Presented by RSAC

For two decades, the RSAC Innovation Sandbox contest has been the industry’s most reliable crystal ball. With over $50.1 billion in investments and more than 100 acquisitions across its alumni, the contest has an extraordinary track record of spotting cybersecurity’s future leaders before the rest of the world knows their names.

The contest’s track record also offers a story of generational innovation that speaks for itself, says Cecilia Marinier, vice president of innovation and scholars at RSAC.

“We see one founder buying another founder buying another founder,” Marinier says. “Think about the amount of accumulated knowledge, and how powerful it is to continue to build on such solid foundations.”

It’s a pattern that repeats throughout the Sandbox’s alumni network. Last year, Donnchadh Casey and James White, CEOs of Calypso AI sold their company to F5, whose current Chief Product Officer is Kunal Anand. Anand was on the RSAC 2016 Innovation Sandbox stage as co-founder of Prevoty. His company was bought by Imperva, which was the winner of the contest in 2007. It’s all resulted in a tight-knit cycle of founders, operators, and acquirers that continues to shape the cybersecurity ecosystem.

Oliver Friedrichs, currently GM of CrowdStrike appeared on the Innovation Sandbox stage twice, winning in 2016 with Phantom, which was acquired by Splunk. He then returned as a 2023 finalist with Pangea, which was later acquired by CrowdStrike. Ali Golshan, a 2017 finalist with StackRox, went on to sell Gretel AI to Nvidia. Rehan Jalil, the 2020 winner who brought Securiti AI to the stage, saw his company acquired by Veeam for $2.7 billion.

“That’s with a B,” Marinier notes, underscoring the scale of value emerging from the Sandbox alumni network. “Those numbers also speak for themselves.”

See the 2026 RSAC top 10 finalists live on stage

This year’s Top Ten finalists take the stage at Moscone Center in San Francisco on Monday, March 23, each delivering a three-minute pitch to a panel of seasoned industry judges. The lineup reads like a map of enterprise security’s most urgent pressure points in 2026: agentic AI governance, non-human identity management, social engineering defense, supply chain provenance, and AI-native code security, among others.

Finalists include:

• Charm Security: uses its agentic AI workforce to targets scams and human-centric fraud

• Clearly AI: helps teams ship secure software fast by replacing manual work with AI-powered reviews

• Crash Override: embeds in CI/CD to capture build execution data that APIs can’t access

• Fig Security: finds and fixes broken security flows across the entire SecOps stack

• Geordie AI: a security and governance platform purpose-built for AI agents

• Glide Identity: verifies users instantly and securely—without passwords or SMS codes

• Humanix: designed to stop social engineering attacks by detecting and responding to attacks on people

• Realm Labs: enables enterprises to see inside the AI’s “brain” and monitor its thoughts during inference

• Token Security: focused on governing AI agents and machine identities at enterprise scale

• ZeroPath: replaces traditional SAST, SCA, and secrets scanning with a single AI-native engine capable of detecting complex business logic flaws.

“The most disruptive technology right now is obviously AI, and it’s bringing with it some brand-new security challenges that are being developed at the same rate that AI is evolving,” Marinier says. “Our finalists are bringing cutting-edge solutions for tackling those problems and beating those nefarious actors.”

Agentic AI, in particular, emerged as a dominant theme this cycle.

“Governance for AI, continuous monitoring, automation, SecOps resilience, everything from threat modeling to how to use agentic AI, and then controlling against agentic AI getting into systems, it’s all there in our top 10,” she says. “It’s the call to action to today and tomorrow’s security leaders.”

Who selects the winners, and why it matters

One of the less-discussed secrets behind the Sandbox’s track record is the rigor of its judging panel. This year’s panel includes:

• Nasrin Rezai, SVP & CISO at Verizon

• Larry Feinsmith, head of global technology strategy at JPMorganChase

• David Chen, head of global technology investment banking at Morgan Stanley

• Paul Kocher, cryptographer and entrepreneur

• Niloofar Razi, operating partner at Capitol Meridian Partners

“We’re very careful about how we put together the panel,” Marinier explains. “They have to represent a variety of perspectives, including an eye for startups that are likely to have positive trajectories. They’re top leaders in the industry, who are able to recognize the companies that have risen above the noise.”

