So, I'm particularly excited to do this Founder Fireside because we have a first for the Founder Fireside series. We are doing a big announcement on this podcast. We are announcing that Variance is coming out of stealth and announcing their $21 million Series A. And I'm really excited to be here with Karine, the co-founder of Variance. Thank you so much for joining us, Karine.
So, this is a big day. You're coming out of stealth after building basically in stealth for the past 3 years and you built Variance quietly into this big company that powers a lot of the products that everybody knows and uses in their regular life. Can you tell us about what Variance is and about the $21 million Series A you're announcing?
So, Variance is building purpose-built AI agents for risk and compliance. We automate content review, fraud reviews, identity reviews at scale. We're powering some of the largest companies in the world's Fortune 500s marketplaces. We've been working with GoFundMe, for instance, to review all of their fundraisers at scale. Some Fortune 50 for verifying all of their sellers and complex UBO verifications. And today coming out of stealth.
And you guys built in stealth for a long time, like 3 years, and you have a lot of customers that you can't even name on this podcast. Why all the secrecy around this?
Variance usually deals with really sensitive data and sensitive issues. And the phrase I like to use is that we're building the systems that are often used by the bad guys, but we're building them for the good guys. So oftentimes it's really hard to market the use cases that customers are using Variance for because those issues are so sensitive. And if we were to market those, then it may create more fraud. It may create more abuse. It may create more bad.
Like your customers are stuck in this constant cat and mouse game with the bad guys and you're their secret weapon. They don't want anyone to know what their secret weapon is.
Exactly. We're in the shadows. I think it's good. It's really impactful for our employees working at the company. Really impactful. You get to see that when you work at Variance, but I think even far beyond the Series A, we'll always be a company that's a little bit more in the shadows. And I think that's okay for us. What's cool about Variance is that even though probably no one who's watching this video has ever actually used the product themselves, they have used many products that under the hood are actually powered by what you've built.
And so indirectly they're actually like using stuff built on top of Variance, like a lot of software infrastructure kind of products. Could you maybe tell people about a specific product that they've used or have probably used that's powered by Variance and how it works?
One of the customers, GoFundMe, is a platform that you can use in order to build your own fundraisers. And GoFundMe is effectively a payments platform. And GoFundMe actually has some very strict compliance requirements because they are liable for facilitating payments to, let's say, an organization that they shouldn't have done so. So Variance is used to verify, for instance, if a fundraiser is going to be built for a military operation, for instance, or if you're building a fundraiser for a crisis that you were not part of, which would be fraudulent. Well, GoFundMe sort of has the responsibility to be able to detect this. They're using AI agents, so Variance AI agents, to conduct those investigations, so make sure that the money is going to the person that they say they are, and also make sure that the money is not going to be funneled to sanctioned countries, for instance, or be going to anything that could be a compliance risk for them.
You were telling me earlier about like one specific very concrete form of fraud. What does like typical fraud on GoFundMe look like?
Yes. So GoFundMe is actually very crisis driven. So if there is any sort of large event or any sort of natural disaster, there's usually going to be a spike in fundraisers that occur on GoFundMe. It's really hard for the team to keep up with how many of these fundraisers are actually going to be real fundraisers for that event or possibly fraudulent. One of the examples that we saw was I think recently there was, for instance, the murder of Charlie Kirk. There was a spike of fundraisers for the family of Charlie Kirk. How do you know who's actually related to Charlie Kirk and who's just trying to raise money for their...
Okay, so like Charlie Kirk dies.
And then what happens is like a hundred people host a fundraiser on GoFundMe like claiming to be a family member of Charlie Kirk.
And it's mostly just like total fraudsters who are just hoping that some people like donate to their Charlie Kirk fundraiser instead of the real Charlie Kirk family fundraiser.
And you're in charge of figuring out which one is the real Charlie Kirk family and who are the like fraudsters.
Exactly. And there's a lot of behavioral signals you can use to do so. You have information on the identity, you have information on what that account has done in the past. You also have information at the fundraiser level, so the image, the bio, and such. So, the Variance AI agents are going to be using all of that context and use the GoFundMe terms of service to basically decide whether or not that should be allowed on the platform. That work used to be done by human analysts and now can be fully automated in a much more consistent manner. Every person who signs up to do a GoFundMe fundraiser, they don't realize it, but actually their request is being validated by Variance software before it's allowed to go live.
Yes, exactly. What are other like products that people use that also are powered by Variance and they don't even realize it?
So, the scale has been impressive, the number of use cases that our agents can be used for. So we have been running complex identity reviews for marketplaces, gig economy platforms. So when you sign up to actually be, for instance, a delivery driver, your identity needs to be verified based on selfies, based on your driver's license. All of that data is then going to be reasoned on by our AI agents and then it's also going to be validated based on the company's standard operating procedures. That's a good example of how Variance is used. We're also used for complex what we call KYB verifications. So if you sign up to do any sort of business online, whether it's for a marketplace or also with a financial institution, they have the compliance requirement to verify that you are actually linked to the business you say you own. So a good example is, for example, I sign up to say I'm going to be doing business with Variance. Well, the legal name of my company is Decoy Technologies and it is tied to Karine Mulada. That's a simple example, but building that graph at scale is really hard. And oftentimes you're going to see a company have multiple shell companies be tied to multiple different agents and different other identities. And within that really large graph, you expand the area of risk for the company where one of these nodes could be in a sanctioned country. One of these nodes could have adverse media on them and possibly have been to court for money laundering, and companies are required to conduct these investigations at scale, and at the moment it's entirely manual.
