Hi, I'm KayVon.

Three decades, three eras.

I started in 1998, in network security and fraud, answering the phone after a breach had already happened. Broadband was just arriving over coax. pcAnywhere shipped with defaults that didn't require a password. Script kiddies were breaking into systems with Back Orifice and L0phtCrack over NetBIOS. My job was purely reactive — I got called when it was already too late. The 1990s were the decade of identification: everyone was accumulating systems and applications and just trying to know what they had.

In 2000, Philip Morris hired me in NYC as a security incident responder for the top twelve executives. That scope grew — to the legal department (and you can imagine the size of a tobacco company's legal department), to the whole NYC office, then across the operating companies: Kraft Foods, Nabisco, Philip Morris USA, PM International. I ended up building global computer security incident response teams across all of them. The 2000s were the decade of protection: more firewalls, more switches, more tools — and more logs than anyone could make sense of. That's when SIM and SEM converged into this new thing called a SIEM.

In 2008, HPE — which had just acquired EDS — brought me in to help build SIEM technology. Two years in, HP bought ArcSight for $1.5 billion. Great technology. But like most SIEMs of that era, you were restricted from your own raw data, restricted in what you could ingest, locked out of using the backend for anything beyond security. The 2010s became the decade of detection and response — and most organizations simply couldn't handle the data volume, the expertise, or the 24/7 coverage it demanded.

Which is exactly what I ran into at the law firm, at noon, at Federal Plaza.

I couldn't find the vendor I needed. So I became it.

After the breach, I went looking for one vendor who could do what I actually needed: come in, drop sensors, start collecting logs from firewalls, switches, routers, servers, applications and users — north-south and east-west — automatically flag anomalies, help remediate on the fly, enrich the data with threat intelligence and geo-resolution, investigate on my behalf, and still give me access to my own raw logs so I could run my own investigation.

I mean — how hard can that be?

I couldn't find a single one. I read everything I could about how other organizations handled this, and I kept coming back to research from Dr. Larry Ponemon's institute with IBM: small and mid-size organizations were the most underserved segment in security, and intrusions were going unnoticed for an average of 287 days. Two hundred eighty-seven days. That's someone living in your house — eating your food, watching your TV, sleeping in your bed when you're not around — for nine and a half months. And you have no idea.

I spoke with hundreds of MSPs in New York. Not one could point me to a turnkey solution that didn't demand a long-term contract, didn't take days or weeks to deploy, and didn't dump raw noise on a team with no analysts. My bar was: onboard in an hour, triage and investigate on the partner's behalf, and only escalate the things that matter.

It didn't exist. So in 2014, I launched Vijilan — built for IT solution providers and MSSPs from day one, because the big enterprises already had their armies. The MSPs, and the millions of small businesses behind them, had nobody. We've watched a lot of companies enter this space and disappear since. We're still here, and we still only sell through partners.

We hit a wall. CrowdStrike is how we broke through it.

The first version of Vijilan ran on a commercially available multi-tenant SIEM. It worked — until it didn't. We grew month after month, year after year, and then we hit the threshold. The infrastructure got unstable. Log collection became guesswork: was it the collector, or the source? We couldn't touch our own raw logs and get answers fast. Reports crawled. Audits hurt. We had to get selective about what data we even ingested — which is the one thing a SOC should never have to do. More servers, more licenses, more engineers, more cost.

We couldn't grow anymore. The platform we built the company on had become the ceiling.

Then we discovered Humio: index-free log management built for massive ingest, with the raw-data access and speed we'd been begging every SIEM vendor for. We rebuilt. When CrowdStrike acquired Humio and it became Falcon LogScale, our data foundation and the world's best endpoint telemetry ended up under one roof — and ViSH, the Vijilan Information Security Hub, became what it is today: a multi-tenant SOC platform on CrowdStrike Falcon Next-Gen SIEM and Falcon LogScale, purpose-built for MSPs and MSSPs.

We ported roughly 900 partner organizations onto the new platform. 95% data compression. 35× query performance. The ceiling was gone — and by 2023 we'd launched four new solutions on that foundation, merging observability and security in one platform.

CrowdStrike now tells Vijilan's story as one of its own official customer stories. Given where this journey started — one analyst locked out of his own logs — I'll take that.

We're the Gucci of managed security. On purpose.

A word on how I run this company. In 2016 I took on four partners to scale. In 2020 I bought back the remaining equity and became the sole owner. Clean cap table, investor-friendly — and here's the part I'm proudest of: revenue has been strong enough that we've never had to bring in an outside investor. No board telling us to chase volume. No pressure to be everything to everyone.

Which means we get to choose who we serve. And we choose the 1%.

The MSP community is the strongest community I've ever worked in. But Vijilan is not a one-size-fits-all company, and we are not cheap. We bring enterprise-grade security — the same platform, the same SOC, the same active remediation the Fortune 500 gets — to the elite 1% of MSPs: the ones who genuinely care about their clients' security and about growing a real security practice. Not the transactional ones shopping for the lowest price.

Every partner gets concierge treatment. White-glove onboarding, a named team, weekly touchpoints when you want them, a founder you can actually reach. That's not scalable the way a self-serve portal is scalable — and that's exactly the point. Read what Layer 8, WCA, Orion Secure and LaScala say about working with us — those are the partners we built this for.