Critically, RSAC itself plays no role in the selection, she adds.

“The judges select these companies,” she says. “They have for the past 20 years, and they will be going into the future.” That independence, she argues, is a core reason why the contest carries such weight with the industry.

The $5 million investment for the future of finalists

Beginning in 2025, as part of the contest’s 20th anniversary, all 10 finalists receive a $5 million investment in the form of a SAFE note, funded by Crosspoint Capital. It’s still early days for measuring the full impact, but Marinier points to the trajectory of ProjectDiscovery, last year’s winner.

Funding launched ProjectDiscovery from a hopeful startup to a company with enough traction to hire industry professionals with experience and know-how, who wouldn’t have previously considered an early-stage startup. Not only did they have the funds, they had the recognition, and they were able to attract great talent because they’re obviously going somewhere.

“The money is ultimately about extending the runway,” Marinier adds. “The SAFE note gives finalists breathing room to scale infrastructure and capitalize on the visibility the contest generates, before the spotlight fades.”

RSAC’s broader innovation ecosystem

The Innovation Sandbox contest is the flagship, but it’s the centerpiece of a significantly larger innovation infrastructure that Marinier has built over the past decade. In that time, RSAC’s innovation programming has touched more than 1,000 companies across multiple programs.

Launch Pad, now in its sixth year, functions as the Sandbox’s “little brother,” a Shark Tank-style forum where earlier-stage companies receive real feedback from judges without a winner being declared, though some of those companies are already starting to “graduate” to the next level of industry success. The Early Stage Expo, featuring 78 companies this year, gives attendees a window into what’s coming down the pipeline, sitting alongside the conference’s 600 main exhibitors.

The Innovation Showcase runs year-round, not just during conference week, with live Q&A sessions between entrepreneurs and audiences that are then carried into RSAC’s new membership platform, an effort to sustain connections across the full year, not just the five days in San Francisco.

There’s also a dedicated track for investors and entrepreneurs, featuring VCs sharing forward-looking perspectives, sessions on fundraising strategy, and design partnership frameworks. And for the next generation, RSAC’s Security Scholars program selects 60 students from universities across the country, with 22 presenting research posters on Wednesday of conference week.

“The security scholars are presenting their research that could lead to nascent technology,” Marinier says. “They’re in theearly phase, working their way up the ladder. One day they’ll make it onto our stages, and after that, the world’s their oyster.”

Why RSAC Conference is unmissable

For anyone serious about the future of cybersecurity, whether you’re a CISO, a founder, an investor, or an engineer, Marinier makes the case plainly.

“Building a safer society requires bold ideas, and new technologies, and real-world solutions,” she says. “RSAC Conference is bringing together some the newest, the smartest, the most innovative security perspectives in the industry for critical conversations about solving the security problems the world faces.”

The RSAC Innovation Sandbox contest kicks off at Moscone Center on Monday, March 23 at 9:30 AM PT. Winners will be announced by approximately noon the same day.

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

Perplexity, the AI-powered search company valued at $20 billion, announced on Wednesday at its inaugural Ask 2026 developer conference that its multi-model AI agent, Computer, is now available to enterprise customers — a move that transforms the three-year-old startup from a consumer search disruptor into a direct competitor to Microsoft, Salesforce, and the legacy enterprise software stack that underpins corporate America.

The enterprise launch arrives barely two weeks after Computer debuted for consumers, where it triggered what the company describes as a viral moment: users on social media demonstrated the agent building Bloomberg Terminal-style financial dashboards, replacing six-figure marketing tool stacks in a single weekend, and automating workflows that previously required dedicated teams. Perplexity says more than 100 enterprise customers messaged the company over a single weekend demanding access.

“With no hyperbole, the introduction of Computer inside Perplexity was the single biggest productivity unlock in our entire history as a company,” Dmitry Shevelenko, Perplexity’s head of business and a board member at the investment bank Lazard, told VentureBeat in an exclusive interview. “There’s no other feature that we’ve ever built that has changed how we work as much as this one.”

