Transmit Security

1.1 Identity, product scope, and operating footprint

Transmit Security consistently presents itself as an enterprise identity-security platform rather than a narrow point product. Official product pages and external profiles describe Mosaic as a combined identity management, authentication, orchestration, fraud-prevention, and identity-verification stack serving complex customer journeys across channels. That product identity is clearer than the corporate-footprint story: third-party and official materials point to Boston, while the company’s November 2025 press release uses a combined Boston-and-Tel-Aviv dateline. The assigned evidence therefore supports a transatlantic operating footprint, but not a single clean headquarters statement that later chapters can treat as definitive without follow-up diligence.[CO001, CO003, CO004, CO009, CO010]

1.2 Founder-led leadership with limited public governance detail

The leadership narrative remains strongly founder-centric. External company databases and the company’s own November 2025 announcement identify Mickey Boodaei and Rakesh Loonkar as co-founders, with Boodaei serving as CEO and Loonkar as President. BusinessWire also introduces David Mahdi as CIO, which suggests some senior functional depth beyond the founders, but the assigned pool does not disclose board composition, control rights, committee structure, or any financing-linked governance terms. That leaves key-person dependence elevated: founder continuity is a positive signal for product coherence, yet it also concentrates explanatory power in a small set of publicly visible operators.[CO002, CO011, CO015]

1.3 Funding credibility is stronger than current-scale transparency

The public record clearly anchors a large June 2021 Series A, but it does not cleanly settle the current cap-table narrative. Tracxn reports $543 million raised and a $2.7 billion current valuation, while Indexed reports $583.0 million across two rounds and CheckThat.ai publishes low-confidence valuation and revenue estimates that it explicitly labels algorithmic rather than verified. Adoption signals are better than operating-metric disclosure: BusinessWire and FIDO both place Transmit in large regulated enterprises, including top U.S. banks, yet no retained source provides current ARR, revenue, customer count, debt, secondaries, or a reconciled valuation bridge. Investors can underwrite product relevance from public sources more confidently than present-day financial scale.[CO005, CO006, CO007, CO008, CO012, CO014]

1.4 Milestones show durable positioning, but proof gaps still matter

The dated milestones that do appear are meaningful. The evidence supports a 2014 founding, a 2018 UK entity, a June 2021 Series A that pushed the company into unicorn territory, a 2022 U.S. legal entity, and a cluster of late-2025 signals around Gartner recognition and updated privacy disclosures. Together they show a company still investing in enterprise credibility and governance surfaces. The more important gap is not chronology but precision: later chapters should treat board oversight, ownership changes, customer concentration, and current commercial scale as open diligence items rather than as facts already established by this overview.[CO001, CO005, CO008, CO010, CO013, CO016, CO015]

1.5 Exhibits

2.1 Market boundary and adjacent spend

The strongest source-backed boundary is customer identity and access management rather than generic cybersecurity or workforce-only IAM. Gartner places Transmit Security in an access-management category that is explicitly "transitioning to Customer Identity and Access Management (CIAM)," while the company and partner materials repeatedly describe the platform as a customer-identity stack that combines orchestration, fraud prevention, and identity verification. That means the included spend is customer onboarding, authentication, account recovery, fraud controls, and identity-proofing workflows, especially where those flows must work across channels and geographies. The clearest excluded spend is pure workforce passwordless software or generic security tooling that is not wired into customer journeys. One third-party comparison broadens the scope to workforce, B2B, and B2C in one platform, so workforce should be treated as an adjacent expansion path rather than the default market boundary until Transmit discloses package mix or revenue split by module.[CM001, CM002, CM003, CM004, CM005]

2.2 Evidence-constrained sizing and enterprise budget lens

The assigned pool does not offer a credible standalone TAM, SAM, or SOM estimate, so the better approach is to preserve several narrower public lenses instead of inventing one giant market number. The first lens is category depth: Gartner shows Transmit participating across CIAM-adjacent review markets, and Tracxn counts a large competitive field, which supports the view that the company sells into a crowded but real identity stack budget. The second lens is contract size: a 2026 comparison page publishes entry pricing from $50,000 per 100,000 identity checks to $200,000 per year for the full platform, which points to enterprise-only budget ownership rather than SMB self-serve adoption. The third lens is installed-base scale: company and partner pages cite customer bases tied to more than $1.3 trillion and more than $2 trillion of annual commerce, but the figures do not reconcile cleanly and should be preserved as a range, not a precise current market-size claim. CheckThat.ai adds a fourth lens by calling its figures algorithmic estimates rather than verified disclosures, which is directionally useful but still not a disclosure-grade valuation signal.[CM006, CM008, CM009, CM010, CM011, CM012, CM013, CM014]

