Kabir Mathur’s company started with a complaint about integrations. Before a security team can automate anything, someone has to connect the tools and make their data agree, and that someone is usually an engineer who would rather be building something else.
“there are so many different solutions in the space. They have all of these different data formats and perspectives on a finite set of assets within security. And there’s no real interconnectedness.”
Kabir Mathur, at 1:06
Kabir started Leen in 2023 with Neel Arora and Akash Bhat (Leen). The company calls its product a “Unified API and Data Fabric for Security” (Leen), and its stated mission is “to be the best devtools company in the world for security teams” (Leen). It sold first to other security vendors, compliance platforms among them, that need data from the tools their customers already run.
Jon McLachlan and Sasha Sinkevich hosted, and it aired on February 25, 2025, as episode 63, with 70 words of show notes. The notes call it the “more tools = more security” trap. On the tape, Kabir never tells anyone to stop buying tools. His argument is about the space between them. Every tool keeps its own data in its own format, and somebody has to join it all up before anyone can act on it.
This page is the rest of it: a section for each part of the conversation with the sources beside it, eleven figures, eighteen clips from the tape, the full transcript, and four tools: a quiz, a scorecard for how connected your security stack is, a calculator for what your integrations cost in engineering time, and a timeline from Kabir’s first job in games to Leen’s agents.
A middleware layer for security
Jon opened with the one-line version, that Leen is a unified API for security data, and asked whether that was right. Kabir said it was, and added the other name the company uses.
“We sometimes also refer to it as a security data fabric. That term, as I’m sure you know from being very experienced in the industry, is still not very well defined by folks in security.”
Kabir Mathur, at 0:35
So he described what it does instead.
“Yeah, essentially what we do is we act as a middleware layer for security.”
Kabir Mathur, at 0:57
A unified API sits between one product and many others. Instead of writing a separate connector for every scanner, endpoint tool and cloud console, a developer writes against one set of data models, one per category of security tool, and the layer handles each vendor’s sandboxes, API changes and authentication (Leen). Leen’s own founding post put the premise in a sentence: “security is fundamentally a data problem” (Leen).
The light bulb at BlueVoyant
Sasha asked what pain pushed them to start the company. Kabir pointed to his co-founder Neel’s work at BlueVoyant, where Neel was a senior principal engineer. Leen’s funding announcement describes BlueVoyant as a managed detection and response (MDR) and threat intelligence services company (Leen).
“And they had built their whole platform on top of Demisto. Demisto is a SOAR, for those of your listeners who might not know.”
Kabir Mathur, at 1:50
A SOAR, short for security orchestration, automation and response, is the kind of tool that lets a security team respond to some incidents automatically. Palo Alto Networks bought Demisto for $560 million in February 2019 (Wikipedia), and the product now carries the Palo Alto name. For various reasons, Kabir said, it didn’t scale with what BlueVoyant needed.
“So they decided to rip it out and build their own SOAR platform. And Neel was put in charge of that project.”
Kabir Mathur, at 2:05
Rebuilding a SOAR meant doing the part nobody sees first.
“you have to do data normalization, and only then can you actually start to build the automations and workflows on top of that.”
Kabir Mathur, at 2:19
Leen’s funding announcement says the same thing from the other side: Neel had built and set up BlueVoyant’s data normalization and orchestration platform before co-founding Leen (Leen). The founders’ bet was that if one engineer felt that frustration, others did too.
Three founders and a pivot
Jon asked how the founders met.
“So we’re all based out of San Francisco. There’s actually three of us. Our third co-partner is Akash. He’s the COO.”
Kabir Mathur, at 2:42
Neel and Akash knew each other through San Francisco circles, and Kabir met Neel separately. Kabir called San Francisco the best place in the world to start a company because of those chance connections. Their first idea wasn’t in security at all.
“we were not working on a security problem at all. We were working on a completely different idea that we tried for two or three months, didn’t see any meaningful traction with it.”