Inside the orchestration engine that coordinates 20 AI models at once

At its core, Perplexity Computer is an orchestration engine. When a user describes an objective — say, “prepare a briefing document on every company attending tonight’s dinner, pulling from the open web, our internal Slack conversations, my emails, and our Notion documents” — Computer decomposes that objective into subtasks, assigns each to a specialized sub-agent powered by the optimal AI model, and delivers a finished work product. It reasons, delegates, researches, codes, generates files, and remembers context across sessions.

The system orchestrates approximately 20 AI models from multiple providers, including Anthropic’s Claude Opus 4.6 as the primary reasoning engine, Google’s Gemini for deep research, Nano Banana for image generation, Veo 3.1 for video, xAI’s Grok for speed-sensitive tasks, and OpenAI’s GPT-5.2 for long-context recall and web search. Each Computer session runs inside its own isolated Firecracker virtual machine — the same microVM technology originally developed by Amazon Web Services for its Lambda serverless platform — ensuring that one user’s session cannot access another’s data or production infrastructure.

That model-agnostic approach carries a bet embedded within it: that no single AI provider will dominate every capability, and that enterprises will increasingly demand the ability to route tasks to the best available model for each job. Perplexity’s own internal data supports this thesis. As VentureBeat previously reported, the company’s enterprise usage shifted dramatically over the past year — from 90% of queries routing to just two models in January 2025, to no single model commanding more than 25% of usage by December 2025.

The enterprise-specific features announced at Ask 2026 are designed to embed Computer where organizations already work. Employees can now query @computer directly inside Slack channels and threads, then continue those conversations in Perplexity’s web interface or mobile app — the same full-power orchestration engine, with the same model selection and connector access, embedded where teams already collaborate. 

Beyond Computer’s existing 100-plus integrations, enterprise customers gain access to business-grade connectors for Snowflake, Datadog, Salesforce, SharePoint, and HubSpot, and administrators can install custom connectors via the Model Context Protocol. The package also includes purpose-built workflow templates for legal contract review, finance audit support, sales call preparation, and customer support ticket triage, along with SSO/SAML authentication, SCIM provisioning, granular admin controls, full audit logging, SOC 2 Type II certification, and the option for zero data retention. The billing model is usage-based: an organization-wide credit pool that administrators can allocate to individual users, with centralized spend management.

The product started as an internal Slack bot that Perplexity couldn’t stop using

The Slack integration is not an afterthought — it is the product’s origin story. According to Shevelenko, Computer was first developed as an internal tool and launched as a Slack bot for Perplexity’s own employees before it ever reached consumers.

“It kind of took off in a way that no other internal prototype ever did before,” Shevelenko said. “Our finance team automated how they run accounts receivable. Everybody on our enterprise sales team automated how they create proposals. And that all came from that cross-pollination” — employees observing each other’s queries in shared Slack channels and realizing what the technology could do.

That cross-pollination dynamic addresses one of the thorniest problems in enterprise AI adoption: education. When employees can see how their colleagues use the tool in shared channels — and can reply to those threads with follow-up questions — adoption spreads organically rather than requiring top-down training programs. The transparency of a shared Slack channel becomes its own onboarding mechanism, a kind of ambient learning that no training deck can replicate.

Perplexity gives enterprise administrators granular controls over which connectors specific employees can access and whether queries run in shared or private settings. “In the same way that you shouldn’t post to a large shared Slack channel information that’s not appropriate for everyone to see, the same applies here,” Shevelenko said. He noted that he personally runs many of his own Computer queries as private Slack messages rather than in shared channels.

How non-technical workers are querying Snowflake databases in plain English

The Snowflake and Datadog connectors — available exclusively to enterprise customers — may prove to be the most quietly disruptive feature in the entire package. They allow non-technical employees to query complex corporate data warehouses in plain English, bypassing the traditional bottleneck of waiting for a data team to write SQL queries or build a custom dashboard.

