GrayPass Founders Arav Mathur and Aditya Ranjan Are Betting Security Cannot Stop at Login

A network user gets to work and signs in at 9 a.m. Twenty minutes later, someone uses that session to request an export of thousands of customers’ names, email addresses, and billing details. The login was legitimate. But what does it establish about who is controlling the session when the data is about to be downloaded? 

For Arav Mathur, the 19-year-old CEO and co-founder of San Francisco-based GrayPass, that gap is the starting point. His argument is not that sign-in security is unnecessary. It is that a successful login and entry authentication should not be the last meaningful check before an employee does something consequential.

Mathur and his co-founder, 18-year-old COO Aditya Ranjan, are building software that brings the question of control closer to the action itself. GrayPass is part of Y Combinator’s Fall 2026 batch, and the pair moved to San Francisco this year to run the company full time. Their approach draws on two different backgrounds: Mathur’s experience building software and Ranjan’s work in neuroscience.

Two backgrounds, one security question

Mathur and Ranjan met on their first day of high school in 2021, before pursuing different fields that would eventually converge in GrayPass. Mathur recalls teaching himself to build and sell software at the age of seven. At just 15, he says, one of his first startups gained hundreds of users and raised several thousands of dollars from grants and angel investors. He subsequently worked in AI, machine learning, and growth engineering at Stan, BenchSci, Aview International and the University of Toronto. Before GrayPass, he built Oro, a consumer fashion app that, he reports, gained thousands of users and attracted significant attention across social media. He studied computer science at the University of Waterloo before moving to San Francisco.

Ranjan’s interests took him toward the brain. He describes working on seizure-node architecture at age 16, exploring how complex brain patterns could be modeled computationally. He later contributed to neurosurgical research and studied neuroscience at McGill University. That background informs his interest in what small, recurring patterns of behavior can reveal, and where those interpretations should stop.

At GrayPass, the two perspectives meet in a practical problem: how an application can use evidence of human behavior without treating it as a complete account of someone’s identity or intentions.

Asking again before the action

The founders distinguish between establishing identity and assessing continued control. A person may authenticate successfully and remain in control throughout a session. But they may also hand a task to an AI agent, deliberately and legitimately. An agent might book travel, pay an invoice or make changes inside a business application. The account has not changed, but the actor carrying out the task has. For GrayPass, that distinction matters most when an application is about to approve a payment, change a payout account, grant administrator access, export customer data or rotate an API key.

The company’s software works alongside passwords, passkeys, multi-factor authentication, and identity providers rather than replacing them. At a protected action, it evaluates the available evidence and returns one of four decisions: allow, verify again, hold, or deny. The application determines how to enforce the result. The aim is not to make every interaction another authentication exercise. It is to give applications a way to reassess control at the points where misplaced trust could have significant consequences.

What behavior can and cannot establish

GrayPass calls its behavioral technology a “Brainprint.” It models interaction patterns such as typing rhythm, cursor movement, scrolling, and pauses, then evaluates those signals alongside identity, device, session, and transaction context. The distinction between how someone interacts and what they type or see on a screen is central to the founders’ approach. Brainprint examines movement rather than the content of typed messages. Mathur describes behavioral evidence as one input to a security decision, not a way to interpret everything a person does.

A Brainprint can provide evidence that the expected person remains in control. It does not independently predict who that person is, what they intend or what they are authorized to do. Those limits are important to the product’s premise: recognizing familiar behavior is not the same as approving a transaction, and a change in behavior does not, on its own, explain why control may have shifted. GrayPass combines those signals with the surrounding context and the application’s policies to help determine what should happen next.

A different starting point

The founders also face a straightforward competitive question: why could an established identity or security company not build the same capability? Mathur’s answer is that it could. He does not argue that established cybersecurity companies lack the engineering resources or customer relationships. His argument concerns where GrayPass begins. Rather than treating post-login checks as an extension of sign-in, the company has organized its product around the moment before a sensitive action executes, as a whole different market. 

Whether that distinction is enough to support a standalone company remains the founders’ central bet. They believe post-login assurance can become a distinct layer of application security, working with existing identity systems while addressing a different question. For two founders not yet 20, the ambition is substantial, but the problem is specific: a valid login establishes an earlier moment of trust. GrayPass wants applications to examine whether that trust still holds when an action carries real consequences.

Entrepreneur Media was not involved in the creation of this content.