Kabir Mathur, at 3:10
Leen’s own post says the name comes from “lean,” for small security teams doing a lot with little, respelled “as a tribute to engineering teams everywhere,” and that it also happens to be Neel spelled backwards (Leen). Jon liked the order of operations.
“That’s spectacular, to have a little bit of experience and to be able to identify, oh, maybe not that, let’s try this next.”
Jon McLachlan, at 3:27
A new industry every five years
Jon asked about Kabir’s superpower on the founding team. Kabir started with his résumé.
“I’d spent my whole career working for startups. It’s been 15 years now.”
Kabir Mathur, at 4:39
His LinkedIn fills in the stops (LinkedIn). He started in business development at Kiz Studios, an Atlanta game studio, in 2009, at the peak of the iPhone’s launch, by his account on the tape. He moved to ad tech at NativeX and then Kiip, a mobile advertising network (Wikipedia), where he ran business development and customer success until 2019. Then came Typeform, the online form company founded in 2012 (Wikipedia), where he led product partnerships and grew its tech partners from 40 to more than 120. He founded Leen in July 2023. The thread through all of it is the one he named.
“the thing that I really enjoy doing, and I think I’m relatively good at, is learning about new industries.”
Kabir Mathur, at 5:22
He didn’t come from security. What carried over was integration work.
“especially the work that I did at Typeform, where I built a couple hundred integrations and technical partnerships around that, so very relevant work, now just redirecting to the security industry.”
Kabir Mathur, at 6:09
Jon’s summary was that someone who changes industries that often has to see what connects them: “the repeatable golden nuggets.”
Vitamin or painkiller
Sasha asked the classic product question.
“As we know, building a product that is a vitamin is not the best path for many different reasons. Building a painkiller for a very explicit pain point seems to work.”
Sasha Sinkevich, at 6:54
Kabir had been on both sides of it. The founders’ first idea, in customer success,
“was definitely a vitamin, and the market told us that in many different ways.”
Kabir Mathur, at 7:22
When they switched to security data, they still didn’t know whether the market was big enough or the problem repeatable. They went through the discovery process anyway, and the response was night and day from the first idea.
“all we had was a concept, right? We didn’t even have a prototype. We were literally pitching to people with a one-pager, telling them what our idea was, and they were super excited about it.”
Kabir Mathur, at 7:50
They spoke with about 100 people, from CISOs and heads of security engineering to founders of other security companies and people running MSSPs, and heard a fairly universal problem.
A dozen or more tools
The question was where to start. Kabir described the market in two segments.
“the range is anywhere between 50 all the way up to 100 security tools that these very large enterprise security teams are using.”
Kabir Mathur, at 8:51
Leen started with the other segment, security product vendors: smaller companies, less bureaucracy, faster sales, and a pain they could state in a sentence. Kabir repeated it the way their product people and CTOs had said it to him.
“I know integrations are really important to my business. I need this data on behalf of my customers from a dozen or more tools, but it takes my team way too long to build these integrations.”
Kabir Mathur, at 9:23
Drata is one of those vendors. Its co-founder and chief technology officer, Daniel Marashlian, was our guest on episode 64. Leen’s case study says each in-house integration had taken Drata two to three months, that build time fell to about two weeks, and that its vulnerability management integrations grew from 1 to 13 in under six months. More than 500 Drata customers use Leen to monitor vulnerabilities, and a Drata product manager put the change simply: “Just one or two engineers could build an integration end-to-end” (Leen). Those are the vendor’s numbers about its own product.
Not a SIEM
Sasha asked about the tool most companies already have.
“Companies already feed a lot of metrics and application logs into a centralized log aggregator.”
Sasha Sinkevich, at 9:56
Splunk is the usual example, and teams build custom queries on top of it to trigger alerts. Kabir drew the line clearly. First, the context: Leen was about a year and a half old.
“About a one and a half year old company. We have 20 customers, all of whom are other security product vendors.”
Kabir Mathur, at 10:46
Then the line itself.
“And what we’ve learned is that we’re not going to replace SIEMs, right? I want to be very clear about that.”