Shevelenko offered a concrete example from his own experience that day. “Literally two hours ago, I ran a query at Computer in the Slack,” he said, describing how he asked what percentage of Perplexity users who had run a Computer query also purchased additional credits beyond their subscription allotment. “I’m not technical, so I don’t know how to write SQL. I wouldn’t have known where to look that up. If I had to ping one of our data scientists — they have a lot going on — even though I’m an executive, it probably still would have been a few hours before I got a response. And here, within a minute, I got a full analysis.”

He described another case: a member of Perplexity’s enterprise sales team needed a customer reference from a B2B media company. Previously, that salesperson would have posted in a Slack channel, hoping the right person saw the message, hoping they replied — “you need 15 things to go right,” Shevelenko said. Instead, the salesperson asked Computer to identify the company’s most loyal B2B media customers and the account representatives who manage those relationships. The agent delivered three recommendations in minutes. “All of a sudden, you just consolidated 15 steps into maybe two or three steps.”

This pattern — collapsing multi-step, multi-person workflows into a single natural-language query — represents the core value proposition of Computer for Enterprise. It is not a chatbot that answers questions. It is an agent that does work: pulling from whatever data sources an organization has connected and delivering finished outputs like PDFs, analyses, presentations, and briefing documents.

Perplexity says it can out-orchestrate Microsoft, Salesforce, and OpenClaw

The enterprise launch positions Perplexity against formidable incumbents. Microsoft has embedded its Copilot AI assistant across the entire Microsoft 365 suite and aggressively expanded agent capabilities through Copilot Studio, which allows organizations to create custom AI workflows connected to Salesforce, ServiceNow, and other enterprise systems. Salesforce has its own Einstein AI platform. Google keeps expanding Gemini’s reach across Workspace. And Anthropic’s Claude Cowork product targets similar enterprise use cases—though it relies exclusively on Anthropic’s own models.

Perplexity’s argument is that its multi-model orchestration is a structural advantage. Rather than locking enterprises into a single vendor’s AI ecosystem, Computer selects the best model for each subtask automatically. Shevelenko framed the product as “the tool that combines every other tool.”

“You have access to 20 models that are all orchestrated. You have access to every possible enterprise connector. You have the ability to create your own skills and add your own connectors,” Shevelenko said. “There’s really no solution out there that is this comprehensive and has security. You obviously have stuff like OpenClaw, which has an open library of skills and connectors, but it is a security nightmare.”

The reference to OpenClaw — the popular open-source AI agent framework that runs locally on users’ machines and has gained a devoted following among developers — is pointed. OpenClaw gives users powerful agentic capabilities but requires technical sophistication to set up and offers minimal enterprise governance controls. Computer runs entirely in the cloud, in isolated virtual machines, with enterprise-grade audit trails and administrator controls. The distinction matters: it is the difference between a power tool for developers and a managed service for Fortune 500 security teams.

But Perplexity’s multi-vendor model strategy also carries risk. The company’s orchestration layer depends on continued API access to models from Anthropic, Google, OpenAI, and xAI — all of which are competitors to varying degrees. If any of those providers restricts access, raises API prices, or degrades performance for third-party callers, Perplexity’s value proposition weakens. As Semafor noted when Computer first launched, if underlying models become commodities, the value of switching between them diminishes.

The agentic AI market is exploding, and Perplexity thinks the timing is finally right

Shevelenko made an argument about timing that deserves scrutiny. He contended that Computer could not have worked even three months earlier because the underlying agent models—particularly Anthropic’s Opus 4.6 — were not yet capable enough to power reliable multi-step orchestration.

“With a lot of AI products, timing is everything,” he said. “I don’t think Computer could have been as powerful as it is if we had launched it even three months ago. You have to have the right harness at the right time. Every technology we’ve built laddered up to this moment, where you finally had a smart enough agent model to orchestrate through that harness.”

The claim aligns with broader industry dynamics. According to a February survey by CrewAI, 100% of surveyed enterprises plan to expand their use of agentic AI this year, with 65% already using AI agents in production and organizations reporting they have automated an average of 31% of their workflows. Fortune Business Insights projects the global agentic AI market will grow from $9.14 billion in 2026 to $139 billion by 2034, a compound annual growth rate of 40.5%. And Gartner forecasts that 40% of enterprise applications will feature task-specific AI agents by 2026, up from less than 5% in 2025.

