Nudge Security

• The patented discovery method depends on continued read access to Microsoft 365 and Google Workspace, which Microsoft and Google control.
• The two granted patents cover email-based discovery, and the reviewed record documents no patent protection for the newer browser and app-connection channels.
• Customer-scale claims come from the company, so traction could prove thinner than the published reference list suggests.
• No source in the reviewed record reports the customer base after 2023, so a stalled account base would stay out of the public record for some time.
• The company states it does not block or limit access to SaaS applications, so buyers who want that control could treat Nudge Security as a discovery feed and buy blocking elsewhere.
• Omdia records that the mailbox method cannot see an account an employee creates with a personal webmail address, so a workforce that routes around corporate mail would shrink the inventory.

Employees adopt SaaS and AI applications faster than a central IT team can record them, and Nudge Security sells the inventory that closes that gap. The buyers are IT and security teams at companies running Microsoft 365 or Google Workspace who have no single list of what their people signed up for.

Omdia calls shadow IT a direct consequence of the success of SaaS, which places the problem independently of the vendor. The numbers that size it are the company's own. Dark Reading carried a Nudge Security finding that organizations averaged six AI tools in use, and that is coverage of the company's data rather than an independent measurement.

The timing argument is that AI capability now sits inside ordinary business applications, so governing AI use means governing the whole application estate. That framing dates to the November 2025 funding round, and the OAuth and browser-extension agents announced in July 2026 for select customers extend it. Buyers do face more applications to govern, though the reviewed evidence carries the company's account of demand rather than an outside measure of it. [s17, s18, s1, s11, s23]

Nudge Security finds applications by reading the automated mail that SaaS providers send. The product connects to the customer's Microsoft 365 or Google Workspace accounts with read-only access, and two granted U.S. patents describe heuristic pattern analysis over that mail combined with machine learning.

Two newer discovery paths now sit beside the patented one. A browser extension passively observes employees creating agents in Cursor, Zapier, Retool, and similar tools, and connected apps pull agent inventories from Salesforce Agentforce, Microsoft Copilot Studio, and other agent-building platforms. The company calls agent discovery a research preview. TechCrunch reported at the 2022 launch that the product uncovered SaaS assets without browser extensions or API integrations, so the mechanism has broadened since.

Past discovery, the product monitors application configurations and the integrations attached to them, and it publishes security profiles covering a large catalog of SaaS vendors. Remediation runs through an automated message to the employee who owns the app, and the company states it does not block or limit access to SaaS applications. Agents announced in July 2026 for select customers analyze OAuth grants and browser extensions and hand the decision to a person. [s16, s22, s7, s14, s8, s23, s2]

Nudge Security competes in a crowded stretch of the SaaS security market, and its own product page names Wing Security, Grip Security, Valence Security, Push Security, and Lumos as companies focused on SaaS security management. That is the company's account of its field rather than an outside one.

Omdia named Grip Security and Push Security as vendors focused on the discovery side of SaaS security when it assessed the company in 2023, and it placed BetterCloud, Zluri, and Torii HQ in a separate group that starts from licence management. Grip starts by inspecting identities and credentials rather than mailbox contents.

Microsoft and Google pose a different kind of competitive question than the specialists. Both control the workspace mail the patented discovery reads, so the method depends on continued access to platforms they own. [s2, s17, s16, s1]

Nudge Security sells through a self-serve trial alongside sales-assisted enterprise contracts. Its pricing page publishes a flat monthly rate for small teams with no per-seat math, a per-user rate that scales with headcount above that, and custom contracts with volume pricing above that band. The unit is the active Google Workspace or Microsoft 365 account, the same mailbox the discovery engine reads, and a free trial starts without a credit card or a sales conversation.

Named references sit on the company's own pages. The customer stories page carries KarmaCheck, Stravito, Watershed, GLAAD, gridX, and Wallace Plese + Dreher, and Reddit's security chief is quoted by name in the November 2025 funding announcement. The AWS Marketplace listing carries 31 reviews syndicated from G2, which is buyer testimony hosted outside its own pages.