Kabir Mathur, at 10:54
A SIEM, short for security information and event management, collects and correlates event data across an environment. Splunk is one, and Cisco completed its $28 billion purchase of it in March 2024 (Wikipedia). Kabir’s distinction was about the kind of data, not the brand.
“SIEMs are very focused on events and logs, whereas we are much more focused on the stateful data.”
Kabir Mathur, at 11:18
Stateful data, in his telling, is what the tools have already concluded.
“so the alerts, the detections, the vulnerabilities, the issues, whatever the tool calls it.”
Kabir Mathur, at 11:33
Leen also pulls out the thing each finding is about, plus some configuration data.
“Is this vulnerability related to a cloud asset, or is it a network asset? Is it an identity?”
Kabir Mathur, at 11:43
His point was that a SIEM serves one part of a security team well, and that corporate security, cloud security and application security often care more about the state of things than about granular logs. For how the SIEM market itself changed, see Alan Braithwaite on episode 50.
Three jobs for the data
Kabir listed the use cases enterprise security leaders had described to him. The first is seeing trends across tools at all.
“they might have a dozen or more tools in their stack. They have to log into these different dashboards even to understand what’s happening within those environments”
Kabir Mathur, at 12:35
The second is compliance. GRC platforms, many of them Leen customers, don’t cover every case inside a large company, so teams build their own store of evidence and share it with auditors.
“many of these teams have to stand up what you can refer to as compliance data lakes”
Kabir Mathur, at 13:06
The third is glue: small applications and Slack or Microsoft Teams workflows that connect tools so someone can triage faster.
“This is all bespoke code that these teams have to own.”
Kabir Mathur, at 13:37
All three are the same job underneath: connect the tools, normalize their data, correlate it where possible, and let people act on it. Jon’s summary was that it sounded like “a great aggregation and normalization set of services that fills an important gap in the market.”
A hundred no’s
Jon asked about the proudest moment so far. Kabir said the founders try not to get too high on the highs or too low on the lows, and that the moment only made sense next to what came before it.
“we talked to about 100 VCs and we got 100 no’s”
Kabir Mathur, at 14:41
Customers called the first idea very interesting too, and it was still rejection after rejection. Jon put a name on that kind of rejection.
“They said no without saying no.”
Jon McLachlan, at 14:57
Kabir knew the script.
“Oh, this is super interesting, but, and the variation of what came after that, but oh, look at the time, I have to go.”
Kabir Mathur, at 14:59
After the pivot, they set up discovery calls with as wide a range of security people as they could find, through cold outreach on LinkedIn, people they knew and security Slack communities. One of those calls didn’t end like a discovery call.
“You guys are raising money, right? I’m going to wire it to you tomorrow, and this is the amount I’m willing to commit.”
Kabir Mathur, at 16:03
That’s Kabir repeating what the person on the other end said. The founders hadn’t asked.
“And we didn’t ask that, that wasn’t the ask at all. We weren’t even sure we were ready to raise money yet.”
Kabir Mathur, at 16:08
The money arrived the next day, and things snowballed. Kabir told the same story in writing on LinkedIn in October 2025, in a post about increasing your surface area for luck, and added that within a week the investor had introduced them to five more angels, security leaders who anchored the round (LinkedIn).
Room in the round
Jon asked about the hardest thing so far. Kabir’s first answer was a fundraising choice.
“there was only so much room in the round. And especially for a small round, you can only have so many people putting in bigger checks. So we had to turn down one amazing VC in particular.”
Kabir Mathur, at 17:15
Turning down a well-known firm as a team with nothing yet was a risk. He thought it had played out well, because of who they picked.
“the reason we picked our lead investor, 11.2 Capital, is because they had a very strong network in security”
Kabir Mathur, at 17:35
Leen’s announcement of the pre-seed round names 11.2 Capital as the lead, with InnerLoop Capital and Preface Ventures, and a long list of security operators as angels, among them Jason Chan, formerly Netflix’s vice president of information security, Adrian Ludwig, formerly Atlassian’s chief information security officer, Emilio Escobar of Datadog, Jeff Trudeau of Chime, Varun Badhwar of Endor Labs and Travis McPeak of Resourcely (Leen), who was our guest on episode 68. Kabir’s LinkedIn sums up the cap table as backed by the security chiefs of Netflix, Datadog, Chime and, formerly, Atlassian (LinkedIn).