Put simply, Perplexity is entering the enterprise agent market at the exact moment when demand is inflecting upward and the underlying models have crossed a reliability threshold. The question is whether its orchestration-layer positioning can withstand the platform power of Microsoft, Google, and the model providers themselves.

Why Perplexity is charging enterprises by usage instead of by the seat

Computer’s enterprise pricing model is a departure from the per-seat licensing that dominates enterprise software. Enterprise Max subscribers receive a per-user allotment of credits included with their subscription. If usage exceeds that allotment, organizations can purchase additional credits. Administrators control spending at the per-employee, per-team, or per-company level.

Shevelenko explained the rationale: the cost of running Computer varies dramatically depending on the task. Generating a video — a compute-intensive operation — costs significantly more than generating a text-based briefing document, which he estimated at roughly 15 cents of compute. “That literally would have taken a chief of staff five hours of time,” he said. “So I feel pretty good about the ROI there.”

The usage-based approach makes strategic sense for a product with such variable workloads—from one-off research queries to long-running campaign automation that executes for hours or days. It also avoids the pricing awkwardness of charging a flat $200 per seat for employees whose usage may range from zero to thousands of credits per month. But it creates a different challenge: enterprise procurement teams generally prefer predictable costs, and usage-based billing can trigger sticker shock when adoption spreads faster than expected across an organization.

The financial stakes are huge. Research firm Sacra estimates Perplexity hit approximately $148 million in annualized revenue by mid-2025, with the company’s own internal projections targeting $656 million in annual recurring revenue by the end of 2026 — a target that would require roughly 230% growth. Computer for Enterprise, priced to scale across entire organizations, is clearly designed to help close that gap. The company has raised approximately $1.5 billion in total funding at a $20 billion valuation.

A three-year-old startup wants access to your most sensitive corporate data

Perhaps the most significant obstacle facing Perplexity’s enterprise ambitions is not technology — it is trust. The company is three years old and asking chief information security officers to route sensitive Snowflake data, legal contracts, and proprietary business intelligence through its platform.

Shevelenko addressed this head-on. “The story of Perplexity in the enterprise is — we have tens of thousands of enterprise customers and only six people on our enterprise go-to-market team,” he said. “It is because the leaders at these enterprises use Perplexity themselves. There’s actually a lot of trust that we’ve created because people have used the product personally, and they want their employees to have the best-in-class solution.”

He drew on his personal experience as a Lazard board member to bolster the credibility argument. “I sit on the board of Lazard, which is an investment bank—financial services, a lot of very sensitive data, regulatory scrutiny. They wouldn’t have appointed me to the board if they didn’t care a lot about AI transformation,” Shevelenko said. “I have a deep empathy for the constraints, especially in regulated industries. And I think I’ve been able to channel some of that empathy into how we build comprehensive solutions that address those concerns.”

That bottom-up adoption pattern — executives discover Perplexity as individual consumers, then advocate for company-wide deployment — mirrors the playbook that made Slack, Dropbox, and Zoom billion-dollar enterprise companies. But those companies were selling relatively simple, well-understood products. Perplexity is asking organizations to trust an AI agent with access to their most sensitive data systems, running autonomously in the background, making decisions about which external AI models to route queries through. The security architecture — Firecracker VM isolation, SOC 2 Type II compliance, zero data retention options, audit logging — is designed to answer those concerns, but each enterprise will need to evaluate it against their own risk tolerance.

The viral launch that Perplexity says it never planned

When Computer launched for consumers in late February, social media lit up. Users demonstrated building Bloomberg Terminal replicas, orchestrating multi-channel marketing campaigns, and generating outputs that appeared to replace enterprise software costing tens of thousands of dollars. One widely shared analysis claimed Computer replaced $225,000 per year in marketing tools in a single weekend, an assertion the company’s official social media accounts amplified.

Shevelenko insisted the viral buzz was entirely organic. “With Computer, this thing has come together so quickly that we frankly didn’t — we didn’t know which day we were launching it,” he said. “Everything that happened was organic. Those were not folks that we engaged in advance or gave early access to, because literally nobody besides employees had access to it until the day we launched.”