Omdia recorded just over 50 paying enterprises in a report published in October 2023, and no later outside figure appears in the reviewed sources, so the customer base the company now claims carries no outside measurement. [s4, s10, s9, s19, s17]

Russell Spitler and Jaime Blasco founded Nudge Security in 2021 after senior roles at AlienVault and AT&T Cybersecurity. SecurityWeek and Omdia both record that the pair created and operated the AlienVault Open Threat Exchange, an open threat-intelligence community, and CRN records that Spitler joined AT&T through the 2018 acquisition of AlienVault, where his last title was senior vice president of product.

The record reaches back further for Blasco. An RSAC speaker profile tied to a 2019 presentation describes him as a security researcher whose work on emerging threats is frequently cited in the general press, and it names two earlier startups he founded in web application security, source code analysis, and incident response. Omdia records 13 years at AlienVault ending as vice president and chief scientist.

The founding idea reached outside security for its method. TechCrunch reported at launch that the company worked with Aaron Kay, a psychology professor at Duke University, on applying psychology research to the product, which is an unusual input for a security tool and explains the company name.

The bench has widened since. A leader with 20 years of go-to-market experience at security companies now runs global sales, marketing, product success, and revenue operations, and another joined after holding the chief technology officer position at TruSTAR, which Splunk acquired in 2020. [s12, s17, s21, s13, s14, s3]

Nudge Security runs a trust center on SafeBase at trust.nudgesecurity.com, which lists CCPA, HIPAA, SOC 2, and GDPR under compliance, and its own trust page states the company holds SOC 2 Type II.

No ISO 27001 certification appears on those pages or elsewhere in the reviewed sources. The trust center is the assurance surface a buyer at this price point has, and the reviewed record names no regime that mandates this product class.

The design limits email retention and human access. The vendor states it keeps no permanent copy of email and grants no human access, and it describes the service as less invasive than a spam filter. The pricing FAQ adds that a customer can delete its account and all data and revoke workspace access at any time. [s6, s5, s4]

Add analyzed competitors to compare them side by side with Nudge Security.

Nudge Security's published pricing puts the product within reach of midsize IT and security teams. The pricing page charges a flat monthly rate for small teams with no per-seat math, a per-user rate that scales with headcount above that, and custom contracts with volume pricing beyond that band.

Omdia put the sweet spot at companies with 500 to 5,000 employees in a highly distributed environment, selling into IT and security teams. The segment is defined by a shared condition rather than by an industry, and the company describes customers spanning software, financial services, healthcare, biotechnology, and entertainment.

The assurance package matches that segment. The trust page states the company holds SOC 2 Type II, which is the assurance surface a midsize buyer has before connecting a product to its mail. The trust center lists CCPA, HIPAA, SOC 2, and GDPR, and the record names no regime that requires more for this product class.

The distinctive capability is discovery through automated email. Two granted U.S. patents describe heuristic pattern analysis over incoming mail combined with machine learning, which lets the product find applications an employee signed up for through the mail the application itself sent.

Two further discovery paths now run beside it. Connected apps pull agent inventories from Salesforce Agentforce, Microsoft Copilot Studio, and other agent-building platforms, while a browser extension passively observes employees creating agents in Cursor, Zapier, Retool, and similar tools. The company calls agent discovery a research preview. The patents describe email-based discovery, and the reviewed record documents no patent covering the newer channels, so the exclusive part of the discovery system is its oldest path.

AI is both the subject and the method here. The product inventories AI apps and agents as assets to govern, watches for sensitive data employees share with AI chatbots, and uses machine learning inside the discovery engine. Remediation stays human-in-the-loop, and agents announced in July 2026 for select customers analyze OAuth grants and browser extensions and hand the decision to a person.

The company sells self-serve first and moves to sales for larger accounts. A free 14-day trial runs without a credit card or a sales conversation and delivers an inventory after a setup the company describes as five minutes. Beyond the published bands the pricing page routes the buyer to a negotiated agreement.

