# Hegen

*/Startups/Hegen*

## Startup Overview

This policy-as-code access engine automatically reconciles unstructured access logs with zero-trust policies. It ingests raw authentication data and permissions telemetry across distributed systems, parsing fragmented log entries to verify whether active user sessions and machine-to-machine connections comply with defined security architectures.

Security and compliance teams manage an overwhelming volume of access requests and permission creep that outpaces traditional manual access reviews. These teams routinely fail to map chaotic, unstructured application logs back to strict zero-trust compliance mandates without dedicating extensive engineering time to log normalization and manual audits.

Unlike legacy identity governance tools like SailPoint or data security platforms like Varonis that require rigid schema integrations, this engine operates directly on unstructured log data. Operations remain natively auditable via policy-as-code, allowing engineers to version-control their access rules alongside application logic. Priced strictly per resolved access anomaly rather than per active user seat, the system aligns operational costs directly with remediated security risks.

## Startup Founding Hypothesis

**Approach**: that automatically reconciles unstructured access logs with zero-trust policies
**Competitors**:
- [SailPoint](/Competitors/SailPoint)
- [Varonis](/Competitors/Varonis)
- [manual access reviews](/Competitors/manual_access_reviews)
**Differentiator2x2**: priced per resolved access anomaly and natively auditable via policy-as-code

## Startup Solution Coordinate

**Solution**: [Trust Reconciler](/Services/Trust_Reconciler)

## Startup Position2x2

```mermaid
quadrantChart
    title Access Reconciliation Landscape
    x-axis "Fixed Seat License" --> "Pay-per-Anomaly"
    y-axis "Manual Opaque Audit" --> "Native Policy-as-Code"
    quadrant-1 "Outcome-Based Security"
    quadrant-2 "Enterprise Legacy"
    quadrant-3 "Labor Intensive"
    quadrant-4 "Niche Automation"
    "manual access reviews": [0.15, 0.15]
    "SailPoint": [0.25, 0.65]
    "Varonis": [0.30, 0.55]
    "Hegen": [0.85, 0.85]
```

## Startup Customer Journey

```mermaid
flowchart LR; A[Terraform Registry] --> B[Core Parsing Engine]; B --> C[SOC2 Audit Report]; C --> D[Policy-as-Code Ruleset]; D --> E[Enterprise Cloud Environment]; E --> F[Model Context Protocol Spec]; F --> G[Autonomous Security Agent];
```

## Startup Proof Points

_Illustrative — target and order-of-magnitude estimate figures, not an achieved track record (this Thing is concept-stage)._

**Pilot Goals**:
- 30-day enterprise SecOps pilot integrating raw legacy logs: Prove the system maps unstructured anomalies to custom policy-as-code schemas without accidentally revoking high-risk user access.
- 60-day mid-market IT deployment capped at 1,000 resolutions: Validate that the platform maps >95% of anomalies automatically and issues credits for misclassifications within the 24-hour SLA.
**Target Metrics**:
- Target: >95% automated mapping of unstructured access logs to existing directory policies
- Aim: 80% reduction in enterprise compliance audit preparation time
- Target: 100% generation of auditable policy-as-code trails for resolved access incidents
- Aim: <24-hour turnaround for manual parsing logic updates following a misclassification
**Target Case Studies**:
- Mid-market Financial Services IT Director: Automatically resolving routine access anomalies against default zero-trust policies, eliminating manual log parsing without exceeding monthly budget caps.
- Enterprise Healthcare SecOps Team: Mapping unstructured legacy access logs to custom policy-as-code while enforcing human-in-the-loop gates for critical medical staff.
**Testimonial Targets**:
- Enterprise CISO: Expresses confidence in the auditable policy-as-code trail and the strict human-in-the-loop approval gates protecting executive access.
- Mid-Market IT Manager: Highlights relief that bespoke legacy logs are automatically normalized without breaking the predictable monthly budget cap.