2.3 Buyer segmentation, adoption drivers, and constraints

The public buyer pattern skews toward large regulated enterprises, especially banks, insurers, retailers, and other customer-facing brands that need security, compliance, and low-friction digital journeys at the same time. The strongest adoption driver is consolidation: multiple sources position Mosaic as an orchestration layer that can combine authentication, fraud controls, and identity verification under one operating model, which is valuable when identity stacks are fragmented. The strongest adoption constraints are also visible in the pool: public entry pricing starts at enterprise levels, Gartner user feedback still flags SDK and custom-UX friction, and public marketing pages do not lay out a full certification list even though the privacy and identity-verification materials make clear that biometric, KYC, and controller-processor issues matter. In practice, that means valuation upside depends on whether buyers prefer one broader platform contract enough to offset implementation complexity and procurement diligence in regulated accounts.[CM004, CM006, CM007, CM008, CM009, CM015, CM016]

3.1 Market set and buyer alternatives

The assigned evidence places Transmit Security in a much wider comparison set than pure fraud tools. Gartner's alternative list surfaces Okta Workforce Identity, Ping Identity Platform, Microsoft Entra ID, and Oracle Access Management as top substitutes, while LoginRadius frames evaluations around broader CIAM depth, B2B tenant management, developer tooling, data residency, and operational simplicity. That means buyers are not only comparing "identity plus fraud" specialists; they are also weighing large incumbent IAM suites, Microsoft-native paths, and lighter-weight CIAM platforms. Independent case-study and market-intelligence pages also describe Mosaic as a broad CIAM stack for large, customer-facing deployments, so the real shortlist is not just feature parity but also proof of scale and implementation fit. For Microsoft-heavy or workforce-adjacent environments, the realistic status quo may be expanding existing identity stacks rather than buying a net-new dedicated platform. For regulated enterprises running large customer bases, the short list is therefore likely to include platforms with stronger ecosystem gravity or easier deployment stories even when Transmit leads on product breadth.[CP001, CP002, CP007, CP008, CP009, CP012]

3.2 Differentiation and switching costs

Transmit's strongest product argument is breadth inside a single vendor boundary. The official platform pages and ForesightIQ both describe Mosaic as a combined identity-management, fraud-prevention, identity-verification, and orchestration stack, and market-intelligence pages track it as a unicorn- scale identity company rather than a niche point tool. That combination is strategically important in regulated enterprise accounts because the more modules a customer adopts, the more operational logic, compliance workflows, and fraud controls become embedded in one platform. The result is a plausible switching-cost advantage after initial adoption: replacing authentication alone is easier than replacing authentication, fraud operations, identity proofing, and the workflow layer together. The same breadth, however, also creates room for competitors to argue that simpler, narrower products will be faster to deploy.[CP001, CP002, CP004, CP011]

3.3 Commercial pressure and displacement risk

Public commercial evidence remains mixed in a way that weakens moat confidence. Transmit publishes packaging and charging mechanics, but not public list prices; buyers must request a quote based on MAUs or event volume, use case, and deployment architecture. Competitor-authored evidence uses that gap to shift the buying conversation toward total cost and implementation friction. LoginRadius argues that teams leave or avoid Transmit when they want broader built-in B2B depth, lower engineering overhead, or faster deployment. PeerSpot's comparison snippets repeatedly frame Transmit as more structured or more expensive than some alternatives, but those pairwise narratives are inconsistent and should be treated only as directional pressure signals rather than benchmark pricing proof. Dealroom and Gartner show enough scale to matter in enterprise evaluations, yet neither closes the key diligence gap around realized pricing, services intensity, or win/loss performance against incumbents.[CP003, CP005, CP006, CP008, CP010, CP013]