Distribution reaches beyond direct selling in one documented way. AWS Marketplace carries a Nudge Security listing priced by the same active-account unit, which puts the product in a procurement channel outside the company's own sales process.

Reference selling is doing real work. The customer stories page publishes six named accounts, and Reddit's security chief speaks on the record in the funding announcement. What outsiders record is Omdia's figure of just over 50 paying enterprises in October 2023 and 31 reviews syndicated from G2 onto the marketplace listing.

Nudge Security publishes its pricing, which fits a self-serve sale. The unit is the active Google Workspace or Microsoft 365 account, the same mailbox the discovery engine reads, so a buyer pays by the surface the product actually covers.

The structure has three steps. A flat monthly fee covers small teams with no per-seat math, a per-user rate scales with headcount through the middle band, and estates above it move to custom contracts with volume pricing. Both published tiers state that all features are included, billed annually. The feature list marks configuration and integration posture management with a dollar symbol the page does not explain.

Charging per mailbox rather than per discovered application keeps the bill predictable as sprawl grows. Per-mailbox pricing also caps upside, because a customer whose application count triples pays the same as one whose count holds steady. The company does not let a buyer meter part of a domain, so the price tracks the whole workspace.

Nudge Security is software the customer connects and operates. Setup is a read-only connection to the workspace provider, with the browser extension and app connections added as the customer chooses.

The service runs on AWS using microservices and serverless components, with logical tenant separation and least-privileged access described on the trust page. Nothing in the reviewed sources describes an analyst team that operates the product on a customer's behalf or accepts responsibility for outcomes.

Where automation cannot close a finding, the product routes the work to a person. That last-mile step is a workflow the customer's own staff runs, and the agents announced in July 2026 keep a person in the decision rather than acting alone.

The company publishes a SafeBase trust center at trust.nudgesecurity.com, which lists CCPA, HIPAA, SOC 2, and GDPR under compliance, and its own trust page states it holds SOC 2 Type II.

No ISO 27001 certification appears on those pages or elsewhere in the reviewed sources. The trust center is the assurance surface a buyer has, and the reviewed record names no regime that mandates this product class.

Reading corporate mailboxes is a material trust consideration for this product. The trust page answers it by describing no permanent storage of email and no human access, the architecture section describes tenant separation on AWS, and the pricing FAQ says a customer can delete its account and all data and revoke workspace access at any time.

Nudge Security behaves as a platform with application features rather than as infrastructure other systems depend on. It reads from Microsoft 365, Google Workspace, and a growing list of business applications, and it publishes an API, but nothing routes through it in the way traffic routes through a gateway.

Its ecosystem reach is broadest on the discovery side. The company claims posture coverage across a very large catalog of SaaS and AI tools with or without an API integration, and it publishes vendor security profiles drawn from that catalog.

The company publishes a public directory of those profiles. Open access puts the research in front of buyers who have not bought anything. It also means the published output is not exclusive to paying customers, and the reviewed sources establish no exclusive corpus behind it.

Russell Spitler and Jaime Blasco founded the company in 2021 out of AlienVault and AT&T Cybersecurity, where Blasco led the Alien Labs threat intelligence and data science unit. SecurityWeek and Omdia both record that the pair created and operated the AlienVault Open Threat Exchange, so the in-domain track record rests on published accounts rather than claimed ones.

CRN and Omdia place Spitler as AlienVault's senior product lead through the 2018 sale to AT&T, and Omdia records 13 years at AlienVault for Blasco ending as vice president and chief scientist. An RSAC speaker profile tied to a 2019 presentation names two earlier startups Blasco founded in web application security, source code analysis, and incident response.

The founding thesis borrowed from outside security. TechCrunch reported that the company worked with Aaron Kay, a psychology professor at Duke University, on applying psychology research to the product. That is an unusual input for a security product and it explains the name.

The bench has widened since. A leader with 20 years of go-to-market experience at security companies now runs global sales, marketing, product success, and revenue operations, and another joined after holding the chief technology officer position at TruSTAR, which Splunk acquired in 2020.