GrayPass Builds Post-Login Security for Employee Actions

Teen founders Arav Mathur and Aditya Ranjan are developing software that rechecks user control before sensitive actions, after a successful login.

Updated on Nov. 6, 2026 in Cybersecurity

Dark server racks receding into a hazy industrial room with a brass padlock resting on a rack door in the foreground. — GrayPass, a San Francisco startup co-founded by 19-year-old CEO Arav Mathur, is building software that rechecks user access before sensitive employee actions, beyond the initial login. AI Illustration. Upload story photo >

GrayPass, a San Francisco startup co-founded by 19-year-old CEO Arav Mathur and 18-year-old COO Aditya Ranjan, is building software that works alongside passwords, passkeys, multi-factor authentication, and identity providers. The company is part of Y Combinator's Fall 2026 batch.

Why it matters

The founders argue that a successful login should not be the last meaningful check before a consequential employee action. Their approach aims to reassess access at the moment a sensitive step is taken rather than only at sign-in.

At a protected action, GrayPass's software returns one of four outcomes (allow, verify again, hold, or deny) based on identity, device, session, and transaction context. Its behavioral layer, which it calls a "Brainprint," models typing rhythm, cursor movement, scrolling, and pauses rather than message content.

The players

GrayPass

GrayPass is a San Francisco startup building post-login security software for sensitive employee actions, and it is part of Y Combinator's Fall 2026 batch.

Y Combinator

Y Combinator is a Silicon Valley startup accelerator that runs batch-based programs for early-stage companies.

The details

GrayPass evaluates identity, device, session, and transaction context alongside behavioral signals when a protected action occurs, and the application determines how to enforce the result. The founders met on their first day of high school in 2021 and moved to San Francisco in 2026 to run the company full time.

2021: Mathur and Ranjan meet on their first day of high school.
Fall 2026: GrayPass joins Y Combinator's batch.
2026: The founders move to San Francisco to run GrayPass full time.

Roadmap

Passkeys and multi-factor authentication have become common safeguards at sign-in, but they verify identity at a single moment. GrayPass extends that model by reassessing control when a consequential action occurs after login.

For employees, the approach could mean an extra verification step when performing sensitive actions after signing in. For organizations, it introduces a new layer of access control that depends on how the four possible decisions are enforced.

The takeaway

Strong login protection does not end at sign-in, so reassessing access before consequential actions may become a more common security expectation. Readers evaluating identity tools can ask how a product handles risk at the moment a sensitive action is taken.