TruU is a security company that detects threats from identities whose behaviour drifts away from their purpose, whether they are employees, contractors, service accounts or AI agents.
Its platform, TOTAL, is for security teams who need to spot an identity that still holds the same access but has started using it differently. Instead of relying on rules and static permissions, it learns what normal looks like for each identity and raises a threat when that changes.
At A Glance
| Vendor | TruU |
|---|---|
| Category | Agentic threat defence, passwordless authentication and NHI discovery |
| Identities covered | Employees, contractors, service accounts, service principals, IAM roles, API keys, tokens, AI agents, RPA bots |
| Deployment | Agentless connectors; discovery agents run inside the customer network |
| Agentic AI | Persona behavioural model, AI Judge, Rogue Agents fleet reasoning |
| Headquarters | Santa Clara, United States |
| Market classification | MFA & Passwordless; also Biometric Platforms |
What TruU Does
A compromised service account or a departing employee rarely breaks a rule; they use access they already have in a new way. TruU’s answer is to model each identity rather than its role: “A Persona isn’t a rule, a job title, or a directory group.” TOTAL maps humans and NHIs into one identity fabric, learns how each behaves, and compares every prediction with that identity’s own baseline and its peers before raising a threat. One model then serves detection, verification and sign-in alike. TruU reports a short onboarding: setup in 15 minutes on day 1, personas across the workforce by day 3, and real threats replayed and predicted by day 7.
Products
NHI Discovery
Security teams often cannot say how many service accounts, keys and agents they have, let alone who owns them. NHI Discovery finds service accounts, API keys, tokens and AI agents through agentless connectors, builds a Persona for each, compares it with its peers and graphs what it can reach. It flags drift when an identity’s actions move away from its purpose even if its permissions have not changed, links each agent to the human steward who controls it, and sorts identities into archetypes with credential age, steward and a recommended next action.
Rogue Agents
A single agent may look harmless while a group of agents together does something dangerous. Rogue Agents reasons across the whole fleet rather than one agent at a time. A Rogue Fleets view shows how far a fleet reaches and how its members coordinate, and the product tracks both steward intent drift and agent execution drift. It describes threat patterns such as the Turned Agent, the Injection Cascade and the Dormant Swarm.
Insider Threat
Insider Threat is for teams trying to catch the departing employee or rogue administrator before data leaves. It measures each person’s Persona drift from baseline and peer group, and reasons over sequences of events to judge intent ahead of exfiltration. Named scenarios include the Attriting Employee, the Rogue Admin and the IP Thief.
Identity Verification
Help desks, MFA resets and contractor onboarding are where impersonators get in. Identity Verification is built to “Confirm a person, not just a document”, using configurable flows of primary, secondary and fallback factors, each given a strength score, for moments such as initial enrolment, privileged access requests and HR interviews.
Passwordless
Passwordless gives workforces phishing-resistant FIDO2 sign-in with keys kept on the device. Face and fingerprint are matched locally, and frontline and shift workers can use PIN, mobile or badge sign-in. One admin console covers Windows, macOS, iOS, Android, VDI, VPN, SaaS, servers and legacy systems, and the experience can be branded as the customer’s own.
Account Takeover And Continuous Authentication
Account Takeover is designed to catch a hijacked identity fast, and Continuous Authentication keeps checking identity after sign-in rather than trusting a single login.
How It Works
TOTAL connects to sources in minutes without agents, discovers data automatically and maps each schema. Discovery agents operate inside the customer network and never reach out. Data comes from logs, events, IAM, HR, SaaS, EDR and VPN systems, directories and authentication systems.
| Component | What it does |
|---|---|
| Identity fabric | Adds each new person, account or agent to the map as soon as it appears in a source. |
| Persona | A per-identity behavioural foundation model combining entitlement graphs, access traces, device and network posture and communication semantics, trained self-supervised to predict each identity’s next action. |
| Reasoning logic | Tests each prediction against the persona’s baseline and peer cluster. |
| AI Judge | Gathers evidence through connector subagents, grounds it in an attack-vector corpus and routes cases to specialist experts before reaching a verdict. |
| Preventative action | A contextual-bandit policy, post-trained on SOC decisions, chooses graduated responses. |
Identities And Systems Covered
| Human users | Employees, contractors and frontline and shift workers |
|---|---|
| Machine identities | Service accounts, service principals, IAM roles, SaaS integrations, API keys and tokens |
| AI agents | AI agents and RPA bots, linked to human stewards |
| Cloud and identity systems | Azure AD, Okta, AWS, GCP and GitHub |
| Collaboration | Microsoft Graph activity |
Agentic AI Capabilities
Agent Fleets That Build The Model
TruU uses its own agents to run TOTAL. Agent fleets profile each data source and map it to a canonical event model, testing every mapping on held-out data; “TOTAL will not ship a mapping it cannot prove.” Graph agents find machine identities, link them to human owners and watch each against a behavioural embedding for drift.
Rogue Agent Verdicts
For suspect AI agents, the AI Judge decides whether an agent has gone rogue through external compromise, malicious insider use or governance creep. It opens Predict cases with a threat brief, a drift timeline and Mark Safe or Mark Unsafe actions for the analyst.
Company Background
| Headquarters | Santa Clara, California, United States |
|---|---|
| Team | Eighty-five people |
| Leadership | Atul Kapadia (CEO), Lucas Budman (Co-Founder and CTO) |
Note: This overview is compiled from TruU’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.