[ { "id": 759, "name": "CyberFend", "slug": "cyberfend", "former_names": [], "small_logo_thumb_url": "/company/thumb/missing.png", "website": "http://cyberfend.com", "all_locations": "San Francisco, CA, USA; Santa Clara, CA, USA", "long_description": "Cyberfend offers a robust security solution to protect your web and mobile applications from sophisticated attacks and fraudulent activity. Cyberfend's solution detects account take-over, payment fraud and the use of stolen credentials. All of these problems are relevant to every consumer facing web and mobile product/service. \n\nCyberfend’s solution uses a new security paradigm – human cognitive science coupled with advanced machine learning. The result is a robust detection system with near zero false positives and false negatives. Today Cyberfend protects nearly a billion login and payment transactions every month for many large e-commerce, web and payment customers. \n\nCyberfend's product is at the intersection of almost every single cutting edge technology today : a) Our core product employs heavy machine learning b) On the backed, our product is cloud based and deals with enormous scale (customers are directing significant portions of their traffic to us) c) On the front end we need to deal with both web and mobile (IOS, SDK) challenges.Please visit us at: www.cyberfend.com.\n\nCyberfend is backed by Y Combinator, SV Angel and A Capital. \n\nCyberfend was acquired by Akamai Technologies in December 2016.", "one_liner": "Cyberfend delivers robust, real-time web and mobile security by…", "team_size": 2, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1416219580, "tags": [ "Cybersecurity", "Fraud Prevention" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Winter 2015", "status": "Acquired", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/cyberfend", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2015/cyberfend.json", "year_founded": null, "city": "San Francisco", "country": "US", "linkedin_url": null, "x_url": null, "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/cyberfend", "github_url": null, "logo_url": null, "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 63716, "full_name": "Sreenath Kurupati", "title": "Founder", "founder_bio": null, "is_active": true, "linkedin_url": "https://www.linkedin.com/profile/view?id=5872270", "x_url": null, "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/edeb8e60bbda11fabb0c1db6e53d65ceded29300.jpg" } ], "jobs": [], "news": [], "launches": [] }, { "id": 854, "name": "ThinAir", "slug": "thinair", "former_names": [], "small_logo_thumb_url": "/company/thumb/missing.png", "website": "http://thinair.com", "all_locations": "San Francisco, CA, USA; Palo Alto, CA, USA", "long_description": "At ThinAir They are building the future of data security--and it's wrought with exciting engineering challenges!\r\n\r\nAs a cloud-based SaaS product, ThinAir is the first data security solution that allows everyone—administrators and employees alike—to take control over their most sensitive data in a way that enhances, not hinders their productivity.\r\n\r\nThey were the 2014 DEMO Enterprise's DEMOGod Winner and they completed Y Combinator as part of W15.", "one_liner": "Intelligent data security for teams", "team_size": 11, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1419817287, "tags": [ "Cybersecurity", "Enterprise" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Winter 2015", "status": "Inactive", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/thinair", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2015/thinair.json", "year_founded": null, "city": "San Francisco", "country": "US", "linkedin_url": "", "x_url": "", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/thinair", "github_url": null, "logo_url": null, "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 72020, "full_name": "Tony Gauda", "title": "Founder/CEO", "founder_bio": null, "is_active": true, "linkedin_url": "https://www.linkedin.com/in/tonygauda", "x_url": null, "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/c4fc6005c4f40b1fb2967af10c4711a5c487a42c.jpg" } ], "jobs": [], "news": [], "launches": [] }, { "id": 891, "name": "Cymmetria", "slug": "cymmetria", "former_names": [], "small_logo_thumb_url": "/company/thumb/missing.png", "website": "http://cymmetria.com", "all_locations": "Tel Aviv-Yafo, Tel Aviv District, Israel", "long_description": "Cymmetria is a cybersecurity company at the forefront of deception technology, and offers the only commercially available deception technology that has caught 5 nation-state APTs.\n\nCymmetria’s deception products, MazeRunner and ActiveSOC, give organizations the ability to hunt attackers, detect lateral movement inside the perimeter, automate incident response, and mitigate attacks. The company also offers deception as a service, enabling organizations to customize deception technologies for their business environment. \n\nFounded in 2014 by security expert Gadi Evron, Cymmetria is changing the asymmetry of cybersecurity, giving defenders the upper hand.\n\nFor more information, visit www.cymmetria.com.", "one_liner": "Shifting the asymmetry of cyber security.", "team_size": 11, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1429997726, "tags": [ "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2015", "status": "Acquired", "industries": [ "B2B", "Security" ], "regions": [ "Israel", "Middle East and North Africa" ], "stage": "Growth", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/cymmetria", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2015/cymmetria.json", "year_founded": null, "city": "Tel Aviv-Yafo", "country": "IL", "linkedin_url": null, "x_url": null, "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/cymmetria", "github_url": null, "logo_url": null, "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 82967, "full_name": "Gadi Evron", "title": "Founder/CEO", "founder_bio": null, "is_active": true, "linkedin_url": "https://il.linkedin.com/in/gadievron", "x_url": null, "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/8fe9658aed273fdae7714f53a1b0d70a954b4bc4.jpg" } ], "jobs": [], "news": [], "launches": [] }, { "id": 940, "name": "Traversal Networks", "slug": "traversal-networks", "former_names": [], "small_logo_thumb_url": "/company/thumb/missing.png", "website": "http://traversalnetworks.com", "all_locations": "San Francisco, CA, USA; Mountain View, CA, USA", "long_description": "Traversal Networks develops a new form of Network Intrusion Detection System designed to catch unknown threats. The Lateral Threat Detector appliances are easily installed on your corporate network. These analyst-assisted sensors learn traffic patterns on each of your network segments and detect lateral exploitation, backdoors, bots, malware, and network reconnaissance.\n\nThe Traversal Networks operate on four different platforms: learn, reputation, machine learning and search.\n\nTraversal Networks has developed heuristics using a corpus of live network data combined with expertise in botnet detection to help filter traffic. Additionally, Traversal Networks uses IP and DNS reputation across all its deployed devices to detect new threats.\n\nThe Lateral Threat Detector appliances utilize reinforcement learning to continually enhance filtering performance on each network segment, and submit prefix-preserving anonymized data to our cloud making it available to be quickly searched in real time.\n\nThe Traversal Cloud Analysis platform was designed to enable its security analysts to quickly pivot on anomalous traffic seen across its network and classify it as malicious or benign.", "one_liner": "Enterprise Threat Detection: Tuning, Triage, and Analysis by Experts.", "team_size": 1, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1430156132, "tags": [ "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2015", "status": "Inactive", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/traversal-networks", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2015/traversal-networks.json", "year_founded": null, "city": "San Francisco", "country": "US", "linkedin_url": null, "x_url": null, "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/traversal-networks", "github_url": null, "logo_url": null, "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [], "jobs": [], "news": [], "launches": [] }, { "id": 1043, "name": "Salt Security", "slug": "salt-security", "former_names": [ "Secful", "Salt" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/ee67d3955bee952b7146cbf36150b372e91df27a.png", "website": "https://salt.security/", "all_locations": "New York City, NY, USA; Tel Aviv-Yafo, Tel Aviv District, Israel", "long_description": "Salt Security protects the APIs that form the core of every modern application. Its patented API Protection Platform is the only API security solution that combines the power of cloud-scale big data and time-tested ML/AI to detect and prevent API attacks. By correlating activities across millions of APIs and users over time, Salt delivers deep context with real-time analysis and continuous insights for API discovery, attack prevention, and shift-left practices. Deployed quickly and seamlessly integrated within existing systems, the Salt platform gives customers immediate value and protection, so they can innovate with confidence and accelerate their digital transformation initiatives.\r\n\r\nSalt pioneered API security and is the industry leader for API security with a proven record of success. You can watch a 90-second overview video of the Salt Security API Protection Platform here: https://youtu.be/Z5nzavnBJj4\r\n", "one_liner": "Protects organizations from getting breached through their APIs.", "team_size": 200, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1447568415, "tags": [ "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Winter 2016", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "Israel", "America / Canada", "Middle East and North Africa", "Remote", "Partly Remote" ], "stage": "Growth", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/salt-security", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2016/salt-security.json", "year_founded": 2016, "city": "New York City", "country": "US", "linkedin_url": "https://www.linkedin.com/company/saltsecurity", "x_url": "https://twitter.com/SaltSecurity", "fb_url": "https://www.facebook.com/SaltAPIProtectionInc", "cb_url": "https://www.crunchbase.com/organization/saltsecurity", "github_url": "https://github.com/SECful", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/ee67d3955bee952b7146cbf36150b372e91df27a.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 110819, "full_name": "Roey Eliyahu", "title": "Founder/CEO", "founder_bio": null, "is_active": true, "linkedin_url": "https://www.linkedin.com/profile/view?id=AAIAABIcm5MBfqBCyLhsb4LF4s6RylWpU2QCVVQ", "x_url": null, "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/df5346c06b3c82fec2cad29aaef8ddbbe21210a7.jpg" } ], "jobs": [], "news": [ { "title": "Salt Security releases Salt Labs State of API Security Report", "url": "https://salt.security/api-security-trends", "date": "Apr 27, 2022" }, { "title": "Salt Security announces $140 million Series D round", "url": "https://salt.security/blog/how-salt-is-having-the-best-journey??utm_source=twitter", "date": "Feb 10, 2022" }, { "title": "Formalizing our API security research with the launch of Salt Labs", "url": "https://salt.security/blog/formalizing-our-api-security-research-with-salt-labs", "date": "Jul 14, 2021" } ], "launches": [] }, { "id": 1223, "name": "Metapacket", "slug": "metapacket", "former_names": [], "small_logo_thumb_url": "/company/thumb/missing.png", "website": "http://www.metapacket.com", "all_locations": "San Francisco, CA, USA", "long_description": "Metapacket is a proxy platform that detects & prevents malwares from exfiltration. Effectively rendering malware useless.", "one_liner": "Metapacket is the first selective web gateway that stops malware by…", "team_size": 2, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1461210618, "tags": [ "Cybersecurity", "Enterprise" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2016", "status": "Inactive", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/metapacket", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2016/metapacket.json", "year_founded": null, "city": "San Francisco", "country": "US", "linkedin_url": null, "x_url": null, "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/metapacket", "github_url": null, "logo_url": null, "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 110582, "full_name": "Nir Krakowski", "title": "Founder/CEO", "founder_bio": null, "is_active": true, "linkedin_url": "https://il.linkedin.com/in/nirkrakowski", "x_url": null, "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/3870fdf4b20f969eb89d196db70a712e5923f5d0.jpg" }, { "user_id": 138624, "full_name": "Itamar Gilad", "title": "Founder/CTO", "founder_bio": "Former technical leader at Microsoft and co-founder for Metapacket. Current research and threat detection lead at Wiz (acquired by Google). Passionate researcher, builder and leader.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/igilad", "x_url": "https://x.com/TrustingTrust", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/661d8f6c325c9906f13a91f1f0be8685180fcdfe.jpg" } ], "jobs": [], "news": [], "launches": [] }, { "id": 1821, "name": "Hunter2", "slug": "hunter2", "former_names": [], "small_logo_thumb_url": "/company/thumb/missing.png", "website": "https://hunter2.com", "all_locations": "Boston, MA, USA", "long_description": "Hunter2 teaches modern appsec to engineering teams through interactive labs. Developers get hands-on practice exploiting and patching real web apps written in their tech stack.", "one_liner": "Hunter2 trains engineering teams in application security through…", "team_size": 0, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1510124608, "tags": [ "Developer Tools", "Education", "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Winter 2018", "status": "Acquired", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/hunter2", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2018/hunter2.json", "year_founded": null, "city": "Boston", "country": "US", "linkedin_url": null, "x_url": "", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/hunter2", "github_url": null, "logo_url": null, "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 107898, "full_name": "Fletcher Heisler", "title": "Founder", "founder_bio": "", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/fheisler/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/993e7f5175fc5b5e7299636ccc7a7ab0417be0dc.jpg" } ], "jobs": [], "news": [], "launches": [] }, { "id": 11921, "name": "Fuzzbuzz", "slug": "fuzzbuzz", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/8e18fbf6ea3daeba8a461bb43e6d3c1a33db734b.png", "website": "", "all_locations": "San Francisco, CA, USA", "long_description": "", "one_liner": "Fuzzing as a Service", "team_size": null, "industry": "B2B", "subindustry": "B2B -> Infrastructure", "launched_at": 1540951464, "tags": [ "Security", "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Winter 2019", "status": "Acquired", "industries": [ "B2B", "Infrastructure" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/fuzzbuzz", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2019/fuzzbuzz.json", "year_founded": null, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/fuzzbuzz", "x_url": "https://twitter.com/fuzzbuzz", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/fuzzbuzz", "github_url": "https://github.com/fuzzbuzz", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/8e18fbf6ea3daeba8a461bb43e6d3c1a33db734b.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 301926, "full_name": "Sabera Hussain", "title": "Founder", "founder_bio": null, "is_active": true, "linkedin_url": "https://www.linkedin.com/in/sabera-hussain", "x_url": null, "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/4283d2050bd5e0bdb2ea2e2d886775cee60fb5ff.jpg" }, { "user_id": 284225, "full_name": "Everest Munro-Zeisberger", "title": "Founder", "founder_bio": "", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/everestmz/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/efe048cd023aa1efa963d7af13f197f0d1df8ebf.jpg" }, { "user_id": 292805, "full_name": "Andrei Serban", "title": "Founder", "founder_bio": "", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/andrei-serban/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/990ac42853223eac6d2ffb88b462c813b264f2b1.jpg" } ], "jobs": [], "news": [], "launches": [] }, { "id": 11977, "name": "MedCrypt", "slug": "medcrypt", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/f83d9fea6258d4ade4828219ac97951e9aabc969.png", "website": "https://www.medcrypt.co", "all_locations": "San Diego, CA, USA", "long_description": "MedCrypt has developed a security toolkit that allows medical device developers to focus on diagnosing and treating disease, while ensuring their devices comply with security regulations and best practices. And since each installation of our software communicates with our MedCrypt network, we can use machine learning-based transaction monitoring algorithms to detect anomalous behavior, thwarting attacks in real time. This centralization of transaction data allows us to facilitate \"Threat Sharing\" between device vendors, helping build a community of device vendors offering the most secure devices possible.\r\n\r\n\r\n\r\nMedCrypt protects medical devices against malicious hacking. Each installation of our software communicates with our MedCrypt network, allowing us to use machine learning-based transaction monitoring algorithms to detect anomalous behavior, thwarting attacks in real time. This centralization of transaction data allows us to facilitate \"Threat Sharing\" between device vendors, helping build a community of device vendors offering the most secure devices possible.\r\n\r\n\r\nIf someone hacks your connected thermostat, you’re uncomfortable. If someone hacks your pacemaker, you could be dead. MedCrypt is bringing modern software security technologies to an important, but underserved technology sector.\r\n", "one_liner": "MedCrypt gives medical device vendors cybersecurity features in a few…", "team_size": 16, "industry": "Healthcare", "subindustry": "Healthcare -> Healthcare IT", "launched_at": 1541131379, "tags": [ "Medical Devices", "Healthcare", "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Winter 2019", "status": "Active", "industries": [ "Healthcare", "Healthcare IT" ], "regions": [ "United States of America", "America / Canada", "Remote", "Partly Remote" ], "stage": "Growth", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/medcrypt", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2019/medcrypt.json", "year_founded": 2016, "city": "San Diego", "country": "US", "linkedin_url": "", "x_url": "", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/medcrypt", "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/f83d9fea6258d4ade4828219ac97951e9aabc969.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 118980, "full_name": "Mike Kijewski", "title": "Founder", "founder_bio": "", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/mkijewski", "x_url": "https://www.twitter.com/mikekijewski", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/0fa44d073e5547897cf82c6606566e712e4c4d3c.jpg" }, { "user_id": 147762, "full_name": "Eric Pancoast", "title": "Founder", "founder_bio": null, "is_active": true, "linkedin_url": "https://www.linkedin.com/in/epancoast", "x_url": null, "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/dd8f001e25df8ad3630e00497773ad0645b950d4.jpg" } ], "jobs": [], "news": [ { "title": "MedCrypt lands $25M injection to secure vulnerable medical devices • TechCrunch", "url": "https://techcrunch.com/2022/11/01/medcrypt-security-medical-device/", "date": "Nov 01, 2022" } ], "launches": [] }, { "id": 12265, "name": "Sublime Black", "slug": "sublime-black", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/a864736635415469c6ff1a5b71a52b880d8e38c1.png", "website": "http://sublimeblack.com", "all_locations": "", "long_description": "", "one_liner": "Automating Cyber Security Incident Response Through Artificial…", "team_size": 0, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1543988091, "tags": [ "Cybersecurity", "Enterprise", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Winter 2019", "status": "Inactive", "industries": [ "B2B", "Security" ], "regions": [ "Unspecified" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/sublime-black", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2019/sublime-black.json", "year_founded": null, "city": null, "country": null, "linkedin_url": "", "x_url": "", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/a864736635415469c6ff1a5b71a52b880d8e38c1.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 257943, "full_name": "Kembey Gbarayor", "title": "Founder", "founder_bio": "", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/kembeyg", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/569f9561d17540269368324fc3a8a158e9f01728.jpg" }, { "user_id": 285825, "full_name": "Charles Whitby, CISSP, PCIP, CRISC, CISM", "title": "Founder", "founder_bio": null, "is_active": true, "linkedin_url": "https://www.linkedin.com/in/charles-whitby-cism-crisc-cissp-91819b55/", "x_url": null, "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/e825cb228e94c6acb9fb5b9d4f477057ca7eaf46.jpg" } ], "jobs": [], "news": [], "launches": [] }, { "id": 12608, "name": "TRM Labs", "slug": "trm-labs", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/19aa5130e3a0a349d200e7510f0c2fe8439a646f.png", "website": "https://trmlabs.com/", "all_locations": "San Francisco, CA, USA; Remote", "long_description": "TRM is on a mission to build a safer world for billions of people. \r\n\r\nAI is extending the capability gap between attackers and defenders. The fundamental unit of scale has shifted from humans to AI tokens. \r\n\r\nTRM combines proprietary data, with an AI investigations platform to build a system of action for crime fighters. Think Claude CoWork for mission critical investigations. \r\n\r\nWe believe AI scale crime deserves AI scale defense. \r\n\r\nJoin our mission ➔ www.trmlabs.com/careers", "one_liner": "TRM is building a safer world for billions of people.", "team_size": 400, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1556572947, "tags": [ "Fintech", "Machine Learning", "GovTech", "Cybersecurity", "Data Engineering" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Summer 2019", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Fully Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/trm-labs", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2019/trm-labs.json", "year_founded": 2018, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/trmlabs/", "x_url": "https://twitter.com/trmlabs", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/trm-labs", "github_url": "https://github.com/trmlabs", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/19aa5130e3a0a349d200e7510f0c2fe8439a646f.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 182800, "full_name": "Esteban Castaño", "title": "Founder", "founder_bio": null, "is_active": true, "linkedin_url": "https://www.linkedin.com/in/ecastano/", "x_url": null, "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/f30ed5d0c98a481c2748ef4df723efad5018bc7b.jpg" }, { "user_id": 253026, "full_name": "Rahul Raina", "title": "Founder", "founder_bio": null, "is_active": true, "linkedin_url": "https://www.linkedin.com/in/rahulr0609/", "x_url": "https://twitter.com/rahulr0609", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/9759364f37d0fa64a091b6496b181d7ae6a3a814.jpg" } ], "jobs": [ { "id": 76585, "title": "New Product Lead", "url": "https://www.ycombinator.com/companies/trm-labs/jobs/Bt9p7XS-new-product-lead", "location": "US / Remote (US)", "type": "Full-time", "role": "Product", "role_type": null, "salary_range": "$175K - $200K", "equity_range": "", "experience": "6+ years", "visa": "US citizen/visa only", "skills": [] } ], "news": [ { "title": "TRM Labs’ Financial-Service Backers Come Back For More In $70 Million Series B Expansion", "url": "https://www.forbes.com/sites/mitchellmartin/2022/11/09/trm-labs-financial-service-backers-come-back-for-more-in-70-million-series-b-expansion/", "date": "Nov 16, 2022" }, { "title": "JPMorgan Chase Strategically Invests in Blockchain-focused TRM Labs", "url": "https://blockworks.co/jpmorgan-chase-strategically-invests-in-blockchain-focused-trm-labs/", "date": "Mar 03, 2022" }, { "title": "TRM Labs Raises $60M as Visa, Amex Play Catch-Up on Crypto Tracking", "url": "https://www.coindesk.com/business/2021/12/07/trm-labs-raises-60m-as-visa-amex-play-catchup-on-crypto-tracking/", "date": "Dec 07, 2021" }, { "title": "TRM Labs Raises $14M as Crypto Tracking Steps Into Spotlight - CoinDesk", "url": "https://www.coindesk.com/trm-labs-raises-14m-as-crypto-tracking-steps-into-spotlight", "date": "Jun 17, 2021" } ], "launches": [] }, { "id": 13322, "name": "Skypher", "slug": "skypher", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/31ab5dbe8214dbe61ef6043964f8ca4f554e778b.png", "website": "https://skypher.co", "all_locations": "New York City, NY, USA", "long_description": "Skypher is an AI agent platform that automates your security/privacy/ddq/esg compliance questionnaires response process making it 10x faster. We save dozens of hours for @Deel, @Retool or Adobe's engineering, sales, customer success, and security leaders on security questionnaires and speed up their sales cycle by 20%. \r\n\r\nSkypher was launched in 2019 in San Francisco and is now the market leader in security questionnaires response automation with 200+ global customers worldwide across North America, Europe and India. We work with Fortune 500 companies such as Adobe, McKinsey & Company, TeamViewer or CMA CGM as well as fast growing tech companies like Deel, TCN or Retool. With a team of over 30 people across Europe and North America with global offices in New York and Paris.\r\n", "one_liner": "AI agent for Compliance Questionnaires Automation", "team_size": 12, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1583971113, "tags": [ "Generative AI", "Compliance", "Cybersecurity", "AI", "AI Assistant" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Winter 2020", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Partly Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/skypher", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2020/skypher.json", "year_founded": 2019, "city": "New York City", "country": "US", "linkedin_url": "https://www.linkedin.com/company/26261406/admin/", "x_url": "https://twitter.com/Skypher_HQ", "fb_url": "https://www.facebook.com/SkypherHQ", "cb_url": "https://www.crunchbase.com/organization/skypher", "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/31ab5dbe8214dbe61ef6043964f8ca4f554e778b.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 332908, "full_name": "Louis Mutricy", "title": "Founder", "founder_bio": null, "is_active": true, "linkedin_url": "https://www.linkedin.com/in/louis-mutricy-372a1a11b/", "x_url": null, "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/c6b7a0cbaf3a3010c1cc6dd9d74149d41c50b93e.jpg" }, { "user_id": 328119, "full_name": "Gaspard de Lacroix", "title": "Founder", "founder_bio": "", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/gaspard-de-lacroix-vaubois-21a580112/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/0f7d2e479e513391089ac8cabfc2e646422a8226.jpg" } ], "jobs": [ { "id": 32961, "title": "Full Stack Developer", "url": "https://www.ycombinator.com/companies/skypher/jobs/ZFOZRt9VS-full-stack-developer", "location": "Paris / Remote (US)", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "$60K - $80K", "equity_range": "0.25% - 2.00%", "experience": "1+ years", "visa": "US citizen/visa only", "skills": [ "JavaScript", "React" ] } ], "news": [], "launches": [] }, { "id": 22079, "name": "Formal", "slug": "formal", "former_names": [ "Shipl", "MetaBank", "Maytana" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/66941efea1bbb96c0037b8eb01cd10d72092895c.png", "website": "https://joinformal.com", "all_locations": "San Francisco, CA, USA; New York, NY, USA; Remote", "long_description": "", "one_liner": "Take control of your data in real-time.", "team_size": 10, "industry": "B2B", "subindustry": "B2B", "launched_at": 1598356040, "tags": [ "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2020", "status": "Active", "industries": [ "B2B" ], "regions": [ "United States of America", "America / Canada", "Remote", "Fully Remote" ], "stage": "Growth", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/formal", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2020/formal.json", "year_founded": 2022, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/formalhq", "x_url": "https://x.com/joinformal", "fb_url": null, "cb_url": null, "github_url": "https://github.com/orgs/formalco/", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/66941efea1bbb96c0037b8eb01cd10d72092895c.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Brad Flora", "url": "https://www.ycombinator.com/people/brad-flora" }, "founders": [ { "user_id": 488485, "full_name": "Mokhtar Bacha", "title": "Founder", "founder_bio": "At 17 Mokhtar Bacha became the youngest employee at ConsenSys, hired by Ethereum co-founder Joseph Lubin. There, he gained expertise in cryptography, consensus algorithms, and distributed systems.\nMokhtar launched Formal in 2022 with the mission to secure the world's data. Today thanks to an incredible team, we are proud to secure the data of customers like Notion.com, Ramp.com, and Gusto.com", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/ahmb84", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/026ab822955d3ef8a1f60edff0a6babfb2fce6ad.jpg" } ], "jobs": [], "news": [ { "title": "YC-backed Formal brings a clever security reverse-proxy out of stealth | TechCrunch", "url": "https://techcrunch.com/2024/11/19/formal-secures-access-to-databases-and-internal-applications-at-the-network-level/", "date": "Nov 19, 2024" } ], "launches": [] }, { "id": 22141, "name": "SafeBase", "slug": "safebase", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/11ecc83b03cfcf5e3849e1ca5f104ded4d413551.png", "website": "https://www.safebase.io", "all_locations": "San Francisco, CA, USA; Remote", "long_description": "Trust Center Platform\r\n\r\nSafeBase Trust Center enables Security teams to proactively share and automate access to security, compliance, and privacy information/ complete security questionnaires.