The second hard thing was letting people go.
“If things don’t work out, it’s really hard as a founder to, one, come to that realization, and then, of course, share that news with the affected person”
Kabir Mathur, at 18:01
Jon’s answer was that building a business takes a strict focus on delivering to the market, and that it isn’t everyone’s cup of tea at every point in a life.
A father’s leap
Jon asked who had the largest influence on Kabir. He named his father.
“we come from very modest roots in India, and he broke out of sort of his corporate job and took a risk and became an entrepreneur, had a successful exit.”
Kabir Mathur, at 19:03
The timing mattered. Kabir described India in the 1990s as almost an oligarchy, a long way from the market it is now.
“It wasn’t the very successful capitalist model that you now know India to be. It was a very closed economy.”
Kabir Mathur, at 19:23
Economic liberalisation in India began in earnest in 1991, opening the economy to foreign trade and investment and giving markets and private companies a larger role (Wikipedia). Entrepreneurship the way Silicon Valley thinks of it, Kabir said, didn’t really exist yet.
“So watching him do that and essentially create something very valuable out of nothing, it kind of blew my mind as a kid, right?”
Kabir Mathur, at 19:37
Give and take
Sasha remembered something from before the recording: one of Kabir’s co-founders hosts a podcast for the security community in India. Kabir gave the credit to Akash. It’s Akash’s own project, started before Leen, with some crossover as the founders met more people in security from Indian backgrounds and invited them on. Kabir tied it to a debt.
“We had nothing a year and a half ago. We started from zero.”
Kabir Mathur, at 21:01
“We asked for a lot of favors to get in touch with investors, to get in touch with customers, to get in touch with our first set of employees.”
Kabir Mathur, at 21:05
So Leen tries to give back, and one way is hosting events.
Inside the buyer’s mind
Kabir mentioned a panel coming up in San Francisco later that month, with CISOs on what it takes to sell into large enterprises.
“So getting into what we call it, inside the buyer’s mind.”
Kabir Mathur, at 21:37
Leen held it on January 27, 2025, at the SVB Experience Center in San Francisco, with Devin Ertel of Menlo Security, Shirish Puranik, formerly an executive vice president for cybersecurity at Wells Fargo, and Adrian Ludwig of Tools for Humanity. Leen’s write-up says buyers are consolidating and replacing tools more than adding them, often paying for something new by retiring something old, and it puts the buyer’s first question this way: “Does this tool create more problems than it solves?” (Leen). That’s the episode’s title, asked by the people who sign the purchase orders.
Sasha asked Kabir the panel’s question directly.
“What does it take to sell into the enterprise?”
Sasha Sinkevich, at 21:50
Kabir said Leen was still breaking into that segment, and that playbooks, champions and relationships all matter. Then he put them second.
“None of that matters unless you’re solving a truly important problem for these teams.”
Kabir Mathur, at 22:33
“Do a lot of these discovery calls, show them prototypes, and don’t treat these as sales calls initially, right? Until you’re sure that you’re solving a problem that matters, just ask for favors.”
Kabir Mathur, at 22:47
In his experience, even CISOs at large companies are usually open to talking to people doing something new, and doing a lot of discovery calls is how a founder refines the solution before trying to sell it.
Polluted by dashboards
Sasha added a view from the buyer’s chair.
“The security space is heavily polluted by different dashboards. Often you have to have a four-year university degree in order to understand how to use certain products.”
Sasha Sinkevich, at 23:33
The opportunity in that, Sasha said, is the experience itself.
“If we can solve a very obvious pain point by producing a better user experience or user interface, that in itself can be a good product and could be a good starting point.”
