Immuta

• Snowflake invested in Immuta yet ships native governance through Horizon Catalog, and Databricks ships governance through Unity Catalog, so the platforms Immuta embeds in could extend their own access controls and absorb the layer Immuta sells at its deepest point of integration.
• Immuta's one-billion-dollar valuation dates to 2022, before the AI funding wave, so if the agentic data access pivot does not reopen growth, a down round or stalled raise would weaken its standing against better-capitalized data-security peers.
• Microsoft Purview and the major data clouds hold the same data and can extend classification and access control into the AI path, so Immuta's cross-platform advantage narrows as each platform deepens native governance.
• The GigaOm benchmark against Apache Ranger that Immuta promotes is its strongest comparative proof point, so an independent evaluation showing a smaller ABAC advantage in production would undercut the efficiency positioning.
• The agentic data access capability is early in 2026, so if enterprise AI-agent access governance consolidates around the model and data-platform vendors first, Immuta could miss the window its repositioning targets.

Immuta sells governed data access to the teams that must let people and systems use sensitive data without exposing it. The company frames the buyer as data governance and security teams reconciling fast access with compliance, and it ties the pain to a concrete cost rather than a generality. SiliconANGLE quotes CEO Matthew Carroll saying customers typically cut the number of data access policies they enforce by 75 percent, and that one customer reduced a 400-page policy manual to 56 rules.

Independent reporting grounds the category demand. TechCrunch reported Carroll positioning Immuta against the access-control complexity that GDPR and CCPA drive, cited third-party surveys on the barriers organizations face setting data policy, and named S&P Global and Mercedes-Benz Group among Immuta's customers, evidence that regulated enterprises were already organizing budget around governed data access.

The problem now extends to AI. Immuta positions retrieval-augmented generation and AI agents as a fast-growing class of data consumer and sells policy enforcement plus usage monitoring as the way to scale those workloads without exposing unauthorized data. That reframes a long-standing access problem around the workload pulling hardest on enterprise data today. [s10, s9, s4]

The Immuta platform runs as a unified data access layer rather than a single point feature. The product overview pairs a data marketplace, where teams request and provision access against data-use agreements, with a data access governance module that authors policy in plain language and enforces it across platforms. VentureBeat independently reported the architecture as three modules, Discover, Secure, and Detect, spanning sensitive-data discovery, access control, and activity monitoring.

Attribute-based access control is the technical core. Immuta lets a governor consolidate hundreds of role-based policies into one dynamic ABAC policy, and a GigaOm head-to-head test found its model needed 75 times fewer policy changes than Apache Ranger's RBAC to meet the same objectives. That benchmark is the external validation point that lifts capability above marketing claims, though Immuta commissioned and promotes it.

Enforcement runs natively inside the data platforms. Immuta's chief product officer describes native integrations with Snowflake, Databricks, and Postgres that control access without proxying, which both deepens the technical claim and binds the product to the platforms it sits on. [s11, s3, s12, s16]

Immuta competes in data access governance against both independent data-security platforms and the data clouds moving to bundle the capability. TechCrunch placed BigID and OneTrust among the rivals in this space. The cluster pattern is consolidation, with the data clouds extending native governance into the access-control layer Immuta sells.

Immuta's stated differentiator is cross-platform policy on one engine. The company positions write-once, enforce-everywhere ABAC across Snowflake, Databricks, and Postgres as a tighter alternative to per-platform role-based controls, a claim the GigaOm comparison against Apache Ranger supports for one rival approach.

The structural question is whether the platforms underneath keep ceding the layer. Snowflake invested in Immuta, Snowflake ships native governance through Horizon Catalog and Databricks through Unity Catalog, and Immuta enforces inside both, so the deepest source of Immuta's stickiness is also the relationship that can commoditize it. [s12, s14, s15, s6, s9]

Immuta shows named customer proof across both independent and vendor sources. TechCrunch named S&P Global, Mercedes-Benz Group, and the U.S. Army, SiliconANGLE added Roche and International Consolidated Airlines Group, and the agentic launch blog names JPMorgan Chase, Booking.com, Cigna, and General Motors. That breadth of named references sits at the upper end of what this cluster typically shows.

Independent reporting also carries a growth signal. SiliconANGLE reported Immuta doubled its customer base and grew revenue by more than 130 percent in 2021, and distribution runs through the data platforms, with native integrations on Snowflake and Databricks and Snowflake Ventures investing in the Series E round.

