Karine Mellata | Lightcone Summary

1. Key Themes

The "Invisible Infrastructure" Business Model in Trust & Safety

Variance operates as deeply embedded, invisible infrastructure inside Fortune 500 platforms — a business model that is both competitively durable and deliberately obscure. The secrecy is not a marketing choice; it's a structural feature of the product.

"We're building the systems that are often used by the bad guys, but we're building them for the good guys. So oftentimes it's really hard to market the use cases that customers are using Variance for because those issues are so sensitive." — Karine Mellata 00:01:29

This creates an unusually sticky moat: customers can't talk about the vendor, and the vendor can't talk about the customers. The switching cost is embedded in operational secrecy itself.

AI Agents Are Replacing the Entire Fraud Stack — Not Just One Layer

Legacy fraud systems were a fragile patchwork of rules engines, ML classifiers, and human analysts. Variance's thesis is that AI agents collapse all three into one self-healing system. This is not incremental improvement; it's architectural replacement.

"You don't need a classifier anymore because AI agents are able to read a set of standard operating procedures and reason over an image or reason over unstructured data and know that this is possibly chargeback fraud. You don't need a specialized classifier for it and you don't need human reasoning anymore. So you have this fully self-healing system." — Karine Mellata 00:13:41

The implication for investors: any company selling point solutions (standalone classifiers, rules engines, BPO fraud review services) is facing structural displacement.

The "On Fire" Problem as Enterprise GTM Strategy

Variance deliberately targeted problems that were acutely painful, not theoretically important. This is a non-obvious but highly replicable enterprise GTM principle.

"We needed to land on a problem space which was on fire. It needed to be on fire because what we found is that if it wasn't on fire, then there was no reason to go and trust this really small startup that had no real proof points behind them." — Karine Mellata 00:21:55

This is particularly relevant for AI-native startups entering regulated industries: compliance urgency is the wedge, and the proof of ROI is immediate rather than aspirational.

2. Contrarian Perspectives

Stealth Is a Permanent Competitive Advantage, Not a Phase

Most startups treat stealth as a temporary state before a big marketing push. Variance treats it as a permanent operating posture — and argues this is actually better for the business.

"I think even far beyond the Series A, we'll always be a company that's a little bit more in the shadows. And I think that's okay for us." — Karine Mellata 00:02:06

This runs counter to typical startup playbooks that emphasize brand-building and thought leadership. For companies in adversarial environments (fraud, security, intelligence), visibility is a liability, not an asset.

Non-Technical Employees Can Ship Production Features Without Engineering

Most enterprise software companies treat engineering as the exclusive path to shipping. Variance's customer success manager now independently ships features using Cursor agents — bypassing engineering entirely.

"Our customer success manager, who's entirely non-technical, but interfaces with enterprise customers on a day-to-day basis, now gets to take on feature requests, especially the simple ones, directly give them to Cursor, a Cursor agent, and then directly be able to ship features in a fully autonomous manner, get back to the customer a few hours later and say, 'Oh, it's shipped.' And she didn't even need to speak to the engineering team." — Karine Mellata 00:19:34

This is a genuine structural change to how companies can be built — the boundary between customer success and product engineering is dissolving.

Founder Conviction at Day Zero Outperforms Iterative Pivoting in Deep Technical Domains

The prevailing YC wisdom is to stay flexible and pivot toward signal. Variance did the opposite — they came in with deep conviction from prior professional experience and never pivoted.

"You came in like day zero with a very strong opinion of what to build. You'd seen the problem firsthand. And then the whole company has just been like that initial hypothesis playing out." — Jared Friedman 00:29:15

"We didn't want to just start a company for any problems. We wanted to solve that problem. And we knew the technology was going to evolve." — Karine Mellata 00:30:01

In verticals with deep domain complexity (fraud, compliance, healthcare), prior insider knowledge may be more valuable than GTM flexibility.

Access to the Open Web Was the Final Missing Piece That Made Full Automation Possible

This is a subtle but technically significant claim: the reason fraud automation couldn't work before wasn't model quality — it was the inability to replicate what a human analyst does when they Google someone.

"I actually think, interestingly enough, that access to the web was one of the final nodes that made this whole problem really hard to automate. When you think of a large graph of abuse, if one of these nodes, one of these intelligence signals, is found on the unstructured or the open web, then without having a human agent Google on the web, you can't even trace back the whole graph of abuse." — Karine Mellata 00:08:35

3. Companies Identified

Variance AI agent platform for risk and compliance automation (KYC, KYB, content review, fraud detection). Coming out of stealth with $21M Series A. Powering Fortune 500 and Fortune 50 clients.

"We automate content review, fraud reviews, identity reviews at scale. We're powering some of the largest companies in the world's Fortune 500 marketplaces." — Karine Mellata 00:00:49

GoFundMe Consumer fundraising and payments platform. Named as a marquee Variance customer using AI agents to detect fraudulent fundraisers in real time, particularly during crisis spikes.

"GoFundMe is used to verify, for instance, if a fundraiser is going to be built for a military operation, or if you're building a fundraiser for a crisis that you were not part of, which would be fraudulent." — Karine Mellata 00:03:23

IAC (Ask Media Group) Publicly traded media holding company (Care.com, Angie, etc.). Named as Variance's first enterprise customer, using AI agents to replace a large BPO team for marketing content compliance review.