Do you license data from a bunch of different sources? Do you like scrape all these government websites?
Yes, but to take a step back, I think it's really elegant how AI agents are built at the moment. There's really only three building blocks that you need. So you have the compliance documents, the standard operating procedure. So what the company deems as necessary to verify at the onboarding level or at any other parts of the life cycle of that entity. Once we have those compliance documents, then the AI agent can do its work using tools that we built and data internal or external. Those are the only building blocks you need to automate complex KYC, complex KYB, complex content review. The question you're asking about data is interesting. Usually, it's going to be a split between internal customer data. So, Variance is really good at connecting to all data sources, pooling unstructured data into our own data stores. And the second one is external data. So we do have access to over hundreds of business registries across the world, which makes us international, and then our agents also have access to the open web. So a lot of unstructured data is found directly on the web. I actually think, interestingly enough, that access to the web was one of the final nodes that made this whole problem really hard to automate.
Yes. Because like the human analyst, a big part of what they would do is they would go and they would like Google for names and then they would like look at what comes up and apply some judgment like, ah, does this seem fishy or not.
When you think of a large graph of abuse.
If one of these nodes, one of these intelligence signals is found on the unstructured or the open web, then without having a human agent Google on the web, you can't even trace back the whole graph of abuse.
What are some other interesting technical challenges that you guys have encountered and had to solve in the course of making this work at scale?
The data problem was really the core hardest technical challenge. Usually with customers what we will do is that we'll pull in petabytes of data that are coming from vastly different sources and all of that data is unstructured. Doesn't have a schema.
Unstructured, isn't it? Don't you just like pull it like right, do you pull like out of their like relational database?
I wish it was this simple, but usually, I mean, I'll give you a very concrete example. So for instance, if you need to verify a fundraiser, I'll pick the fundraiser example. Okay, usually the data is going to be scattered around the user identity data. So, you need to have information on the user. You need to have information on all of their login behaviors, the devices that they've had, the PII that they've onboarded at the beginning. You need to also be able to pull in information about the business. And then you need to have also all of the information on the fundraiser itself and all the history of that fundraiser. What has been hard is that oftentimes, whether you're a financial institution or you're a marketplace, that data is going to be scattered across five to ten different systems. It's going to be into different data stores. And one thing that's been really interesting in that is that sometimes that data is going to be hidden behind a UI. So the only way that the Variance AI agents are able to sort of scoop up that data and reason over it is to be able to directly scrape from a UI that was built for a human. So the data piece and being able to scoop up all of that data and bring it to Variance was one of the hardest technical challenges. It's really an onboarding one.
And so do you do that? Do you have agents that interact with like the customers' internal dashboards and like pull data out of them?
Yes. So at the moment the way to integrate with Variance can be reverse ETL, API, but very recently we've been awarded this third way which is spinning up a browser, opening up a really old review tool that was built for a human, pulling that data and then reasoning over it.
I guess it makes sense because like the work was being done by a human before and so like the human can use the dashboard while the agent can use the same dashboard.
Right. You worked on related systems at Apple like payments and now you're building this like deeply agentic system. Can you talk about how the technology has evolved and like why it's possible to solve this problem now?
Yeah, definitely. So, I think it's important to sort of understand how these problems were solved at scale before. So, usually companies are going to have a patchwork of different what I call deterministic systems. So, they're going to have rules that say, 'Well, if this transaction is over $1,000, then do this.' They're going to have classifiers that are really good at detecting one specific flavor of abuse. Then they're going to have humans. And humans are really good at understanding in context all of these different nodes and signals and then making a final decision. And I think when you think of a fraud system, the most important feature of a fraud system is that it needs to evolve really rapidly and you need to have a really tight feedback loop. But when you think of the three nodes I've mentioned, rules engine, classifiers, and humans, humans being really slow oftentimes and a little bit inconsistent, that feedback loop can only be so fast. And we never really felt like you could achieve a self-healing system that could thrive in a dynamic environment. And I think fraud is the most dynamic environment because you always have adversaries. So Michael and I were always really, really, really stubborn about making the system have no nodes that were inefficient, if that makes sense. And now you have AI agents that are able to sort of close the loop from a reliance and self-healing standpoint. They're able to materialize any features that a rules engine would be able to materialize. You don't need a classifier anymore because AI agents are able to read a set of standard operating procedures and reason over an image or reason over sort of unstructured data and know that this is possibly chargeback fraud. You don't need a specialized classifier for it. And you don't need human reasoning anymore. So, you have this fully self-healing system which at scale is really transformative and allows companies to be able to ship faster, open new product lines because they don't have this sort of bottleneck.
Do you have an example of something like that with one of your customers where the system was able to do something that just like no human team of fraud analysts could ever have been able to do?