\r\n", "one_liner": "Trust Center platform that scales customer security reviews", "team_size": 60, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1595995902, "tags": [ "SaaS", "Productivity", "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2020", "status": "Acquired", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Fully Remote" ], "stage": "Growth", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/safebase", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2020/safebase.json", "year_founded": 2020, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/safebase/", "x_url": "", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/11ecc83b03cfcf5e3849e1ca5f104ded4d413551.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 468111, "full_name": "Al Yang", "title": "Founder", "founder_bio": "Father of two - lives in the Bay - enjoys company building and golfing. Started SafeBase to help companies share their security and compliance posture and automate access to sensitive information -- a pain he dealt with in his last company (Medumo, acquired by Philips Health). ", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/alyang10/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/b7940a9cdf08f3d84c64caa8ff5c1e4c24485d17.jpg" }, { "user_id": 452212, "full_name": "Adar Arnon", "title": "Founder", "founder_bio": "Former R&D group leader in an elite technology unit in the Intelligence Directorate of the IDF. Specialized in Cybersecurity and OS architecture. Graduated from the joint-degree MS/MBA program at Harvard.\nI enjoy building stuff, and I enjoy breaking stuff even more. I've had years of varied experiences in the intersection of cybersecurity & web infrastructure, from designing secure networking protocols, to architecting operating system drivers, and managing a reverse-engineering team.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/adarnon/", "x_url": "https://twitter.com/adararnon", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/37a5c3a09564be609b8e785389afe8ddc3943608.jpg" } ], "jobs": [], "news": [ { "title": "SafeBase + Drata: Redefining Trust and Compliance for the Enterprise", "url": "https://safebase.io/blog/drata-acquires-safebase", "date": "Feb 11, 2025" }, { "title": "SafeBase taps AI to automate software security reviews | TechCrunch", "url": "https://techcrunch.com/2024/04/30/safebase-taps-ai-to-automate-software-security-reviews/", "date": "Apr 30, 2024" }, { "title": "SafeBase bags $18M Series A to speed up vendor security auditing process – TechCrunch", "url": "https://techcrunch.com/2022/03/10/safebase-bags-18m-series-a-to-speed-up-vendor-security-auditing-process/", "date": "Mar 10, 2022" } ], "launches": [] }, { "id": 22669, "name": "Stacksi", "slug": "stacksi", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/f156eef4b9ac5fa38dd9afff769a51093bf61255.png", "website": "https://www.stacksi.com", "all_locations": "Los Angeles, CA, USA; Remote", "long_description": "Stacksi helps companies automate the process of answering enterprise security questionnaires so they can close deals faster and save their best engineers’ time for more strategic projects.\r\nSalespeople, CTOs, and CEOs of fast-growing enterprise startups can upload security questionnaires into our system. If the company already has written security policies, they can upload those documents, too. From there, Stacksi parses their documents, identifies gaps in their security policies vs. standards, and helps them establish a successful security program. \r\nUltimately, we will help them 1) automate completion of security questionnaires, 2) quickly get through enterprise security audits and 3) improve their security posture.", "one_liner": "Automated Answers to Security Questionnaires", "team_size": 4, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1614621439, "tags": [ "Compliance", "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Winter 2021", "status": "Acquired", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Fully Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/stacksi", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2021/stacksi.json", "year_founded": 2020, "city": "Los Angeles", "country": "US", "linkedin_url": "https://www.linkedin.com/company/stacksi/", "x_url": "", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/f156eef4b9ac5fa38dd9afff769a51093bf61255.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 581239, "full_name": "Emre Murray Mangir", "title": "Founder", "founder_bio": "Current:\n- Product at Ashby (we make powerful and pleasant software for hiring) \nPreviously:\n- Co-founder at Stacksi (W21 - we automate security questionnaires)\n- Co-founder at Mozio (aggregates global ground transport)\n- Former pricing & marketing consultant at Simon-Kucher & Partners (improves unit economics, pricing, and packaging)\n- UC Berkeley - Applied Math, Economics", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/emremangir/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/ed4f95dc983aedeaedbf44f5fff4e2ecd55feb15.jpg" } ], "jobs": [], "news": [ { "title": "SafeBase Acquires Fellow Y Combinator-Backed Stacksi to Fuel Its Vision for Zero-friction Security Assessments | Business Wire", "url": "https://www.businesswire.com/news/home/20230906917869/en/SafeBase-Acquires-Fellow-Y-Combinator-Backed-Stacksi-to-Fuel-Its-Vision-for-Zero-friction-Security-Assessments", "date": "Sep 06, 2023" } ], "launches": [] }, { "id": 24195, "name": "Tarsal", "slug": "tarsal", "former_names": [ "V-diff", "vdiff" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/75747b61e59eadbd8831c406fbe1beed2fd4957b.png", "website": "https://www.tarsal.co/", "all_locations": "New York City, NY, USA; San Francisco, CA, USA; Remote", "long_description": "Tarsal is a data pipeline custom built for security teams. As security data grows 25% year over year, security teams desperately need access to best-in-class data infrastructure. Tarsal bridges the gap between the modern data stack and security teams, pioneering the modern security data stack. \r\n", "one_liner": "Data pipeline for your security data lake.", "team_size": 10, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1680491615, "tags": [ "B2B", "Cybersecurity", "Big Data", "Data Engineering" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2021", "status": "Acquired", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Fully Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/tarsal", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2021/tarsal.json", "year_founded": 2021, "city": "New York City", "country": "US", "linkedin_url": "https://www.linkedin.com/company/tarsal/", "x_url": "https://twitter.com/tarsalhq", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/75747b61e59eadbd8831c406fbe1beed2fd4957b.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 504645, "full_name": "Sunny Rekhi", "title": "Founder", "founder_bio": "cofounder/CEO of Tarsal (acq)", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/sunny-rekhi/", "x_url": "https://twitter.com/sunnyrekhi", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/7871e148fe5e8bc56d0a7ff53112f6ed73439faa.jpg" } ], "jobs": [], "news": [ { "title": "Tarsal Raises $6 Million for Security Data Movement Platform - SecurityWeek", "url": "https://www.securityweek.com/tarsal-raises-6-million-for-security-data-movement-platform/", "date": "Mar 21, 2024" } ], "launches": [ { "id": 71058, "title": "Tarsal: Data pipeline built for modern security teams", "tagline": "Run your SIEM on a generic data lake with one-click connectors that normalize your logs to a unified schema", "body": "### **TL;DR:**\n\n[**Tarsal**](https://tarsal.co) **is the first data pipeline built for modern security teams.** We’re like Fivetran or Segment, but built for security teams.\n\nTarsal provides:\n\n\\- one-click ingestion and normalization for all security logs (e.g multi-cloud infra, Okta, Duo, Slack, CrowdStrike, etc.)\n\n\\- normalization _across_ sources for easy correlation\n\n\\- detections as code\n\n\\- a vendor-agnostic pipeline so you can use the best log destination for the job (supported destinations include Snowflake, S3, Databricks, Splunk, DataDog, etc.)  \n\n### 👤 **The Team**\n\n[**Sunny Rekhi**](https://www.linkedin.com/in/sunny-rekhi/) **(CEO)** was previously an infrastructure + backend engineer at TikTok and Uber, where he worked on high scale data systems.\n\n[**Manny Gundampalli**](https://www.linkedin.com/in/manny-gundampalli-6a982019b/) **(CTO)** was previously a data infrastructure engineer at Plaid, where she worked on Plaid’s highest volume ML pipelines.\n\n### **❌ The Problem**\n\n**Security data has become unmanageable.**\n\n![](https://lh4.googleusercontent.com/48OpE_QVew8YK5ESoSSTbQC9_FXZWfbtePb8yXmZlY7vpDTBGjNbqb7rCW4XRM4BzJtnUng2CeOGYkrqzO3VHXonj_23Q99TUIGRqOHDqZxNC7RdXz-W1sBM78XNig5TovQL1n5S8TtaeKgVdII8W2AtGQ=nw)\n\n* There’s no standard for how security data is defined, so security teams have to write complex queries to account for all the variations.\n* There’s no consistent way to get your log data: some vendors expose a REST API, others expose a GraphQL API. Some give you JSON data, some give you unstructured text. Schematized data is rare.\n* There’s _a lot_ of it. Security data is growing at 23% CAGR, and log storage costs are incredibly high.\n\n## **✨ Our Solution**\n\n[**Tarsal**](https://tarsal.co) is the first data pipeline built for modern security teams. With zero-hassle, one-click connectors, security teams can ingest normalized data and route it to the destination of their choice.\n\n**Our unified schema is specifically designed to reduce the complexity in incident response.** By normalizing a set of standard fields across all log sources, security teams no longer have to write complex queries to track an incident across their systems. Query once against Tarsal fields — let us figure out how that maps back to the original data.\n\n**We save you money on log storage costs by letting you route logs to the cheapest destination.** With data growing 23% year over year, organizations face ballooning infrastructure cost. Tarsal lets you filter + route logs to any of our supported destinations, including major SIEMs, Amazon S3, or a modern data warehouse like Snowflake, BigQuery, or Databricks.\n\n**Tarsal lets you write real-time detections as code.** Write expressive and flexible detections in Python for needs specific to your enterprise. Benefit from pre-built detections that are mapped to specific threats.\n\n**We alert you if anything breaks in your log ingestion.** Rest assured that you’re collecting the data you’d need during an incident. Set up Slack or PagerDuty alerts if any of your logs stop syncing over.\n\n![](https://lh6.googleusercontent.com/s_iuAJD6ZiI_jJBjGYE8ndHSN0grI-BEHRg_unkfAwwFlRvqhiWxfDPsNQ14mUlakvOPbedvfdc_ITMJfFlT3KdMUYolC43L-wwZx39-LbomTRhIstS4EofeIhj2WWBFLqCZEnaoCwbV9DL9_0FP-zKCbw=nw)\n\n### **🎉 Interested?**\n\nEmail us at [founders@tarsal.co](mailto:founders@tarsal.co) and we’ll give you a link to sign up. You can also a book a call with me [here](https://calendly.com/rohit-rekhi/30min) to learn more.", "url": "https://www.ycombinator.com/launches/IU6-tarsal-data-pipeline-built-for-modern-security-teams", "votes": 58, "created_at": "2023-04-19T14:52:36.010Z" } ] }, { "id": 24382, "name": "Malloc Inc", "slug": "malloc-inc", "former_names": [ "Malloc, LTD.", "Malloc" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/6f9e51a7bd166fd06ac233b1bc31a81d599db773.png", "website": "https://mallocprivacy.com/", "all_locations": "Nicosia, Nicosia, Cyprus", "long_description": "Malloc monitors and prevents anyone from recoding or transmitting data from your mobile device without your knowledge. Malloc uses on-device AI to detect zero-click spyware and abnormal activity and blocks any suspicious communication in real time. We sell this to individuals, enterprises and governments that care about their privacy. ", "one_liner": "AI-driven mobile cybersecurity ", "team_size": 10, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1626963356, "tags": [ "Privacy", "Cybersecurity", "Defense", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2021", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "Cyprus", "Europe", "Remote", "Partly Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": true, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/malloc-inc", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2021/malloc-inc.json", "year_founded": 2021, "city": "Nicosia", "country": "CY", "linkedin_url": "https://www.linkedin.com/company/68859929/", "x_url": "https://twitter.com/MallocPrivacy", "fb_url": "https://www.facebook.com/mallocprivacy", "cb_url": "https://www.crunchbase.com/organization/malloc-05ff", "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/6f9e51a7bd166fd06ac233b1bc31a81d599db773.png", "app_video_url": null, "dday_video_url": "https://bookface-images.s3.us-west-2.amazonaws.com/video_event/54/1630618022265-acxzfezjf07-35c3ea3ebb9324b0ab3d5b405802c007/ac1e6283178fdc5aa9eeb9de9d92db55.mp4?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAQC4NIECABPQ2AHNW%2F20261020%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20261020T022659Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=85f48bf7ae03051adecb09164bc03b8297fe33d105264d753b36257b2ce25c3e", "company_photos": [ "https://bookface-images.s3.us-west-2.amazonaws.com/attachments/264567834956d1eaadf02e9ea3e11dd1af3bb4f7.png" ], "primary_partner": null, "founders": [ { "user_id": 596801, "full_name": "Maria Terzi", "title": "Founder", "founder_bio": "Maria Terzi is the co-founder and CEO of Malloc. Maria holds a Ph.D. in Machine Learning and Recommender Systems. During her Ph.D., she won two Google hackathons and has previously worked at Google. Maria holds extensive experience in R&D in the areas of data analysis, machine learning, secure and private AI. ", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/maria-terzi/", "x_url": "https://twitter.com/mariankh_", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/c6a08f6a3943d618936dbd6c2c77dfc7a7727858.jpg" }, { "user_id": 600671, "full_name": "Liza Charalambous", "title": "Founder", "founder_bio": "Liza Charalambous is a Digital Security expert with 8+ years of experience in the ideation and implementation of (cyber) security projects. Liza holds a PhD in machine learning, as well as academic titles in signal processing and AI and digital communications. Over the years, she collaborated with various privately owned and public organizations to provide solutions that improve users’ quality of life. ", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/lzcharalambous/", "x_url": "https://twitter.com/lzcharalambous", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/bdcacd6c9da58df1227d94eb366d5e3b567653c6.jpg" } ], "jobs": [], "news": [ { "title": "Towards a privacy-conscious internet - Hunting Greek Unicorns #38", "url": "https://startuppirate.substack.com/p/hunting-greek-unicorns-38", "date": "Oct 01, 2021" }, { "title": "YC-backed Malloc wants to take the sting out of mobile spyware – TechCrunch", "url": "https://techcrunch.com/2021/09/27/y-combinator-malloc-spyware/", "date": "Sep 27, 2021" } ], "launches": [] }, { "id": 24604, "name": "Telivy", "slug": "telivy", "former_names": [ "Telivy", "Inc." ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/9c2b737c315b075b967ccb0e8aa0683e1b37cef2.png", "website": "https://www.telivy.com", "all_locations": "San Francisco, CA, USA", "long_description": "Telivy helps small and medium businesses purchase the best cyber insurance coverage. Our proprietary ML-based risk platform assesses insurability gaps, offers remediation plans and brokers insurance quotes from A+ rated carriers. ", "one_liner": "Automate your cyber security risk assessments", "team_size": 6, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1629349306, "tags": [ "Security", "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2021", "status": "Acquired", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Partly Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/telivy", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2021/telivy.json", "year_founded": 2021, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/telivy/", "x_url": "https://twitter.com/TelivyInsurance", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/9c2b737c315b075b967ccb0e8aa0683e1b37cef2.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Gustaf Alstromer", "url": "https://www.ycombinator.com/people/gustaf-alstromer" }, "founders": [ { "user_id": 162837, "full_name": "Naren Sathiya", "title": "Founder", "founder_bio": "Naren is interested in the intersection of finance and technology, and views the insurance industry as a data science problem to be optimized on. He joined Hippo Insurance as an early engineer and led its embedded distribution channel with homebuilders, which became over 20% of its revenue within 1.5 years. He hopes to build similar workflows and user experience for the commercial industry, starting with cyber and compliance companies. In his free time, he likes to mountain bike, swim and hike. ", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/naren-sathiya-01197a19", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/af2fb864fbbb5250ab04f3075019229a9c85eb04.jpg" } ], "jobs": [], "news": [], "launches": [] }, { "id": 26776, "name": "Overwatch", "slug": "overwatch", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/1def1e618878c538c08d4635fb23a133ed14d476.png", "website": "http://www.overwatchdata.ai", "all_locations": "New York City, NY, USA", "long_description": "Overwatch Data offers real-time AI agents to scale fraud, cyber, and security teams. Our agents automate the threat intelligence and brand protection workflow, while also conducting risk reviews at scale to detect fraud and financial crime.", "one_liner": "Enterprise software for enterprise risk and cyber fraud intelligence", "team_size": 14, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1657829137, "tags": [ "Cybersecurity", "Fraud Prevention", "Fraud Detection", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2022", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Partly Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/overwatch", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2022/overwatch.json", "year_founded": 2022, "city": "New York City", "country": "US", "linkedin_url": "https://www.linkedin.com/company/overwatchdata/", "x_url": "https://twitter.com/Overwatch_data", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/1def1e618878c538c08d4635fb23a133ed14d476.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 977105, "full_name": "Arjun Bisen", "title": "Founder", "founder_bio": "I started my career as an Australian diplomat, during which time I analyzed geopolitical and cyber risk across APAC and writing Australia's Cyber Engagement Strategy. I then studied the intersection of technology and risk at Harvard on a full Fulbright scholarship. I've since led risk teams at Stripe and Google Search before founding Overwatch to help those teams get ahead of emerging cyber, fraud, and financial crime risks. ", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/arjun-bisen/", "x_url": "https://twitter.com/ArjunBisen1", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/35718f1a274cd5ca0063277cf94d8ea427b33a52.jpg" }, { "user_id": 1081618, "full_name": "Zara Perumal", "title": "Founder", "founder_bio": "Co-founder / CTO at Overwatch Data\n\nZara studied Artificial Intelligence and Cybersecurity at MIT LIDS/CSAIL focusing on active learning for malware detection and risk-limiting post-election audits. After graduating, Zara worked on Google Assistant then at Google’s Threat Analysis Group, where she built machine learning and software systems to use threat intelligence and malware analysis to better protect against targeted threats and disinformation by state sponsored actors.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/zperumal/", "x_url": "https://twitter.com/zaraperumal", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/4cf5bf21b04591b4d94995d4372e5b115c12e836.jpg" } ], "jobs": [], "news": [ { "title": "What launching a startup taught me about foreign policy | The Hill", "url": "https://thehill.com/opinion/international/3757491-what-launching-a-startup-taught-me-about-foreign-policy/", "date": "Dec 01, 2022" } ], "launches": [ { "id": 64636, "title": "🌍 ⚠️ Overwatch - Automating global risk detection and analysis", "tagline": "Monitor data streams, including news and satellite imagery, for narratives and events that will impact operations, supply chain, and reputation", "body": "Hey YC! Tad, Zara and I are excited to launch [Overwatch 🦉](http://www.overwatchdata.io)​ - to help automate global risk detection and analysis. Our tool allows enterprises to monitor data streams, including news and satellite imagery, for narratives and events that will impact their operations, supply chain, and reputation. Our tool can be used for live monitoring OR historic due-diligence on a location.\n\n**😠The Problem**\n\n* Businesses have many points of failure in their global operations and struggle to monitor all the locations and narratives that matter to them \n* Current event detection tools are often noisy and don't provide any context on why that event might be significant to a specific business.\n\n \n\n**🔨Our Solution**\n\nWe cut through the noise.\n\n* We help companies filter more accurately for events and narratives that matter to them.\n* We provide visualizations of how those events or narratives have changed over time and layer these events on top of other datasets, e.g. satellite imagery, shipping routes, trade data, commodity production sites, flood and fire maps, and other risk indices. \n* This helps draw connections and provide a holistic picture of how that event could impact their business.\n\n![](https://lh3.googleusercontent.com/OdI55U0rZf6ZSicyHS8BtsJ-xIY54kVTVw4wAojwTV6qvKYY-ZIjOc3Ae8hyKLVyYCNhE7YhFupIv-x9poZABJ-d7F8Mq3h1cc_E4C-l0M5k4c0OZRZOloKzWBee6FSH0qjsF7NXv7qJZphCiWONUs8)\n\n![](https://lh5.googleusercontent.com/dWmnLh1Pj0BJC39LrVN9R-j2u0hdrEbmj_qk_i5WcD0p9W0GGvU8a2sEWnwPjRTr_JaxqvavyJnCQtpkRgomQ018TbDsqPnT1Tlfe2J5ZgUDvgER0iIyrkai3_4FCHXU0IDwXOSWpOu7JQj-g05g2NU)\n\n**The Ask❓**\n\n* Do you (or anyone you know) struggle to detect, analyze, or predict events and narratives that could disrupt your business operations, brand, or supply chain? Then please reach out to ([founders@overwatchdata.io](mailto:founders@overwatchdata.io)) or [book a call](https://calendly.com/arjun-overwatch/30min) and we’d love to help.\n* Are you a data provider with interesting risk-related data? We’d love to discuss how we might incorporate it into our product.", "url": "https://www.ycombinator.com/launches/GoW-overwatch-automating-global-risk-detection-and-analysis", "votes": 18, "created_at": "2022-07-14T20:09:34.423Z" } ] }, { "id": 27677, "name": "Matano", "slug": "matano", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/a222c90e6dc5a485e0f58e7075243197316b5126.png", "website": "https://www.matano.dev", "all_locations": "Seattle, WA, USA; San Francisco, CA, USA", "long_description": "Matano is a modern SIEM, built for cloud-first security teams. \r\n\r\nIt replaces traditional SIEM databases like Splunk or Elastic with a cybersecurity platform built on top of a cost-effective Security Data Lake.", "one_liner": "Cloud Native SIEM (alternative to Splunk/Elastic)", "team_size": 2, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1673220532, "tags": [ "DevSecOps", "Analytics", "Open Source", "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Winter 2023", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Partly Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/matano", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2023/matano.json", "year_founded": 2022, "city": "Seattle", "country": "US", "linkedin_url": "https://www.linkedin.com/company/matanolabs/", "x_url": "https://twitter.com/matanolabs", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/matano", "github_url": "https://github.com/matanolabs", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/a222c90e6dc5a485e0f58e7075243197316b5126.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Diana Hu", "url": "https://www.ycombinator.com/people/diana-hu" }, "founders": [ { "user_id": 785948, "full_name": "Samrose Ahmed", "title": "Founder", "founder_bio": "Hi I'm Samrose, a software engineer by background. I grew up in NYC, went to CMU, and worked at AWS for a few years before starting Matano. I'm especially interested in big data, cloud, and highly available systems. Outside of work, I'm an avid reader.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/samrosea", "x_url": "https://twitter.com/AhmedSamrose", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/52bfc4aa9aa1ac47491681b0e4a44e634a13e971.jpg" }, { "user_id": 787913, "full_name": "Shaeq Ahmed", "title": "Founder", "founder_bio": "Hey! Shaeq is a software engineer who originally hails from New York and loves all things open source, security and big data. He quit his job \ncrunching data for autonomous robots at Amazon to build Matano - an open-source SIEM alternative for security teams on AWS.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/shaeq-ahmed", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/a79a8d4cc1f220f2fc21e18256f03991d9392f7e.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 68262, "title": "Matano - Open source SIEM alternative for AWS", "tagline": "Matano is a high scale, low cost alternative to traditional SIEM (e.g. Splunk, Elastic) built around a vendor agnostic Security Data Lake in your AWS account.", "body": "**👋** Hi YC! We’re Samrose & Shaeq and we are excited to launch [Matano](https://github.com/matanolabs/matano).\n\n### TL;DR\n\n**Matano is a high-scale, low-cost, zero-ops alternative to traditional SIEM (e.g. Splunk) that deploys a security data lake directly in your AWS account.** It lets you ingest petabytes of security and log data from various sources, store and query them in an open [Apache Iceberg](https://iceberg.apache.org/) data lake, and create Python detections as code for realtime alerting. Matano is fully serverless and designed specifically for AWS.\n\n![uploaded image](/media/?type=post&id=68262&key=user_uploads/785948/5ec8b84a-df7a-44d1-914b-2c30af3dc2fa)\n\n### **Problem**\n\n* Traditional tools used to analyze security data (SIEMs) don’t scale, and are too expensive and difficult to manage for security teams on the cloud.\n* Security data is now a Big Data problem: collecting data from your network, SaaS, and cloud environments can exceed 100TBs of data. Security teams are forced to either not collect some data, leave data unprocessed, or build an in-house data lake to cost-effectively analyze large datasets.\n* At scale, without a strategy to normalize data into a structured format, it is difficult to correlate across data sources & build effective alerts that don’t create many false positives. Traditional SIEM query-based rules fail to accurately identify threats.\n\n### **Our Solution**\n\nWe’re leveraging our years of experience at AWS in Big Data and cloud technologies to build a modern alternative to SIEM designed from the ground up for efficiency, scalability, cost effectivity, and vendor neutrality.\n\n![](https://www.matano.dev/assets/images/diagram-09d3bbd00cb55ab585125b7a7ec452c6.webp)\n\n* **Security Data Lake** Matano normalizes unstructured security logs into a structured realtime data lake in your AWS account. All data is stored in optimized Parquet files in S3 object storage for cost-effective retention & analysis at petabyte scale.\n* **No vendor lock-in** Matano lets you truly own your own security data. Cybersecurity vendors lock your data in proprietary formats which make it very difficult to use outside of their product. With Matano, all your data is in open Apache Iceberg tables that can can be directly queried from different tools (AWS Athena, Snowflake, etc.) without having to copy any data.\n* **Detection-as-code** Matano gives you the flexibility of Python to implement realtime alerting on your log data and introduce a development lifecycle to detection by managing rules in Git (test, code review, audit).\n* **Serverless** ​​Matano is a fully serverless platform built entirely on technologies like Lambda, S3, and SQS and is designed for zero-ops and unlimited elastic horizontal scaling. Matano uses Rust for blazing fast performance [🦀](https://emojiterra.com/crab/).\n* **Open source** Matano is licensed as Apache 2.0 and always will be. Matano uses an open table format (Apache Iceberg) and common schemas ([Elastic Common Schema](https://github.com/elastic/ecs)), to give you full ownership of your security data.\n\n### **Ask**\n\n* If you’re a security team interested in using Matano, feel free to reach out over email at [founders@matano.dev](mailto:founders@matano.dev).\n* Try out our project and star [⭐](https://emojipedia.org/star/) us on GitHub: .