About LayerV
AI-powered attackers find and exploit anything exposed online in minutes. LayerV keeps your apps, APIs, and agents invisible by default, reachable by invitation, and gone when done.
Tell us about your background.
I’ve spent about 25 years in security, mostly on teams that had to ship. At Microsoft I built tracking protection that the FTC adopted. I helped launch Apple Pay at Visa and Disney+ at Disney, and I’ve also worked at Cisco/AppDynamics and CrowdStrike. Launches teach you where security actually breaks: at scale, under real traffic, usually at 2 a.m.
I co-authored OpenNHP, the authenticate-before-connect protocol ratified by the Cloud Security Alliance, and contribute to its IETF Internet-Draft. I started LayerV with Ben Chen and Joe Ollis to turn that standard into infrastructure that people and AI agents can use without becoming protocol experts.
Tell us about your business/idea.
LayerV makes software invisible to everyone except the people and AI agents it’s meant for. Our product, qURL, puts an app, API, MCP server or dataset behind authenticate-before-connect: nothing answers until the requester proves who they are, and access is scoped to the task and expires when it’s done. To a scanner, there’s nothing there.
We’re focused first on the fastest-growing source of exposure: AI-generated software. With one command, a just-built app becomes a private, expiring link instead of a public endpoint. Builders and agents use qURL through our CLI, desktop app, API, SDK and MCP tools, alongside the identity and security tools they already run.
What was the original inspiration for your company/product?
The internet was built on reachability. Every server answers anyone who knocks, and security is the pile of locks we add afterward. Each exposed service becomes something you defend indefinitely, and an attacker only needs the one you forgot.
Outside security, I design large-scale treasure hunts, which is mostly the study of how people search. The best hiding place is the one nobody knows to look in. So we reversed the order: verify the requester first, then make the resource reachable to that requester alone. OpenNHP defines how. LayerV makes it something a developer, or an agent, can turn on with one command.
What’s your vision for the future? What will the market you are pursuing look like in 5-10 years?
Within a decade, most traffic on the internet will be agents acting on someone’s behalf, and most new software will be written by AI. Much of it will be short-lived and built for an audience of one person, one team or another agent. The reachable-by-default internet can’t absorb that. Attackers have the same AI, and no security team can review, scan and patch software as fast as it’s now being generated.
So the internet’s defaults will flip. Resources will stay invisible until a verified requester asks for them. Access will be granted per task and end when the work is done. Long-lived credentials and open ports will look as dated as login pages without HTTPS. In that world, the scarce resource is trust: knowing who an agent is, who stands behind it, and who stands behind what it’s reaching. Whoever runs that verification becomes core internet infrastructure.
How does your business address pressing cyber and data challenges for the commercial sector?
Every company is now a software factory, whether it planned to be or not. Employees ship internal tools, dashboards, prototypes and MCP servers with AI coding assistants, often outside the review process that used to catch mistakes. Each one adds attack surface that most security teams can’t inventory, let alone defend. Trying to secure AI-generated software after it’s exposed is a race defenders lose.
qURL removes the exposure at the moment of publishing. The app stays invisible to scanners and reachable only by the people and agents granted access. Access expires on its own, and owners get a record of who reached what and when for audit and incident response. Builders keep moving at machine speed, and security teams get control without becoming the bottleneck. The protocol underneath has held up through more than a million scans by testers from over ten countries at IETF hackathons.
What attracted you to the DataTribe Foundry? Why did you choose to participate in the DataTribe Challenge?
DataTribe co-builds companies rather than only funding them, and it understands that security is a trust business. A company that wants to help the internet decide whom to trust has to earn that trust first, and that takes go-to-market discipline as much as good cryptography.
Being named a finalist puts our approach in front of people who understand both the technical problem and what it takes to build a company around it. We want their hardest questions about where this matters most and what we need to prove next.
What’s your long-term vision for your business?
We want LayerV to be the trust authority for the agentic internet: a verification network for agents that also works for humans, invisible by default. It decides who gets to connect before anything is exposed.
Adoption comes first. Builders and their agents use qURL free to keep what they make private, and every connection proves the requester is the same one that was granted access. The business is proving who: verified organizations standing behind their resources and their agents, with the policy, revocation and audit enterprises require. OpenNHP stays an open standard, much as TLS is. LayerV plays the role certificate authorities played for the web, vouching for who is on each end. The goal is for private, verified access to be as easy as sharing a link, while everything else stays hidden.