Sasha Sinkevich, at 23:47
Plays nice with everyone
Jon asked how listeners could find Leen’s events. They’re open to the public, and Kabir framed hosting them as part of the company’s role.
“We see ourselves as being this company that plays nice with everyone in security.”
Kabir Mathur, at 24:39
As a middleware layer, Leen co-hosts with vendors and security teams alike. That panel was its second at Silicon Valley Bank’s space on Market Street, and Jon recommended the old bank vault downstairs.
“The best place to find out about our events is actually to follow our LinkedIn page.”
Kabir Mathur, at 25:12
The events go up on Luma, and Leen approves anyone who works in security. Kabir also promised more around the big conferences, RSA and Black Hat.
Far more engineering driven
Jon asked what success looks like. Kabir answered with the long-term bet Leen is making for the industry, that
“security teams overall are going to become far more engineering driven.”
Kabir Mathur, at 26:25
Security grew up with an IT and compliance makeup, he said, and the threats, the tools and the headcount it has to secure keep growing.
“So overall, the entropy in this space is just increasing.”
Kabir Mathur, at 26:56
The data grows with it, and his conclusion follows from first principles.
“our hypothesis on this is that you don’t solve big data problems without applying engineering principles to them.”
Kabir Mathur, at 27:07
He saw it in hiring already: security teams looking for people who can write basic scripts, and the most advanced ones hiring only software developers.
“You can’t just rely on what the point solutions are doing for you.”
Kabir Mathur, at 27:51
Over five to ten years, he expected those teams to need a middleware layer and a set of developer tools built for the security stack, and Leen to be the one they choose.
Power tools
Jon brought in AI with a story from an event, where someone asked an AI expert when AI would replace developers.
“well, I think that’s kind of like asking when our power tools are going to replace construction workers.”
Jon McLachlan, at 28:45
His point was that someone still has to understand what happens underneath the hood when you click a button, and that with this much data, that’s an engineering problem. Kabir agreed and took it one step further.
“So we’ve been talking a lot about how humans can consume this data and activate it and deal with it more programmatically.”
Kabir Mathur, at 29:42
Garbage in, garbage out
AI, he said, is now part of the same equation, and it depends on the data more than anything else.
“If the data is not formatted correctly, if it’s not normalized, if it’s all over the place coming from all these different tools, it’s going to be garbage in, garbage out.”
Kabir Mathur, at 29:58
Garbage in, garbage out is one of computing’s oldest rules: flawed input produces flawed output (Wikipedia). Kabir’s fix is the same layer he’d been describing all along.
“if we can normalize the data, we can correlate it, we can deduplicate it”
Kabir Mathur, at 30:19
With that done, he said, the output a team gets from AI, whether security insights, a reporting layer or compliance work, should be, in theory, much better. Leen made the same argument in 2026, in a post on why agents need a normalized data layer: “Large language models don’t fix bad data. They amplify it.” (Leen).
Take the leap
Jon asked what Kabir would tell his younger self. He mentors young founders now, and his advice was about timing.
“looking back, I maybe waited a little too long to venture out and do my own thing.”
Kabir Mathur, at 31:07
From outside, other founders’ raises and overnight successes are intimidating, and you don’t see what’s underneath them.
“And the great attribute that I think most founders need to have is just tenacity and the belief in yourself that you will figure things out.”
Kabir Mathur, at 31:36
Jon offered the other side, that everything along the way made Kabir who he is.
“There’s that catch-22 of, we’re always learning, we’re always growing, we’re always hungry.”
Jon McLachlan, at 32:18
Kabir agreed there’s no right age. He has worked for founders of 18 or 19, who make the mistakes of people new to the workforce.
“There’s so many successful entrepreneurs who didn’t start their first company until their 40s or 50s.”
Kabir Mathur, at 33:00
Sasha closed the thought.
“We all make mistakes regardless of the age.”
Sasha Sinkevich, at 33:10
Where the unsolved problems are
Sasha asked where Kabir would start a company today. Leen’s position helps: Kabir said he had spoken with more than 100 founders in the past year alone, in GRC, vulnerability prioritization, identity and more. His first answer was cloud security.
