Rising Star Excalibur

Excalibur is a European cybersecurity vendor founded in 2016 in Poprad, Slovakia, focused on Privileged Access Management (PAM) at the intersection of MFA and Zero Trust. Operating in a late seed stage and preparing for Series A, it is funded through commercial revenue, European and Slovak government grants, and support from the European Innovation Council. Its platform addresses modern PAM demands created by hybrid IT, insider threats, credential theft, shadow IT, and remote access by moving beyond vaulting toward controlled, observable privileged interactions that also support regulatory alignment, including NIS2 and DORA.

The company’s core innovation is Streamed Access Management (SAM): a unified, browser-delivered system combining PAM, smartphone-centric passwordless MFA, and secure remote connectivity. Instead of giving users direct network-level access, Excalibur inserts an isolation layer between user and resource, executes sessions in a controlled environment, and streams the interaction to the browser. Users authenticate via a smartphone flow using QR scanning, biometrics, location, device trust, and PIN, then reach RDP, SSH, VNC, and web apps without local clients or exposing credentials. Credentials remain encrypted and are injected only when needed, while sessions are monitored, recorded, and auditable across on-prem, cloud, SaaS, and MSP-hosted deployments using a microservices architecture.

A key differentiator is VITRO, an RBI-WAF isolation layer that splits the browser engine so application logic runs centrally while only inert rendering data is delivered to the endpoint, keeping users disconnected from runtime and DOM to neutralize exploit paths in vulnerable web apps. A server-side intent engine continuously evaluates actions against expected workflows and can trigger step-up authentication or peer approval when behavior deviates, shifting PAM toward continuous governance of privileged interactions.

• Excalibur was founded in 2016.
• The headquarters is in Poprad, Slovakia.
• The company is in a late seed stage and preparing to launch a Series A round.
• Funding sources include commercial revenue, European and Slovak government grants, and support from the European Innovation Council (EIC).
• The solution is deployed in organizations including Slovakia’s Ministry of the Interior.
• Streamed Access Management (SAM) combines PAM, passwordless MFA, and secure remote connectivity in a browser-based interface.
• The platform supports RDP, SSH, VNC, and web applications without requiring local clients.
• Credentials are stored in encrypted form and injected as needed.
• Sessions are fully monitored, recorded, and auditable.
• Deployment models include on-premises, cloud, SaaS, and MSP-hosted environments using a microservices-based architecture.

• “PAM has become a central control point in modern cybersecurity, particularly as organizations operate across hybrid, multi-cloud, and distributed environments.”
• “Modern PAM platforms are evolving beyond password vaulting to offer granular, time-bound access, continuous monitoring, session recording, and contextual authentication.”
• “Excalibur’s solution is built around the concept of Streamed Access Management (SAM), a unified platform that combines PAM, smartphone-centric passwordless MFA, and secure remote connectivity through a single browser-based interface.”
• “Rather than exposing systems to authenticated users, the platform isolates applications and delivers access through streamed sessions.”
• “This approach reduces the attack surface associated with compromised devices and credential misuse.”
• “Instead of streaming a static image, VITRO splits the browser engine, processing application logic centrally while rendering locally on the client.”
• “Because the endpoint never interacts with the application runtime or DOM, users cannot exploit vulnerabilities the protected web application might contain.”
• “Excalibur also introduces a server-side intent engine that continuously evaluates user actions against expected application workflows.”
• “By keeping the user entirely disconnected from the application runtime, it neutralizes flaws in the underlying software without relying on a continuous cycle of WAF rules or immediate emergency patching.”
• “Excalibur addresses this convergence by tightly integrating authentication, access control, and session streaming into a unified architecture.”