A Clean Foundation for Innovation Rita Gurevich and Cyber Hygiene

Four years into a stint at Lehman Brothers, Rita Gurevich found herself in the middle of the worst global financial crisis since the Great Depression. “It felt like the world was in complete disarray,” she recalls. “A lot of people were questioning what to do next.” 

Lehman’s overexposure to the collapsing sub-prime mortgage market in 2008 spelled the end for the company. For Gurevich, though, it was just the beginning of a life-changing journey.  

Gurevich began working at Lehman Brothers through a co-operative program while studying Computer Science and Mathematics at Stevens Institute of Technology in New Jersey. An avid student with interests in emerging technologies, she was immediately drawn to the intricate suite of programs supporting one of the largest investment banks in the United States.  

In 2008, just two years after graduating from Stevens, Gurevich had worked her way up to an assistant vice president role at Lehman. The looming financial crisis brought an aura of chaos and uncertainty, but when Lehman Brothers eventually filed for bankruptcy, Gurevich decided to stay on board as entities including Barclay’s and Nomura Holdings bought up its assets. She saw a unique opportunity to get hands-on experience in uncharted waters. “There was an immediate need for the bank to disseminate its technology stack- something which had never been done before,” she says. “I and everyone else who stayed embarked on a historic exercise in big data analysis.” 

What could have been a staggering blow to her emerging career turned out to be an invaluable springboard. Gurevich and her colleagues embarked on an unprecedented effort to divide up Lehman’s tech stack and ensure the company’s buyers received desegregated data that their competitors couldn’t access, all while meeting new expectations and regulations around data governance.  

For Gurevich, it was a revelation. “I realized large financial services firms were still struggling to understand the concepts of risk assessment and remediation,” she says. She felt an entrepreneurial spark: why not found her own company to address this problem? Gurevich knew her skillset was highly valuable and matched an industry-wide need. She envisioned herself helping companies clarify and manage access within increasingly complex technology stacks. Starting a company, though, is easier said than done.  

Gurevich needed to refine and test her thesis before taking the leap into founding. She spent the next two years working at Barclay’s Capital and data protection company StealthBits Technologies (now merged with Netwrix), exploring gaps around data and access controls.  

What Gurevich found was more evidence of the market need she first encountered with Lehman. Companies were finding it incredibly painful to manage access within outdated and disparate systems. “So many companies were either overlooking the importance of access management or using inefficient manual solutions,” she says. Overly permissive access brought serious risks, making it easier for hackers to traverse company networks and, in the tightening post-2008 regulatory environment, clashing with new data governance and compliance expectations.  

The final pieces soon fell into place for Gurevich. She would build an end-to-end identity hygiene solution, giving organizations visibility into who has access to assets and securing their systems. But she faced a hurdle every founder has encountered: successful businesses are built on more than just good ideas. She needed a viable business model.  

Fortunately, Gurevich had an ace up her sleeve: her network. Many of her Lehman colleagues had moved on to other investment banks and Gurevich had worked hard to maintain strong connections across the industry. Her efforts paid off in the form of a forward-thinking, captive audience that was interested in hearing about her business. Through conversations across her network, Gurevich determined that SPHERE’s business model should leverage a combination of automation and expert guidance- a tried and true model for effective services startups. She was ready to make her move.  

In 2010, Gurevich launched SPHERE to help businesses address governance, security, and compliance concerns by managing access controls. In the early days, the company operated on a consulting model, helping clients update, revoke, and secure permissions across their environments. “We called ourselves ‘access control janitors’- we analyzed and cleaned up permissions to lower risk,” Gurevich recalls. 

SPHERE’s first customers were major financial services companies including Barclay’s, a function of Gurevich’s career path. She notes how counterintuitive it may have seemed from an outsider’s perspective. “Financial services companies had the most sophisticated technology stacks- not to mention, we were in the middle of a recession with unpredictable markets,” she says. “I can see how people probably thought it was an odd time and place to start a company.” 

But SPHERE’s approach ended up being an advantage. With a core client base of large enterprises in critical infrastructure and other highly regulated spaces, Gurevich’s team tackled the most complicated issues from the very beginning. While this created a demanding learning curve, as SPHERE grew, it became easier to scale since they had already solved so many of the problems their clients faced.  

Over time, SPHERE built out an impressive set of capabilities including end-to-end discovery and visibility across assets, paired with actionable intelligence and ongoing remediation to automate access control. They offered their customers newfound abilities to effectively implement zero-trust initiatives and easily comply with regulatory requirements. 

All the while, SPHERE was jockeying for position against larger players in the market. To stand out, Gurevich and her team developed strong value-added services and meaningful relationships. “We were a small, nimble company that was able to adapt to changing times and align with each client’s needs,” Gurevich says. “We learned the importance of delivering a successful product and maintaining positive relationships with each client.”  

Gurevich and her team bootstrapped SPHERE for ten years, integrating new technology, automation, and talent along the way. In 2020, she began considering outside investment for the first time when she was approached by Forgepoint Capital. Gurevich realized that partnering with venture capital firms could give SPHERE access to new networks of supporters, business executives, and entrepreneurs to help even more organizations reduce risk through cleaner permissions environments. Forgepoint would eventually lead SPHERE’s $10M Series A round in 2021 and participate in the company’s $31M Series B round in 2022 alongside Edison Partners.  

Today, SPHERE has a full-fledged flagship platform- SPHEREboard- with automated detection and remediation capabilities. ‘Identity hygiene’ is the company’s new calling card for their holistic identity and data security offerings.  

Gurevich cites SPHERE’s continued focus on their customers’ needs as a key differentiator in an increasingly competitive cybersecurity market. She encourages her team to practice respect, empathy, and kindness with both existing and potential clients. SPHERE integrates customer perspectives into their work to maintain practical project scopes and timelines.  

Good customer relationships are only half of the battle, though. “The only way to grow and maintain the relationship is to deliver value in a distinctive manner,” Gurevich says. Innovation will always power the company’s customer relationships. The dual-faceted approach has helped the company maintain clients including Goldman Sachs, Freddie Mac, and Northwell Health. 

Gurevich is also passionate about using SPHERE to advocate for women and other underrepresented groups in tech. “Great inventions come from people with unique perspectives, no matter their age, gender, ethnicity, or background,” she says. Gurevich is committed to building a diverse team and inclusive company culture to promote creative and innovative solutions for customers. To put these ideas into formal practice, SPHERE launched the SP(HER)E initiative in 2022 to highlight diverse women in cybersecurity and partner with local companies to recruit recent high school graduates for short-term internships. 

“Cleaning up end user and privileged access isn’t glamorous, but it’s what enables AI and other technologies to succeed.” 

There’s a lot of room for SPHERE to continue expanding and help more companies protect their data. While technologies, cyber threats, and cybersecurity capabilities have progressed significantly since 2010, fundamental identity and access issues are still common. Companies are often hindered by cluttered foundations when integrating cutting-edge technologies like generative AI. SPHERE’s mission remains critical as companies increasingly pursue digital transformations. “In SPHERE’s early days, a core part of our customer messaging was education around clean, standardized permissions,” Gurevich notes. “Now, we focus on accelerating their permissions objectives and expanding coverage to achieve scalable security at a more granular level.” 

Gurevich knows her company has an important role to play as companies embrace new technologies. “Cleaning up end user and privileged access isn’t glamorous, but it’s what enables AI and other technologies to succeed,” she says. Gurevich intends to lean in on the winning formula that has brought SPHERE success over the past fourteen years. “We’re going to continue providing our clients with clean environments, peace of mind, and the freedom to scale up safely.”