He contrasted this with the launch of Comet, Perplexity’s AI-native browser, where the company ran a deliberate influencer strategy with early access. For Computer, the product was so new internally that even a planned press demonstration had to be canceled when engineers found issues hours before the event.

The organic virality is notable because it suggests genuine product-market fit rather than manufactured hype. When users voluntarily create elaborate demonstrations of a product and share them publicly, it signals something different from a coordinated marketing campaign. Of course, organic virality and real enterprise value are two very different things — building a Bloomberg Terminal demo in a sandbox is not the same as running mission-critical financial operations through an AI agent. Perplexity’s challenge now is converting consumer enthusiasm into durable enterprise contracts.

The enterprise software industry braces for a new kind of middleware threat

The most provocative question about Computer for Enterprise is whether Perplexity is building an interface layer that sits on top of existing enterprise software — or a replacement for it. If Computer can query Salesforce, generate reports from Snowflake, manage campaigns through marketing APIs, and build internal tools on the fly, how long before enterprises question why they need those underlying platforms at all?

Shevelenko offered a measured answer. “I think the world of productivity software contains multitudes,” he said. “What I think is true is that many organizations will have an all-the-above strategy. They’ll keep their existing vendors, but they will also encourage internal teams to use Perplexity Computer to fill the gaps with what they don’t like about their current solutions, or what could be better or more personalized about them.”

He pointed to the Bloomberg Terminal demonstrations that went viral. “To be clear, you cannot one-shot Bloomberg. Bloomberg has all kinds of things that you can’t rebuild with Perplexity Computer,” Shevelenko said. “But there are certainly gaps in Bloomberg Terminal that you can make better with Perplexity Computer. And there’s certainly a lot of people that can’t afford a $35,000-a-year piece of software that can get a $200-a-month version through Consumer Max that suits their needs and is actually personalized to them.”

That framing — not displacement, but gap-filling and democratization — is diplomatically smart. Perplexity needs Salesforce, Snowflake, and SharePoint as connector partners even as Computer potentially reduces how much time employees spend inside those platforms. It is a classic platform-layer tension: every successful middleware product eventually threatens the applications it connects.

What happens when the AI agent is smarter than the tools it connects to

Perplexity’s enterprise launch arrives at a pivotal moment for the agentic AI market. IDC forecasts a tenfold increase in agent usage and a thousandfold growth in inference demands by 2027. Security and governance rank as the top evaluation factor for enterprise agentic platforms, according to the CrewAI survey — and Perplexity has clearly built its enterprise feature set with that priority in mind.

Several dynamics bear watching in the months ahead: whether Perplexity’s multi-model orchestration delivers measurably better outcomes than single-vendor alternatives like Microsoft Copilot or Anthropic’s Claude Cowork; whether the usage-based pricing model survives contact with enterprise procurement teams that strongly prefer predictable costs; whether any of the model providers whose APIs power Computer restrict access or raise prices in ways that undermine the platform; and whether Computer’s Slack-first distribution strategy can replicate the bottom-up enterprise adoption patterns that built Slack, Zoom, and Notion into enterprise staples.

Shevelenko, for his part, resisted making grand predictions about where it all leads. “It’s really hard to make predictions in AI,” he said. “The thing I’m most confident in is that six months from now, I’m going to have a top three priority today that I don’t know what it is. I genuinely believe that. Six months ago, I did not know we were going to be all in on Computer, because it was unclear that the models would be smart enough to power something like this.”

That admission may be the most revealing detail in the entire conversation. Perplexity is not claiming to have built the final form of enterprise AI. It is claiming to have built the best orchestration layer for this particular moment — and betting that the moment is big enough to build a durable business on.

The irony is hard to miss. A company that made its name by sitting on top of other people’s information is now asking to sit on top of other companies’ AI models, data warehouses, and business workflows. If Computer works as advertised, every platform it plugs into becomes a little less essential and Perplexity becomes a little more indispensable. The enterprise software industry has seen this playbook before. The last company that pulled it off was Salesforce.