“even though you have behemoths like Wiz in the space.”
Kabir Mathur, at 34:14
Two months after the recording, on March 18, 2025, Google announced it would buy Wiz for $32 billion in cash, and the deal closed on March 11, 2026 (Wikipedia). Kabir still saw unsolved, narrower problems around it, and Sasha didn’t think a giant should scare anyone off.
“But I would say that when Apple started in a garage, the IBM already existed, and they owned a lot of real estate in the Silicon Valley.”
Sasha Sinkevich, at 34:38
Kabir’s second answer was identity, because the main ways in are still basic.
“a lot of them are still happening at a very basic level”
Kabir Mathur, at 35:03
Exposed credentials were on his list. His third was the space the automated GRC companies work in, because the number of frameworks keeps growing and large enterprises still build bespoke solutions where the platforms stop.
“Number of frameworks that companies have to adhere to is only going to continue to increase.”
Kabir Mathur, at 35:31
Sasha connected it back to the episode’s theme. If a platform can’t pull and understand the data from the technical implementation, it’s hard to make GRC fully automated.
“ideally it needs to be driven by the data itself.”
Sasha Sinkevich, at 36:13
Finding the wedge
Sasha asked what was next for Leen. It was the start of 2025, and Kabir named the biggest thing on the list.
“And one of the biggest things that we’re going to be focused on is creating value for these enterprise security teams, right?”
Kabir Mathur, at 36:57
Leen had found its footing with vendors that need to scale their integrations. With enterprise teams, he wanted one specific problem first, and then a platform for reporting, compliance workflows and automations.
“initially, you have to find that wedge use case.”
Kabir Mathur, at 37:50
Sasha’s summary was the advice of the whole episode.
“Just connecting the dots, making sure whenever we build a product, it’s important to keep the focus on what the market is asking for and create a solution for it.”
Sasha Sinkevich, at 37:57
What happened after the tape
When we recorded. The conversation was recorded on January 16, 2025, and aired on February 25. Kabir mentions the panel coming up “later this month,” and Leen held it on January 27.
The vendor side kept growing. Leen announced a partnership with Tenable in April 2025, a connector that brings Tenable’s vulnerability data into developer workflows (Leen). In May 2025 it published its own estimate of what an in-house integration costs, about 240 hours to build and about 220 hours a year to maintain, review and keep up with API changes (Leen), which are the defaults in the calculator below. Its integrations later became two-way, creating and updating tickets in Jira and ServiceNow (Leen).
The tool count, in his words. In September 2025 Kabir wrote about the line he kept hearing from enterprise security leaders. One CISO told him 40% of the team’s time went to managing data, and his conclusion was that visibility comes from connecting the data you already have (LinkedIn).
I keep hearing the same thing from enterprise security leaders: “We run 80+ tools, but we still don’t have visibility.”
Kabir Mathur · Founder and CEO, Leen · September 24, 2025
Something doesn’t add up.
Two months earlier, Leen and Rinki Sethi’s Lockstep had shared what they heard from 25 security practitioners about the gap between what practitioners need and what most products deliver (LinkedIn). Leen’s own account on X kept it shorter.
Connecting two souls can take years. Connecting your security data shouldn't.
Leen (@leendotdev) · August 26, 2025
From a data layer to agents. By 2026, Leen’s site led with “We started by connecting your security tools. Now we run your security operations.” (Leen). Its agents connect a team’s tools, normalize the data and run campaigns from a finding through remediation to a verified fix, and they ask a person to approve before acting (Leen). Kabir’s LinkedIn lists the jobs as triaging vulnerabilities across scanners, collecting compliance evidence for audits and fixing cloud misconfigurations as they drift, on top of 50-plus integrations and 20-plus normalized data models, with SecurityScorecard, Drata, Sysdig and Secureframe among its customers (LinkedIn). Those are the jobs from the tape, the dashboards, the compliance data lakes and the bespoke glue, done by software on top of the same layer.