"There was a very large team of human agents, part of a BPO, outsourced, that was doing this work. And that was basically hurting their growth... We were the first company to say, 'Hey, we can actually do that with large language models.'" — Karine Mellata 00:23:21

Meter Infrastructure/networking startup. Mentioned as the prior employer of a key Variance engineer (Luke), notable for the quality of talent it produces.

"Luke on the team was one of the first engineers at Meter. And he understands evals for large language models better than anyone else on the team and even, I think, better than a lot of people in the industry." — Karine Mellata 00:18:35

4. People Identified

Karine Mellata Co-founder & CEO of Variance. Former fraud data engineer at Apple. Drove all founder-led sales for Variance's early enterprise deals. Survived a serious accident (broken spine, broken leg) mid-hypergrowth and returned to lead the company.

"For a year and a half as a founder, you're moving so fast... and then all of a sudden as a founder, you're in a bed and you can't move." — Karine Mellata 00:26:20

Michael (Co-founder, Variance) Co-founder & CTO of Variance. Former ML engineer at Apple's fraud engineering team. Held the company together operationally during Karine's hospitalization.

"Michael was a machine learning engineer... his machine learning decisions were then dispatched to the rest of the organization through my own streaming jobs. So we had a very symbiotic relationship from the get-go." — Karine Mellata 00:20:43

Luke (Engineer, Variance) Early engineer at Meter, now at Variance. Identified as having exceptional, industry-leading expertise in LLM evals — a capability increasingly critical to any AI-native product.

"He understands evals for large language models better than anyone else on the team and even, I think, better than a lot of people in the industry." — Karine Mellata 00:18:35

5. Operating Insights

The Three Building Blocks Framework for AI Agent Automation

Variance distilled enterprise AI agent deployment into three reusable components: (1) compliance/SOP documents, (2) internal and external data tools, and (3) open web access. Any operator attempting to automate complex knowledge work with AI agents should audit whether these three are in place before building.

"There's really only three building blocks that you need. So you have the compliance documents, the standard operating procedure... Once we have those compliance documents, then the AI agent can do its work using tools that we built and data, internal or external. Those are the only building blocks you need to automate complex KYC, complex KYB, complex content review." — Karine Mellata 00:07:44

Browser-Based Agents as a Data Integration Shortcut

When enterprise data is trapped behind legacy UIs (common in large, older companies), spinning up a browser agent to scrape internal dashboards is a faster integration path than waiting for API access or data pipelines. This is an underused onboarding tactic.

"Very recently, we've been onboarded this third way, which is spinning up a browser, opening up a really old review tool that was built for a human, pulling that data and then reasoning over it." — Karine Mellata 00:11:27

Triage 99%, Surface 1%: The Human-in-the-Loop Design Pattern

A common mistake in AI automation is trying to eliminate all human review. Variance's architecture deliberately automates the high-volume simple cases and routes only the genuinely complex 1% to humans — with a purpose-built investigative UI. This design pattern dramatically improves both automation rates and human analyst quality.

"Because AI agents are able to take on the simplest part of the workflow, so they're able to triage 99% of cases, that 1% is usually going to be the most complex cases that need to be reviewed by a human. And you need a really good dashboard. You need a really good investigative visual tool to be able to make sense of those super complex use cases." — Karine Mellata 00:17:09

6. Overlooked Insights

State-Sponsored Influence Operations Are Now Detectable at Scale by Commercial AI — and Companies Are Quietly Doing It

This was mentioned almost in passing, but it is a massive signal. A private, 12-person company is already detecting state-sponsored influence campaigns on behalf of Fortune 500 platforms during U.S. elections — and handing findings to law enforcement. This is a capability that previously existed only inside national intelligence agencies and the largest tech platforms.

"Throughout the elections, because our AI agents had access to the context of entities in relation to other entities... we were able to detect really complex fraud rings of especially state-sponsored actors that were pushing one narrative over. And I don't think this would have been possible if you had one classifier in isolation." — Karine Mellata 00:14:47

The implication: there is an emerging commercial market for geopolitical threat intelligence embedded within trust & safety platforms. This is an investment theme almost no one is tracking explicitly, sitting at the intersection of national security, AI, and enterprise compliance.

The UBO (Ultimate Beneficial Ownership) Graph Problem Is Unsolved at Scale and Enormous

Karine briefly describes building ownership graphs across shell companies, agents, and international registries to satisfy KYB compliance — but this was glossed over quickly. This is actually one of the hardest and most valuable problems in financial compliance globally, with regulatory pressure intensifying post-2024 U.S. Corporate Transparency Act enforcement.

"You're going to see companies have multiple shell companies, be tied to multiple different agents and different other identities. And within that really large graph, you expand the area of risk for the company where one of these nodes could be in a sanctioned country. One of these nodes could have adverse media on them and possibly have been to court for money laundering. And companies are required to conduct these investigations at scale. And at the moment, it's entirely manual." — Karine Mellata 00:07:17

Any AI-native company that can solve automated UBO graph traversal at scale — with access to 100+ business registries internationally — is sitting on a very large, very underserved compliance market.