3.4 Exhibits

4.1 Pricing is public enough to show the revenue architecture, not enough to show realized economics

Transmit Security's public materials make the monetization structure unusually legible at the top of the funnel for a private cybersecurity company: Mosaic is sold as modular enterprise software with indicative list pricing, usage-based billing units, and rapid follow-up through a sales quote rather than self-serve checkout. The company publishes four starting points across its main customer-identity bundles, but every disclosed number is still conditional on use case, deployment architecture, and scale, so list pricing is not the same as realized contract value or recognized revenue. Independent review coverage reinforces the same conclusion and adds the adverse read-through: buyers can see enough to infer a six-figure ACV motion, but not enough to normalize discounts, multi-module take rates, renewal uplift, or large-volume pricing above the published baselines.[CI001, CI002, CI003, CI004, CI005, CI006, CI007]

4.2 Service delivery and support are clearly relevant, but not quantified

The assigned evidence suggests that first-year economics are driven by more than software subscription fees. Independent pricing analyses and review coverage consistently point to implementation labor, journey design, integration effort, training, and support as material cost drivers, while the official pricing page confirms a 99.99% uptime commitment and premium support across plans. The company also frames the product around orchestrating regulatory, business, and security requirements across many platforms, which is strategically attractive but usually implies meaningful solution-engineering and customer-success effort. That combination supports the view that Transmit can command high starting ACVs, yet it leaves public investors without a credible margin bridge because neither professional-services pricing nor steady-state support intensity is disclosed.[CI008, CI009, CI010, CI011, CI015]

4.3 Public traction proof is historical, while current capital adequacy is still opaque

Public traction evidence exists, but it is mostly historical and largely company-issued. The strongest explicit numeric disclosure in the assigned pool is an August 2022 press release claiming more than $100 million of ARR, 40% year-over-year first-half revenue growth, and 51% customer-base growth since the June 2021 Series A. A FIDO Alliance company profile adds a broader scale signal by describing deployments at large banks, insurers, and retailers responsible for more than $1.3 trillion in annual commerce. Those facts indicate real enterprise reach, but they do not update the current revenue base, customer concentration, or retention picture, and none of the retained sources discloses current cash, burn, runway, debt, or financing triggers. That leaves capital adequacy and the next-round dependency as diligence topics rather than underwritten facts.[CI012, CI013, CI014, CI016]

4.4 Verdict: credible enterprise monetization, but weak public underwriting visibility

Financially, Transmit Security looks like a sales-led enterprise platform with meaningful pricing power at the entry tier, broad module coverage across identity, fraud, and verification, and customer outcomes that can plausibly support ROI-oriented selling into regulated enterprises. The underwriting problem is not whether a revenue model exists; it is that public evidence stops before the numbers investors actually need to test revenue quality and capital intensity. Without a current revenue bridge, realized pricing by module, gross margin, services attach, CAC or payback, and cash-runway disclosures, the chapter can support a qualified view on revenue architecture but not a clean view on margin path or financing sufficiency.[CI001, CI007, CI008, CI010, CI014, CI016]

4.5 Exhibits

5.1 Platform scope and module coverage

The official product pages describe Mosaic as a broad customer-identity platform, not a narrow authenticator. Transmit says one platform covers identity management, fraud prevention, and identity verification across the user lifecycle and across user-facing channels, while the FIDO showcase echoes the same "entire customer identity lifecycle" framing. In workflow terms, the documented scope spans onboarding, login, account recovery, session/profile management, and risk checks inside one control plane. That breadth is the core product story and the main differentiator repeated across official, partner, and third-party profile surfaces.[CE001, CE002, CE005, CE006, CE014]

5.2 Architecture, integrations, and delivery model

Public materials point to a composable architecture that blends no-code orchestration with microservices-based identity services. The platform page describes drag-and-drop and natural-language journey design for registration, login, and payments, plus a CIAM layer for B2C and B2B lifecycle management. Partner materials add that deployments rely on APIs, SDKs, and standards integrations such as OAuth 2.0, OpenID Connect, SAML, and FIDO2, while the AWS Marketplace consulting offer makes clear that enterprises often buy implementation help rather than treating Mosaic as a plug-and-play utility. That combination suggests real flexibility, but also meaningful integration and change-management work.[CE003, CE008, CE009, CE010]