\n* Join our [Discord community](https://discord.gg/YSYfHMbfZQ)!", "url": "https://www.ycombinator.com/launches/Hl0-matano-open-source-siem-alternative-for-aws", "votes": 48, "created_at": "2023-01-09T00:57:23.279Z" } ] }, { "id": 27690, "name": "Credal.ai", "slug": "credal-ai", "former_names": [ "Credal.AI" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/67584a441ac14e21e59b84f0e3760e5308aaf4dc.png", "website": "https://credal.ai", "all_locations": "New York City, NY, USA", "long_description": "Build, govern, and deploy enterprise AI agents and MCP servers \r\nPowered by your data, subject to enterprise controls", "one_liner": "The Control Plane for Enterprise Agents", "team_size": 14, "industry": "B2B", "subindustry": "B2B -> Productivity", "launched_at": 1669993072, "tags": [ "Generative AI", "Cybersecurity", "Enterprise", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Winter 2023", "status": "Active", "industries": [ "B2B", "Productivity" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/credal-ai", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2023/credal-ai.json", "year_founded": 2022, "city": "New York City", "country": "US", "linkedin_url": "https://www.linkedin.com/company/91502554/", "x_url": "https://twitter.com/credal_ai", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/credal-ai", "github_url": "https://github.com/credal-ai/", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/67584a441ac14e21e59b84f0e3760e5308aaf4dc.png", "app_video_url": null, "dday_video_url": null, "company_photos": [ "https://bookface-images.s3.us-west-2.amazonaws.com/attachments/c139655b29030046ecb659bee3e1d3ec690290e0.png" ], "primary_partner": { "name": "Brad Flora", "url": "https://www.ycombinator.com/people/brad-flora" }, "founders": [ { "user_id": 1038471, "full_name": "Ravin Thambapillai", "title": "Founder", "founder_bio": "I hanker after an honorable Goddam skull. I worked at Google, TheHutGroup (now THG) at Series A, GoCardless at Series A, and most recently at Palantir for 7 years, where I led the building of significant parts of America's emergency-public-health infrastructure, including what Atlantic Magazine called \"America's most reliable Pandemic data.\"\n\nMy principles are listed here: https://docs.google.com/document/d/11-yFsiwOgYDUmHSWe8J0B2RU2a0JbO2yYUwqM2fjDbE", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/ravin-thambapillai-77aa0a11/", "x_url": "https://twitter.com/ravin_tham", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/73231bf66d563b58e53bb5097e302dda57b8313a.jpg" }, { "user_id": 1047303, "full_name": "Jack Fischer", "title": "Founder", "founder_bio": "Five years at Palantir in various technical capacities on projects ranging from airline reliability to defense computer vision. Palantir's US commercial hiring manager 2020-2022. \nWorked on several of the precursors to H1 (YC W20) and developed their early entity resolution algorithms.\nNow enabling secure AI!", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/jackfischer11/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/30ac732fbe78f690991e5a10c38459b3adcba120.jpg" } ], "jobs": [ { "id": 70840, "title": "Founding GTM - Deployment Strategist", "url": "https://www.ycombinator.com/companies/credal-ai/jobs/3OnqAVU-founding-gtm-deployment-strategist", "location": "New York, NY, US", "type": "Full-time", "role": "Operations", "role_type": null, "salary_range": "$120K - $150K", "equity_range": "0.05% - 0.20%", "experience": "3+ years", "visa": "US citizen/visa only", "skills": [] }, { "id": 81964, "title": "Founding Frontend/UX Software Engineer", "url": "https://www.ycombinator.com/companies/credal-ai/jobs/4hSv1Na-founding-frontend-ux-software-engineer", "location": "NY, US", "type": "Full-time", "role": "Engineering", "role_type": "Frontend", "salary_range": "$190K - $250K", "equity_range": "0.20% - 0.90%", "experience": "3+ years", "visa": "US citizen/visa only", "skills": [ "React", "React Native", "TypeScript" ] }, { "id": 99647, "title": "Founding Design Engineer", "url": "https://www.ycombinator.com/companies/credal-ai/jobs/8QpLF8h-founding-design-engineer", "location": "NY, US", "type": "Full-time", "role": "Design", "role_type": "UI / UX", "salary_range": "$170 - $230", "equity_range": "0.10% - 0.50%", "experience": "3+ years", "visa": "US citizen/visa only", "skills": [] }, { "id": 105583, "title": "Founding GTM Deployment Strategist", "url": "https://www.ycombinator.com/companies/credal-ai/jobs/JkwCCe6-founding-gtm-deployment-strategist", "location": "Credal HQ (Brooklyn, NY)", "type": "Full-time", "role": "Operations", "role_type": null, "salary_range": "$120K - $150K", "equity_range": "0.05% - 0.20%", "experience": "Any (new grads ok)", "visa": "US citizen/visa only", "skills": [] }, { "id": 105584, "title": "Forward Deployed Software Engineer", "url": "https://www.ycombinator.com/companies/credal-ai/jobs/UuUgcZc-forward-deployed-software-engineer", "location": "Credal HQ (Brooklyn, NY)", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "$140K - $220K", "equity_range": "0.10% - 0.90%", "experience": "Any (new grads ok)", "visa": "US citizen/visa only", "skills": [] }, { "id": 105585, "title": "Customer Deployment Engineer", "url": "https://www.ycombinator.com/companies/credal-ai/jobs/d0PrRkz-customer-deployment-engineer", "location": "Credal HQ (Brooklyn, NY)", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "$120K - $160K", "equity_range": "0.07% - 0.30%", "experience": "Any (new grads ok)", "visa": "US citizen/visa only", "skills": [] }, { "id": 105587, "title": "Business Development Representative", "url": "https://www.ycombinator.com/companies/credal-ai/jobs/88clofi-business-development-representative", "location": "Credal HQ (Brooklyn, NY)", "type": "Full-time", "role": "Sales", "role_type": null, "salary_range": "$90K - $120K", "equity_range": "0.05% - 0.20%", "experience": "Any (new grads ok)", "visa": "US citizen/visa only", "skills": [] }, { "id": 114492, "title": "Software Engineer", "url": "https://www.ycombinator.com/companies/credal-ai/jobs/YYLdmmL-software-engineer", "location": "Credal HQ (Brooklyn, NY)", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "$190K - $250K", "equity_range": "0.20% - 0.90%", "experience": "Any (new grads ok)", "visa": "US citizen/visa only", "skills": [] } ], "news": [ { "title": "Credal aims to connect company data to LLMs 'securely' | TechCrunch", "url": "https://techcrunch.com/2023/10/26/credal-aims-to-connect-company-data-to-llms-securely/", "date": "Oct 26, 2023" } ], "launches": [ { "id": 88742, "title": "Credal.ai: The Security-First Multi-Agent Collaboration Platform", "tagline": "The world's only multi-agent platform where Agents collaborate across your tools while respecting the data permissions in your systems", "body": "Ravin & Jack here from [Credal.ai](http://Credal.ai). Proud to announce the world’s only multi-agent platform in production at Enterprises that lets Agents collaborate across Enterprise systems like GSuite, Salesforce, and Slack while respecting the permissions of the end users across those tools. We’re in production at amazing Enterprise customers like Mongodb, Wise, Checkr, Lattice, and even at traditional Enterprises like Comcast, the US Federal Government (HHS), and the IFRS — and we’re now excited to bring it to the world.\\\n\n\n## The Problem\n\nAI can understand enterprise data and provide marginal productivity gains, but we know that “Chat with your data” doesn’t scale—especially in complex operations.\n\nGetting users to adopt AI for simple tasks, like improving email wording or summarizing meeting notes, is easy. But these small wins don’t fundamentally change how an organization operates. It’s no surprise that 74% of companies still struggle to achieve tangible value from generative AI in 2025; most companies remain stuck in the proof-of-concept phase.\n\nAI is not truly transformative at the enterprise level, and we at Credal want to change that. To solve for this problem, AI agents must integrate into enterprise operations—communicating with internal systems, other agents, and subject matter experts while ensuring security, governance, visibility, and ultimately real business impact.\n\n## 💡 Our Solution\n\n![uploaded image](/media/?type=post&id=88742&key=user_uploads/89898/75296e1a-0363-4079-9f82-0c5a9d786d1b)\n\nCredal enables enterprises to deploy secure, specialized AI Agents that collaborate to handle complex, multi-step workflows.\n\nEach Agent is designed by subject matter experts—your employees—for specific tasks like:\n\n* Researching a prospect and personalizing outreach\n* Conducting KYC and AML checks\n* Answering HR and IT helpdesk questions\n* Completing security and compliance questionnaires\n* Analyzing trends in revenue and churn and suggesting the next best action for Customer Success Managers or Account Executives.\n\nWhen a user or API call invokes an Agent, it can autonomously call other Agents for assistance, all while enforcing enterprise-grade governance, risk, and compliance (GRC) policies. This composability moves beyond single-agent AI, allowing for scalable, controllable, and secure AI adoption across complex workflows in the enterprise. AI can at last operate seamlessly across your systems while respecting permission boundaries.\n\n![uploaded image](/media/?type=post&id=88742&key=user_uploads/89898/2c33a821-eabf-402e-a866-a552b5ca4590)\n\n## How it Works\n\nEvery user request follows this pattern:\n\nThe request gets routed to a primary agent which decides whether to call any actions or other Agents based on:\n\n* The instructions you provide in the background prompt and feedback from previous interactions\n* The provided tools and agents, with their descriptions and associated RBAC settings\n* Access Controlled Data from Enterprise systems like Salesforce, Confluence, GDrive, Slack and Sharepoint.\n\nThe primary agent then:\n\n* Notifies the user of any actions it is calling\n* Parallelizes the submission of all relevant actions\n* Polls for responses\n* Notifies the user when responses come back\n\n## ⚙️ Use Cases\n\n✅ End-to-end Know Your Business (KYB) workflows:\n\n* Validate document authenticity\n* Cross-check business addresses\n* Detect politically exposed persons (PEPs)\n* Ensure company services comply with internal policies\n\n✅ Go-To-Market Automation\n\n* Deep research on prospects and target accounts\n* Identify intent signals and the right buyers\n* Automate personalized outreach and seller training\n* Suggest Next Best Actions and upsell opportunities\n\n✅ Security Questionnaires\n\n* Automate security and compliance questionnaire responses no matter what tool you have to upload your response in\n* Ensure regulatory alignment with minimal manual effort\n\n✅ HR & Performance Management\n\n* Draft and refine self-reviews\n* Validate manager reviews for consistency and bias\n\n…and much more, including vendor contract analysis, government agency rule-making, corporate standards setting, customer support automation, training across teams, and general-purpose “ask-anything” AI assistants.\n\n## Next Steps\n\nWith Credal, enterprises can finally operationalize AI at scale—securely, efficiently, and with full control.\n\nReady to power your business with intelligent AI Agents?\n\nLet’s talk. Contact us at [sales@credal.ai](mailto:sales@credal.ai) or book a demo at [credal.ai/get-started](http://credal.ai/get-started).", "url": "https://www.ycombinator.com/launches/N5K-credal-ai-the-security-first-multi-agent-collaboration-platform", "votes": 56, "created_at": "2025-03-18T14:24:46.451Z" }, { "id": 70320, "title": "Credal: Control how AI uses your data", "tagline": "Credal protects your organization's sensitive data from AI that can surface it externally. Think Okta for AI.", "body": "Hi there! Ravin and Jack here from [Credal.ai](http://Credal.ai)\n\n**TL;dr:**\n\nCredal protects your sensitive data across all AI apps. We give everyone at your company access to the latest AI models via our secure Chat UI, integrated with your data, whilst management gets granular control over what data is shared with each provider.\n\n⚔️ **The Problem:**\n\nCEOs of every company from Microsoft to our YC W23 batchmates understand the massive productivity gains available through AI applications. But huge concerns exist over adopting these tools at the enterprise: what’s happening to our data once we hand it over to AI providers? The landscape of providers is already large and fast-growing. Many have terms of service that permit training general models on your data. As the usage of these tools explode, businesses risk losing control over what data has been shared with whom, when, and what technical and contractual safeguards are in place to protect that data from inadvertently ending up in the hands of competitors via an AI model’s training dataset.\n\n⚡ **Solution:**\n\nCredal is the gatekeeper for your data, ensuring that all data sent to AI is protected by 3 layers of security:\n\n1. Credal identifies sensitive data using our (self-hosted) detection models alongside your existing data classifications and lets you automatically redact, anonymize, block, or simply warn the user, if sensitive data is about to be sent over to a provider.\n2. For the major endpoints like chat or text completion, Credal allows you to seamlessly switch between providers: letting you take advantage of the latest models, or highest privacy models as they are released, without locking your company into a single vendor.\n3. Finally, Credal protects you with standardized Terms of Service and MSAs that ensure you have total control over your data. Credal links your audit logs to the specific provider associated with each request, allowing full transparency into both the technical and contractual safeguards that govern how any cut of data could be used.\n\nOur secure chat UI can automatically route your request to the best AI for your question (or you can specify manually)\n\n![uploaded image](/media/?type=post&id=70320&key=user_uploads/1038471/53a41cac-1a2c-4bc6-9441-cc87ed0ef0d3)\n\nWith granular audit logs on each request, per data source, including what was redacted:\n\n![uploaded image](/media/?type=post&id=70320&key=user_uploads/1038471/fb382a2e-54de-47ec-b03e-93cc332981a9)\n\n**Who needs this, and why did we build it?**\n\nOur current customers are security-conscious companies trying to use AI to get an edge in their operations and product. We noticed early on building AI applications that customers were really nervous about handing data over to AI models they didn’t fully understand. Many enterprises were turning ChatGPT off entirely, or banning its use on anything remotely sensitive. Today, our customers use Credal for a range of problems, from basic things like using ChatGPT for summarizing meeting notes, to using complicated combinations of AI (like Claude + GPT 4) to automatically structure company documents. Either way, Credal is giving our customers the confidence they need to use cutting-edge AI on sensitive data.\n\n**Meet the Team:**\n\n![uploaded image](/media/?type=post&id=70320&key=user_uploads/1038471/77898790-6a46-477b-8832-df0f5cecd528)\n\nJack and I met in 2019 when we co-led Palantir’s engagement with a multibillion-dollar Life Sciences conglomerate, steering it from an initial pilot to an enterprise deal so critical to their business that Palantir going bankrupt was mentioned as a risk on the customer’s S1 filing.\\\n\\\nI started my career at Google, and since then have been both in the trenches and leading teams at THG at Series A, GoCardless at Series A, and Palantir. Jack started his career at H1 (at pre-seed), before joining Palantir. We’ve both led highly acclaimed teams at Palantir: _Atlantic_ Magazine called the output of work I led for 18 months: “America’s most reliable pandemic data”\\[1\\] and the _Washington Post_ said of a team Jack led for a year: “With these systems aiding brave Ukrainian troops, the Russians probably cannot win”\\[2\\]\n\nWe’re bringing a wealth of expertise in handling the most sensitive data imaginable, into what we see as one of the central problems of our time: building trust in AI.\n\n**Interested?**\n\nIf you are an enterprise with sensitive data, but you want to be able to use that data with AI  - [grab time to chat with us](https://calendly.com/jack-fischer-credal/credal-ai-intro). Enterprises that sign up before Demo Day (April 5th) are eligible for 50% off!\\\n\\\nFootnotes:\n\n\\[1\\] (The article discusses whether the Biden administration would keep paying for the ‘vital system’ that HHS had procured under Trump. In case you’re wondering what happened, it did and even expanded the contract.\n\n\\[2\\] ", "url": "https://www.ycombinator.com/launches/IIC-credal-control-how-ai-uses-your-data", "votes": 128, "created_at": "2023-03-15T20:22:38.701Z" } ] }, { "id": 27926, "name": "Variance", "slug": "variance", "former_names": [ "Decoy", "Intrinsic" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/e32d61652a6684aecf45080965c0897ba451022f.png", "website": "https://www.variance.com/", "all_locations": "San Francisco, CA, USA", "long_description": "Variance builds AI agents for fraud, identity, and investigations for Fortune 500s, Marketplaces, and regulated financial services.", "one_liner": "AI Agents for Fraud Review and Investigations", "team_size": 12, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1677704898, "tags": [ "Compliance", "Cybersecurity", "Enterprise Software", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Winter 2023", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/variance", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2023/variance.json", "year_founded": 2022, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/variancesafety", "x_url": "https://twitter.com/trustvariance", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/e32d61652a6684aecf45080965c0897ba451022f.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Jared Friedman", "url": "https://www.ycombinator.com/people/jared-friedman" }, "founders": [ { "user_id": 544605, "full_name": "Karine Mellata", "title": "Founder", "founder_bio": "Co-Founder at Variance (fka Intrinsic).\n\nMaking the internet safer, one line of code at a time.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/karinemellata/", "x_url": "https://twitter.com/karinemellata", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/7b6c8e84fc0d16df4298ba7d7a737691dfe019dd.jpg" }, { "user_id": 1184751, "full_name": "Michael Lin", "title": "Founder", "founder_bio": "Co-founder of Variance. Working to scale AI agents for investigations and fraud reviews.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/michael-lin-2933a013b/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/278a5ed2c4d86e38f7cbacec45f22e1c6712159c.jpg" } ], "jobs": [ { "id": 67445, "title": "Forward Deployed AI Engineer", "url": "https://www.ycombinator.com/companies/variance/jobs/0BmwPv6-forward-deployed-ai-engineer", "location": "San Francisco", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "$115K - $200K", "equity_range": "", "experience": "3+ years", "visa": "US citizen/visa only", "skills": [] }, { "id": 74151, "title": "Business Development Representative", "url": "https://www.ycombinator.com/companies/variance/jobs/bxFqv04-business-development-representative", "location": "San Francisco", "type": "Full-time", "role": "Sales", "role_type": null, "salary_range": "$65K - $120K", "equity_range": "", "experience": "Any (new grads ok)", "visa": "US citizen/visa only", "skills": [] }, { "id": 93289, "title": "Enterprise Account Executive", "url": "https://www.ycombinator.com/companies/variance/jobs/F9eOW1L-enterprise-account-executive", "location": "San Francisco", "type": "Full-time", "role": "Operations", "role_type": null, "salary_range": "", "equity_range": "", "experience": "", "visa": "US citizen/visa only", "skills": [] }, { "id": 93290, "title": "Senior Software Engineer", "url": "https://www.ycombinator.com/companies/variance/jobs/HZwc3gx-senior-software-engineer", "location": "San Francisco", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "", "equity_range": "", "experience": "", "visa": "US citizen/visa only", "skills": [] }, { "id": 93294, "title": "Research Engineer, Judgment Systems", "url": "https://www.ycombinator.com/companies/variance/jobs/o2Qfu8N-research-engineer-judgment-systems", "location": "San Francisco", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "", "equity_range": "", "experience": "", "visa": "US citizen/visa only", "skills": [] }, { "id": 93296, "title": "Research Engineer, Evals", "url": "https://www.ycombinator.com/companies/variance/jobs/Eok2YSs-research-engineer-evals", "location": "San Francisco", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "", "equity_range": "", "experience": "", "visa": "US citizen/visa only", "skills": [] }, { "id": 93297, "title": "Enterprise Account Executive", "url": "https://www.ycombinator.com/companies/variance/jobs/unx03tA-enterprise-account-executive", "location": "New York", "type": "Full-time", "role": "Operations", "role_type": null, "salary_range": "", "equity_range": "", "experience": "", "visa": "US citizen/visa only", "skills": [] }, { "id": 93298, "title": "Product Marketing Lead", "url": "https://www.ycombinator.com/companies/variance/jobs/HJStuvw-product-marketing-lead", "location": "San Francisco", "type": "Full-time", "role": "Marketing", "role_type": null, "salary_range": "", "equity_range": "", "experience": "", "visa": "US citizen/visa only", "skills": [] } ], "news": [ { "title": "Variance raises $21.5M for AI risk investigations", "url": "https://www.axios.com/pro/fintech-deals/2026/03/31/variance-21-5m-series-a-ai-compliance-agents", "date": "Mar 31, 2026" }, { "title": "Intrinsic Raises $3.1M in Seed Funding", "url": "https://www.finsmes.com/2024/01/intrinsic-raises-3-1m-in-seed-funding.html", "date": "Jan 02, 2024" }, { "title": "Y Combinator-backed Intrinsic is building infrastructure for trust and safety teams | TechCrunch", "url": "https://techcrunch.com/2023/12/21/y-combinator-backed-intrinsic-is-building-infrastructure-for-trust-and-safety-teams/", "date": "Dec 21, 2023" } ], "launches": [ { "id": 69844, "title": "🌔 Intrinsic - Safety tooling for Trust & Safety teams", "tagline": "Maintain high quality content communities, monitor brand safety and keep your users safe", "body": "**tl;dr:** We make it easy to take care of safety so that you can focus on the product. Intrinsic integrates **policy management, data engineering, moderator workflow management, and content understanding** under one platform. [Ping us for a demo!](https://www.withintrinsic.com/contact)\n\n\\\nHey everyone! We’re Karine and Michael, the team behind Intrinsic.\n\nWe’re working to help connect safety teams with the best tools available to prevent abusive behaviour and tell better stories. We both come from Apple and Discord, where we worked on the Trust & Safety machine learning and data engineering infrastructure that was pivotal in protecting both platforms from large-scale abuse. We believe that a safer internet for everyone starts with more accessible safety tools.\n\n### **Who this is for**\n\n* Engineers implementing safety features into products\n* Product managers and directors of Trust & Safety teams\n\n### **Problem**\n\nTrust & Safety engineers are tasked with maintaining platform integrity and user safety in an era of evolving **fake accounts, illegal content, hate speech, misinformation, and child safety concerns.** Nobody wants this stuff on their platforms, but getting up and running with industry best practices is challenging.\n\nCurrently, there are two huge barriers to shipping safety-by-default products:\n\n* T&S teams are siloed from crucial data they need to evaluate safety risks and measure impact. Product and customer service teams own this data.\n* Data integration with either in-house or third-party detection services is costly.\n\nAs a result, safety engineers and data scientists are caught in an endless cycle of blindsided firefighting and doing tedious integrations.\n\n## **Solution**\n\nIntrinsic is a platform for Trust & Safety with a focus on scalability and composability of processes to help a company move faster in responding to evolving threats:\n\n* We handle setting up detection, enforcement, policy management, and integrating an observability platform designed for Trust and Safety.\n* We focus on helping you get up and running end-to-end in minutes for a new safety product integration.\n* We automatically make all Trust & Safety actions, whether banning users or flagging content for review, to be logged and measurable.\n* We can help diagnose failures by tracing safety stories that span disparate products, for example tracing a particular enforcement back to a specific clause of terms and conditions that was breached.\n\nTrust & Safety and Fraud are two problem domains that require rapidly evolving AI systems that start with machine learning and rules (proactive detection) and end with human decisioning (content moderation). We believe that by streamlining this process and closing the feedback loop — **the applications go far beyond Trust & Safety and into any domain that benefits from a rapidly evolving response**.\n\n## **Asks**\n\nIf you know anyone who’s ever had issues with the following,\n\n* Spam, fake accounts, bots\n* Low-quality content\n* High-harm content (bullying, child safety issues, violent speech)\n\nPing [Karine](https://www.linkedin.com/in/karinemellata/), [Michael](https://www.linkedin.com/in/michael-lin-2933a013b/) or [founders@withintrinsic.com](mailto:founders@withintrinsic.com), we would love to schedule a demo!", "url": "https://www.ycombinator.com/launches/IAW-intrinsic-safety-tooling-for-trust-safety-teams", "votes": 64, "created_at": "2023-03-01T20:45:32.177Z" } ] }, { "id": 28778, "name": "Xeol", "slug": "xeol", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/3d8557d5066f2f1e94f1be8ddc427697b79cc8d1.png", "website": "https://www.xeol.io/", "all_locations": "New York City, NY, USA", "long_description": "Pronounced Zee-O-L. \r\n\r\nEnd-of-life (EOL) and outdated software are a black box of vulnerabilities with very limited remediation paths. These 2 factors combine to make managing them a necessary proactive practice. Xeol enables enterprises and Fortune 500s to create a proactive EOL management program that directly contributes to better vulnerability management and lower cyber insurance. ", "one_liner": "Close your outdated dependency attack vector", "team_size": 3, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1689618282, "tags": [ "Security", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2023", "status": "Acquired", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/xeol", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2023/xeol.json", "year_founded": 2023, "city": "New York City", "country": "US", "linkedin_url": "https://www.linkedin.com/company/xeol", "x_url": "https://twitter.com/xeol_io", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/xeol", "github_url": "https://github.com/xeol-io", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/3d8557d5066f2f1e94f1be8ddc427697b79cc8d1.png", "app_video_url": null, "dday_video_url": null, "company_photos": [ "https://bookface-images.s3.us-west-2.amazonaws.com/attachments/8c4047771eda54f492d2bcd886af0cc692bc72b3.png" ], "primary_partner": null, "founders": [ { "user_id": 1279127, "full_name": "ShiHan Wan", "title": "Founder", "founder_bio": "CEO @ Xeol. Backend Engineer.\n\nPreviously helped build 2 startups from early to 🦄, now doing that for Xeol.\n\n", "is_active": true, "linkedin_url": "https://linkedin.com/in/shihanwan", "x_url": "https://twitter.com/shihanwan", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/6ccd5955aeabc741fbfaefb062eb80e08362368c.jpg" } ], "jobs": [], "news": [ { "title": "🎉 Announcing our $3.2M Seed Round!", "url": "https://www.xeol.io/post/announcing-our-3-2m-seed-round", "date": "Dec 12, 2023" } ], "launches": [ { "id": 80578, "title": "bumpgen - keep your code up-to-date with AI", "tagline": "Open source tool to generate code fixes for breaking changes", "body": "![uploaded image](/media/?type=post&id=80578&key=user_uploads/89898/e210f386-2345-4c2e-ba0a-6133d756141a)\n\n[**bumpgen**](https://github.com/xeol-io/bumpgen) generates fixes for breaking changes in version upgrades with AI\n\n* 🧑🏼‍💻 `bumpgen ` to get fixes to your version bump breaking changes\n* 🔑 Bring your own **OpenAI API key**\n* 🌐 Supports **Typescript** codebases\n\n### Why build bumpgen?\n\nKeeping your dependencies updated is a good security and engineering practice (just not too up-to-date, thanks xz 🙏🏼). But they can be a pain to actual perform because:\n\n* **Major version bumps** have breaking changes and no one wants to fix them.\n* **25% minor version bumps** have breaking changes as well (semver isn’t perfect)\n* There can be a lot of version bumps from small packages to large frameworks\n\n### How Does bumpgen work?\n\n![uploaded image](/media/?type=post&id=80578&key=user_uploads/1279127/f06347b9-da03-4f95-aa1b-8f850576b262)\n\n**bumpgen** is pretty straight forward:\n\n* **BUMP** your dependency version then **GEN**erate the fixes for the breaking changes\n* Quick to get started with `npm install -g bumpgen`\n* Works on top of your Dependabot or Renovate to take care of those gnarly breaking changes\n\nIf you are curious how bumpgen identifies, fixes, then propagates the breaking change fix, we added bumpgen’s architecture and design decisions [**here**](https://github.com/xeol-io/bumpgen) 👈\n\n### How to start?\n\n* 🧑🏼‍💻 [**Try it out**](https://github.com/xeol-io/bumpgen), it’s 100% open source\n* ⭐ [**Support**](https://github.com/xeol-io/bumpgen) the project with a star\n* 📩 [**Get updated**](https://www.xeol.io/beta) on the GitHub app release", "url": "https://www.ycombinator.com/launches/Kxe-bumpgen-keep-your-code-up-to-date-with-ai", "votes": 43, "created_at": "2024-05-02T15:07:15.215Z" }, { "id": 73333, "title": "🌌 Xeol - Modern platform for software supply chain security", "tagline": "Cut through the noise, identify and remediate risks, then enforce security policies", "body": "![uploaded image](/media/?type=post&id=73333&key=user_uploads/1279127/210f8a5b-d0c2-4f78-a504-dea9eb6669ca)\n\n### TLDR\n\n> Fortune 500 companies use Xeol to connect all their software dependencies into a contextual graph to ask questions like “am I affected by vulnerability X?” and enforce policies like “ensure all my docker images were signed by me?”\n\n![uploaded image](/media/?type=post&id=73333&key=user_uploads/1279127/040b5865-0ba9-42f6-a893-bbf3f0eb3222)\n\nWe first met 6 years ago as early engineers at **Ada** leading backend, cloud infrastructure, and security. Right before founding Xeol:\n\n* **Benji** was a Sr DevOps Engineer at **Datadog** leading its service catalog project with a near decade career in DevOps\n* **ShiHan** was the Director of Engineering helping build 2 startups from early stage to 🦄\n\nWe have been in the startup world for many years and are now on our own journey to help AppSec engineers quickly identify, remediate, and enforce security risks.