Infisical says it has 1,300 customers and did not need the $40 million it just raised

Infisical, a San Francisco developer-security company founded in 2022, raised a $40 million Series B at a $600 million valuation on October 27 and said it did not need the money, according to a post by chief executive Vlad Matsiiako. The company says it has more than 1,300 customers and has been cash-flow positive for a long time. None of those business figures is audited or independently confirmed.

What happened

Elad Gil, the investor who led Infisical's Series A, led the Series B again. Y Combinator and Gradient Ventures also took part, along with Gallery Ventures, Pace Capital, Dynamic Capital and other investors, Matsiiako wrote. Infisical makes software that stores and controls the passwords, keys and certificates, known as secrets, that software systems use to connect to one another.

Matsiiako framed the round as optional: "We didn't have to raise this round. Infisical has been cash-flow positive for a long time, and we have more money in the bank than we've ever raised." The same sentence structure appeared in the Series A announcement in June 2025, which said "we didn't have to raise this round" and that the company had "more money available than we have ever raised." The post does not give revenue, profit or cash balances.

How it started

According to Infisical's about page, the three founders, Matsiiako, Tony Dang and Maidul Islam, "built multiple products, but were always frustrated with .env files." The files hold the variables, including passwords and keys, that an application needs, and the company's launch post describes how they get lost or leaked. The founders concluded that legacy security tools were too complex to adopt, and built their own.

Y Combinator's profile lists Infisical as founded in 2022 and in its Winter 2023 batch. The company's launch post there said it launched as an open-source, end-to-end encrypted platform, and that three months after launch it had "4.2K+ stars on GitHub, 50 contributors, and 220+ community members." GitHub stars are bookmarks that developers give to projects, a rough measure of interest rather than of customers.

What it sells

The launch post lists three problems the founders set out to address. Teams lose track of secrets spread across infrastructure, which "often leads to missing secrets"; companies leak hardcoded secrets and .env files into source control; and many alternatives cannot be self-hosted or are not end-to-end encrypted. Infisical's answer was a platform that stores secrets, injects them into applications in place of .env files and can be hosted on a customer's own infrastructure, with versioning, rollbacks and audit logs.

The product has widened since. In the Series A post, Matsiiako said that over the previous year the company had launched Infisical PKI, SSH, KMS "and more," and that "secrets management is just the beginning." The about page now describes "one open-source platform for secrets, certificates, keys, privileged access, and AI agents."

How it grew

The about page now reports 30,085 GitHub stars, 5,000,000+ Docker pulls of its self-hosted image, 1,300+ customers and "10,000,000,000+" secrets secured every day. The star count is about 7.2 times the figure in the launch post (computed from 4,200 and 30,085). The Series B post says the customers include LG, First American Financial, OpenRouter, Wise and the US government.

In the Series A post of June 7, 2025, the company said it had "gone from a simple open source project to securing workloads for Fortune 50 enterprises." It raised $16 million then, led by Elad Gil, with Y Combinator, Gradient Ventures, Dynamic Fund and the chief executives of Datadog, Samsara and Valor taking part. The Series B came 507 days later (computed).

Y Combinator's profile lists a team size of 70, and the Series B post says Infisical is hiring for more than 100 positions across engineering, sales, marketing, product and design. The two figures are from different dates and the profile may be out of date.

Why the company raised now

Matsiiako gave three reasons, all tied to AI coding tools and agents. First, "coding agents have increased the amount of code being produced by more than 10x," which he said means more infrastructure and credentials to secure. Second, he wrote, "attackers have more opportunities than ever." Third, he said AI agents "are getting access to increasingly sensitive systems and taking actions that previously required human approval, often without proper oversight."

The 10x figure is Matsiiako's own and the post does not cite a source for it.

The company said it will invest in secrets, certificate and privileged access management and "significantly increase" its focus on Agent Vault, a product that "lets AI agents access sensitive systems without exposing the underlying credentials."

What the sources do not show

The announcements give no revenue, customer growth rate, or profit figure, so the claim of positive cash flow cannot be checked against numbers. They also do not say how the $600 million valuation was set or what share of the company the new investors hold.

What's next

Matsiiako wrote that the company will keep investing in secrets, certificate and privileged access management, which he said makes it easier for organizations "to move away from legacy tooling." It will also expand hiring across several teams. The post sets no dates, revenue targets or customer targets for either plan, and it does not say how much of the new money is earmarked for Agent Vault.

What the founders say

The Series B post is the most recent first-person account of the founders' reasoning. In it, Matsiiako wrote that "security and developer experience shouldn't be at odds," and that "when security is difficult, developers find workarounds. When it's easy, they adopt it." He did not describe setbacks, a pivot or early customers in this post.