5.3 Maturity and roadmap signals

The assigned public evidence supports an "actively shipping" verdict more strongly than a "fully proven at scale" verdict. The 2026 release-notes surface shows updates in February, March, May, June, August, and September across identity orchestration, customer identity management, fraud prevention, identity verification, passwordless authentication, device management, and fraud operations. That cadence implies current product investment and expanding module depth. At the same time, most of the maturity proof in this pool is vendor-authored or partner-mediated, so release velocity is visible while operational quality, upgrade friction, and support burden remain less transparent.[CE007, CE010, CE013]

5.4 Trust, privacy, and technical risks

Trust and compliance controls are explicit parts of the public product story. Transmit's privacy statement says the company is usually a processor when enterprise customers use the platform to verify end users, but it also acts as a controller for Identity Network profile reuse and some service improvement use cases. The same policy confirms biometric handling and a stated retention limit of no more than one year after last service use. Those disclosures are useful, but the chapter's assigned sources still document privacy roles more clearly than they document public uptime commitments, independently measured fraud/verification accuracy, or customer-reported implementation effort.[CE011, CE012, CE013]

5.5 Exhibits

6.1 Customer segments and buyer-user structure

Transmit Security's disclosed customer base is best understood as enterprise buyers funding a platform used by their own end customers rather than by internal employees alone. Its current product pages position Mosaic for both B2C and B2B journeys including registration, login, payments, onboarding, consent, and self-service, while the privacy statement distinguishes the paying enterprise customer from the end user whose identity or fraud signals are processed. The public proof set is concentrated in regulated, high-risk customer-facing sectors—especially banking and adjacent financial services—then broadens into insurance and retail. That implies a buyer set led by identity, fraud, security, and digital-product owners, with the end user typically being a consumer or business user moving through a customer journey rather than a workforce identity flow.[CU001, CU002, CU003, CU012, CU014]

6.2 Public adoption proof and deployment scale

Transmit has more than logo-only proof, but the quality of that proof varies. The company and case-study directory both anchor the installed base in banks, insurers, retailers, and other large brands, and the 2022 press release is unusually concrete by private-company standards: it claims 51% customer-base growth in the first half of 2022, more than $100 million of ARR, and customer additions including Goldman Sachs, BRED Banque Populaire, and America's Car-Mart. The named-proof layer is strongest where a use case or outcome is stated—such as a 100% passwordless marketplace, a 200 million-client banking deployment, tens of millions in annual savings, or a 98% fraud-reduction result—rather than where a logo appears without deployment detail. Independent platform evidence also exists through Gartner Peer Insights, but the review base is still small relative to mega-vendor peers.[CU003, CU004, CU005, CU006, CU007, CU010]

6.3 Durability, expansion, and concentration remain under-disclosed

The customer story is directionally attractive but not yet durable enough for a clean underwriting conclusion. Public materials show expansion vectors—more identity steps, more channels, and potentially cross-customer identity reuse through the Identity Network—but they do not disclose NRR, GRR, churn, renewal rates, contract lengths, or top-customer mix. The independent review signal is also modest: Gartner shows 31 ratings at 4.5 out of 5, which confirms live usage but is not broad enough to validate retention or cohort quality on its own. As a result, the right read is not “customer quality proven,” but rather “enterprise adoption proven, durability still partly opaque.”[CU006, CU009, CU011, CU013, CU014]

6.4 Exhibits

7.1 Ranked risk landscape

The strongest public evidence supports a broad product footprint, but that same breadth creates underwriting risk because Mosaic appears to sit in the critical path for registration, login, fraud controls, and identity verification. Official and partner materials portray a unified orchestration layer for identity and fraud, while independent reviewers describe the platform as enterprise-priced, complex enough to require staged implementation, and harder to exit once embedded. That makes the residual risk profile less about feature scarcity and more about deployment friction, vendor dependence, pricing fit, and the lack of public proof for some regulated-workload requirements. [CR001, CR003, CR006, CR007, CR008, CR009, CR010, CR011, CR014]