What the public record lacks is recent independent scale confirmation. Carroll declined to disclose recurring revenue or customer count to TechCrunch, and no analyst-audited growth ranking or acquisition price has corroborated momentum since 2022, so the traction read rests on named logos and a dated growth figure rather than current verified scale. [s9, s10, s8]

Immuta's leadership pairs a founder-CEO with a product executive drawn from developer tooling. TechCrunch reports that Matthew Carroll co-founded Immuta in 2015 with Steven Touw and Mike Schiller, after a career that began as a U.S. Army intelligence officer, and the about page lists him on both the leadership team and the board. Chief Product Officer Mo Plassnig is the public voice on the native-enforcement architecture.

The investor signal reinforces the team's standing. The 2022 round was led by NightDragon, whose founder Dave DeWalt was previously CEO of FireEye and McAfee, with Snowflake Ventures joining and existing backers Dell Technologies Capital and Intel Capital participating, validation from firms that fund and operate security and infrastructure companies.

The credibility comes from the build itself rather than a prior exit. Carroll's record is the decade he has spent scaling Immuta into a unicorn, not an earlier company sold into a larger platform, and the public record reviewed did not surface a sustained research or publication program of the kind that lifts the strongest teams in the category. [s9, s5, s10]

Immuta sells into regulated enterprises and government, which sets a high bar for assurance evidence. The homepage logo wall and independent reporting name buyers including JPMorgan Chase, Swedbank, Roche, and the U.S. Army, whose procurement requires security attestations and data-handling terms before the platform touches sensitive data.

The trust portal documents an inspectable posture. Immuta lists an AICPA SOC 2 Type 2 attestation, ISO 27001 and ISO 27701 certifications, and A-Lign PCI DSS, and states that its security measures are audited annually by an independent external party, with the SOC 2 report available on request through an account manager. These are enterprise-grade procurement assurance rather than a moat.

The product's position raises the assurance stakes regardless of the badges. Because Immuta inspects an organization's data, classifies sensitive fields, and enforces access inside the data platforms, a review will examine how Immuta handles the metadata and audit records it generates, terms that sit beyond what the published attestations cover. [s7, s1, s8, s10]

Add analyzed competitors to compare them side by side with Immuta.

Immuta sells to the data governance and security teams inside large regulated enterprises and government agencies. Immuta's customers page names General Motors, Swedbank, Thomson Reuters, Roche, IAG, and JPMorgan Chase, and its agentic-access launch adds Booking.com and Cigna, the buyers whose data exposure carries regulatory and contractual cost. TechCrunch independently named S&P Global, Mercedes-Benz Group, and the U.S. Army when it covered the 2022 round.

The buyer is the team that must reconcile fast data access with compliance. Immuta frames the persona as governors and stewards who define access policy once and enforce it across every platform, and it ties the pain to a concrete cost. SiliconANGLE quotes the chief executive on customers cutting enforced policies by 75 percent, with one reducing a 400-page policy manual to 56 rules.

The segment now extends to a new consumer of enterprise data. Immuta positions retrieval-augmented generation and AI agents as a fast-growing class of data consumer and sells policy enforcement plus usage monitoring as the way to scale those workloads without exposing unauthorized data.

Attribute-based access control is the technical core. Immuta lets a governor consolidate hundreds of role-based policies into one dynamic attribute-based policy authored in plain language, and Immuta's own page describing a GigaOm head-to-head comparison reports that model needing 75 times fewer policy changes than Apache Ranger's role-based approach, a vendor-hosted account of the result rather than the report itself. The engine discovers, tags, and classifies sensitive data, then compiles policy and masking that the monitoring layer reports against.

The claimed advantage is where enforcement happens. The chief executive describes writing code natively into each compute layer so policies run inside Snowflake, Databricks, and Postgres rather than through a proxy. VentureBeat independently reported the same native-enforcement design and a patented sensitive-data discovery approach that classifies data without it leaving the database.

What holds up is engineering depth rather than a data moat. The classification models and the policy library are accumulated intellectual property a funded rival could rebuild from the same public techniques, and the GigaOm result is a comparison Immuta commissioned and promotes. No named non-public cross-customer dataset appears in fetched sources to compound the advantage with usage.

Immuta runs an enterprise sales motion distributed through the data platforms its customers already buy. Native integrations with Snowflake and Databricks put it inside the ecosystems its buyers already run, and Snowflake Ventures invested in the 2022 Series E, coupling go-to-market to the Snowflake relationship. The reviewed pages document the integrations and the investment but no marketplace listing or partner-led sales channel.

Named customer proof spans independent and vendor sources. TechCrunch named S&P Global, Mercedes-Benz Group, and the U.S. Army, SiliconANGLE added Roche and IAG, and the agentic launch names JPMorgan Chase, Booking.com, Cigna, and General Motors. SiliconANGLE also reported Immuta doubled its customer base and grew revenue by more than 130 percent in 2021.

