risk.
Cofounder of Lazyweb (a16z Speedrun). Previously grew subscriptions and built native ads at Duolingo. Writes First1000 (90,000+ subscribers).
Published · Updated
Candor is an agentic data-loss prevention and insider-risk platform for security teams that need to understand the story around a data movement event. It fits a fast-moving company where static rules create too many alerts and the real concern is what a person did, what they accessed and where the data went.
What it does
Candor’s current site describes AI agents that connect data movement with user behavior and surrounding activity. The product shows open cases, behavioral profiles and an investigation graph rather than a single alert stream. It says the system can detect sensitive transfers, investigate the timeline and surface the cases that warrant a human decision.
The differentiation is contextual triage. A USB copy, a paste to a public site or a file sent to a personal inbox can be benign in isolation. Candor’s thesis is that the security team should see the sequence, the person, the access level and the destination together. The site lists integrations across Google and Microsoft workspaces, Okta and Entra ID, endpoint tools, ServiceNow, Workday and SIEM providers.
Candor says most organizations can be live within a week, depending on cloud or on-premise deployment, and that its system reduced mean time to investigate by 80%. It also says inference runs on private, isolated infrastructure and customer data is not used to train models. These are vendor claims to validate during a security review, not independent performance or architecture findings.
Founder context and tradeoffs
The YC profile identifies Ansh Gupta and Aditya Iyengar as founders. Aditya’s public background includes FlutterFlow, Uber and NASA, while the company’s about page positions him as CEO and Ansh as CTO. The founders’ engineering context is relevant to the product’s attempt to replace brittle rule maintenance with an investigation workflow.
Pricing is not public. The buyer needs to clarify data residency, employee-notice requirements, retention, access to investigation evidence, model-change controls and what happens when the system misses a real insider event. “Less noise” is valuable only if the coverage boundary is visible.
Editorial take
I would shortlist Candor for a lean security team dealing with shadow AI, source-code movement or sensitive customer data and drowning in DLP alerts. I would start with one high-value data path and a reviewable case definition. The best outcome is a faster, better-supported decision—not a promise that the agent can replace security judgment.
Quick facts
| Field | Sourced detail |
|---|---|
| Product | AI-native DLP, insider-risk detection and investigation |
| Buyers | Security, insider-risk and data-protection teams |
| Integrations | Workspace, identity, endpoint, ITSM, HR and SIEM categories listed publicly |
| Public claims | One-week deployment and 80% MTTI reduction, company-reported |
| Pricing | Not publicly listed |
Sources checked
| Source | Checked |
|---|---|
| YC profile | 2026-09-19 |
| Candor homepage | 2026-09-19 |
| Candor about page | 2026-09-19 |
| Candor field notes | 2026-09-19 |
Cohort context
Candor is listed in Winter 2025. In our 2026-09-18 directory snapshot, 104 of 165 listed companies in that cohort have YC’s primary industry label B2B (63.0%). This is a current-directory comparison, not an original intake count or a performance ranking. Nine-cohort dataset.
Public website snapshot
Observed 2026-09-19T16:19:27.602Z in raw homepage HTML. This records visible metadata and advertised links, not agent execution or product quality.
| Signal | Homepage observation |
|---|---|
| Product description metadata | Observed |
| Canonical link | Observed |
| H1 or H2 heading | Observed |
| Typed structured data | Observed |
| Docs/developer link | Not observed in this response |
| Pricing link | Not observed in this response |
| llms.txt link | Not observed in this response |
| Markdown alternate | Not observed in this response |
Public observations · Collection method. Missing links here do not establish that a capability or file is absent elsewhere.
About the author
Cofounder of Lazyweb (a16z Speedrun). Previously grew subscriptions and built native ads at Duolingo. Writes First1000 (90,000+ subscribers).
I cofound Lazyweb and publish Mudpie. This is an owner-written publication, not an independent testing organization. Research notes distinguish observations, sourced reporting and editorial judgment.
First1000 ↗ · X ↗