Vlad Matsiiako - cofounder of Infisical
Infisical cofounder Vlad Matsiiako explains how an MIT license helped a young security company earn enterprise trust, why easy adoption matters as much as strong encryption, and how startup rules change from one “mini-game” to the next.
Vlad Matsiiako is the CEO and cofounder of Infisical, an open-source platform for managing secrets across developers, infrastructure and deployment systems.
What starts as a safer replacement for sharing API keys in Slack becomes a question of organizational trust: centralize sensitive credentials, show exactly who or what can access them, and make the secure path simple enough that developers actually use it.
The Q&A below is experimental — extracted from the episode transcript with AI. If you spot a mistake, let us know at jack@scalingdevtools.com.
Why does a team need a secrets-management tool?
Even a two-person team needs a safe way to share environment variables, API keys, certificates and database credentials. As infrastructure grows, those secrets spread into Kubernetes, Terraform and CI systems, making access and changes difficult to audit. Infisical centralizes and encrypts them so a company can see which people and service accounts have access and track what happens to each secret.
Why did Infisical become open source?
The product began closed source, but early customers hesitated to entrust a young startup with critical credentials. Publishing the core under the MIT license let developers inspect and contribute to it, while self-hosting let companies and governments keep secrets inside their own cloud accounts or data centers. Open source turned an early credibility problem into a practical adoption route.
How did that help large organizations trust the company?
A bank can test the product and even move it into production without first sending its most sensitive data to an unfamiliar cloud vendor. The public code, visible issues, contributions and growing community provide evidence beyond the company’s own claims. Over time, brand recognition among security leaders made Infisical Cloud easier to trust too, but self-hosting supplied the bridge when the company was unknown.
How do open-source users become enterprise customers?
Developers can use the core product and prove it in a real environment. As usage becomes organizational, managers and security leaders ask for compliance certificates, granular access controls, support and service guarantees—features provided by the enterprise edition. Infisical will actively recommend the free version when a company lacks a strong paid use case, so a later sales conversation begins with a buyer who already knows exactly what it needs.
Why choose the MIT license instead of a more restrictive one?
MIT is familiar and already appears on many enterprises’ approved-license lists. A novel license can trigger a legal review that lasts as long as a developer’s entire quarterly project, causing them to choose another tool. Vlad prefers an open-core boundary like GitLab’s: keep developer-level functionality permissively licensed, then charge for the controls and capabilities that managers need in complex organizations.
How does Infisical spread through an enterprise?
Adoption may begin with one application team, expand through recommendations or happen across an organization at once. Users also carry the product to their next employer. Traditional businesses can have thousands of engineers, so a tool discovered inside one group has significant room to travel. That growth looks organic, but the team deliberately removes friction from evaluation and deployment to make every next step easier.
What does making security software easy actually involve?
Early self-hosting required numerous tokens, environment variables and manual settings; the team automated that work until somebody could try an instance with a Docker Compose command in minutes. Ease is a security property as well as a growth tactic. If a supposedly secure system is hostile to developers, they route around it and an organization gains a false sense of protection while credentials continue moving through unsafe channels.
How does Infisical fan the flames beyond product-led adoption?
The team publishes on its blog, Hacker News and Reddit, while maintaining an open forum where users can ask questions and propose changes. Much of the strongest distribution cannot be centrally controlled: people organize meetups, speak at conferences, contribute code and recommend the product to colleagues. The shared identity is a developer who cares deeply about security but also insists that secure tools remain pleasant to use.
What does it mean that startups are a series of mini-games?
Vlad learned the framing from Y Combinator’s Dalton Caldwell: between two founders in a garage and a huge public company sit perhaps 15 distinct levels. Each has different rules, and fast growth can move a company into the next one before its founders notice. The recurring job is to recognize the new stage, stop relying on practices that won the previous one and earn the right to advance again.
Which rules were changing for Infisical?
A lean founding team had to become an actively hiring organization because customer demand and product opportunities exceeded its capacity. Founder-led sales based on discovery was becoming more advisory as the core product matured. Product development also shifted from broad exploration to reliability: hundreds or thousands of customers can adopt a new certificate, scanning or sharing feature immediately, so every release carries consequences that the earliest version did not.