7.2 Regulatory and privacy exposure

The clearest legal and regulatory risk comes from the sensitivity of the data handled and the fact pattern in Transmit's own privacy statement. The company says it is usually a processor for customer-provided user data, but becomes a controller in some Identity Network and service-improvement scenarios. The same policy says identity-verification services can process government-issued IDs and selfies, which raises the cost of any control failure or ambiguous responsibility split. Independent review also says FedRAMP was not yet attested as of 2026, so expansion into public-sector or similar authorization-heavy workloads should not be underwritten from public marketing alone. [CR004, CR005, CR008, CR016]

7.3 Operational and dependency risk

External review evidence points to real implementation and dependency risk even though user feedback is directionally positive. StackInsight says deployment complexity varies with architecture and that advanced features can extend rollout time materially beyond a basic implementation, while Gartner review evidence suggests user experience and onboarding can be strong when the technical team is engaged. Those two facts can coexist: complex, high-stakes deployments may still land well, but they appear to depend on implementation quality, support capacity, and tuning discipline. The assigned pool does not provide a public uptime history, formal SLA evidence, or incident archive, leaving an unresolved resilience question for a platform that can sit directly in the authentication and fraud-decision path. [CR003, CR010, CR011, CR012, CR013, CR015, CR017]

7.4 Investment implication and kill criteria

The investment implication is that Transmit may be attractive when a buyer values unified CIAM, fraud, and verification enough to absorb enterprise pricing and implementation work, but risky if the deal thesis requires broad customer fit, low switching friction, or public-sector readiness. Public evidence is not strong enough to clear customer concentration, renewal durability, runway, uptime resilience, or data-portability risk. A thesis break should trigger if diligence shows unclear controller boundaries by module, weak export and migration rights, absent certification or incident evidence for target verticals, or a growth plan that still depends on a narrow set of regulated enterprise accounts. [CR004, CR006, CR007, CR008, CR009, CR014, CR016, CR017]

7.5 Exhibits

8.1 Investment call and thesis balance

The evidence supports a serious enterprise identity platform rather than a speculative concept. Transmit Security's current product pages still show orchestration, authentication, fraud, and identity-verification breadth, while third-party pricing captures six-figure annual entry points that fit an enterprise sales motion. The problem is not product relevance; it is valuation confidence. The latest public financing anchor in the assigned pool is still the June 2021 Series A at a reported $2.2 billion valuation, and the freshest revenue proof is a company-issued August 2022 statement that ARR exceeded $100 million. Without a newer valuation mark, current financial disclosures, or clear liquidity path, the underwriting posture should stay research-more rather than buy.[CV001, CV002, CV003, CV004, CV007, CV012, CV013, CV014]

8.2 Valuation context and entry discipline

The financing context is still dominated by the outsized 2021 Series A, which gave the company a premium cybersecurity valuation during a much richer software market. Public evidence in this pool shows the company has maintained broad product ambition, enterprise packaging, and a live hiring engine that includes stock-option compensation, but it does not reveal the current preference stack, option-pool size, secondary pricing, or whether any later insider or structured financing reset the effective mark. The privacy statement also shows the platform carries controller and biometric data responsibilities that matter for enterprise diligence and could add compliance cost if growth slows. Entry discipline therefore has to assume valuation opacity and require fresh private-market evidence before treating the 2021 unicorn mark as a dependable 2026 reference point.[CV001, CV003, CV005, CV006, CV010, CV011, CV012, CV013, CV014]

8.3 Scenarios, exit readiness, and final diligence asks

The bull case depends on Transmit Security turning platform breadth, enterprise pricing, and historical growth into a much larger recurring revenue base than the public record shows today. The base case assumes the company is strategically valuable but still too opaque on current financials and financing terms for a clean price call. The bear case is that historical momentum has slowed, implementation-heavy enterprise delivery constrains margins, and the last known valuation remains above what a refreshed market clearing price would support. Exit readiness is also weakly evidenced because the assigned pool explicitly says no IPO timeline has been announced. The next diligence step is therefore not to debate product quality, but to obtain current ARR, retention, gross margin, customer concentration, and cap-table evidence that could reprice the recommendation.[CV002, CV003, CV007, CV008, CV009, CV011, CV012, CV013, CV014]

8.4 Exhibits