## Startup Top Risks

**Risks**:
- Severity: existential · Description: Enterprises refuse to route highly sensitive unstructured access logs to a third-party startup engine due to strict data residency and internal compliance policies. · Mitigation Status: in-progress
- Severity: high · Description: The per-anomaly pricing model triggers unpredictable billing spikes during large-scale network re-architectures, causing procurement teams to revert to flat-rate seat licensing. · Mitigation Status: unmitigated
- Severity: high · Description: Upstream infrastructure providers silently change their unstructured log formats, breaking the reconciliation engine and flooding security teams with false positives. · Mitigation Status: in-progress
- Severity: moderate · Description: Incumbents like SailPoint replicate the policy-as-code audit trail and bundle it for free into existing enterprise identity suites. · Mitigation Status: unmitigated

## Startup Competitors

- [SailPoint](/Competitors/SailPoint) — Incumbent
- [Varonis](/Competitors/Varonis) — Incumbent
- [Manual Access Reviews](/Competitors/Manual_Access_Reviews) — Status Quo
- [Opal Security](/Competitors/Opal_Security) — Identity Platform
- [ConductorOne](/Competitors/ConductorOne) — Access Management

## Startup Token Hero

**Genre**: founding-hypothesis
**Rendered**: Every audit cycle, security leads struggle with manual access reviews. Hegen resolves access anomalies automatically so you can enforce zero-trust policies through auditable code.
**Mechanism**: spine-derived-v1
**Template Id**: spine-founding-hypothesis
**Vocab Fingerprint**: 5f9258993ce6bf77

## Startup Token Positioning

**Genre**: moore-positioning
**Rendered**: Policy-as-code access reconciliation engine for security operations leads at mid-market enterprises. Unlike manual access reviews — automatically resolve access anomalies without manual log normalization.
**Mechanism**: spine-derived-v1
**Template Id**: spine-moore-positioning
**Vocab Fingerprint**: 17a491afb15af5b4

## Startup Token Pitch Deck

**Genre**: pitch-deck
**Rendered**: Problem: Manually auditing fragmented SailPoint logs and Varonis permissions telemetry requires hundreds of engineering hours to satisfy zero-trust mandates.
Solution: Every audit cycle, security leads struggle with manual access reviews. Hegen resolves access anomalies automatically so you can enforce zero-trust policies through auditable code.
Customer: security operations leads at mid-market enterprises
Unlike: manual access reviews
**Mechanism**: spine-derived-v1
**Template Id**: spine-pitch-deck
**Vocab Fingerprint**: edf98dc4a6fc0ebc

## Startup Token M E D D P I C C

**Pain**: Manually auditing fragmented SailPoint logs and Varonis permissions telemetry requires hundreds of engineering hours to satisfy zero-trust mandates.
**Metrics**: Target: Every user session and machine connection is verified against your policy-as-code, with audit-ready documentation generated automatically.
**Rendered**: Pain: Manually auditing fragmented SailPoint logs and Varonis permissions telemetry requires hundreds of engineering hours to satisfy zero-trust mandates.
Economic buyer: Security Engineering Lead
Metrics: Target: Every user session and machine connection is verified against your policy-as-code, with audit-ready documentation generated automatically.
Competition: manual access reviews
**Mechanism**: spine-derived-v1
**Competition**: manual access reviews
**Economic Buyer**: Security Engineering Lead
**Vocab Fingerprint**: e6badc2a42d07b86

## Startup Token Cold Email

**Genre**: cold-email
**Rendered**: Subject: Policy-as-code access reconciliation engine for security operations leads at mid-market enterprises

security operations leads at mid-market enterprises — Manually auditing fragmented SailPoint logs and Varonis permissions telemetry requires hundreds of engineering hours to satisfy zero-trust mandates. Every audit cycle, security leads struggle with manual access reviews. Hegen resolves access anomalies automatically so you can enforce zero-trust policies through auditable code.
**Mechanism**: spine-derived-v1
**Template Id**: spine-cold-email
**Vocab Fingerprint**: 6cae5dd7c2060412