\n\n### Problem. A New Attack Vector\n\nAsk anyone on the street to plug in a random USB drive and they will scoff. They know it’s unsafe! But developers do this every day when they use open-source packages as part of their software supply chain. The typical npm package has **86 dependencies** and with supply chain attacks up **600%** over the past year alone, this attack vector is widening.\n\nWhat’s not working?\n\n* **Too much noise:** tools that show all possible CVEs without contextual runtime information make prioritization near impossible leading to alert fatigue\n* **Attacks are more common:** generative AI enables malicious actors to easily launch attacks\n* **Huge attack surface:** many actors involved including OSS maintainers and their code, CI/CD systems, container orchestrators, and in-house developers\n\n### Solution. Complete Ontological Visibility\n\n![uploaded image](/media/?type=post&id=73333&key=user_uploads/1279127/a7017029-25ff-45a2-b114-6386d949057d)\n\nXeol is an **agentless** solution that scans your software artifacts at **build** and **runtime** then creates a **contextual graph** of your software supply chain. This contextual graph allows AppSec engineers to:\n\n**answer** questions like\n\n* Where am I using package X?\n* Which software are end-of-life?\n* Which packages are missing SLSA attestations?\n* Which software artifacts are produced from repo X?\n\n**enforce** policies like\n\n* Ensure all Docker images were built by my org from our CI pipeline\n* Prevent software X, which is end-of-life, from being packaged in our Docker images\n* Ensure sure all packages meet a minimum [OSSF](https://openssf.org/) score\n* Prevent any dependencies using a GPL license\n\n### Our Ask\n\n**See** Xeol’s graph capabilities in action [here](https://dashboard.xeol.io/demo)\n\n**Try** our open-source CLI [tool](https://github.com/xeol-io/xeol) to scan for end-of-life software\n\n**Follow** us on [LinkedIn](https://www.linkedin.com/company/xeol), [GitHub](https://github.com/xeol-io), or [Twitter](https://twitter.com/xeol_io) to get the latest updates", "url": "https://www.ycombinator.com/launches/J4n-xeol-modern-platform-for-software-supply-chain-security", "votes": 45, "created_at": "2023-07-24T02:01:24.497Z" } ] }, { "id": 28862, "name": "Corgea", "slug": "corgea", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/4f659e1a5051b790e28f097f1c858880dc797b7f.png", "website": "https://www.corgea.com/", "all_locations": "San Francisco, CA, USA", "long_description": "Corgea is an autonomous application security platform that finds and validates vulnerabilities, then generates safe code fixes developers can apply in their existing workflow. In production customers like Zapier and Yageo, see ~20% more true positives and ~90% fewer false positives (vs their prior tooling), reducing triage and speeding remediation without adding headcount.\r\n", "one_liner": "Corgea finds, and fixes insecure code and packages autonomously. ", "team_size": 6, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1686005960, "tags": [ "Developer Tools", "SaaS", "Security", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Summer 2023", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Partly Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/corgea", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2023/corgea.json", "year_founded": 2023, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/corgea/", "x_url": "https://twitter.com/CorgeaInc", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/corgea", "github_url": "https://github.com/Corgea", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/4f659e1a5051b790e28f097f1c858880dc797b7f.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Diana Hu", "url": "https://www.ycombinator.com/people/diana-hu" }, "founders": [ { "user_id": 65616, "full_name": "Ahmad Sadeddin", "title": "Founder", "founder_bio": "Ahmad is the founder and CEO of Corgea, which is his 3rd startup. His last one was acquired by Coupa. He spent the last 3 years of his tenure there leading the payments product where he worked on making sure their products were secure.", "is_active": true, "linkedin_url": "https://linkedin.com/in/asadeddin", "x_url": "https://twitter.com/asadeddin", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/2faba562e39bcac6bfbe892753fd27713da6b74d.jpg" } ], "jobs": [ { "id": 69626, "title": "Senior software engineer - California", "url": "https://www.ycombinator.com/companies/corgea/jobs/BkQzEJ1-senior-software-engineer-california", "location": "San Francisco, CA, US / San Mateo, CA, US / Remote (CA, US)", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "$120K - $200K", "equity_range": "0.50% - 2.00%", "experience": "6+ years", "visa": "US citizen/visa only", "skills": [] }, { "id": 69628, "title": "Senior software engineer - Jordan", "url": "https://www.ycombinator.com/companies/corgea/jobs/28hnjyF-senior-software-engineer-jordan", "location": "JO / Remote (JO)", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "$20K - $65K", "equity_range": "0.10% - 2.00%", "experience": "6+ years", "visa": "US citizen/visa only", "skills": [] }, { "id": 81750, "title": "Software engineer - Jordan", "url": "https://www.ycombinator.com/companies/corgea/jobs/4ikDBbl-software-engineer-jordan", "location": "JO / Remote (JO)", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "$17K - $40K", "equity_range": "0.10% - 2.00%", "experience": "1+ years", "visa": "US citizen/visa only", "skills": [] }, { "id": 81751, "title": "Software engineer - California", "url": "https://www.ycombinator.com/companies/corgea/jobs/Fj7nVVP-software-engineer-california", "location": "San Francisco, CA, US / San Mateo, CA, US / Remote (CA, US)", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "$100K - $180K", "equity_range": "0.25% - 2.00%", "experience": "1+ years", "visa": "US citizen/visa only", "skills": [] }, { "id": 83239, "title": "Security Researcher", "url": "https://www.ycombinator.com/companies/corgea/jobs/flq0ShW-security-researcher", "location": "San Francisco, CA, US / San Mateo, CA, US / Remote (US)", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "$120K - $220K", "equity_range": "0.25% - 0.75%", "experience": "6+ years", "visa": "US citizen/visa only", "skills": [ "JavaScript", "Python", "Information Security", "Software Security" ] }, { "id": 91598, "title": "Founding DevOps Engineer - California", "url": "https://www.ycombinator.com/companies/corgea/jobs/5adGCih-founding-devops-engineer-california", "location": "San Francisco, CA, US / Remote (US; CA, US)", "type": "Full-time", "role": "Engineering", "role_type": "Devops", "salary_range": "$100K - $210K", "equity_range": "0.05% - 0.50%", "experience": "3+ years", "visa": "US citizenship/visa not required", "skills": [] }, { "id": 91601, "title": "Founding DevOps Engineer - Jordan", "url": "https://www.ycombinator.com/companies/corgea/jobs/AxEYjCf-founding-devops-engineer-jordan", "location": "JO / Remote (JO)", "type": "Full-time", "role": "Engineering", "role_type": "Devops", "salary_range": "$25K - $42K", "equity_range": "0.05% - 0.20%", "experience": "3+ years", "visa": "US citizen/visa only", "skills": [] } ], "news": [ { "title": " Introducing PolicyIQ: Contextual Security Analysis for Smarter, More Accurate Results - Corgea - Home", "url": "https://corgea.com/blog/introducing-policyiq-contextual-security-analysis-for-smarter-more-accurate-results", "date": "Jan 15, 2025" }, { "title": "Corgea’s raises $2.6 Million Seed Round", "url": "https://en.incarabia.com/shorooq-partners-leads-corgea%E2%80%99s-us26-million-seed-round-694875.html", "date": "Nov 06, 2024" }, { "title": "Corgea Recognized as an IDC Innovator for DevSecOps Automated Remediation", "url": "https://corgea.com/blog/corgea-recognized-as-an-idc-innovator-for-devsecops-automated-remediation", "date": "Sep 18, 2024" } ], "launches": [ { "id": 103899, "title": "Corgea: Agentic Pentesting", "tagline": "An autonomous penetration testing engine that runs in hours and not weeks", "body": "[**Corgea AI Pentesting**](https://corgea.com/products/ai-pentest): an autonomous penetration testing engine that uses AI agents to plan, execute, validate, and report security tests. It doesn’t run a checklist. It reasons about your application.\n\n\n\n## The numbers\n\nIn a recent pentest:\n\n* **Corgea found 25 findings.** The human pentester found 6.\n* **Delivery time: 4-8 hours.** The human pentest took 2 weeks.\n\n![Corgea AI Pentesting findings overview](https://corgea.com/cms/blog/introducing-ai-pentesting/image-3.png)\n\n## How it works\n\nMost autonomous pentesting tools are black-box scanners with better marketing. They probe endpoints against a generic vulnerability checklist and produce a PDF full of theoretical findings that security teams have to triage manually.\n\nCorgea takes a fundamentally different approach. The engine operates like a real pentesting team.\n\n**Multi-agent architecture.** Not a single scanner. Corgea spawns a coordinator agent that assigns specialized sub-agents (an authentication discovery agent, an API exploration agent, a SQL injection expert agent) based on what it discovers. These agents collaborate, share findings, and build on each other’s discoveries. For complex targets, Corgea can spawn hundreds of agents.\n\n![Corgea AI Pentesting multi-agent execution view](https://corgea.com/cms/blog/introducing-ai-pentesting/image-1.png)\n\n**Code-aware, not black-box.** The engine ingests code context, dependency data, infrastructure configuration, and business logic. It uses your existing [AI SAST](https://corgea.com/products/ai-sast) findings for white-box pentesting, exploiting vulnerabilities at runtime that static analysis already identified. This combination of static insight and dynamic testing dramatically amplifies what the engine can find.\n\n**Dynamic adaptation.** Corgea’s agentic architecture is not fixed. The system continuously adapts its strategy based on what it learns about the target, dynamically scaling the number of agents, their responsibilities, and their specialization. It doesn’t follow a one-size-fits-all workflow.\n\n**Exploitability validation built in.** Corgea doesn’t report theoretical vulnerabilities. Agents validate exploitability during the test itself, confirming a finding can be triggered, capturing evidence, and explaining business impact. This eliminates the triage burden that makes traditional pentest reports a firehose of unverified findings.\n\n![Corgea AI Pentesting exploit reproduction script](https://corgea.com/cms/blog/introducing-ai-pentesting/image-2.png)\n\n## The pipeline\n\n1. **Environment setup.** Corgea provisions a Linux-based sandbox with a full suite of security tools for crawling, discovery, reconnaissance, and exploit validation.\n2. **Scope and context ingestion.** Target scope, endpoints, API documentation, auth flows, user roles, business logic context, and optional code/repo context. Both authenticated and unauthenticated.\n3. **Attack surface discovery.** Maps reachable routes, APIs, parameters, forms, auth boundaries, authorization-sensitive workflows, and exposed services.\n4. **Autonomous test planning.** AI agents reason about application structure and generate test plans for broken access control, IDOR, authentication bypass, injection, SSRF, insecure file handling, sensitive data exposure, and business logic abuse.\n5. **Safe execution and validation.** Hundreds of sub-agents execute probes, observe responses, adapt based on application behavior, and validate exploitability.\n6. **Evidence generation.** For confirmed issues: affected endpoint, payload or request sequence, response evidence, exploitability reasoning, severity, business impact, and remediation recommendation.\n7. **Developer-native remediation.** Findings go directly into developer workflows (PR comments, Jira tickets, Slack notifications, CI/CD pipelines) with reproduction steps, code context, and suggested fixes.\n8. **Reporting.** Findings converted into reports for management, auditors, and customers.\n\n## Supervised autonomy\n\nAutonomous doesn’t mean uncontrolled. Humans remain in control of:\n\n* Defining and approving test scope\n* Setting rules of engagement\n* Approving aggressive or potentially disruptive testing\n* Reviewing sensitive findings\n* Accepting final pentest reports\n* Making risk decisions for production environments\n\nCorgea automates the repetitive and technically complex parts. Humans own the risk decisions.\n\n## Continuous, not point-in-time\n\nTraditional pentesting delivers a PDF report weeks after testing begins. By the time you read it, your application has changed.\n\nCorgea supports both one-time and continuous autonomous pentesting. Retesting is automatic after remediation. Findings close the loop between discovery, fix, and verification in hours, not waiting for the next quarterly cycle.\n\n## Ready to Ditch Security Theater?\n\nIf you're tired of checkbox pentests:\n\nBook a call: \n\nEmail us: sales@corgea.com", "url": "https://www.ycombinator.com/launches/R1n-corgea-agentic-pentesting", "votes": 18, "created_at": "2026-06-24T15:40:00.793Z" }, { "id": 77558, "title": "🐕 Corgea - Easily and quickly fix vulnerable code using AI", "tagline": "We make it easy for companies fix vulnerable code by automating away 80% of the engineering work needed. ", "body": "**TL;DR**: Corgea helps companies fix vulnerable source code. It is an AI-powered security platform that writes security patches for engineer approval, saving 80% of the engineering effort needing and $$$. Having Corgea is like having a security engineer on staff constantly focused on making your code more secure. \n\nHi YC! This is Ahmad, and along with Adam, Pratik and Tamara we’re building [Corgea](https://corgea.com/).\n\n![uploaded image](/media/?type=post&id=77558&key=user_uploads/65616/fd08a653-a912-4b81-8d59-cfb4c56e0d95)\n\n### 🕳️ Unresolved holes in software\n\nCompanies scan their code for security vulnerabilities, and are often met with a big pile of findings. On average, companies take 3 months to fix a vulnerability, and 60% of breach victims were aware of the unpatched vulnerability that was exploited.\n\nWhy? This is because engineers prioritize revenue-generating work, often leaving security fixes lower in priority. It is also really expensive for companies to fix vulnerabilities, costing them between $400 - $4,000 per fix. Unacceptable in today’s environment of more frequent security breaches and increasingly sophisticated attacks.\n\nSecurity teams kept complaining to us that all of their hundreds (yes hundreds) of security tools alert them about issues without giving them a way to actually resolve the issues automatically. This leaves security teams hanging high and dry.\n\n### 🐕 What does Corgea do?\n\nWe’re approaching one of the hardest problems in security with an entirely new approach. Unlike other tools that have been vehemently obsessed with just reporting on vulnerabilities, Corgea fixes them.\n\nCorgea connects to your existing SAST (Static application security testing) tools, like Snyk and Semgrep, and automatically writes code fixes for the reported vulnerabilities. Security teams can issue a pull request for the fix with a single click without disrupting any workflows. Engineers get the code fix for review, and well written descriptions helping them understand the changes.\n\nFor example, Corgea can rewrite code and issue PRs to fix SQL injection, path traversal, SSRF, or hundreds of other vulnerabilities. Here’s a brief demo to show Corgea’s capabilities.\n\n[Fixing Issues using Corgea - Watch Video](https://www.loom.com/share/318f06b97dac48628971bb52db372fb8)\n\n![](https://cdn.loom.com/sessions/thumbnails/318f06b97dac48628971bb52db372fb8-1702061376925-with-play.gif)\n\n### ✅ Empowering Security and Freeing up Engineering\n\nSecurity is often perceived as a blocker to engineering, and vice versa. With Corgea, we’re empowering security teams to be able to take action while also accelerating engineering velocity. This fundamentally changes the dynamic between teams.\n\n* **💪 Stronger code:** companies can now secure their products and reduce their fix times to hours without taxing engineering. Many prospects we spoke to have tens of thousands of vulnerabilities that now has a fighting chance in reducing them.\n* **🚀 Increase engineering velocity:** since Corgea is issuing the code fix, we see up to an 80% savings in time engineers spend fixing security issues. Security can now be an enabler to engineering rather than a blocker.\n* **💰 Slash Costs:** Research shows that a single vulnerability takes about $400 - $4,000 to fix. Corgea reduces these costs by up to 80%. Many enterprises can expect to save at least $10m in direct development costs. This doesn’t account for breach cost savings.\n\nOften, security software lacks a clear return on investment or value proposition. They are frequently bought due to fear, uncertainty, and doubt. At Corgea, our belief is that security software needs to lead first with real value and a clear ROI.\n\n### 🌟 How is Corgea different than existing solutions?\n\nThe current market is flooded with tools that overwhelm security teams with alerts and are not effective at fixing what they’re reporting.\n\n* General code-gen tools do not specialize in security and we’ve seen them inadvertently introduce security issues unbeknownst to the engineer. Additionally, they often do not integrate into a wider ecosystem of tools, preferring to focus solely on their own findings.\n* Most SAST & SCA vulnerability scanners do not remediate issues. Many tout this but it’s mostly limited to upgrading packages from one version to another to reduce a CVSS. This often introduces downstream challenges. If they do offer CWE remediation capabilities their success rates are very low because they’re often based on traditional AI methodologies. Finally, they do not integrate into a wider ecosystem of tools because they want to only serve their own findings.\n\nEnterprises often use multiple scanners like Snyk, Semgrep, Checkmarx, and may have multiple repository tools like Github, Gitlab and Bitbucket for their code. They need a solution that consolidates across their existing tools.\n\n### 👩🏽‍💻 Who is building Corgea?\n\nEach member of the Corgea team has experienced the challenges of addressing vulnerabilities in both security and engineering. We first hand witnessed the frustration of teams in wanting to deliver on high quality feature-rich secure software. Our goal is to shatter the silos between the teams and empower both of them rather than empower one at the expense of the other.\n\nIn our prior roles, we designed, secured and built mission-critical software products at companies like of Coupa, Autodesk, and PlanGrid.\n\n### 🎉 Want to try it?\n\nWe’re really excited to help companies in automating the security of their source code. [Use Corgea today](https://www.corgea.app/registration/) for free and without a credit card. Setup takes less than a few minutes. Feel free to [reach out to us](https://calendly.com/asadeddin/30min?month=2024-01) to chat and get a more in-depth demo.", "url": "https://www.ycombinator.com/launches/KAw-corgea-easily-and-quickly-fix-vulnerable-code-using-ai", "votes": 24, "created_at": "2024-01-16T16:32:31.262Z" }, { "id": 73406, "title": "🐕 Corgea - Enterprise data security and privacy", "tagline": "Empowering enterprises to secure sensitive data", "body": "Hi everyone!\n\nWe’re building [Corgea](https://corgea.com?utm_source=yc&utm_medium=cpc&utm_campaign=yc_launch&utm_id=yc_launch) - a data security and privacy platform that automates sensitive data protection and compliance in the products companies make.\n\n### [**🚩**](https://emojipedia.org/triangular-flag/) **The Problem**\n\nCompanies process sensitive data, but don't know what it is, and who they share it with. They can’t protect and make private what they don’t know they have and what it is. Additionally data protection requires a lot of different stakeholders to come together, and they lack the proper tools to collaborate around it.\n\n### [**⚡**](https://emojipedia.org/high-voltage/) **How does it work?**\n\nCorgea monitors data traffic, classifies sensitive data (e.g., PII, PHI, payment data), and maps where it came from and who it's being shared with. It then tells you which data protection and privacy policies you need to comply with.\n\nCorgea is unique because you can set it up using 300+ out-of-the-box connectors in hours with no IT integration work.\n\n![uploaded image](/media/?type=post&id=73406&key=user_uploads/65616/f206fe9c-e12f-4749-9946-5567453cecb7)\n\n### [**🧰**](https://emojipedia.org/toolbox/) **What can you do with Corgea?**\n\nHaving this information at your fingertips gives you super powers to be able to:\n\n* Unlock revenue by making data protection your competitive advantage\n* Reduce your attack surface vector of your infrastructure\n* Accelerate breach response\n* Know which 3rd parties receive sensitive data\n* Understand your data compliance requirements\n* Receive alerts for out-of-policy data events\n* Perform data minimization\n\n![uploaded image](/media/?type=post&id=73406&key=user_uploads/65616/dad1dd93-4e77-4560-95b3-cda61b090fc6)\n\n### [**📖**](https://emojipedia.org/open-book/) **The Story**\n\nOne day, Ahmad received a massive excel sheet to fill out for a data privacy initiative. By the end of it, he had curated hundreds of data fields manually, and identified where they came from and where they were sent to. Feeling how inefficient this was for the company, he decided to automate it by building Corgea.\n\nAhmad previously led the payments product at Coupa and founded 2 other companies before Corgea. His last company was acquired by Coupa.\n\n![uploaded image](/media/?type=post&id=73406&key=user_uploads/65616/437a87ab-4bc7-47d8-b8a8-9c81c8f0d034)\n\n### **🚀 Team**\n\nAhmad is joined by an amazing team all with experience in working and building software in regulated data environments such as HIPAA, FedRamp, PCI, ITAR, and data privacy.\n\n![uploaded image](/media/?type=post&id=73406&key=user_uploads/65616/c345a149-ae43-472e-a09c-ff7895239bf9)\n\n### [**❤️**](https://emojipedia.org/red-heart/)**Interested?**\n\nIf you are a company processing sensitive data, and want to unlock revenue while being compliant then [**schedule a call with us**](https://l.linklyhq.com/l/1rIbH)!\n\nCompanies that sign up before Aug 30th are eligible for **50% off**!", "url": "https://www.ycombinator.com/launches/J5y-corgea-enterprise-data-security-and-privacy", "votes": 43, "created_at": "2023-07-25T14:47:43.101Z" } ] }, { "id": 28927, "name": "Metalware", "slug": "metalware", "former_names": [ "Metalware", "metalware", "Metalware", "Isocode" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/17a2d106f9cdebdba12fd6e7d00d9e948e77f5be.png", "website": "https://www.metalware.com/", "all_locations": "San Francisco, CA, USA", "long_description": "Metalware develops advanced firmware security solutions for critical infrastructure, protecting industries like aerospace, defense, automotive, telecom, and healthcare from cyber threats.\r\n\r\nOur product is an automated, intelligent binary fuzzer that enables organizations to efficiently discover and remediate security weaknesses in hardware products before deployment.", "one_liner": "Firmware cybersecurity", "team_size": 4, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1689732876, "tags": [ "DevSecOps", "Hardware", "GovTech", "Cybersecurity", "Enterprise" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Summer 2023", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/metalware", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2023/metalware.json", "year_founded": 2023, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/metalwareinc", "x_url": "https://twitter.com/metalwareinc", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/metalware", "github_url": "https://github.com/metalware-inc", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/17a2d106f9cdebdba12fd6e7d00d9e948e77f5be.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 1029004, "full_name": "Ryan Chow", "title": "Founder", "founder_bio": "Co-founder & CEO of Metalware. Previously SpaceX, JHU APL.", "is_active": true, "linkedin_url": "https://linkedin.com/in/chowryan", "x_url": "https://twitter.com/ryanchowww", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/0c52029f0b5f3263354745532d7f9c141026b194.jpg" }, { "user_id": 1371245, "full_name": "Andrew Nedea", "title": "Founder", "founder_bio": "Co-founder & CTO of Metalware. Previously SpaceX, Amazon Robotics, Autodesk.", "is_active": true, "linkedin_url": "https://linkedin.com/in/andrew-nedea-404b38131", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/f714cc378a1178107248eb18b5ebfeb0c065f391.jpg" } ], "jobs": [ { "id": 88398, "title": "Founding Engineer", "url": "https://www.ycombinator.com/companies/metalware/jobs/uNMiZtp-founding-engineer", "location": "San Francisco, CA, US", "type": "Full-time", "role": "Engineering", "role_type": "Embedded systems", "salary_range": "$120K - $180K", "equity_range": "0.10% - 0.60%", "experience": "3+ years", "visa": "US citizen/visa only", "skills": [ "C", "C++", "Rust", "Hack", "Software Architecture", "Software Security", "Embedded Linux", "Device Drivers", "Microcontrollers" ] } ], "news": [], "launches": [] }, { "id": 29246, "name": "Tracecat", "slug": "tracecat", "former_names": [ "neometrics.ai", "Neometrics" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/13bc35dc5fca68051b65f9b77d4198acae677418.png", "website": "https://tracecat.com", "all_locations": "New York City, NY, USA", "long_description": "Tracecat helps AI-native security teams build agents and automate work. All-in-one platform with agents, skills, prompt-to-workflows, and case management. Scale cyber defense with agents you own.\r\n\r\nOpen source and community-driven at it's core: https://github.com/TracecatHQ/tracecat", "one_liner": "Open-source agentic security automation platform", "team_size": null, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1704382841, "tags": [ "Open Source", "Cybersecurity", "Enterprise", "Automation", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Winter 2024", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/tracecat", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2024/tracecat.json", "year_founded": 2024, "city": "New York City", "country": "US", "linkedin_url": "https://www.linkedin.com/company/tracecathq", "x_url": "https://x.com/tracecathq", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/tracecat", "github_url": "https://github.com/TracecatHQ/tracecat", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/13bc35dc5fca68051b65f9b77d4198acae677418.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Garry Tan", "url": "https://www.ycombinator.com/people/garry-tan" }, "founders": [ { "user_id": 1589002, "full_name": "Chris Lo", "title": "Founder/CEO", "founder_bio": "CEO and cofounder @ Tracecat", "is_active": true, "linkedin_url": "https://linkedin.com/in/chrislohy", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/9364ac3f992aed21a5c91ff788661feee6b346ec.jpg" }, { "user_id": 1593591, "full_name": "Daryl Lim", "title": "Founder/CTO", "founder_bio": "Daryl Lim is the Co-Founder and Chief Technology Officer of Tracecat.\n\nPreviously, he worked on various observability, data and AI infrastructure teams at AMD, Meta, and a London-based quant trading firm. He earned a Bachelors and Masters degree in Computer Engineering from Imperial College London.", "is_active": true, "linkedin_url": "https://linkedin.com/in/daryllimyt", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/fefca3125ffea270c6461ff05704f3a62c0243bb.jpg" } ], "jobs": [ { "id": 97385, "title": "Software Engineer (Full-stack)", "url": "https://www.ycombinator.com/companies/tracecat/jobs/iatK7cl-software-engineer-full-stack", "location": "New York, NY, US", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "$200K - $250K", "equity_range": "0.10% - 0.50%", "experience": "1+ years", "visa": "US citizen/visa only", "skills": [ "Python", "React", "TypeScript", "Next.js" ] }, { "id": 117455, "title": "Mid-Market Account Executive", "url": "https://www.ycombinator.com/companies/tracecat/jobs/pzdYsO1-mid-market-account-executive", "location": "New York, NY, US", "type": "Full-time", "role": "Sales", "role_type": null, "salary_range": "$150K - $350K", "equity_range": "0.10% - 0.20%", "experience": "2+ years", "visa": "US citizen/visa only", "skills": [] } ], "news": [], "launches": [] }, { "id": 29324, "name": "PromptArmor", "slug": "promptarmor", "former_names": [ "Board Security Inc." ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/f85e50382b3869e84b292235c05317d5db4ab8cd.png", "website": "https://promptarmor.com/", "all_locations": "San Francisco, CA, USA", "long_description": "", "one_liner": "LLM Security and Compliance", "team_size": null, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1702083397, "tags": [ "Generative AI", "Security", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Winter 2024", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/promptarmor", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2024/promptarmor.json", "year_founded": 2023, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/promptarmor", "x_url": "https://twitter.com/PromptArmor", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/f85e50382b3869e84b292235c05317d5db4ab8cd.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Garry Tan", "url": "https://www.ycombinator.com/people/garry-tan" }, "founders": [ { "user_id": 592271, "full_name": "Shankar Krishnan", "title": "Founder/CEO", "founder_bio": "Al Security & Compliance. Previously at Snappr, Observe, Tesla, Accenture. Berkeley Data Science & Econ‎", "is_active": true, "linkedin_url": "https://linkedin.com/in/shankar-krishnan", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/98d7fa926e66d41bef63f3becd665196d0cd771b.jpg" }, { "user_id": 325305, "full_name": "Vikram Jayanthi", "title": "Founder/CTO", "founder_bio": "Co-founder of PromptArmor.\n\nPreviously infrastructure & security at Google, Roblox, and Symantec.