The episode’s one-sentence summary still holds: a security team doesn’t need fewer tools so much as tools whose data agrees.
Did you catch it? A six-question quiz
Six questions from the episode. Each answer links the moment in the transcript.
Quiz · six questions
Did you catch it?
Pick an answer for each question, then check your score.
-
What did Neel's team at BlueVoyant rip out and rebuild?
- Their SIEM
- Their SOAR platform, built on Demisto
- Their ticketing system
b. "So they decided to rip it out and build their own SOAR platform." Transcript, 2:05.
-
How many security tools did Kabir say very large enterprise teams use?
- Five to ten
- Twenty to thirty
- Fifty to a hundred
c. "the range is anywhere between 50 all the way up to 100 security tools that these very large enterprise security teams are using." Transcript, 8:51.
-
What kind of data did Kabir say Leen focuses on, next to a SIEM's events and logs?
- Stateful data, such as findings
- Packet captures
- Endpoint telemetry
a. "SIEMs are very focused on events and logs, whereas we are much more focused on the stateful data." Transcript, 11:18.
-
How many VCs said no to the founders' first idea?
- About ten
- About a hundred
- About a thousand
b. "we talked to about 100 VCs and we got 100 no's" Transcript, 14:41.
-
What did Kabir say happens when AI is fed data that isn't normalized?
- The model cleans it up
- It runs faster
- Garbage in, garbage out
c. "it's going to be garbage in, garbage out." Transcript, 30:06.
-
Which customers did Leen decide to sell to first?
- Other security product vendors
- Large enterprise security teams
- Government agencies
a. "And the segment that we decided to start with are other security product vendors." Transcript, 8:26.
Is your security stack connected?
Eight questions for a security team that runs more tools than it can comfortably watch, drawn from what Kabir, Sasha and Jon covered. Each one links the part of the episode it comes from.
Scorecard · eight questions
Is your security stack connected?
Answer for your whole security program as it runs today. If two answers fit, pick the lower one.
-
Can you list every security tool you pay for, and who owns each one?
- No
- Roughly
- Yes, with an owner for each
"the range is anywhere between 50 all the way up to 100 security tools" See A dozen or more tools.
-
Can you see findings from all your tools in one place, in one format?
- No, we log into each dashboard
- For some tools
- Yes, normalized in one place
"They have to log into these different dashboards even to understand what's happening within those environments" See Three jobs for the data.
-
Do you know which asset or identity each finding is about?
- No
- For some tools
- Yes, across tools
"Is this vulnerability related to a cloud asset, or is it a network asset? Is it an identity?" See Not a SIEM.
-
How do you collect compliance evidence for an audit?
- Screenshots and spreadsheets, by hand
- Partly automated
- Pulled from the tools automatically
"many of these teams have to stand up what you can refer to as compliance data lakes" See Three jobs for the data.
-
Who maintains the scripts and workflows that glue your tools together?
- Nobody in particular
- One person who might leave
- A team that owns them as code
"This is all bespoke code that these teams have to own." See Three jobs for the data.
-
Before you buy a new security tool, do you decide what it replaces?
- No
- Sometimes
- Yes, every time
"The security space is heavily polluted by different dashboards." See Polluted by dashboards.
-
Does your security team have people who can write code?
- No
- A few scripts
- Yes, engineers on the team
"you don't solve big data problems without applying engineering principles to them." See Far more engineering driven.
-
Before AI reads your security data, is it normalized and deduplicated?
- No
- Partly
- Yes
"it's going to be garbage in, garbage out." See Garbage in, garbage out.
Your tools work, but they work alone. Start with a list of every tool and its owner, then pick the two whose findings you'd most like to see side by side and get them into one format.
Some of the data agrees and some doesn't. Normalize findings and the assets they're about before you build more dashboards, and put the glue code under an owner.
Your tools feed one picture. Keep it that way at the buying stage, decide what each new tool replaces, and make sure the data is clean before AI reads it.
What do your integrations cost?