## Startup Token Agent Spec

**Genre**: ai-agent-spec
**Rendered**: Policy-as-code access reconciliation engine. Every audit cycle, security leads struggle with manual access reviews. Hegen resolves access anomalies automatically so you can enforce zero-trust policies through auditable code. Serves security operations leads at mid-market enterprises.
**Mechanism**: spine-derived-v1
**Template Id**: spine-ai-agent-spec
**Vocab Fingerprint**: 6ed62860ca0cdef6

## Neighborhood

### Candidate solutions

- [Cryptographic Audit Trail Deficits](/Problems/Cryptographic_Audit_Trail_Deficits) — candidate solution for · Problems

### What it offers

- [Trust Reconciler](/Services/Trust_Reconciler) — offers · Services
- [Hegen Provenance Anchor](/Services/Hegen_Provenance_Anchor) — offers · Services

### Competitors

- [Varonis](/Competitors/Varonis) — competes with · Competitors
- [Manual Access Reviews](/Competitors/Manual_Access_Reviews) — competes with · Competitors
- [SailPoint](/Competitors/SailPoint) — competes with · Competitors
- [ConductorOne](/Competitors/ConductorOne) — competes with · Competitors
- [Opal Security](/Competitors/Opal_Security) — competes with · Competitors
- [AWS CloudTrail](/Competitors/AWS_CloudTrail) — competes with · Competitors
- [WORM Storage Exports](/Competitors/WORM_Storage_Exports) — competes with · Competitors
- [Manual Batch Hashing](/Competitors/Manual_Batch_Hashing) — competes with · Competitors
- [LangSmith Platform](/Competitors/LangSmith_Platform) — competes with · Competitors
- [Splunk Enterprise Security](/Competitors/Splunk_Enterprise_Security) — competes with · Competitors

### Embodies

- [Service-as-Software](/Theses/Service-as-Software) — embodies · Theses

### Composed of

- [Telemetry Shard API](/Agents/Telemetry_Shard_API) — composes · Agents
- [Provenance Vault Service](/Services/Provenance_Vault_Service) — composes · Services
- [Trace Attestation Agent](/Agents/Trace_Attestation_Agent) — composes · Agents
- [State Rollup Worker](/Agents/State_Rollup_Worker) — composes · Agents
- [Cryptographic Anchor Engine](/Agents/Cryptographic_Anchor_Engine) — composes · Agents

### Similar Startups

- [Accibe](/Startups/Accibe) — similar · Startups
- [Accault](/Startups/Accault) — similar · Startups
- [Coveloom](/Startups/Coveloom) — similar · Startups
- [Aaronic](/Startups/Aaronic) — similar · Startups
- [Anthembasis](/Startups/Anthembasis) — similar · Startups
- [Octity](/Startups/Octity) — similar · Startups
- [Direridian](/Startups/Direridian) — similar · Startups
- [Accepository](/Startups/Accepository) — similar · Startups
- [Rubricvault](/Startups/Rubricvault) — similar · Startups
- [Rebanyon](/Startups/Rebanyon) — similar · Startups
- [Autema](/Startups/Autema) — similar · Startups
- [Melassess](/Startups/Melassess) — similar · Startups
- [Accaze](/Startups/Accaze) — similar · Startups
- [Allaster](/Startups/Allaster) — similar · Startups
- [Auditfoundry](/Startups/Auditfoundry) — similar · Startups
- [Domill](/Startups/Domill) — similar · Startups
- [Consolidatesphere](/Startups/Consolidatesphere) — similar · Startups
- [Latticeforge](/Startups/Latticeforge) — similar · Startups
- [Staborus](/Startups/Staborus) — similar · Startups
- [Florix](/Startups/Florix) — similar · Startups