\n\nBerkeley CS & Public Policy.", "is_active": true, "linkedin_url": "https://linkedin.com/in/vikramjayanthi", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/9866a979e839d1d267f85264c95b2d45f385a9fc.jpg" } ], "jobs": [ { "id": 92807, "title": "Growth", "url": "https://www.ycombinator.com/companies/promptarmor/jobs/YgI1Tbu-growth", "location": "San Francisco, CA, US", "type": "Full-time", "role": "Operations", "role_type": null, "salary_range": "$80K - $120K", "equity_range": "0.50% - 0.75%", "experience": "Any (new grads ok)", "visa": "US citizen/visa only", "skills": [] } ], "news": [ { "title": "IBM's AI agent Bob easily duped to run malware: Researchers • The Register", "url": "https://www.theregister.com/2026/01/07/ibm_bob_vulnerability/", "date": "Jan 07, 2026" }, { "title": "‘Claude For Excel’ Gets Tricked Into Leaking Secrets — The Information", "url": "https://www.theinformation.com/articles/rubrik-tests-undo-button-malfunctioning-ai-agents?rc=bqclp0", "date": "Nov 25, 2025" }, { "title": "Slack patches Slack AI issue that could have allowed insider phishing | SC Media", "url": "https://www.scworld.com/news/slack-patches-slack-ai-issue-that-could-have-allowed-insider-phishing", "date": "Aug 22, 2024" }, { "title": "Slack AI can leak private data via prompt injection • The Register", "url": "https://www.theregister.com/2024/08/21/slack_ai_prompt_injection/", "date": "Aug 22, 2024" } ], "launches": [] }, { "id": 29368, "name": "CodeAnt AI", "slug": "codeant-ai", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/9efd3b7815df44b6aca06023be3c607e3a345ee5.png", "website": "https://codeant.ai/", "all_locations": "San Francisco, CA, USA", "long_description": "CodeAnt AI attacks your systems the way a real adversary would, then it walks back into your code and helps you build the defenses exactly where the attack got through.\r\n\r\nContinuous attack. Continuous defense. One self-learning platform.\r\n\r\nTrigger a free pentest No engagement fee. Pay only if we find high or critical issues; low and medium issues are free.", "one_liner": "Autonomous offensive and defensive cybersecurity platform", "team_size": 25, "industry": "B2B", "subindustry": "B2B -> Engineering, Product and Design", "launched_at": 1700644508, "tags": [ "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Winter 2024", "status": "Active", "industries": [ "B2B", "Engineering, Product and Design" ], "regions": [ "United States of America", "America / Canada", "Remote", "Partly Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/codeant-ai", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2024/codeant-ai.json", "year_founded": 2023, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/codeant-ai", "x_url": "https://x.com/CodeAntAI", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/codeant-ai", "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/9efd3b7815df44b6aca06023be3c607e3a345ee5.png", "app_video_url": null, "dday_video_url": null, "company_photos": [ "https://bookface-images.s3.us-west-2.amazonaws.com/attachments/b6280c38fc5b81b68b190730904f503cb97645d1.png" ], "primary_partner": { "name": "Tom Blomfield", "url": "https://www.ycombinator.com/people/tom-blomfield" }, "founders": [ { "user_id": 304615, "full_name": "Amartya Jha", "title": "Founder/CEO", "founder_bio": "Amartya Jha, Co-Founder and CEO, CodeAnt AI, ships zero-days for fun. CVE-2026-29000, CVSS 10.0, full auth bypass in pac4j-jwt. CVE-2026-28292, CVSS 9.8, RCE in simple-git. Two of 87 zero-days he dropped across packages downloaded 1.85 billion times a month. Now, building offensive and defensive security in one self-learning system at CodeAnt AI.", "is_active": true, "linkedin_url": "https://linkedin.com/in/amartya-jha", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/7172da2edfd88ef281c3d34d0195784dbc1c2909.jpg" }, { "user_id": 438232, "full_name": "Chinmay Bharti", "title": "Founder/CTO", "founder_bio": "Chinmay Bharti, Co-Founder and CTO, CodeAnt AI, architected the engine behind the 100+ CVEs CodeAnt AI disclosed. Previously worked in HFTs. IIT Bombay, Electrical Engineering. Now building offensive and defensive security in one self-learning system at CodeAnt AI.", "is_active": true, "linkedin_url": "https://linkedin.com/in/chinmay-bharti", "x_url": "https://twitter.com/chhinna00", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/17860c0238400abed79f2a47cfb45197ee21565d.jpg" } ], "jobs": [ { "id": 77432, "title": "Account Executive (In-person in San Francisco)", "url": "https://www.ycombinator.com/companies/codeant-ai/jobs/ZdQvjSA-account-executive-in-person-in-san-francisco", "location": "San Francisco, CA, US", "type": "Full-time", "role": "Sales", "role_type": null, "salary_range": "$145K - $250K", "equity_range": "0.25% - 0.75%", "experience": "1+ years", "visa": "US citizen/visa only", "skills": [] }, { "id": 106835, "title": "Account Executive (In-person in San Francisco)", "url": "https://www.ycombinator.com/companies/codeant-ai/jobs/GF7lDUC-account-executive-in-person-in-san-francisco", "location": "San Francisco, CA, US", "type": "Full-time", "role": "Sales", "role_type": null, "salary_range": "$145K - $250K", "equity_range": "0.25%", "experience": "1+ years", "visa": "US citizen/visa only", "skills": [] } ], "news": [ { "title": "CodeAnt AI uncovered a critical authentication bypass using only public key that went undetected for 6 years, CVE-2026-29000.", "url": "https://cyberpress.org/pac4j-jwt-authentication/", "date": "Mar 05, 2026" }, { "title": "Worried About AI-Generated Code? Ask AI To Review It", "url": "https://www.forbes.com/sites/davidprosser/2025/05/07/worried-about-ai-generated-code-ask-ai-to-review-it/", "date": "May 07, 2025" }, { "title": "CodeAnt AI Raises USD 2 Mn in Seed Funding to Streamline Code Review with AI | Entrepreneur", "url": "https://www.entrepreneur.com/en-in/news-and-trends/codeant-ai-raises-usd-2-mn-in-seed-funding-to-streamline/491291", "date": "May 07, 2025" } ], "launches": [ { "id": 101960, "title": "CodeAnt AI - Autonomous offensive and defensive security", "tagline": "Find the breach before the attacker does!", "body": "### What we do\n\nCodeAnt AI attacks your systems the way a real adversary would, then it walks back into your code and helps you build the defenses exactly where the attack got through.\n\nContinuous attack. Continuous defense. One self-learning platform.\n\n![uploaded image](/media/?type=post&id=101960&key=user_uploads/304615/2d6a6c48-8892-4d33-9e38-a08770079ab0)\n\n\\\n\\\n[**Trigger a free pentest**](https://app.codeant.ai/) No engagement fee. Pay only if we find high or critical issues; low and medium issues are free.\n\n### Why us\n\nWe've run pentests for 200+ companies. Almost everyone had exposed PII, PHI, payment records, patient files, or critical data leaks.\n\nWe've also disclosed 100+ zero-day CVEs, affecting 1.85B+ monthly downloads, including [pac4j-jwt auth bypass at CVSS 10.0 ](https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key)and [simple-git RCE at CVSS 9.8](https://www.codeant.ai/security-research/simple-git-remote-code-execution-cve-2026-28292).\n\n### Why now\n\n**90% of modern software is embarrassingly easy to breach.**\n\nAttackers got AI. A human pentester gets 2 weeks and a scope doc. An AI adversary gets unlimited patience and parallelism, and it'll chain a forgotten subdomain to a leaked credential to a misconfigured auth API until the data is out.\\\n\\\nYour defenses? Still fighting the last war.\n\nSAST & SCA tools surface 10,000 findings. The 50 that matter are buried. Pentest firms show up once a year. File a PDF and leave. You fly blind the other 363 days.\n\n![uploaded image](/media/?type=post&id=101960&key=user_uploads/304615/1c942f59-a1c1-418f-827c-7517ec157597)\n\n### How do we close it\n\nCodeAnt lives at every layer where code is written: CLI, IDE, PR, CI/CD. Then it takes what it learned and attacks.\n\n### What you get\n\n* **Blackbox** 500+ exploit agents (BOLA, IDOR, SSRF, auth bypass, etc)\n* **Whitebox** AI SAST, SCA, SBOMs, malware, business logics, etc.\n* **Graybox** Black-box + white-box fused, the full kill chain.\n* **Evidence** SOC 2, HIPAA, ISO compliant reports\n\nStart your [free pentest](https://app.codeant.ai/) here or schedule a [scoping call](https://meet.codeant.ai/meet/codeant-ai/demo)\n\n---", "url": "https://www.ycombinator.com/launches/QWW-codeant-ai-autonomous-offensive-and-defensive-security", "votes": 137, "created_at": "2026-05-26T14:44:33.425Z" }, { "id": 94457, "title": "CodeAnt AI - Engineering metrics that show real developer impact. Deeper insights than LinearB.", "tagline": "Get full visibility into what every developer builds, fixes, and improves.", "body": "## **🏆 TL;DR**\n\nMost developer productivity tools show **numbers**, not **impact**.\\\nThey count commits and PRs but don’t explain what was _actually built, fixed, or improved_.\n\n**CodeAnt AI’s [Developer 360](https://www.codeant.ai/developer-360)** **gives you that missing visibility**,\n\n![uploaded image](/media/?type=post&id=94457&key=user_uploads/304615/7facde8e-ac94-47ee-bfdb-a479a02585c4)\n\n\\\nWe’re already enterprises and fast-growing startups, such as **Commvault, Sanas, Akasa Air, and Kore AI** to improve developer productivity.\n\n![uploaded image](/media/?type=post&id=94457&key=user_uploads/304615/4d0e4ff4-d08a-4668-b2e8-793bd7c4c317)\n\n## **❌ The Problem**\n\nEngineering dashboards today are full of **empty stats.**\n\nCurrent tools show _50 commits_ and _20 pull requests_, but you have no idea if that’s 50 critical bug fixes or just 50 formatting changes.\n\nLeaders can’t tell the difference between busy work and meaningful progress,\\\nand developers end up feeling like numbers, not contributors.\n\n## **🌟 The Solution - Developer 360**\n\nDeveloper 360 shows the _real story_ behind your codebase.\\\n\\\nCodeAnt AI reviews every pull request, getting the deepest context of your code, from features shipped to bugs fixed or risks introduced. It looks at every commit, pull request, and pipeline run to show what your team is really doing.\n\nYou’ll see:\n\n* What features were shipped\n* What bugs and security issues were fixed\n* Where reviews or builds are slowing things down\n* Who’s driving steady, high-quality progress\n\nEverything rolls up into a single, easy-to-understand view of your engineering work.\n\n**AI Developer Summaries** reports that explain what was shipped, fixed, or improved\n\n![uploaded image](/media/?type=post&id=94457&key=user_uploads/304615/a3209b2d-cb3d-4e6c-a074-8d8188cac1e2)\n\n**Throughput Comparison** benchmark developers on consistency, efficiency, and merge quality\n\n![uploaded image](/media/?type=post&id=94457&key=user_uploads/304615/e76e624e-23e8-4c8f-aa67-e3c92bdd36de)\n\n## **🙏 Our Ask**\n\n**Developer 360 is live at** [https://app.codeant.ai](https://app.codeant.ai%5C)\\\n\\\nGet started with the 14-day free trial, no credit card needed.\n\nWant a quick demo? [**Book a call here**](https://meet.codeant.ai/meet/codeant-ai/demo)", "url": "https://www.ycombinator.com/launches/OZV-codeant-ai-engineering-metrics-that-show-real-developer-impact-deeper-insights-than-linearb", "votes": 18, "created_at": "2025-10-08T00:31:53.063Z" }, { "id": 77911, "title": "CodeAnt AI: AI Code Reviewer", "tagline": "Helping engineering teams cut code review time and bugs by over 50%.", "body": "### **PROBLEM:**\n\nCode reviews are already painful — slow, repetitive, and easy to miss bugs & security vulnerabilities. With more AI-written code, it's getting worse: bigger PRs, faster cycles, less peer context.\n\n### **Solution:**\n\n![uploaded image](/media/?type=post&id=77911&key=user_uploads/304615/f41a52cf-20a5-4a3d-8b03-94b77e822984)\n\n1. [CodeAnt AI](https://www.codeant.ai/) connects directly to [GitHub, GitLab, Bitbucket, Azure DevOps](https://app.codeant.ai/) in 2 clicks\n2. Builds deep Abstract Syntax Trees (ASTs) of your entire codebase\n3. Automatically reviews every PR for:\n * Code quality issues\n * Security vulnerabilities (SAST, IaC, Secrets, SCA, EOL libs, Cloud misconfigs)\n * Best practice violations\n4. Flags exact lines and suggests one-click fixes in Pull Request\n5. Add custom rules and design best practices\n6. Integrates with [VS Code](https://marketplace.visualstudio.com/items?itemName=codeantai.codeantai) and [JetBrains IDE](https://plugins.jetbrains.com/plugin/23405-codeantai)\n7. Works fully inside your pull requests\n\nResult? [**Teams cut code review time and bugs by over 50%.**](https://www.codeant.ai/customer-story) _(Attached case studies)_\n\n![uploaded image](/media/?type=post&id=77911&key=user_uploads/304615/cf12efdd-ad6c-4c96-866a-07732fdc2021)\n\nTrack every code change in your repositories for security and quality issues — mapped to each developer — so you can stack-rank engineers, spot gaps, and drive targeted upskilling.\n\n### 💥 **About Us:**\n\nHello everyone, we are [Amartya](https://linkedin.com/in/amartya-jha) and [Chinmay](https://linkedin.com/in/chinmay-bharti).\n\n![uploaded image](/media/?type=post&id=77911&key=user_uploads/304615/197c0c2a-1764-4de7-b97b-120c80d3c9e6)\n\n[Amartya Jha](https://www.linkedin.com/in/amartya-jha/) scaled the platform & infrastructure at Zeta and ShareChat to handle millions of requests a day. Tired of bugs slipping through manual reviews, he quit to fix it at the root.\n\n[Chinmay Bharti](https://www.linkedin.com/in/chinmay-bharti/) is an IIT Bombay engineer with a master’s in AI and a second-time founder. He built systems at a high-frequency trading firm where even one bug could cost millions.\n\n![uploaded image](/media/?type=post&id=77911&key=user_uploads/304615/8fbcc8ff-703d-4946-8fae-1ca933276a4f)\n\n### **❇️ Ask:**\n\n1. Start a [**14-day Free trial**](https://app.codeant.ai/)**,** no credit card required\n2. Need a demo? [Schedule a call](https://calendly.com/codeant-ai/30min) with the founders", "url": "https://www.ycombinator.com/launches/KGd-codeant-ai-ai-code-reviewer", "votes": 54, "created_at": "2024-01-29T15:25:43.255Z" } ] }, { "id": 29659, "name": "Unbound", "slug": "unbound", "former_names": [ "Unbound Security" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/36df07c499b1ae5e15e4171c4cc3ef24d462d03c.png", "website": "https://getunbound.ai/", "all_locations": "San Francisco, CA, USA", "long_description": "", "one_liner": "Use AI tools without fear of data leakage", "team_size": 7, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1715812278, "tags": [ "Privacy", "Cybersecurity", "Data Labeling", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Summer 2024", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Partly Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/unbound", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2024/unbound.json", "year_founded": 2023, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/91353269/", "x_url": "", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/36df07c499b1ae5e15e4171c4cc3ef24d462d03c.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": null, "founders": [ { "user_id": 901694, "full_name": "Rajaram Srinivasan", "title": "Founder/CEO", "founder_bio": "Building data security for Gen AI.\nPrev: Palo Alto Networks, Adobe | MIT Alum", "is_active": true, "linkedin_url": "https://linkedin.com/in/rajaramsrinivasan", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/a03990b831f31057f44e921c63774348d6c10eb1.jpg" }, { "user_id": 1985851, "full_name": "Vignesh Subbiah", "title": "Founder/CTO", "founder_bio": "Cofounder at Unbound. Security for AI agents.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/vigneshsubbiah16/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/390bb26fdd2b8135d1b2e6de0c675b9497c5ee6b.jpg" } ], "jobs": [ { "id": 69774, "title": "Founding Engineer", "url": "https://www.ycombinator.com/companies/unbound/jobs/FfwAxvH-founding-engineer", "location": "San Francisco, CA, US", "type": "Full-time", "role": "Engineering", "role_type": "Backend", "salary_range": "$110K - $180K", "equity_range": "0.10% - 1.00%", "experience": "Any (new grads ok)", "visa": "US citizen/visa only", "skills": [] }, { "id": 76243, "title": "Founding growth engineer", "url": "https://www.ycombinator.com/companies/unbound/jobs/YIPCJgp-founding-growth-engineer", "location": "San Francisco, CA, US / Remote (US)", "type": "Full-time", "role": "Sales", "role_type": null, "salary_range": "$80K - $135K", "equity_range": "0.10% - 0.50%", "experience": "1+ years", "visa": "US citizenship/visa not required", "skills": [] }, { "id": 93184, "title": "Software Engineering Intern", "url": "https://www.ycombinator.com/companies/unbound/jobs/hn66xKN-software-engineering-intern", "location": "San Francisco, CA, US", "type": "Internship", "role": "Engineering", "role_type": "Backend", "salary_range": "$5K - $7K / monthly", "equity_range": "", "experience": null, "visa": "US citizen/visa only", "skills": [] } ], "news": [ { "title": "Unbound raises $4M to help enterprises embrace AI tools on their terms | Markets Insider", "url": "https://markets.businessinsider.com/news/stocks/unbound-raises-4m-to-help-enterprises-embrace-ai-tools-on-their-terms-1034775030", "date": "Jun 30, 2025" }, { "title": "Unbound secures USD $4 million seed to boost safe AI adoption", "url": "https://securitybrief.com.au/story/unbound-secures-usd-4-million-seed-to-boost-safe-ai-adoption", "date": "May 30, 2025" }, { "title": "Race Capital Leads USD 4 Mn Funding Round in Unbound | Entrepreneur", "url": "https://www.entrepreneur.com/en-in/news-and-trends/race-capital-leads-usd-4-mn-funding-round-in-unbound/492477", "date": "May 29, 2025" }, { "title": "Governance Start-Ups Boom In The Battle To Keep AI Honest", "url": "https://www.forbes.com/sites/davidprosser/2025/05/29/governance-start-ups-boom-in-the-battle-to-keep-ai-honest/", "date": "May 29, 2025" }, { "title": " Unbound raises $4 Mn in seed round led by Race Capital", "url": "https://entrackr.com/snippets/unbound-raises-4-mn-in-seed-round-led-by-race-capital-9317863", "date": "May 29, 2025" } ], "launches": [ { "id": 83204, "title": "🚀 Unbound Security - Secure Gen AI apps for enterprise", "tagline": "We help enterprises prevent data loss on consumer Gen AI apps", "body": "### TL;DR\n\n[Unbound Security](https://www.unboundsecurity.ai/) prevents leakage of sensitive information when employees use Gen AI applications. For example, we intervene and stop when someone pastes a code snippet that contains a secret key into ChatGPT while troubleshooting.\n\n# The problem\n\n1. **AI faces enterprise adoption roadblocks**: Despite Gen AI boosting productivity, many enterprises remain wary. Even in 2024, over 1 in 4 organizations have banned all AI apps, keeping them off-limits to employees.\n2. **AI app sprawl:** There are now well over 1,000 Gen AI apps, and many have questionable security practices. These cool “tools” continue to worry CSOs (Chief Security Officers) as employees are already using many of these to get work done.\n3. **Data privacy remains a top concern**: Over 55% of all prompts contain some form of Personally Identifiable Information (PII). This is not only a privacy nightmare, but also pushes enterprises out of compliance with multiple regulations such as PCI, SOX and HIPAA.\n\n# Our solution\n\n1. **AI app discovery:** We discover and catalog all AI apps in use by employees and help security teams understand the risk levels of each of these apps.\n\n ![uploaded image](/media/?type=post&id=83204&key=user_uploads/901694/8e15836b-4e62-4980-8805-1c87c21af0dd)\n\n2. **Granular application access policies:** Rather than block all apps by default, we allow enterprises to allow some trustworthy AI apps and steer users towards those. For example, if your org invested in Chat GPT enterprise, we help get the most out of that investment by encouraging people to use that instead of a random cool file summarizer on the internet.\n\n ![uploaded image](/media/?type=post&id=83204&key=user_uploads/901694/113c41b1-c9d2-4df4-b74d-b914db53680d)\n\n3. **Protect data leakage:** On the allowed AI apps, Unbound monitors all prompts and also blocks users from sharing sensitive information based on the configured AI usage policy.\n\n ![uploaded image](/media/?type=post&id=83204&key=user_uploads/901694/47fc0b0f-3d45-4d58-8684-64e85e0d8d5c)\n\n\n# Our ask and offer\n\n1. If you know a company that has blocked the usage of AI apps, we can help your friends use these apps with IT consent. Please drop us a note at [founders@unboundsecurity.ai](mailto:founders@unboundsecurity.ai).\n2. If you’d like to understand what people are using AI for within your org, and stay compliant, we are happy to offer our AI visibility platform for free to any YC company. Let’s [chat more over a meeting.](https://calendly.com/rajws/30-mins-meeting)\n\n# The team\n\n[Vignesh](https://www.linkedin.com/in/vigneshsubbiah16/) and [Raj](https://www.linkedin.com/in/rajaramsrinivasan/) worked together at Adobe on the same Engineering team for 5+ years, solving some of the most complex problems in the digital advertising space - The team built sub-millisecond latency systems that processed billions of advertising artifacts. Vignesh went on to be founding engineer at Tophatter and an early engineer at [Shogun (YC S18)](https://www.ycombinator.com/companies/shogun). Raj has built data security products for Palo Alto Networks and Imperva prior to Unbound where he observed the struggles of data security programs in large enterprises.\n\n![uploaded image](/media/?type=post&id=83204&key=user_uploads/901694/7b8b3e08-52e1-4d45-86ac-9963a62da345)\n\n", "url": "https://www.ycombinator.com/launches/Le0-unbound-security-secure-gen-ai-apps-for-enterprise", "votes": 121, "created_at": "2024-08-19T22:37:57.387Z" } ] }, { "id": 29812, "name": "ZeroPath", "slug": "zeropath", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/fd70ee2d072b5f54e3fd3fc0e2531e49708b3fa7.png", "website": "https://zeropath.com", "all_locations": "San Francisco, CA, USA", "long_description": "ZeroPath is a developer tool that autonomously detects, verifies, and submits fixes for vulnerabilities in your code. Engineers can use ZeroPath to find security problems that they might only otherwise catch in pentests or from bug bounty researchers.", "one_liner": "Automatically find and fix your software vulnerabilities", "team_size": 10, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1718222641, "tags": [ "Developer Tools", "B2B", "Security", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2024", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/zeropath", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2024/zeropath.json", "year_founded": 2024, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/zeropathai", "x_url": "https://x.com/zeropathAI", "fb_url": null, "cb_url": null, "github_url": "https://github.com/zeropathai", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/fd70ee2d072b5f54e3fd3fc0e2531e49708b3fa7.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "David Lieb", "url": "https://www.ycombinator.com/people/david-lieb" }, "founders": [ { "user_id": 2021206, "full_name": "Dean Valentine", "title": "Founder", "founder_bio": "ZeroPath founder", "is_active": true, "linkedin_url": "", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/d4aa118f45ea9f67b3ca5bb4aa5d886701b03b48.jpg" }, { "user_id": 2049348, "full_name": "Raphael Karger", "title": "Founder", "founder_bio": "CTO at ZeroPath. Former Google Security Engineer and BishopFox Consultant.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/raphael-karger/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/db088b311094bb1d324eed9d1fde67f15d0cd2f6.jpg" }, { "user_id": 2021191, "full_name": "Etienne Lunetta", "title": "Founder", "founder_bio": "COO at ZeroPath. Former Co-Founder at Mevlink, acquired by bloXroute Labs in 2023.", "is_active": true, "linkedin_url": "", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/69f8b695e026ab2db3939b185d23a01ceef56eb8.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 82258, "title": "🛡️ ZeroPath - Autonomous vulnerability patching", "tagline": "Detect and fix your web application's exploitable security issues without config.", "body": "📝 TL;DR: [ZeroPath](https://zeropath.com/) is a GitHub app that detects, verifies, and issues pull requests for security vulnerabilities in your code.\n\n![uploaded image](/media/?type=post&id=82258&key=user_uploads/2021206/183871ce-a1b3-4db9-a320-ce73defc63c3)\n\n### 💡 Why We Built This:\n\nAs security engineers and developers, we've seen firsthand how challenging it is for businesses to secure their products. Existing Static Application Security Testing (SAST) tools overwhelm teams with false positives and fail to remediate the real vulnerabilities they do find. We built ZeroPath to allow fast-moving teams to write secure code without having to configure or review a scan dashboard.\n\n![uploaded image](/media/?type=post&id=82258&key=user_uploads/2021206/9f2ff51d-2c6b-4ad5-b7c3-4c48e26fc0e9)\n\n### 🛠 How It Works:\n\n1. Executes regular vulnerability scans of your source code\n2. Integrates with GitHub to scan pull requests for vulnerabilities\n3. Uses advanced LLMs to significantly reduce false positives\n4. Generates patches for vulnerabilities identified\n5. Automatically issues pull requests to patch them\n\n### 💪 Why ZeroPath:\n\n* Integrates with your existing SAST - **removes** **85% of false positives**\n* Reduces vulnerability remediation time by up to **90%**\n* Enables natural language modification of patches, just tag @zeropath-ai in PRs (including your own!)\n* Supports complex, multi-file changes seamlessly\n* Prevents SAST vendor lock-in\n\n### 👥 Our Team:\n\n* [Nathan](https://linkedin.com/in/nathan-hrncirik): Ex-Tesla Red Team Engineer, $100k+ in bug bounties\n* [Raphael](https://linkedin.com/in/raphael-karger): Ex-Google Security Engineer, 12 security researcher hall of fames\n* [Dean](https://www.linkedin.com/in/dean-valentine-3b7583313/) & [Etienne](https://www.linkedin.com/in/etienne-lunetta-574065313/): Founders of Mevlink (acquired by Bloxroute in 2023)\n\n## 💰 YC Launch Deal: 50% off for 12 months\n\n* $20/month per contributing developer (reg. $40)\n* Use code LAUNCHYC at checkout, **valid until 8/15**\n\n### 🙏 How You Can Help:\n\nWe're eager for your insights on our product, feature ideas, and security needs - whether through trying our GitHub app, scheduling a meeting, or sharing feedback.\n\n* [Install our GitHub app](https://zeropath.com/)\n* [Schedule a meeting to discuss your application security needs](https://cal.com/zeropath/30min)\n* [Share your feedback](mailto:hello@zeropath.com)\n\n### 🚀 Get started in 30 seconds: \n\n📅 Want to learn more? Schedule a demo: \n\n![uploaded image](/media/?type=post&id=82258&key=user_uploads/2021206/c947eed7-8cdb-43e0-b330-0c5e36c86ef5)\n\n", "url": "https://www.ycombinator.com/launches/LOk-zeropath-autonomous-vulnerability-patching", "votes": 47, "created_at": "2024-07-18T18:38:13.935Z" } ] }, { "id": 30087, "name": "Gecko Security", "slug": "gecko-security", "former_names": [ "Gecko Security Inc." ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/45adce9bea5991ec16d5af841bb7bca96948baf2.png", "website": "https://gecko.security", "all_locations": "London, England, United Kingdom", "long_description": "We built Gecko for teams that want to build secure code quickly without wasting time on security tools that don’t deliver results, or relying on one-time human pentests that quickly become outdated. Gecko uses AI to understand how your application should work, simulates relevant attacks to find critical vulnerabilities, and then verifies these vulnerabilities by exploiting them. It also helps you understand the risk of these vulnerabilities and applies a working fix to keep your code secure.", "one_liner": "Security that understands your company", "team_size": 2, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1729014786, "tags": [ "SaaS", "B2B", "Security", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Fall 2024", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United Kingdom", "Europe", "Remote", "Partly Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/gecko-security", "api": "https://devasheeshg.github.io/yc-api/batches/fall-2024/gecko-security.json", "year_founded": 2024, "city": "London", "country": "GB", "linkedin_url": "https://www.linkedin.com/company/geckosec", "x_url": "https://x.com/gecko_sec", "fb_url": null, "cb_url": null, "github_url": "https://github.com/Gecko-Security", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/45adce9bea5991ec16d5af841bb7bca96948baf2.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Pete Koomen", "url": "https://www.ycombinator.com/people/pete-koomen" }, "founders": [ { "user_id": 1543392, "full_name": "Jeevan Jutla", "title": "Founder/CEO", "founder_bio": "Jeevan, Co-Founder and CEO of Gecko Security, has previously worked as a security researcher for UK Intelligence, where he built automated security tools. He’s ranked in the top 500 globally for competitive hacking and has co-developed machine learning tools for vulnerability research, 3 years ahead of public research.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/jeevan-jutla", "x_url": "https://x.com/jjjutla", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/74dd4dee3403d90703a392dc55f1bfb34cb2bf67.jpg" }, { "user_id": 1969797, "full_name": "Artemiy Malyshau", "title": "Founder/CTO", "founder_bio": "Artemiy is the CTO and Co-Founder at Gecko Security. He holds an MSc from Imperial College London, where he was a scholar. He contributed to research in multi-agent systems and reinforcement learning. Prior, he developed threat intelligence software for Interpol and national governments.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/artemiy-malyshau/", "x_url": "https://x.com/nkoorty", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/5ebf9724a66e3cf8fe013ca476bdfca6e4ccec30.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 92703, "title": "Gecko Security: AI SAST for finding Vulnerabilities in Code", "tagline": "30+ 0-Days found using Gecko", "body": "**TL;DR:** Static analysis tools flood teams with false positives and miss the vulnerabilities that matter. We use LLMs to find the complex business logic flaws that traditional scanners can't detect.\n\n![uploaded image](/media/?type=post&id=92703&key=user_uploads/1969797/42239d23-2918-4c49-bc6d-38a1955fc1c7)\n\n# **The Problem**\n\nCompanies scan their code for security vulnerabilities and are often met with a big pile of findings. 80% of these findings are false positives and not exploitable vulnerabilities. Even among the true positives, these scanners still miss issues like privilege escalation and authentication bypasses. These are the most important issues that only surface later during manual code review or penetration testing.