The engineering time it takes to connect your own tools, with Leen’s estimate for one integration as the starting point. Change the numbers to your own.
Calculator
What do your integrations cost?
Four estimates: how many tools you need data from, the hours to build one integration, the hours a year to keep one working, and what an engineering hour costs you.
Building these integrations yourself takes about 5,520 h of engineering time in the first year, about $552,000, and 2,640 h every year after that. That's 1.3 full-time engineers doing nothing but keeping integrations working, which is the work Kabir's customers told him their teams shouldn't be spending time on.
The defaults are Leen's own estimate for one integration, about 240 hours to build and about 220 hours a year of maintenance, security reviews and API changes (Leen). Leen sells the alternative, so put in your own numbers. Twelve tools follows Kabir's "a dozen or more tools," and a full-time engineer is counted as 2,000 hours a year.
From Kiz Studios to Leen’s agents
Everything on this page sits on one timeline, from India’s reforms to Leen’s agents. Filter it by thread.
Timeline · 1991 to 2026
From Kiz Studios to Leen's agents
Filter by thread. Dates are from the public record except where marked as part of this show.
- India opens up
Economic liberalisation begins opening India's economy to foreign trade and investment (Wikipedia, on this show).
- Kiz Studios
Kabir starts in business development at an Atlanta game studio, his first stop in gaming (LinkedIn).
- NativeX
Into ad tech, managing advertiser and publisher accounts (LinkedIn).
- Kiip
Developer success, then head of business development and customer success at the mobile ad network, to 2019 (LinkedIn).
- Demisto
Palo Alto Networks buys the SOAR maker for $560 million (Wikipedia, on this show).
- Typeform
Kabir leads product partnerships, growing the tech partner list from 40 to more than 120, to April 2022 (LinkedIn).
- Leen
Kabir founds Leen with Neel Arora and Akash Bhat after a first idea in customer success (LinkedIn, on this show).
- Cisco closes Splunk
The $28 billion deal for the SIEM maker completes (Wikipedia, on this show).
- Leen's origins
Leen publishes its founding thesis, that security is fundamentally a data problem (Leen).
- SOC 2
Leen announces its SOC 2 compliance (X).
- Why Leen
The name, from "lean," respelled for engineering teams and Neel's name backwards (Leen).
- Recorded
Kabir, Jon and Sasha record the episode. Leen has 20 customers, all security vendors (on this show).
- Inside the buyer's mind
Leen's CISO panel at the SVB Experience Center in San Francisco (Leen, on this show).
- Episode 63
The episode airs (transcript).
- Google and Wiz
Google announces a $32 billion all-cash deal for Wiz (Wikipedia, on this show).
- Tenable
A partnership and connector for Tenable vulnerability data (Leen).
- The cost of building in-house
Leen estimates about 460 engineering hours per integration in the first year (Leen, calculator).
- Practitioner research
Leen and Lockstep share what 25 security practitioners told them (LinkedIn).
- 80+ tools
Kabir writes about the enterprise leaders who run 80-plus tools without visibility (LinkedIn).
- Surface area for luck
Kabir writes up the discovery call that turned into the first check (LinkedIn, on this show).
- Wiz joins Google
The acquisition completes (Wikipedia).
- Data for agents
Leen argues that AI agents need a normalized data layer (Leen, on this show).
- Agents
Leen's site leads with running security operations on top of its integrations (Leen).
What to do this week
Five things, in the order Kabir’s argument suggests.
- List your tools and their owners. Every security tool you pay for, who owns it, and what data it produces. The scorecard above shows where else you stand.
- Pick two tools and make their findings agree. Same format, same severity scale, and the same asset or identity attached to each finding.
- Price the glue. Count the scripts, workflows and integrations someone keeps alive, and run the calculator with your own hours.
- Decide what a new tool replaces before you buy it. The buyer’s question from Leen’s panel is the right one: does it create more problems than it solves?
- Clean the data before AI reads it. Normalize, correlate and deduplicate first. If you’d like a second pair of eyes on your stack, our vCISO team can help, and you can book 15 minutes with us.