What the public record withholds is recent independent scale confirmation. Carroll declined to disclose recurring revenue to TechCrunch, and no analyst-audited growth ranking or acquisition price has corroborated momentum since 2022, so the traction read rests on named logos and a dated growth figure rather than current verified scale.

Public sources reviewed do not disclose Immuta's price or contract unit. Unpublished pricing alongside a roster of large enterprises and the U.S. Army points to negotiated enterprise deals, an inference rather than a stated fact. The absence withholds the budget-anchoring signal some data-security peers publish.

The platform's framing suggests the value meter is policy reach rather than seats or scans. Immuta sells write-once, enforce-everywhere policy across Snowflake, Databricks, and Postgres, so the natural unit is the number of platforms and the volume of governed data under one policy engine, though the public record does not state which Immuta actually charges by.

The economic pitch is the cost the policy model removes. The GigaOm comparison frames the 75-times policy reduction as raising cloud return on investment, so Immuta sells against the labor of writing and maintaining per-platform role-based policies rather than against a rival's list price. Confirming the contract unit would require a sales conversation.

Immuta delivers as software the customer configures and operates, enforcing inside the data platform rather than proxying traffic through its own infrastructure. The chief executive describes embedding code natively into each compute layer so the governance team authors policy and enforcement happens on the data without rerouting queries. Native connectors cover Snowflake, Databricks, Postgres, and BigQuery.

The platform pairs three operating pieces. A data marketplace lets teams request and provision access against data-use agreements, a data access governance module authors and enforces policy across platforms, and a monitoring layer reports query histories, sensitive-data indicators, and classification changes, closing the loop from policy to audit.

The public trust page lists the controls and attestations openly, while the SOC 2 report itself is obtained through an account manager. The portal documents an annual external audit, and the customer obtains the underlying SOC 2 report through an account manager, so a buyer evaluates data-handling and retention terms in a formal review rather than from a published service-level commitment.

Immuta maintains a real, inspectable trust posture for a product that classifies and governs sensitive enterprise data. The trust portal lists an AICPA SOC 2 Type 2 attestation, ISO 27001 and ISO 27701 certifications, and A-Lign PCI DSS, and states a role as both data processor and data controller under the GDPR.

The attestations are enterprise-grade procurement assurance rather than a moat. Security measures are audited annually by an external party, and the SOC 2 report is available on request through an account manager rather than open download. That breadth eases the security review that government and regulated buyers run before the platform touches sensitive data.

The product's position raises the assurance stakes regardless of the badges. Because Immuta inspects an organization's data, classifies sensitive fields, and enforces access inside the data platforms, a review will examine how Immuta handles the metadata and audit records it generates, terms that sit beyond what the published attestations cover.

Immuta positions itself as the policy and governance layer that sits inside the modern data stack rather than a console that replaces it. The platform operates natively inside cloud data platforms, and its connectors span Snowflake, Databricks, Postgres, and BigQuery, so the platform claim rests on being the one place a governor authors policy that every connected platform then enforces.

That ownership is a sharper position than tools that sit beside the data, and it is also the dependency. Immuta enforces inside platforms it does not own, so its reach is bounded by the connectors it builds and the cooperation of the platforms underneath. The native depth that makes policy run at query time is the same depth that ties Immuta's reach to those vendors' roadmaps.

The exposure is that the hosts ship competing governance. Snowflake invested in Immuta yet ships native governance through Horizon Catalog, and Databricks ships Unity Catalog, so the platforms Immuta embeds in can extend their own access controls and absorb the layer Immuta sells at its deepest point of integration.

Immuta's credibility comes from a founder who has run the company for a decade. TechCrunch reports that Matthew Carroll co-founded Immuta in 2015 with Steven Touw and Mike Schiller, after a career that began as a U.S. Army intelligence officer, and built it into a data-access company that reached a one-billion-dollar valuation in 2022. The about page lists him on both the leadership team and the board.

The investor bench reinforces the founder signal. The 2022 Series E was led by NightDragon, whose founder Dave DeWalt was previously CEO of FireEye and McAfee, with Snowflake Ventures joining and existing backers Dell Technologies Capital and Intel Capital participating, validation from firms that fund and operate security and infrastructure companies.

The credibility comes from the sustained build rather than a prior exit. Carroll's record is the decade he has spent scaling Immuta into a unicorn, not an earlier company sold into a larger platform, and the reviewed sources do not establish a sustained research or publication program of the kind that lifts the strongest teams in the category.