\n\nSecurity teams have to deal with this by spending hours tuning scanners and rules or hiring headcount to triage through the false positives. This translates into delayed releases, overtime costs, and compliance risks when critical flaws slip through undetected.\n\n# **The Solution**\n\nTraditional SAST (Static Application Security Testing) tools have two fundamental limitations. First, they parse code into simplistic models like ASTs or call graphs, which lose context and can't resolve complex call chains. Second, they rely on pattern matching against predefined rules, which works for basic vulnerabilities like XSS and SQLi but fails completely for custom business logic flaws.\n\nGecko solves both problems. We built a custom, compiler-accurate indexer that preserves semantic information and allows us to precisely navigate code like an IDE. This gives us the ground truth of how your code actually works.\n\nWith that foundation, we use LLMs to perform threat modeling. The LLM analyzes your code's business logic, data flows, and trust boundaries to generate targeted attack scenarios. We then systematically validate each potential attack path, using the indexer to reconstruct full call chains from source to sink and determine real-world exploitability before flagging it as a vulnerability.\n\nThis approach finds the complex, multi-step business logic vulnerabilities that have been invisible to traditional tools.\n\n# **Ask**\n\nWe've got a handful of Fortune 500 companies and startups alike excited about this, because it addresses key pain points they couldn’t address with traditional scanners. Customers are seeing 50% fewer false positives on the same codebases, and are finding issues using the scanner that would only appear in pentests and manual code reviews.\n\nWe’ve used it to find 30+ CVEs in projects like Ollama, Gradio, and Ragflow (). You can [try it on any OSS repo](https://app.gecko.security) at or [get a demo](https://cal.com/geckosec/30min).\n\n# **Team**\n\nJJ and Artemiy met four years ago while studying in London. Since then, they have traveled the world competing in CTFs and hackathons, earning over $100,000 in prizes.\n\nJJ, CEO and Co-founder, previously worked for the UK Intelligence Service, as a teenager building automated tooling to defend critical infrastructure. He also worked at Binance in China leading security tool development for the Red Team. \n\nArtemiy, CTO and Co-founder, served in the Austrian Cyberforces and built threat intelligence platforms used by Interpol and national governments. A scholar of Imperial College London, he’s spent his career developing systems that detect and respond to complex cyber threats", "url": "https://www.ycombinator.com/launches/O7D-gecko-security-ai-sast-for-finding-vulnerabilities-in-code", "votes": 22, "created_at": "2025-08-04T18:13:52.289Z" }, { "id": 84816, "title": "Gecko Security: Your AI Security Engineer", "tagline": "Gecko is an AI SAST for finding and fixes security vulnerabilities in your codebase. It's just like having a security engineer making your code secure.", "body": "**TL;DR:** We built [Gecko](https://gecko.security/) for teams that want to build secure code quickly without wasting time on tools that don’t deliver results, or relying on one-time human pentests that quickly become outdated.\n\n![uploaded image](/media/?type=post&id=84816&key=user_uploads/1969797/81233561-38af-49a4-b7ed-03f61aa03ae0)\n\n### **The Problem**\n\nMost developers tell us they think of security as an afterthought, added out of fear rather than part of the development process at the start. This is because current security tools **can’t find critical business logic vulnerabilities**, which are the ones attackers actually exploit, and instead flag low-priority issues with many **false positives**. This makes fixing these issues slow and costly, **pulling engineers away from building** features that grow revenue.\n\n### **The Solution**\n\nGecko uses AI to understand how your application should work, simulates relevant attacks to find critical vulnerabilities, and then verifies these vulnerabilities by exploiting them. It also helps you understand the risk of these vulnerabilities and applies a working fix to **continuously** **keep your code secure**. [Watch our demo here!](https://www.youtube.com/watch?v=ObuItEP3rZk)\n\n### **Technical Details**\n\nAt a high level, Gecko mimics the approach of skilled security experts by using LLM agents combined with program analysis tools like static analyzers, fuzzers, and symbolic executors, which were previously **only used in intelligence agencies**. For fixing vulnerabilities, Gecko uses multiple agents to iteratively refine the patches - ensuring the vulnerability is remediated, and your code isn’t broken. All testing is done in parallel with certified human pentesters, as we continue to benchmark Gecko’s performance to ensure no vulnerabilities are overlooked.\n\n### **Ask**\n\n**Do you have code that needs to be secured?** Email us at [**gecko@gecko.security**](mailto:gecko@gecko.security) or book a demo at [**https://cal.com/geckosec/15min**](https://cal.com/geckosec/15min).\n\n### **Team**\n\n[JJ](https://www.linkedin.com/in/jeevan-jutla/) and [Artemiy](https://www.linkedin.com/in/artemiy-malyshau/) met four years ago while studying in London. Since then, they have traveled the world competing in CTFs and hackathons, earning over $100,000 in prizes. \n\nJJ previously worked for the UK Intelligence Service (GCHQ), as a teenager building automated tooling to defend critical infrastructure. He also worked at Binance in China leading security tool development for the Red Team.\n\nArtemiy holds an MSc from Imperial College London, where he was a scholar. He has contributed to research in multi-agent systems and reinforcement learning. As the first employee and only non-PhD member at his previous company, he developed threat intelligence software for Interpol and national governments. \n\nBoth are deeply committed to cybersecurity and AI, and are focused on solving one of the industry's most challenging problems.", "url": "https://www.ycombinator.com/launches/M40-gecko-security-your-ai-security-engineer", "votes": 81, "created_at": "2024-10-16T21:47:06.425Z" } ] }, { "id": 30273, "name": "Candor", "slug": "candor-security", "former_names": [ "Physion Works", "Sophris", "Mirror", "Anomaly", "Bastion", "Haleum" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/fb05bd36fb4b277d12ebca5a33307afd09834f65.png", "website": "https://candor.security/", "all_locations": "San Francisco, CA, USA", "long_description": "Candor is agentic data loss prevention (DLP) and insider risk management. Employees share sensitive data with third parties and email source code to personal inboxes every day. For fast-moving companies, protecting these crown jewels and customer trust is core to closing deals. Legacy DLP tools can cross off compliance checkboxes but flood security teams with false positives. Candor's AI agents understand both the data movement and the person behind it, giving lean security teams broad coverage without the noise. ", "one_liner": "Protect your data and stop insider risk", "team_size": 3, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1740017526, "tags": [ "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Winter 2025", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/candor-security", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2025/candor-security.json", "year_founded": 2024, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/candorsec", "x_url": "", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/fb05bd36fb4b277d12ebca5a33307afd09834f65.png", "app_video_url": null, "dday_video_url": null, "company_photos": [ "https://bookface-images.s3.us-west-2.amazonaws.com/attachments/b25c6e96323189fdf2430d59f53794c097b86ff7.png" ], "primary_partner": { "name": "Brad Flora", "url": "https://www.ycombinator.com/people/brad-flora" }, "founders": [ { "user_id": 1583056, "full_name": "Ansh Gupta", "title": "Founder", "founder_bio": "Co-Founder/CTO @ Candor (https://candor.security/). We help companies protect themselves from data loss and insider threats with AI.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/gupta-ansh", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/6b5ede187d11f52f613d3711eada87cdc8a0c23b.jpg" }, { "user_id": 1753464, "full_name": "Aditya Iyengar", "title": "Founder", "founder_bio": "Co-founder @ Candor. Prev SWE @ Flutterflow (W21), Uber, and NASA. ", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/aditya-v-iyengar", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/a6ea81edf6ac8bc6f2c111cae88700e84d81acdf.jpg" } ], "jobs": [ { "id": 93340, "title": "Senior Full-Stack Engineer", "url": "https://www.ycombinator.com/companies/candor-security/jobs/VHLrfOO-senior-full-stack-engineer", "location": "San Francisco, CA, US", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "$150K - $250K", "equity_range": "0.20% - 0.50%", "experience": "3+ years", "visa": "US citizen/visa only", "skills": [ "Express", "Node.js", "React", "Docker", "Information Security", "AI Agents" ] } ], "news": [], "launches": [] }, { "id": 30307, "name": "Archon", "slug": "archon", "former_names": [ "NEXUS" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/a035400f6acd84a35dea2f9fb7832b054c02ed12.png", "website": "https://archon.inc", "all_locations": "San Francisco, CA, USA", "long_description": "Archon helps software companies sell to the government by cutting the required federal compliance timeline (called FedRAMP) down from 16 to 6 months and cuts costs by $1M per company. \r\n\r\nEmail us at inquiries@archon.inc", "one_liner": "We help software companies sell to government.", "team_size": 3, "industry": "Government", "subindustry": "Government", "launched_at": 1738095676, "tags": [ "GovTech", "Compliance", "Cybersecurity", "Cloud Computing" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Winter 2025", "status": "Active", "industries": [ "Government" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": [ { "question": "How did your company get started? (i.e., How did the founders meet? How did you come up with the idea? How did you decide to be a founder?)", "answer": "We came to YC planning to build AI agents that would speed up government workflows. But, we realized that we’d be spending more of our time on government compliance, than on our actual product. Currently, companies seeking FedRAMP certification face two bad options: spend millions of dollars on consultants, or use loophole solutions that lock them into unfavorable terms. We're building the solution we wish existed - a straightforward path that helps software companies build lasting government partnerships." } ], "url": "https://www.ycombinator.com/companies/archon", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2025/archon.json", "year_founded": 2024, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/getarchon/", "x_url": "https://x.com/archoninc", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/archon-technologies-9074", "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/a035400f6acd84a35dea2f9fb7832b054c02ed12.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Gustaf Alstromer", "url": "https://www.ycombinator.com/people/gustaf-alstromer" }, "founders": [ { "user_id": 1220402, "full_name": "George Parks", "title": "Founder/CEO", "founder_bio": "CEO of Archon. Previously a tech policy analyst at the U.S. Department of State, informing diplomats on trends in AI, Quantum, and VR/XR. Originally a software engineering consultant. Studied CS at Georgia Tech.\n", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/george-parks/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/a00f68f05f36874e6552433e262e98e436a1173e.jpg" } ], "jobs": [ { "id": 77338, "title": "Founding Engineer, Infrastructure", "url": "https://www.ycombinator.com/companies/archon/jobs/iSDasJM-founding-engineer-infrastructure", "location": "San Francisco, CA, US", "type": "Full-time", "role": "Engineering", "role_type": "Devops", "salary_range": "$130K - $210K", "equity_range": "0.50% - 1.50%", "experience": "Any (new grads ok)", "visa": "US citizen/visa only", "skills": [ "Microsoft Azure", "Groovy", "Kubernetes" ] }, { "id": 77339, "title": "Software Engineer, Security", "url": "https://www.ycombinator.com/companies/archon/jobs/n9cvKhD-software-engineer-security", "location": "San Francisco, CA, US", "type": "Full-time", "role": "Engineering", "role_type": "Backend", "salary_range": "$120K - $170K", "equity_range": "0.25% - 0.75%", "experience": "Any (new grads ok)", "visa": "US citizen/visa only", "skills": [ "Docker", "Software Security" ] }, { "id": 77340, "title": "Software Engineer, Full Stack", "url": "https://www.ycombinator.com/companies/archon/jobs/R6DSmps-software-engineer-full-stack", "location": "San Francisco, CA, US", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "$120K - $170K", "equity_range": "0.25% - 0.75%", "experience": "Any (new grads ok)", "visa": "US citizen/visa only", "skills": [] } ], "news": [], "launches": [ { "id": 87386, "title": "Archon: Fast-track selling software to government", "tagline": "Get the cybersecurity requirements you need to sell software to government.", "body": "We’re George and Sam—co-founders of Archon, and former government staffers. \n\n**TL;DR:** Our free-to-integrate SDK gives you all the cybersecurity requirements you need to sell to government faster and cheaper. This saves companies $1M (2/3rds of the cost) and reduces the timeline from 16 to 6 months. \n\n**Problem: The government software market is locked behind an opaque, million-dollar compliance process (called FedRAMP) that favors big incumbents with lots of time.**\n\n**Solution:** Our SDK provides compliant-out-of-the-box implementations of all the compliance features you need to sell to government – authentication, logging, access control, etc. You can integrate it into your existing codebase in a week, and we handle all of the obscure compliance restrictions so you don’t have to. \n\n![uploaded image](/media/?type=post&id=87386&key=user_uploads/2110890/2caad249-0936-4910-9a4e-12ad4425e4f5)\n\nIf you want to sell your software to government agencies, start exploring our SDK [here.](https://archon.inc/docs)\n\n\\\n**We condense the FedRAMP process into 4 steps.**\n\n1. Integrate our free SDK (what we’re launching today)\n2. Self-serve onboarding; then we prepare your 700-page security package\n3. Get an audit\n4. Wait for the Federal authorization board to approve your audit\n\nA typical Series A startup spends $1.5M on consultants and 1.5 years on the first 2 steps. Archon’s SDK cuts the integration timeline down to 1 week. We also know many startups that never sold their software to the government because the barrier was just too high. **Yet, the government’s IT spending accounts for 20% of the entire U.S. software market.** It’s our mission to eliminate these compliance hurdles and bring much-needed innovation from small tech to the federal sector. \n\n![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXcz8xKiHOkcrclWYcEfAY2gc_hB1s4NlkbyEpQMLR9RNfngWF5EKYxG6N7b67Ix_5A7xxplmqU3xUvP65S-RAl4BSWsBuHJ0sy1duVwFAvZXXZ7xTPG9XPF4LZufVFMc5eQ-a-qrQ?key=gLGrgddQZLJJWptIH4zDOWpy)\n\n**Context:**\n\nWe came to YC planning to build AI agents that would speed up government workflows. But, we realized that we’d be spending more of our time on government compliance, than on our actual product. Currently, companies seeking FedRAMP certification face two bad options: spend millions of dollars on consultants, or use loophole solutions that lock them into unfavorable terms. We're building the solution we wish existed - a straightforward path that helps software companies build lasting government partnerships.\n\n**Team:**\n\n* **George Parks:** Advised diplomats on emerging technologies at State.\n* **Sam Jung:** Previously at State, advised the U.S. AI Safety Institute.\n\n# **OUR ASK:**\n\n* **Anyone looking to sell software to the government, or get FedRAMP**, we’d be grateful for an introduction. Email us at [founders@archon.inc](mailto:founders@archon.inc)\n* **If you want to sell to government, what technology do you use?** Our SDK is only available for NodeJS to start. Let us know what tech stack you use with [this form.](https://forms.office.com/r/m5vPfmqVP3)", "url": "https://www.ycombinator.com/launches/MjS-archon-fast-track-selling-software-to-government", "votes": 26, "created_at": "2025-02-03T21:39:28.653Z" } ] }, { "id": 30527, "name": "MindFort", "slug": "mindfort", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/67f8fa73a583138ab0060e99d6a10e8341a0d040.png", "website": "https://mindfort.ai/?utm_source=ycombinator&utm_medium=referral&utm_campaign=yc", "all_locations": "Los Angeles, CA, USA", "long_description": "MindFort is building fully autonomous AI agents powered by their in-house models that can find, exploit, and patch complex vulnerabilities in web applications at massive scale. MindFort agents use the same principles as human penetration testers to understand their target and figure out the best ways to work together to exploit it. We can do fully autonomous AI web pentesting and bring offensive security to teams out numbered. \r\n\r\nWhile security teams were already behind with legacy tools and processes, AI coding is make the problem worse. AI generates code far faster than human teams can secure it; MindFort can match that speed and scale. Our agents will become critical as organizations scale up development with AI.\r\n", "one_liner": "Autonomous Security Agents", "team_size": 6, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1747245373, "tags": [ "Developer Tools", "Cybersecurity", "Enterprise Software", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Spring 2025", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/mindfort", "api": "https://devasheeshg.github.io/yc-api/batches/spring-2025/mindfort.json", "year_founded": 2025, "city": "Los Angeles", "country": "US", "linkedin_url": "https://www.linkedin.com/company/106469568/", "x_url": "https://x.com/mindfort_ai", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/mindfort-ai", "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/67f8fa73a583138ab0060e99d6a10e8341a0d040.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Nicolas Dessaigne", "url": "https://www.ycombinator.com/people/nicolas-dessaigne" }, "founders": [ { "user_id": 525065, "full_name": "Brandon Veiseh", "title": "Founder/CEO", "founder_bio": "Co-founder and CEO of MindFort AI. Previous founder, product leader in AI and Security.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/brandon-veiseh-77762113a/", "x_url": "https://twitter.com/bveiseh", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/6adfd0bc0deb384b42ebb12dc0a50a3df70f67ac.jpg" }, { "user_id": 1327738, "full_name": "Akul Gupta", "title": "Founder/CTO", "founder_bio": "Co-founder and CTO of MindFort.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/akulguptax/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/c33e727522c067e9599fb5756c86eb381545c180.jpg" } ], "jobs": [ { "id": 84795, "title": "Software Engineer ", "url": "https://www.ycombinator.com/companies/mindfort/jobs/g3aPQUZ-software-engineer", "location": "Los Angeles, CA, US / Remote (US)", "type": "Full-time", "role": "Engineering", "role_type": "Backend", "salary_range": "$150K - $250K", "equity_range": "0.20% - 0.50%", "experience": "1+ years", "visa": "US citizen/visa only", "skills": [] }, { "id": 95701, "title": "AI Researcher", "url": "https://www.ycombinator.com/companies/mindfort/jobs/HV2EzUk-ai-researcher", "location": "Los Angeles, CA, US / Remote (US)", "type": "Full-time", "role": "Engineering", "role_type": "Backend", "salary_range": "$150K - $250K", "equity_range": "0.20% - 0.50%", "experience": "3+ years", "visa": "US citizen/visa only", "skills": [] } ], "news": [], "launches": [ { "id": 90555, "title": "MindFort.ai - Fully Autonomous Security Agents", "tagline": "Fully autonomous security agents that find, validate, and patch vulnerabilites 24/7", "body": "![uploaded image](/media/?type=post&id=90555&key=user_uploads/525065/9bbd9d91-5dba-43e0-9412-2c45bac5782a)\n\nHey everyone! 👋 We're Brandon, Sam, and Akul - Co-founders of [MindFort.ai](http://MindFort.ai).\n\nWe're building fully autonomous AI security agents that find, validate, and patch vulnerabilities in web applications and networks at machine speed and scale.\n\nhttps://youtu.be/Oe-errlwaow\n\n## 🔥 The Problem\n\nSecurity is fundamentally broken for most engineering teams today:\n\n* **Scanners are unreliable** - They flood engineers with 30-50% false positives, wasting precious development time\n* **Traditional pen testing is too slow** - It happens quarterly at best, costs a fortune, and takes weeks to complete\n* **AI-accelerated development creates new risks** - Teams are shipping code faster than ever, but security reviews have become an even bigger bottleneck\n\nThe result? Companies are forced to choose between shipping fast or shipping secure. Engineering teams lose **\\~20%** of their time dealing with security issues or slowing down to accommodate outdated security practices.\n\n## 🚀 Our Solution\n\n[MindFort.ai](http://MindFort.ai)'s autonomous security agents work 24/7/365 to find, validate, and patch vulnerabilities:\n\n* **Find** complex vulnerabilities like a human tester would\n* **Validate** every finding to eliminate false positives\n* **Patch** with intelligent fixes that integrate directly with your codebase\n* **Scale** to thousands of tests in an instant, giving coverage never possible before\n\nUnlike solutions that slow development, MindFort accelerates it by eliminating security bottlenecks. Our platform is already finding vulnerabilities in production systems that other tools miss, identifying issues in bug bounty programs, and scoring high on human penetration testing benchmarks.\n\n## 💡 Our Story\n\nBrandon worked as a PM at ProjectDiscovery, a security scanner company where he led development of the Nuclei cloud platform from an open source tool to an enterprise ready product. He then joined NetSPI, one of the world’s largest penetration testing firms, to build generative AI tools for human testers. He sat with countless customers across both companies, learning about their struggles in securing attack surfaces at scale.\n\nAkul received his masters in computer science from the University of Illinois Urbana-Champaign, and was drawn to AI and security early on in his academic career. He co-authored multiple papers on using LLMs to perform various cybersecurity attacks, worked on creating novel benchmarks for hacking agents, and participated in red teaming and model safety programs at both OpenAI and Anthropic.\n\nSam worked as a senior engineer at Salesforce, where he led security for a large business unit, Tableau. During his time there, he worked first hand on keeping a large scale product secure. Between juggling security assessments, validating findings, and managing remediations inside of a large organization, he had seen it all. He began experimenting with ways to use AI to help solve some of the issues he faced at Salesforce and even worked on a demo of a tool to perform agentic code review through a DARPA program. He recently completed a master’s degree in cybersecurity at UC Berkeley.\n\nWe all met through our work and research. Early on, we all realized that the future of security was going to belong to AI agents, and that the coming tidal wave of new code generated with AI would need a solution of equal magnitude.\n\n![uploaded image](/media/?type=post&id=90555&key=user_uploads/525065/51cbc28d-9ff7-41b3-af19-d3e9fc23ef0a)\n\n## 🔮 Our Vision\n\nSecurity should accelerate your business, not slow it down. We're creating a world where security testing happens continuously and vulnerabilities are patched autonomously, **keeping your product and your users safe, while letting you ship faster.**\n\n## 👇 Our Ask\n\nReady to ship quickly and securely? 👉 **Visit [mindfort.ai](http://mindfort.ai) to request access**\n\n📧 Email us directly: [founders@mindfort.ai](mailto:founders@mindfort.ai)", "url": "https://www.ycombinator.com/launches/NYZ-mindfort-ai-fully-autonomous-security-agents", "votes": 62, "created_at": "2025-05-20T14:20:43.961Z" } ] }, { "id": 30528, "name": "Probo", "slug": "probo", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/c0e14dfc874747053fa6732daf6dbf9f9ed3e18d.png", "website": "https://www.probo.com?utm_source=yc-bookface", "all_locations": "San Francisco, CA, USA", "long_description": "Probo acts like your compliance team. You tell us how you work, and Probo does the rest:\r\n1. Set the right requirements - not overkill\r\n2. Handle docs, risks, controls, evidence\r\n3. Run the audit\r\n4. Keep everything up to date afterward\r\nFounders shouldn’t lose weeks to this stuff. Even one day is too much.\r\n", "one_liner": "We help you get compliant while you focus on your business.", "team_size": 6, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1747978784, "tags": [ "SaaS", "B2B", "Compliance", "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Spring 2025", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Partly Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/probo", "api": "https://devasheeshg.github.io/yc-api/batches/spring-2025/probo.json", "year_founded": 2024, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/getprobo/", "x_url": "https://x.com/getprobo", "fb_url": null, "cb_url": null, "github_url": "https://github.com/getprobo", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/c0e14dfc874747053fa6732daf6dbf9f9ed3e18d.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Tom Blomfield", "url": "https://www.ycombinator.com/people/tom-blomfield" }, "founders": [ { "user_id": 2229971, "full_name": "Antoine Bouchardy", "title": "Founder/CEO", "founder_bio": "Probo co-founder & CEO. Cybersecurity auditor with a data & product background.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/antoinebouchardy/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/33fd1c4954b833c489ebb4ed6da203da5e451490.jpg" }, { "user_id": 1142157, "full_name": "Bryan Frimin", "title": "Founder/CTO", "founder_bio": "CTO & Co-founder of Probo. French engineer building an open-source AI platform that simplifies SOC2/ISO27001 compliance.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/gearnode", "x_url": "https://www.twitter.com/gearnode", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/4239e339bb04f3406fd6b9fe2d14cbc0625f40d3.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 90678, "title": "Probo - Open-source compliance platform", "tagline": "We make you SOC 2 compliant so you focus on your business.", "body": "Hi everyone!\n\nWe are Antoine and Bryan from Probo.\n\nWe do your SOC 2 (and other) compliance, making sure you don’t waste time on useless tasks.\n\nOver the last 2 months, we've already worked with 39 companies to get SOC2, HIPAA or ISO27001 without the hassle. \n\nhttps://youtu.be/i-IT5hYwemY\n\n## **What’s broken**\n\nCompliance.\n\nAs an auditor, I asked companies for the same checklists and sent the same doc requests, over and over. Founders wasted time filling in boxes without thinking.\n\nLooking back, it was mindless busywork that frustrated everyone.\n\n## **What we are building**\n\nProbo acts like your compliance **team.** You tell us how you work, and Probo does the rest:\n\n1. Set the _right_ requirements - not overkill\n2. Handle docs, risks, controls, evidence\n3. Run the audit\n4. Keep everything up to date afterward\n\nFounders shouldn’t lose weeks to this stuff. **Even one day is too much.**\n\n## **What’s next**\n\nThree things:\n\n* **Open source**: Commoditize existing tools \n* **AI powered:** Agents to continuously monitor and maintain things up to date\n* **No third-party trust:** proofs are end-to-end verifiable\n\nIf you’re building and don’t want to lose weeks on compliance,\n\nIf this sounds like something you’ve wished existed,\n\n=> [founders@getprobo.com](mailto:founders@getprobo.com)\n\n=> [www.getprobo.com](http://www.getprobo.com)\n\n![uploaded image](/media/?type=post&id=90678&key=user_uploads/2229971/12941717-a6c6-4eae-b8eb-08a49e657b33)\n\n", "url": "https://www.ycombinator.com/launches/NaY-probo-open-source-compliance-platform", "votes": 144, "created_at": "2025-05-23T16:45:14.090Z" } ] }, { "id": 30535, "name": "Cotool", "slug": "cotool", "former_names": [ "Holtzman" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/c50bede6546396b2ac97015979b5f1979c3c8f35.png", "website": "https://cotool.ai", "all_locations": "San Francisco, CA, USA", "long_description": "Cotool builds AI agents and the infrastructure around them to help security teams detect threats, investigate alerts, hunt for attacks, and respond.\r\n\r\nOur agents work across a team's security tools and data. They investigate alerts, write and tune Python detections, and turn threat intelligence into hunts and new coverage. Teams can customize agents around their workflows, inspect the evidence, edit detection logic, and bring humans in when judgment or approval matters.\r\n\r\nUnderneath the agents, Cotool provides log storage and search built for their workloads, with access to data where it already lives. The goal is to give security teams more capacity to defend their companies as their environments and workloads grow.\r\n\r\nTeams at Ramp, EliseAI, ClickHouse, Legora, and many more use Cotool.", "one_liner": "Security operations optimized for agents.", "team_size": 8, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1747110142, "tags": [ "SaaS", "Compliance", "Security", "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Spring 2025", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/cotool", "api": "https://devasheeshg.github.io/yc-api/batches/spring-2025/cotool.json", "year_founded": 2025, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/cotool-ai", "x_url": "https://x.com/cotoolai", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/c50bede6546396b2ac97015979b5f1979c3c8f35.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Pete Koomen", "url": "https://www.ycombinator.com/people/pete-koomen" }, "founders": [ { "user_id": 2254937, "full_name": "Max Pollard", "title": "Founder/CEO", "founder_bio": "Building AI agents and infrastructure to help security teams detect threats, investigate alerts, and respond. Co-founder and CEO of Cotool. San Francisco native.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/mmpollard/", "x_url": "https://x.com/maxpollard415", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/a3e5bb1453fdc94ab1ddc26b05036ed17d06b708.jpg" }, { "user_id": 2300356, "full_name": "Logan Carmody", "title": "Founder/CTO", "founder_bio": "building Cotool for security teams\n\nhmu if you're interested in chatting (opp|app)-sec, agents, trail running or cycling", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/logan-carmody/", "x_url": "https://x.com/endorseurgirl", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/05e1063a714ee172a41aecc6b0eb0b25ab451463.jpg" }, { "user_id": 2530428, "full_name": "Eddie Conk", "title": "Founder/CPO", "founder_bio": "Building Cotool to help security teams eliminate manual & repetitive tasks.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/eddieconk", "x_url": "https://x.com/eddieconkml", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/4fae79b207cffda00fa166e58974e0c57e47421d.jpg" } ], "jobs": [ { "id": 116142, "title": "Founding Product Engineer", "url": "https://www.ycombinator.com/companies/cotool/jobs/s3Bwr2M-founding-product-engineer", "location": "San Francisco, CA, US", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "$150K - $300K", "equity_range": "", "experience": "Any (new grads ok)", "visa": "US citizen/visa only", "skills": [] }, { "id": 116143, "title": "Machine Learning Engineer — Applied AI & Agents", "url": "https://www.ycombinator.com/companies/cotool/jobs/WWZZsd5-machine-learning-engineer-applied-ai-agents", "location": "San Francisco, CA, US", "type": "Full-time", "role": "Engineering", "role_type": "Machine learning", "salary_range": "$150K - $300K", "equity_range": "", "experience": "Any (new grads ok)", "visa": "US citizen/visa only", "skills": [] }, { "id": 116240, "title": "Account Executive", "url": "https://www.ycombinator.com/companies/cotool/jobs/8quCd1f-account-executive", "location": "San Francisco, CA, US / Remote (New York, NY, US)", "type": "Full-time", "role": "Sales", "role_type": null, "salary_range": "$200K - $300K", "equity_range": "", "experience": "3+ years", "visa": "US citizen/visa only", "skills": [] } ], "news": [ { "title": "Cotool raises a $7.4M seed led by a16z for agentic security", "url": "https://www.axios.com/pro/enterprise-software-deals/2026/03/05/cybersecurity-cotool-seed-a16z-enterprise-tech", "date": "Mar 05, 2026" } ], "launches": [ { "id": 90398, "title": "Cotool - Composable AI Agents for every Security Team", "tagline": "Reduce time spent on investigations and detection engineering by 90%", "body": "Hey everyone 👋\n\nWe're [Eddie](https://www.linkedin.com/in/eddieconk/), [Logan](https://www.linkedin.com/in/logan-carmody/), and [Max](https://www.linkedin.com/in/mmpollard/) – co-founders of [Cotool](https://cotool.ai).\n\n### TL;DR\n\nCotool uses AI to automate repetitive security workflows so teams can focus on threat hunting instead of manual tasks. Our early users have used the copilot and agents to cut investigation time by 90% and increase detection quality & coverage. Book a demo to learn how you can do the same!\\\nhttps://www.youtube.com/watch?v=GnyZuJGQ5C0\n\n### ❌ The Problem\n\nSecurity is complex, but the problems facing most teams are not:\n\n1. Alert Fatigue: Hours lost to false positives, while genuine threats slip by unnoticed.\n2. Context Switching: Investigations requiring constant toggling across 5-10 disconnected tools just to assemble basic context.\n3. Documentation Overhead: Teams spend more time as technical writers than security practitioners, bogged down in endless reporting.\n\nBefore founding Cotool, we collaborated with cutting-edge security teams including OpenAI, Coinbase, Figma, and DoorDash, experiencing these universal challenges firsthand.\n\nAdvancements in AI now offer an opportunity to truly reimagine this model; by building intuitive, collaborative tools that complement, not replace, security professionals.\n\n### 👷 Our Solution\n\nCotool provides a suite of Agents and an AI co-pilot designed specifically for security teams, streamlining workflows and reducing frustration through:\n\n* Seamless Investigations 🔍: A true AI co-pilot that works alongside security engineers during alert triage, investigations, and detection engineering; automatically gathering relevant context from across tools so they can focus on reasoning, not tool-hopping.\n* No-code Agents 🤖: Turn successful debugging flows into reusable agents, then refine their behavior with natural language prompts and connect them to any tools Cotool has access to, with granular permission controls.\n* Automated Documentation 📊: Generating thorough, accurate reports in seconds, freeing up valuable security practitioner time.\n\n![uploaded image](/media/?type=post&id=90398&key=user_uploads/2254937/d59dd9d1-e396-4f77-8dce-283a5e31c4ee)\n\n### 👨‍💻 The Team\n\nWe have worked together for years and co-founded Cotool in 2025.\n\n[Max Pollard](https://www.linkedin.com/in/mmpollard/) (CEO) led the forward deployed engineering team at Material, working directly with security teams to understand their workflows and pain points. He built the team up from one to 8 engineers and embedded himself with the world's best security programs. Previously he worked as a SE at Okta. He holds a BA in Business and Computer Science from UC Berkeley.\n\n[Eddie Conk](https://www.linkedin.com/in/eddieconk/) (CPO + Head of AI) spent the last 3 years at Material Security, leading the ML Engineering function. He developed and trained AI models for detecting Phishing emails at scale for some of the largest and most secure companies in the world. Previously he was an ML Engineer at Apple, and holds a BA in Computer Science from UC Berkeley.\n\n[Logan Carmody](https://www.linkedin.com/in/logan-carmody/) (CTO) was an early engineer and the technical lead for the Phishing Protection product at Material Security. He helped develop the proprietary language and compiler which Material’s threat researchers used to detect Phishing messages and Workspace breaches. He previously was a Staff SWE at LinkedIn working in infrastructure, and holds a BS in Computer Science and Philosophy from Duke University.\n\nTogether, we've spent years embedded with some of the world's best security teams. We're passionate about helping security teams focus on what they do best – hunting threats, not handling workflows.", "url": "https://www.ycombinator.com/launches/NW2-cotool-composable-ai-agents-for-every-security-team", "votes": 142, "created_at": "2025-05-14T16:47:35.959Z" } ] }, { "id": 30558, "name": "BitPatrol", "slug": "bitpatrol", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/a49803acbbc34d447ce47d0129bde3f02dd6b0ec.png", "website": "https://www.bitpatrol.io/", "all_locations": "New York City, NY, USA", "long_description": "Leverage cutting-edge AI to detect exposed credentials in real time and protect your organization from high-impact data breaches.", "one_liner": "AI-powered code security", "team_size": 1, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1747422859, "tags": [ "DevSecOps", "Machine Learning", "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Spring 2025", "status": "Acquired", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/bitpatrol", "api": "https://devasheeshg.github.io/yc-api/batches/spring-2025/bitpatrol.json", "year_founded": 2024, "city": "New York City", "country": "US", "linkedin_url": "https://www.linkedin.com/company/bitpatrol/", "x_url": "", "fb_url": null, "cb_url": null, "github_url": "https://github.com/BitPatrol", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/a49803acbbc34d447ce47d0129bde3f02dd6b0ec.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Aaron Epstein", "url": "https://www.ycombinator.com/people/aaron-epstein" }, "founders": [ { "user_id": 2475147, "full_name": "Christopher Lambert", "title": "Founder/CEO", "founder_bio": "Building BitPatrol — AI-powered secret detection that actually works. ex-Stripe, Tesla, Lyft.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/~chris/", "x_url": "https://x.com/theriley106", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/91f2d4b7be340fcad47a8c214790d2be665e9e90.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 90617, "title": "🚨 BitPatrol – Secret Detection That Actually Works", "tagline": "AI-powered security tool that prevents secret leaks in source code.", "body": "**Vibe coding is flooding GitHub with leaked secrets.**\n\nAs writing code becomes increasingly accessible, it's easier than ever to accidentally expose API keys, database credentials, SSH private keys, and more.\n\n**TLDR:** BitPatrol detects secret leaks in your source code that traditional scanners miss, helping you prevent costly data breaches.\n\n🎥 **Launch Video:** [Watch here](https://youtu.be/2qu3B_bX7dw)\n\n---\n\n### **The Problem**\n\nSecret leaks are happening every day, impacting companies across every industry. Traditional scanning tools attempt to catch these leaks using rigid regex patterns and keyword matching.\n\n![uploaded image](/media/?type=post&id=90617&key=user_uploads/2475147/274a7869-42fd-41fc-86f4-668846d4d01e)\n\nHowever, these methods struggle with secrets that don't follow set patterns, allowing critical leaks like these to slip through undetected.\n\n![uploaded image](/media/?type=post&id=90617&key=user_uploads/2475147/e67f96a4-a636-461e-9434-93a92f23f1ff)\n\n### **Our Solution**\n\nUnlike legacy tools that rely on regular expressions, BitPatrol uses our proprietary machine learning model to detect secrets based on code context and developer intent – not just string patterns.\n\n![uploaded image](/media/?type=post&id=90617&key=user_uploads/2475147/243b128a-4438-4e39-bf3b-7c6c1b8e3d32)\n\nOnce our model flags a potential secret, we reference it against our dataset of billions of public commits, docker images, and open source packages. This helps us rapidly assess the secret's exposure frequency, drastically reducing false positives and solving the issue of alert fatigue.\n\nUsing our [GitHub App](https://github.com/apps/bitpatrol), you can trigger actions that occur when a secret is detected, including automated alerts and custom workflows to immediately respond and remediate when a secret is leaked.\n\n### **The Team**\n\nBitPatrol was founded by [Chris Lambert](https://www.linkedin.com/in/~chris), a former Stripe engineer who quickly rose to the top 2% globally on HackerOne after uncovering secret leaks at some of the world’s largest companies—many of which were actively using our competitor’s tools.\n\n### 🙏 **Ask: How You Can Help**\n\n* **Try BitPatrol:** Install our [GitHub App](https://github.com/apps/bitpatrol) and experience immediate, real-time secret detection.\n* **Connect with Us:** If you know a technical leader concerned about protecting their company from secret leaks in code, please connect them to [founders@bitpatrol.io](mailto:founders@bitpatrol.io)\n\n### 🔥 **The Deal**\n\nTo celebrate our launch, we’re offering:\n\n* **Free 2024 Company Secret Leak Audit**\n * External-only scan — requires no internal data access\n * Deep, high-coverage audit of your public code surface (commits, mobile apps, etc.)\n * Request an [audit here](https://docs.google.com/forms/d/e/1FAIpQLSfBwBwk9-tizbOo1y3Aj9aK6jXeX8QNKJIhwEFTp0OuvhcNAg/viewform?usp=header)\n* **Exclusive early-adopter pricing**\n * Just $20/dev/month for real-time secret scanning with our [GitHub App](https://github.com/apps/bitpatrol)\n\nDon’t let vibe coding turn into your next major breach—secure your code with BitPatrol today.\n\n👉 [Get started at BitPatrol.io](https://bitpatrol.io/) or reach out directly: [founders@bitpatrol.io](mailto:founders@bitpatrol.io)", "url": "https://www.ycombinator.com/launches/NZZ-bitpatrol-secret-detection-that-actually-works", "votes": 62, "created_at": "2025-05-21T20:55:32.897Z" } ] }, { "id": 30626, "name": "ContextFort", "slug": "contextfort", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/6087e1f0e34063f0cc8f7a39962c8cbe63788444.png", "website": "https://contextfort.ai/", "all_locations": "San Francisco, CA, USA", "long_description": "ContextFort gives security teams visibility and controls for AI browser agents.\r\nIt’s a Chrome extension that:\r\nDetects when an AI agent takes control of the browser\r\nRecords every action during the session (pages visited, clicks, text entry) \r\nProvides controls to prevent risky actions and cross-site data leakage", "one_liner": "Visibility and Controls for Browser Agents", "team_size": 2, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1753951898, "tags": [ "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2025", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/contextfort", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2025/contextfort.json", "year_founded": 2025, "city": "San Francisco", "country": "US", "linkedin_url": "", "x_url": "", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/6087e1f0e34063f0cc8f7a39962c8cbe63788444.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Ankit Gupta", "url": "https://www.ycombinator.com/people/ankit-gupta" }, "founders": [ { "user_id": 1596702, "full_name": "Ashwin Ramachandran", "title": "Founder/CEO", "founder_bio": "MS CS @ UC San Diego | CS @ IIT Bombay\nAutomating drawing reviews for construction contractors", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/ashwinram2002/", "x_url": "https://x.com/ashwinram2002", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/45afc911c6470bb22f6e4e3f2a5baec670169b32.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 92604, "title": "ContextFort - Copilot for Construction Drawing Review", "tagline": "Automating Drawing Reviews for Construction Contractors", "body": "# **tl;dr**\n\nContextFort automatically finds missing dimensions and overlay mismatches across your architectural and structural drawings and drafts Requests For Information (RFIs). Watch our [demo](https://www.youtube.com/watch?v=2C4Gfe4UoJA) here.\n\n# **The Problem**\n\nContractors plan their construction using drawings prepared by the design team (Architects, Structural Engineers). But before building, they need to review them for errors and ask for clarification by submitting a **Request For Information (RFI)**.\n\nToday, this review is done by **manual pageturn and eyeballing overlays** which takes up **weeks**. And, this has to be done every time a modified version is released.\n\nIf an inconsistency goes unidentified or an RFI is not sent early, the project gets **delayed** or ends up needing **costly rework** with change-orders having uncertain payments.\n\n**The problem goes beyond this.** Corrections following these RFIs affect multiple trades but they are never notified; for example, a concrete contractor moving a column by 3 inches can affect HVAC and elevator contractors. This poor cross-trade visibility has been the cause for a majority of reworks.\n\n# **Our Solution**\n\nToday, ContextFort saves contractors **2-3 weeks/project** by using AI to:\n\n1. Identify missing and inconsistent dimensions across architectural and structural drawings\n2. Find overlay mismatches between different versions.\n3. Ensure RFIs being generated are not already in the construction documents.\n4. To draft an RFI following the format laid out in the spec sheets.\n\n![uploaded image](/media/?type=post&id=92604&key=user_uploads/1596702/7b5f2e9e-d0d6-4ad6-8bd2-2e09171ba7b6)\n\nOur vision is to turn every drawing set into a **living, shared model:**\n\n1. One that tests itself with rules that capture every trade clearances, codes, scheduling constraints and run automatically on every edit\n2. Only the teams affected by a change get pinged– no more hunting through 200 sheets to see what moved\n3. Each contractor views a filtered lens of the model that shows precisely what they must build and how other trades’ moves impact them\n\n**Our mission is to turn RFIs into a rare exception and have projects finish first-time-right.**\n\n# **Our Ask**\n\nWe would love for you to:\n\n1. Intro us to builders, general and sub contractors\n2. Email us with thoughts and ideas to [ashwin@contextfort.ai](mailto:ashwin@contextfort.ai)\n3. Upload your drawings at [contextfort.ai](http://contextfort.ai)", "url": "https://www.ycombinator.com/launches/O5c-contextfort-copilot-for-construction-drawing-review", "votes": 22, "created_at": "2025-08-03T19:18:44.328Z" } ] }, { "id": 30696, "name": "GhostEye", "slug": "ghosteye", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/5e189bef77c95ad81a23c2a379e641dd9f19e141.png", "website": "https://ghosteye.ai", "all_locations": "New York City, NY, USA", "long_description": "We emulate the attacks real adversaries run today: help-desk vishing, deepfaked executives, MFA fatigue, and the payloads that follow. We run them against your people and the controls around them to reveal what is actually exploitable, not what looks compliant. Then we close the gap, retest until the fix holds, and give your leadership the evidence that risk actually went down. From initial access to remediation.", "one_liner": "Your always-on red team.", "team_size": 6, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1753230986, "tags": [ "B2B", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2025", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/ghosteye", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2025/ghosteye.json", "year_founded": 2025, "city": "New York City", "country": "US", "linkedin_url": "https://www.linkedin.com/company/ghosteye-ai/", "x_url": "https://x.com/GhostEyeee", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/ghosteye", "github_url": "https://github.com/ghosteye-ai", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/5e189bef77c95ad81a23c2a379e641dd9f19e141.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Andrew Miklas", "url": "https://www.ycombinator.com/people/andrew-miklas" }, "founders": [ { "user_id": 2000500, "full_name": "Mohammad Eshan", "title": "Founder/CEO", "founder_bio": "CEO of GhostEye. Former BlackRock Red Team Lead & Offensive Cyber Operations at MITRE", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/moheshan/", "x_url": "https://x.com/eshannnnnnnn", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/d0e178742b8ef2e867b88e7c60c6fda46fd68c05.jpg" } ], "jobs": [], "news": [], "launches": [] }, { "id": 30875, "name": "Veria Labs", "slug": "veria-labs", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/4a840ecd92ea1ebab3e7fa406ce9389683fe9208.png", "website": "https://verialabs.com", "all_locations": "San Francisco, CA, USA", "long_description": "Veria Labs is developing AI agents that hack better than the best human hackers. Founded by members of the #1 US competitive hacking team, we've already found critical bugs in AI tools, operating systems, fintech and billion dollar crypto exchanges. \r\n\r\nNow we're scaling that expertise through AI-native security tooling that operates faster than human researchers while finding deeper, more complex vulnerabilities that traditional tools miss.", "one_liner": "Continuous AI pentesting that finds and fixes vulnerabilities", "team_size": 3, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1758644249, "tags": [ "Security", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Fall 2025", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/veria-labs", "api": "https://devasheeshg.github.io/yc-api/batches/fall-2025/veria-labs.json", "year_founded": 2025, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/verialabs/", "x_url": "https://twitter.com/verialabs", "fb_url": null, "cb_url": null, "github_url": "https://github.com/verialabs", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/4a840ecd92ea1ebab3e7fa406ce9389683fe9208.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Tom Blomfield", "url": "https://www.ycombinator.com/people/tom-blomfield" }, "founders": [ { "user_id": 2964558, "full_name": "Cayden Liao", "title": "Founder", "founder_bio": "I've previously done work in the Web3 security space writing fuzzers for crypto and zero knowledge protocols. NCAA varsity swimmer and part of the #1 CTF (competitive hacking) team in the US. Prevented the largest hack in crypto history $94B.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/cayden-liao-6b018a272/", "x_url": "https://x.com/Cayden_Liao", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/e0738bc3df42b0c5f6d82f610337031d0e8e310b.jpg" }, { "user_id": 948094, "full_name": "Jayden Sarveshkumar", "title": "Founder", "founder_bio": "working on the future of security @ Veria Labs. web hacking @ .;,;. (#1 US competitive hacking team). ", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/jayden-s/", "x_url": "https://x.com/0jayden_", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/f58ac057077848126e2af32cae2e0ade1d46e13c.jpg" }, { "user_id": 2411026, "full_name": "Stephen Xu", "title": "Founder", "founder_bio": "CEO & Co-Founder @ Veria Labs\n\nPreviously doing Offensive Security @ TikTok, and play on the #1 CTF (competitive hacking) team in the US. Also used to do computational physics research at some point.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/stuxf", "x_url": "https://x.com/stuxfdev", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/0250381cdafcf8e7303136fa3900d8298e020161.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 94260, "title": "Veria Labs: AI agents that pentest your code continuously", "tagline": "Automated penetration testing for modern development teams", "body": "👋Hi all, we’re Stephen, Cayden and Jayden from [Veria Labs](https://verialabs.com)!\n\n## TL;DR\n\n* Most companies pentest only 1-2x per year, but high-performing teams deploy multiple times per day \n* We're building AI agents that continuously find vulnerabilities in your application\n* **Our ask:** If you're at a fintech, healthcare, or crypto company that wants to be secure while moving fast, let’s talk: \n\n---\n\n## The Problem\n\nYou ship code constantly. You test for security once a year, if at all.\n\nThis isn't a startup problem. It's structural. PCI DSS mandates annual pentests. HIPAA requires regular security assessments. Crypto projects get audited before launch. But after that initial test, your codebase evolves, you add features, you refactor, and there's no continuous security validation.\n\nTraditional pentesting is **fundamentally broken** for modern development:\n\n**It's too slow.** Results take weeks to deliver. By the time you get the report, your codebase has changed 50+ times.\n\n**It's too expensive.** $15,000-$30,000+ per engagement. You can't afford to test continuously at these prices, but you also can't afford _not_ to be secure.\n\n**It has terrible coverage.** Pentesters scope to 5-10 application features because that's all they can audit in two weeks. The rest of your codebase gets ignored. Your background jobs, admin panels, internal APIs are all potential attack vectors that never get looked at.\n\n**It's too shallow.** Even within their limited scope, human pentesters are constrained by time. They get 5-10 days, bill $250-300/hour, and move on to the next client. They find the obvious vulnerabilities: SQL injection, XSS, broken auth. But complex, multi-step exploits that require deep exploration of your business logic get missed because there's simply not enough time.\n\nMeanwhile, 1 in 5 companies don't test their software for security vulnerabilities at all.\n\n## Our Solution\n\nWe're building AI agents that run continuously on your codebase and send you actionable results every Monday morning.\n\n**Why we're different from traditional pentesting:**\n\nOur agents aren't constrained by human hours or budgets. We can test exhaustively: every code path, every edge case, every possible attack chain. We're not just faster and cheaper. We find more bugs.\n\n**Why we're different from SAST tools (Semgrep, Snyk):**\n\nStatic analysis tools flag potential issues but can't exploit them. Our LLM-based agents:\n\n* Actually exploit vulnerabilities to prove they're real (no false positives)\n* Understand and adapts to your business logic and data flows\n* Learn your codebase architecture and conventions, which means dramatically fewer false positives\n* Chain together low-severity findings into high-impact exploits\n\n## About Us\n\nWe're members of the [#1 competitive hacking (CTF) team](https://ctf.gg/contests) in the United States.\n\nBetween us, we've found critical vulnerabilities in AI tools, operating systems, fintech apps, and billion-dollar crypto exchanges. The future of security testing is automated, and we're building it.\n\n## What We’re Looking For\n\nIf you:\n\n* Deploy code daily but test for security sporadically (or never)\n* Are spending $30K+ per year on pentests that are outdated within weeks\n* Need continuous security without hiring an entire red team\n* Want to find complex vulnerabilities before attackers do\n\nLet's talk: \n\nWe're especially interested in working with **fintech, healthcare, and crypto companies** (where the stakes are highest), but if you're facing similar challenges in other industries, we'd love to hear from you too.\n\n![uploaded image](/media/?type=post&id=94260&key=user_uploads/2411026/8021be6a-59f2-4d9c-9c43-ec32d957299e)\n\n", "url": "https://www.ycombinator.com/launches/OWK-veria-labs-ai-agents-that-pentest-your-code-continuously", "votes": 16, "created_at": "2025-10-01T13:55:13.126Z" } ] }, { "id": 30900, "name": "LogosGuard", "slug": "logosguard", "former_names": [ "Logos AI" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/028016b5518081901c8e2d5a5483ea0f04a88946.png", "website": "https://logosguard.com/", "all_locations": "San Francisco, CA, USA", "long_description": "Use AI tools like ChatGPT, Claude, and Gemini safely without leaking sensitive data. LogosGuard redacts your private information before the prompt ever leaves your device.", "one_liner": "The sensitive data redaction layer for AI", "team_size": 2, "industry": "B2B", "subindustry": "B2B", "launched_at": 1762810607, "tags": [ "B2B", "Compliance", "Security", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Fall 2025", "status": "Active", "industries": [ "B2B" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/logosguard", "api": "https://devasheeshg.github.io/yc-api/batches/fall-2025/logosguard.json", "year_founded": 2025, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/logosguard/", "x_url": "https://x.com/logos_guard", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/028016b5518081901c8e2d5a5483ea0f04a88946.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "David Lieb", "url": "https://www.ycombinator.com/people/david-lieb" }, "founders": [ { "user_id": 1360462, "full_name": "Abel John", "title": "Founder/CTO", "founder_bio": "Cofounder at Logos Guard", "is_active": true, "linkedin_url": "https://linkedin.com/in/abel-john-85a7551b6", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/2676fb12a3376b0738c096529889dfbc776c9310.jpg" }, { "user_id": 1963504, "full_name": "Sukrut Oak", "title": "Founder/CPO", "founder_bio": "Cofounder at LogosGuard", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/sukrut-oak/", "x_url": "https://x.com/sukrut_oak", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/00a28be2c7282668c2d86a62afa38131143eef20.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 95396, "title": "LogosGuard: The risk management software for enterprises adopting AI", "tagline": "Evaluate your AI risk, responsibly.", "body": "Hey everyone! We’re[ Sukrut Oak](https://www.linkedin.com/in/sukrut-oak/) and [Abel John](https://linkedin.com/in/abel-john-85a7551b6) from[ LogosGuard](https://logosguard.com/).\n\n**TL;DR**\n\nEnterprises are racing to adopt AI, but often don't have the right controls in place or know how to verify vendors are compliant. LogosGuard turns AI policies into executable controls, stress-tests your AI products, and continuously monitors changes, giving enterprises the confidence to scale AI responsibly.\n\n**The Problem**\n\nSOC-2 wasn’t designed for AI. Without the right controls in place, enterprises are having to rely on outdated standards or navigate a fragmented landscape of nascent AI frameworks (think NIST AI RMF, ISO 42001, and CSA AICM). The result: slow approvals for new projects and vendors, inconsistent and insufficient reviews, and no reliable way to prove an AI product still meets policy after it changes.\n\n**The Solution**\n\n**LogosGuard** is an AI governance and assessment platform that fits into your existing procurement and compliance systems, and produces reports your teams can act on:\n\n* **Build your AI Controls baseline.** We translate leading controls frameworks, including NIST AI RMF and ISO/IEC 42001, and your internal policy, into a clear set of AI controls. We help you understand and choose controls tailored to your industry, and keep up to date with the continuously changing state and federal regulations.\n* **Stress test the AI features.** We run targeted evaluations for prompt-injection, harmful guidance, PII mishandling, access-control gaps, transparency failures, robustness, and more.\n* **Continuous monitoring.** When vendors update models and features, we re-run the key tests continuously and alert you if risk rises over time.\n* **Painless reporting.** We provide executive summaries, auditor-ready evidence, and a searchable record of decisions so compliance, information security, and leadership see the same truth.\n\n**Impact**\n\n* Vendor risk reviews in days, not months\n* Maintain a robust set of AI controls, with regulatory compliance informing policy updates\n* Catch drift before incidents occur with continuous monitoring\n\n**Why us**\n\n* **Sukrut Oak** — Stanford BS/MS (CS, AI); 3+ years AI safety and benchmarking research; ex-AI engineering at Apple’s Health team; ex-SpaceX.\n* **Abel John** — Stanford BS/MS (CS, AI); ex-AI engineering at Apple; ex-MTS at Accordance (AI for tax accounting - backed by Khosla, Sequoia, and more)\n\n**Our Ask**\n\n* Warm intros to CISOs, CIOs, or anyone who signs off on new AI deployments.\n\nWe’d love to chat. Reach out to us at [founders@logosguard.com](mailto:founders@logosguard.com) or find a time on[ our calendar](https://calendly.com/d/cw55-rnb-3w8/logos-guard-demo)! If you’re in SF, coffee is on us:)\n\n[Launch Video](https://www.youtube.com/watch?v=UZL54wns8nI)", "url": "https://www.ycombinator.com/launches/Ooe-logosguard-the-risk-management-software-for-enterprises-adopting-ai", "votes": 231, "created_at": "2025-11-11T00:36:13.063Z" } ] }, { "id": 30906, "name": "Agentic Fabriq", "slug": "agentic-fabriq", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/9a5cc9740ffbab442e3f13d623875ee650093eac.png", "website": "https://www.agenticfabriq.com", "all_locations": "San Francisco, CA, USA", "long_description": "Agentic Fabriq helps companies securely manage what AI agents can access and do across business tools, data, and teams. We give each agent an identity, scoped permissions, approval flows, and audit logs, so employees and customer-facing workflows can use agents without relying on shared API keys, overbroad service accounts, or one-off integrations.", "one_liner": "The control plane for AI agents.", "team_size": 2, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1762294029, "tags": [ "B2B", "Identity", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Winter 2026", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/agentic-fabriq", "api": "https://devasheeshg.github.io/yc-api/batches/winter-2026/agentic-fabriq.json", "year_founded": 2025, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/agentic-fabriq/", "x_url": "https://x.com/agenticfabriq", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/agentic-fabriq", "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/9a5cc9740ffbab442e3f13d623875ee650093eac.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Harj Taggar", "url": "https://www.ycombinator.com/people/harj-taggar" }, "founders": [ { "user_id": 2840984, "full_name": "Paulina Xu", "title": "Founder/CEO", "founder_bio": "AI + Physics @ MIT, working on Agentic Fabriq (security middleware for all agentic communication)", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/paulina-xu-5bba0821b?utm_source=share&utm_campaign=share_via&utm_content=profile&utm_medium=ios_app", "x_url": "https://x.com/paulinazhxu", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/c121ed2a60fa303b7cd17e1f0dc5f1159b30b9e4.jpg" }, { "user_id": 2459873, "full_name": "Matthew Xu", "title": "Founder", "founder_bio": "Dropped out of MIT at 19. Building Agentic Fabriq, the security layer between agentic applications and tools.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/matthew-xu-b32a36271", "x_url": "https://x.com/matthew_xu23", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/063a24958bb9b6eaa3b201fd0c124e25cc472de6.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 98377, "title": "Agentic Fabriq: Okta for Agents", "tagline": "The central hub for agent identity, governance, and visibility. ", "body": "Hey everyone! This is Paulina & Matthew from Agentic Fabriq. \n\n**TL;DR:** AI agents are entering production — but identity systems weren’t built for them. Agentic Fabriq is the identity and governance layer built specifically for AI agents.\n\nOur launch video:   \n\n![uploaded image](/media/?type=post&id=98377&key=user_uploads/2840984/7ee786fe-0377-4c6d-9e0e-e8032c2998a7)\n\n\n**The Problem**\n\nAgents are moving fast. Security isn’t.\n\nTeams are shipping AI agents that call tools, trigger workflows, access internal data, and act on behalf of users. But the identity layer underneath them was designed for humans logging into apps — not autonomous software acting across systems.\n\nToday, teams hardcode tokens into workflows, drop user identity once an agent runs, and re-implement OAuth for every integration. Security teams lose visibility into what agents are accessing and doing, and no one can confidently answer a simple question: **who did this agent act for?**\n\nOAuth, IAM, and IdPs were built for humans and apps. They were never designed for agents calling tools, calling other agents, and operating autonomously across environments. Engineers get stuck rebuilding auth, IT struggles to govern permissions, and security teams are left without clear audit trails.\n\n**What We Built**\n\nAgentic Fabriq is the identity, governance, and visibility layer for AI agents.\n\nWe sit in the middle of every agent’s calls and manage both agent identity and user identity. We handle token exchange and authentication, enforce least-privilege access, and enable fine-grained, per-user permissioning for every agent. Every action is logged centrally for audit and compliance.\n\nInstead of wiring OAuth, scopes, and policies for every agent and every workflow, you call us once.\n\nYou connect your tools, register your agent, define the permissions — and we handle identity propagation, authorization, and logging.\n\nHere’s a demo of our permissioning feature with OpenWebUI: \n\n**What This Enables**\n\n* Per-user agent access\n* Agent + user pair permissioning\n* Full visibility across tools and workflows\n* Instant revocation and policy control\n* Compliance-ready audit trails\n\nWe make it easy for companies to make their agents secure.\n\n**Why Now**\n\nEvery major computing shift forced identity to evolve. \n\nSaaS required SSO. \n\nCloud required IAM. \n\nAPIs required OAuth. \n\n\\\nAgents are the next shift – and they need their own security platform. \n\nWe’re building it.\n\n**Our Ask**\n\nIf you’re building internal agents, shipping AI into enterprise, or thinking about agent governance and security, we’d love to talk.\n\n**CONTACT**\n\n* email us: [founders@agenticfabriq.com](mailto:founders@agenticfabriq.com)\n* book a meeting: \n* website: \n\n**TEAM**\n\nPaulina and Matthew met @ MIT admit weekend and have been friends since. They dropped out before their second year to work on Agentic Fabriq\n\nPaulina was studying AI + Physics and doing CS/ML research at MIT Kavli Institute, MIT Haystack Observatory, and INAF Padua.\n\nMatthew was studying AI + Math and doing CS/Econ research at MIT Futuretech Lab and Computational Biology research at MIT CSAIL.", "url": "https://www.ycombinator.com/launches/Paj-agentic-fabriq-okta-for-agents", "votes": 9, "created_at": "2026-03-03T01:46:49.295Z" }, { "id": 95246, "title": "Agentic Fabriq: Okta for Agents", "tagline": "Power your AI with governed data", "body": "Hey everyone! This is [Paulina](https://www.linkedin.com/in/paulina-xu-5bba0821b/) & [Matthew](https://www.linkedin.com/in/matthew-xu-b32a36271/) from Agentic Fabriq.\n\n**TL;DR:** Agentic Fabriq is Okta for agents. Fabriq ensures that employees can’t access data or do actions with agents that they themselves would not have permissions to do.\n\n![uploaded image](/media/?type=post&id=95246&key=user_uploads/2840984/d57b9148-8a8a-44a0-8c53-1292f611641b)\n\nOur launch video:[ https://youtu.be/V4dTw58ZeTQ?si=ykoz3x06_fTgEXeK](https://youtu.be/V4dTw58ZeTQ?si=ykoz3x06_fTgEXeK)\n\nThe field of agentic AI is brand new, and everyone is rushing to build and ship their own agents. But there’s a critical gap appearing: **how do you guarantee an agent can’t do more than the employee using it?**\n\n**THE PROBLEM**\n\nAI is rewriting how work gets done, but most companies still can’t let every employee harness it with **their own, permissioned data**. The market is full of tools and agents, but **the core organizational layer is missing**. There’s no unified place to enforce per-user + least-privilege access, separate tenants, or audit what an agent did, with which user, and why, across all of your internal agents and tools.\n\nToday, there’s only scattered solutions to this with identity and permission systems that were built for humans, not for agents acting as humans. Agentic Fabriq solves this issue **for the first time** by giving IT and admins a way to ensure their agents are always constrained to the **exact permissions of the employee asking** - no more, no less.\n\n**OUR SOLUTION**\n\nAgentic Fabriq is the secure fabric that simplifies data permissioning for all your agents, tools, and employees. We handle the auth & integration so IT & admin can manage employee permissions, agent permissions per employee, and tool connections. We’ve solved the security and identity hurdles so you can connect to a tool in minutes and personalize **what your agents can do and access per user**.\n\nOn Fabriq,\n\n![uploaded image](/media/?type=post&id=95246&key=user_uploads/2840984/07608446-8a9e-4906-88ff-57c9bd5cb1d4)\n\nregister a tool connection,\n\n![uploaded image](/media/?type=post&id=95246&key=user_uploads/2840984/8e2c2fb2-38b9-4253-b87a-5894da56de89)\n\nregister your own AI/agents,\n\n![uploaded image](/media/?type=post&id=95246&key=user_uploads/2840984/f703ec51-0cd0-47e3-99ca-8d330c6fe157)\n\nand manage your entire organization\n\n![uploaded image](/media/?type=post&id=95246&key=user_uploads/2840984/6b9fad2b-5606-4ed6-8e3f-af21f966357b)\n\n![uploaded image](/media/?type=post&id=95246&key=user_uploads/2840984/4bbadb2e-6cb7-4858-9343-0b63b8938458)\n\n**we made it as simple as that.**\n\nAgentic Fabriq provides users with:\n\n* **per-user connections**: connect your own account to approved tools - no shared creds\n* **org-wide controls**: define what internal agents/apps can access & which employees can use them\n* **least-privilege by default**: access is scoped & revocable, with centralized policy\n* **full visibility**: every action is logged for audit & compliance\n* **prebuilt connectors**: add tools fast without rebuilding auth & permissions each time\n\nThis allows teams to make the most use of AI with exactly the data they’re allowed to use - **safely, auditable & at scale.**\n\n**OUR ASK**\n\nIf you or anyone you know would like to be early adopters of Fabriq, book a call with us or send us an email!\n\n**CONTACT**\n\n* email us: [founders@agenticfabriq.com](mailto:founders@agenticfabriq.com)\n* book a meeting:[ https://calendly.com/paulinaxu/agentic-fabriq-meeting](https://calendly.com/paulinaxu/agentic-fabriq-meeting)\n* website:[ https://www.agenticfabriq.com](https://www.agenticfabriq.com)\n\n**TEAM**\n\nPaulina and Matthew met @ MIT admit weekend and have been friends since. They dropped out before their second year to work on Agentic Fabriq\n\nPaulina was studying AI + Physics and doing CS/ML research at MIT Kavli Institute, MIT Haystack Observatory, and INAF Padua.\n\nMatthew was studying AI + Math and doing CS/Econ research at MIT Futuretech Lab and Computational Biology research at MIT CSAIL.", "url": "https://www.ycombinator.com/launches/OmE-agentic-fabriq-okta-for-agents", "votes": 18, "created_at": "2025-11-06T20:55:28.851Z" } ] }, { "id": 30918, "name": "ComplyDo", "slug": "complydo", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/1138acf799ce629450bf7f2fb3d38a36aabb6d93.png", "website": "https://www.complydo.io/", "all_locations": "Berlin, Berlin, Germany", "long_description": "The most flexible enterprise compliance engine that makes GRC teams 10x more efficient. Already trusted by global leaders and the largest EU enterprises.\r\n\r\nWhat it does:\r\n- Extracts requirements from any file\r\n- Maps them to controls and policies\r\n- Shows gaps and monitors changes\r\n- Advises on maturity and next steps", "one_liner": "Global Compliance for Enterprises", "team_size": 17, "industry": "B2B", "subindustry": "B2B -> Legal", "launched_at": 1759460278, "tags": [ "B2B", "Compliance", "LegalTech", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Fall 2025", "status": "Active", "industries": [ "B2B", "Legal" ], "regions": [ "Germany", "Europe" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": [ { "question": "What is the core problem you are solving? Why is this a big problem? What made you decide to work on it?", "answer": "Enterprises waste months and millions on manual IT compliance. It slows deals, blocks growth, creates regulatory risk, and drains already stretched teams. Global rules get more complex every week, but tools and consultants haven’t kept up.\r\n\r\nWe built ComplyDo to change that: the most flexible compliance engine for enterprises. With ComplyDo companies can move faster, stay safer, and win across markets." } ], "url": "https://www.ycombinator.com/companies/complydo", "api": "https://devasheeshg.github.io/yc-api/batches/fall-2025/complydo.json", "year_founded": 2025, "city": "Berlin", "country": "DE", "linkedin_url": "https://www.linkedin.com/company/complydo-io", "x_url": "", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/complydo", "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/1138acf799ce629450bf7f2fb3d38a36aabb6d93.png", "app_video_url": null, "dday_video_url": null, "company_photos": [ "https://bookface-images.s3.us-west-2.amazonaws.com/attachments/80a50621e790e60fb76403e535da72414caa2519.png" ], "primary_partner": { "name": "Nicolas Dessaigne", "url": "https://www.ycombinator.com/people/nicolas-dessaigne" }, "founders": [ { "user_id": 2687177, "full_name": "Leo Schuhmann", "title": "Founder/CEO", "founder_bio": "Helping enterprises win across markets. \nTech & Consulting Background.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/leo-schuhmann-324927182/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/6a02c3ebd952a4ff24d89085719f812b941e2b00.jpg" }, { "user_id": 2710525, "full_name": "Moritz Moser", "title": "Founder/CPO", "founder_bio": "Building ComplyDo", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/moritz-moser-99b3a320a/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/d200b6871073ea9cd8e51ca4dbba265162125516.jpg" }, { "user_id": 2735214, "full_name": "Matthias Schneider", "title": "Founder/CTO", "founder_bio": "Deploying agents to automate enterprise compliance.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/matthias-schneider-134391223/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/33a3f0cc53ae97c4aeddb2df62bce1f7bd30ea5a.jpg" } ], "jobs": [ { "id": 99476, "title": "Engineer", "url": "https://www.ycombinator.com/companies/complydo/jobs/oA2oHJC-engineer", "location": "Berlin, BE, DE / Berlin, Berlin, DE", "type": "Full-time", "role": "Engineering", "role_type": "Full stack", "salary_range": "€60K - €90K EUR", "equity_range": "", "experience": "Any (new grads ok)", "visa": "US citizenship/visa not required", "skills": [] } ], "news": [], "launches": [ { "id": 94528, "title": "ComplyDo 🌎: Automating how enterprises comply with hundreds of global regulations", "tagline": "More Comply, Less Do.", "body": "Hi, we’re [**Leo**](https://www.linkedin.com/in/leo-schuhmann-324927182/), [**Moritz**](https://www.linkedin.com/in/moritz-moser-99b3a320a/) & [**Matthias**](https://www.linkedin.com/in/matthias-schneider-134391223/), launching [**ComplyDo**](https://www.complydo.io/).\n\n# **TL;DR**\n\n**ComplyDo automates how enterprises comply with hundreds of global regulations.** Already used by leading global players to replace months of manual work, reduce consulting hours, and accelerate market access.\n\n**Ask:** Can you introduce us to compliance, GRC, or audit leaders at enterprises and consultancies? We can help them a lot. Contact: [**leo.schuhmann@complydo.io**](mailto:leo.schuhmann@complydo.io)\n\nhttps://www.youtube.com/watch?v=qDvBicSeQ0U\n\n# The problem\n\nEnterprises face an explosion of global regulations and standards. ISO, PIPL, NIS2, PCI, DORA, and many more. Due to this complexity, compliance, legal, and audit teams still handle most of the work manually or through consultants: mapping requirements, reviewing policies, collecting evidence, and maintaining spreadsheets. It’s slow, expensive, and limits how fast companies can move.\n\n![uploaded image](/media/?type=post&id=94528&key=user_uploads/2687177/89a03819-0f69-4e68-aa22-0694b846409b)\n\n---\n\n# The solution\n\n![uploaded image](/media/?type=post&id=94528&key=user_uploads/2687177/9057684c-921e-4d4a-adf8-42f72b97f822)\n\n**ComplyDo** automates this painful process. Upload any regulation, standard or requirement file. Our system:\n\n1. Extracts requirements and obligations\n2. Maps them to your internal controls and policies\n3. Identifies gaps and next steps\n4. Monitors changes across frameworks\n\nAlready **used by global enterprises**, ComplyDo helps organizations stay compliant continuously and scale across markets. **Without** a fleet of consultants.\n\n---\n\n# How we got here\n\nWe’ve worked across consulting, software development, and AI, and saw the same issue in every global company. Starting with some of the world’s most innovative enterprises, we went deep into their GRC processes and shifted manual work from compliance teams and consultants to our models. It became the foundation for faster, smarter global governance.\n\n---\n\n---\n\n# Call to action\n\nWe’re expanding with enterprises, innovative consultancies, and certification bodies. **If you work in GRC, internal audit, or cyber/IT compliance**, we’d love to connect! We go above and beyond to eliminate slow, manual work. If someone in your network could benefit, an intro would mean a lot.\n\n📩 [**leo.schuhmann@complydo.io**](mailto:leo.schuhmann@complydo.io)\\\n🌐 [complydo.io](http://complydo.io)\n\n---\n\n**More Comply. Less Do.**\n\n![uploaded image](/media/?type=post&id=94528&key=user_uploads/2687177/d3081360-af6f-4fed-adda-c726d5037ccd)\n\n", "url": "https://www.ycombinator.com/launches/Oae-complydo-automating-how-enterprises-comply-with-hundreds-of-global-regulations", "votes": 66, "created_at": "2025-10-09T18:26:18.676Z" } ] }, { "id": 30999, "name": "Antigen", "slug": "antigen", "former_names": [ "Claybird", "zag.dev", "Zag" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/8dccef83823a85d888578112126c72cae4a92e61.png", "website": "https://antigen.sh/", "all_locations": "San Francisco, CA, USA", "long_description": "Antigen is an AI adversary for the enterprise. It maps, exploits, and secures your attack surface through nightly automated offensive testing and monthly human red team assessments. Every finding is delivered with traces, reproduction steps, and remediation directly in GitHub, Linear, or the Antigen Platform.\r\n\r\nWe work with companies in financial services, healthcare, retail, and government where security is trust.\r\n\r\nWe're backed by Lightspeed, DST Global, and Susa Ventures.", "one_liner": "Continuous offensive security for the enterprise.", "team_size": 5, "industry": "B2B", "subindustry": "B2B -> Engineering, Product and Design", "launched_at": 1759979466, "tags": [ "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": true, "nonprofit": false, "batch": "Fall 2025", "status": "Active", "industries": [ "B2B", "Engineering, Product and Design" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/antigen", "api": "https://devasheeshg.github.io/yc-api/batches/fall-2025/antigen.json", "year_founded": 2026, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/antigenco", "x_url": "https://x.com/antigenco", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/8dccef83823a85d888578112126c72cae4a92e61.png", "app_video_url": null, "dday_video_url": null, "company_photos": [ "https://bookface-images.s3.us-west-2.amazonaws.com/attachments/f5f28d8d287d812fe939e54e9715c473f92e79ce.png", "https://bookface-images.s3.us-west-2.amazonaws.com/attachments/6b0db6d8a2d3b51411efe244a7950f32195cf541.png" ], "primary_partner": { "name": "Aaron Epstein", "url": "https://www.ycombinator.com/people/aaron-epstein" }, "founders": [ { "user_id": 3049862, "full_name": "Saad Jamal", "title": "Founder/CTO", "founder_bio": "co-founder @ antigen. prev. ml infra at tesla autopilot. law school dropout.\n\nBefore Zag, Saad trained reasoning models with Ashish Vaswani, author of the famous Attention Is All You Need paper. At Nuro, he developed an ML Compiler framework that enabled running the perception layer across multiple GPU's. And at Tesla he built infrastructure that halved the time it took to train Planning & Controls models. \n\nHe also served at the Supreme Court of Pakistan and dropped out of UChicago Law.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/sadjamz/", "x_url": "https://x.com/sadjamz_", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/6884a1d6d955d0cd249bd70c06cee8e3a2beec8d.jpg" }, { "user_id": 919490, "full_name": "Abdullah Nauman", "title": "Founder", "founder_bio": "Co-Founder @ Antigen. Previously product at Google Ads and ML at Google Search.\n\nPreviously at Google, shipped product features for new advertisers and built large-scale ML infrastructure for measuring cross-site conversions on Search.\n\nTook a year off college to join as second employee at a YC startup. Separately scaled a bootstrap SaaS to $30k MRR. Also wrote low-level imaging software for silicon wafer manufacturing.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/abdullahnauman", "x_url": "https://x.com/_AbdullahNauman", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/27a5ff8bdb4258fc05aad5e34af5f89aeb2216ba.jpg" } ], "jobs": [ { "id": 109112, "title": "Security Researcher", "url": "https://www.ycombinator.com/companies/antigen/jobs/CAQhaJY-security-researcher", "location": "San Francisco, CA, US", "type": "Full-time", "role": "Engineering", "role_type": "Devops", "salary_range": "$150K - $220K", "equity_range": "0.50% - 1.00%", "experience": "1+ years", "visa": "US citizen/visa only", "skills": [ "Information Security", "Software Security", "AI Agents" ] } ], "news": [], "launches": [ { "id": 94551, "title": "Zag: AI Review Agents for Every PR", "tagline": "Custom review agents that build, test, and run your code before it lands.", "body": "Hey everyone, we’re Abdullah and Saad - cofounders of [Zag](https://zag.dev/) 👋\n\n**TL;DR**\n\n**Zag** is a platform for building and running AI review agents. You describe agents in TypeScript or Swift as composable Tasks, and Zag runs them in **real sandboxed environments** on every pull request. Agents don't just read diffs. They build your project, run your tests, boot your app, and verify that it actually works.\n\n_We've opened early access to teams building for Apple platforms (iOS, iPadOS, macOS), running on dedicated Apple Silicon with Xcode, simulators, and the full native toolchain._\n\n\n\n**_The Problem_**\n\nCoding agents are producing changes faster than humans can review them. Tools like Claude Code and Codex are accelerating how code gets written, but the review side hasn't kept up. Teams are merging changes they haven't fully validated, or creating bottlenecks where a handful of senior engineers review everything.\n\nStatic AI code review (inline comments on diffs) helps, but it requires more human-in-the-loop than teams can sustain. Reading AI-generated suggestions about AI-generated code doesn't scale. The kind of confidence that lets teams merge fast comes from actually building, testing, and running the code.\n\n**_Our Solution_**\n\nZag lets teams build custom review agents that run in real environments on every PR.\n\nWe believe that as human engineering work moves up a layer of abstraction, a tech lead's primary job will be tuning better review agents. Not reading diffs line by line, but shaping the automated judgment that enforces their team's engineering culture at the scale of AI-authored code.\n\nThe primary unit of work is a Task: a composable, dependency-aware unit that describes an environment and the logic that runs inside it. Tasks can spin up Claude Code, Codex, or custom agents with access to real build tools, simulators, and full operating systems. Every Task runs in an ephemeral session on dedicated Apple Silicon that boots in seconds from pre-warmed snapshots.\n\nUse built-in utilities for common checks (build verification, test execution, crash detection, App Store compliance), or write your own agents for the specific behaviors your team cares about. When applied to every PR, this helps teams merge changes as fast as they author them.\n\n**Why Apple Developers First**\n\nApple developers need macOS to build and test their code. You can't meaningfully validate an iOS app without Xcode, a simulator, and Apple Silicon. Most CI providers treat macOS as an afterthought. Zag provisions dedicated M4 hardware with no queue at $0.015/minute, priced at AWS cost. If you already have GitHub Actions or Cirrus workflows, a one-line runner swap points them at Zag compute, even before you adopt the review agents.\n\n**_Our Ask_**\n\n1. Connect us with iOS/macOS teams that are frustrated with their CI or are already using coding agents and feeling the review bottleneck.\n2. If you lead an engineering team and want to try custom review agents on your codebase, book a demo at zag.dev/book. A dedicated engineer will embed with your team to set up agents you can trust on every PR.\n3. Share this with anyone building for Apple platforms.\n\n**_The Team_**\n\n![uploaded image](/media/?type=post&id=94551&key=user_uploads/919490/d4e60f0f-0558-48f6-b318-f404ec638358)\n\n**Abdullah** built ML infrastructure at Google powering core Search systems that directly drove **$1B+ in revenue**.\n\n**Saad** spent three years training video models at Tesla Autopilot and later built training infrastructure with **Ashish Vaswani** (author of _Attention Is All You Need_).\n\nTogether, we’ve also collected **$200k+ in bug bounties** from security research.", "url": "https://www.ycombinator.com/launches/Ob1-zag-ai-review-agents-for-every-pr", "votes": 66, "created_at": "2025-10-10T07:18:24.526Z" } ] }, { "id": 31537, "name": "Trident", "slug": "trident", "former_names": [ "Esprit" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/537de46d97dcdac9c07b330a6a1a4b2ab0583b7b.png", "website": "https://tridentsecurity.io/", "all_locations": "San Francisco, CA, USA", "long_description": "Trident is the standard for modern day security. its an agentic pentester that chains vulnerabilities together like a real attacker mapping verified attack paths across AWS, Azure, GCP, web apps, and APIs. Run AI attacks and get fixes.\r\n\r\nGet started today: tridentsecurity.io", "one_liner": "Autonomous offensive security agents. The best defense is offense", "team_size": 4, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1785361922, "tags": [ "Security", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2026", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/trident", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2026/trident.json", "year_founded": 2025, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/tridentsecure", "x_url": "https://x.com/TridentSecures", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/537de46d97dcdac9c07b330a6a1a4b2ab0583b7b.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Harshita Arora", "url": "https://www.ycombinator.com/people/harshita-arora" }, "founders": [ { "user_id": 2758911, "full_name": "Junaid Mahmood", "title": "Founder/CEO", "founder_bio": "Co-founder @Trident, CTF player & bounty hunter. Taught coding at 16 ", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/junaidmahmood-/", "x_url": "https://x.com/whosjunaidd", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/6d60dad6ab24eccee2fa15fe372ef5e8b202fc97.jpg" }, { "user_id": 2702103, "full_name": "Dekai Li", "title": "Founder/CTO", "founder_bio": "Co-founder @Trident, CS @University of Waterloo. \n", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/li-dekai-8287332a6/", "x_url": "https://x.com/li_dekaii", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/5fbb11cf2687c50bb8c031cace4f6fbb674856c8.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 110468, "title": "Trident: Secure your company 24/7", "tagline": "My app keeps getting hacked what can I do?", "body": "\n![uploaded image](/media/?type=post&id=110468&key=user_uploads/2758911/13ca2ba5-d205-4afd-8d7c-ea92334d7136)\n\n**TL;DR**: Traditional pentesting is a thing of the past. Attackers use AI now, so we're making it fair. Trident safely and continuously attacks your own apps and cloud so you know what to fix before they do.\n\n![uploaded image](/media/?type=post&id=110468&key=user_uploads/2758911/a4001049-62a7-4856-b611-2f692dc8c3b7)\n\nToday we're launching Trident.\n\nAI changed the game on both sides. Your team ships every single hour; attackers scan and exploit at a scale no human team can match. Meanwhile, security is still sold as an annual pentest: a PDF about a version of your product that no longer exists.\n\nThat's not a fair fight. So we built Trident to make it even.\n\nTrident safely runs attacks on your own web apps, APIs, and cloud (AWS, GCP, Azure, Kubernetes), continuously. Every finding comes as an attack path that actually reaches your data, with proof of exploit and a proper fix. You know what to fix before someone else finds it.\\\n\\\n[https://drive.google.com/file/d/1qIn0j8LgI3XijoqyE0HBT4G66hBdyCAy](https://drive.google.com/file/d/1qIn0j8LgI3XijoqyE0HBT4G66hBdyCAy/view?usp=sharing)\n\nSince our batch started, we've found critical vulns in a ton of startups, bug bounty prorgams and 3 unicorns:\n\n* API keys hardcoded in desktop app binaries (yes, that was us on Twitter)\n* Publicly exposed S3 buckets and Azure Blob containers\n* Exploitable flaws in live DeFi protocols\n\nAll responsibly disclosed and fixed before anyone else got there. And none of these were careless teams, just great ones moving fast.\n\n![uploaded image](/media/?type=post&id=110468&key=user_uploads/2758911/bdb88f72-d6d1-44f1-a2d8-4aa555bfa399)\n\nCan't afford a dedicated security team yet? That's exactly who we built this for.\n\nYour job is to ship. Ours is to secure.", "url": "https://www.ycombinator.com/launches/Sjk-trident-secure-your-company-24-7", "votes": 14, "created_at": "2026-08-13T22:30:00.463Z" } ] }, { "id": 32138, "name": "NebuSec", "slug": "nebusec", "former_names": [ "Nebula Security" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/c60d9cd12e8c1b315e07ee45555c24b5f74d5654.png", "website": "https://nebusec.ai", "all_locations": "San Francisco, CA, USA; Remote", "long_description": "NebuSec is founded by the world’s #1 hacking team.\r\n\r\nWe were the first team to build an nginx RCE and the first to root Android 17. Our co-founders include members of the world’s No. 1 CTF team, DEF CON winners, Black Hat speakers, and PhD in cybersecurity. We have won $400K in bug bounties by exploiting the Linux kernel and Chrome browser.\r\n\r\n“Audited by NebuSec” is a mark of serious security credibility: a signal to customers, investors, and partners that your product has been reviewed by the world’s best hackers.", "one_liner": "Autonomous AI defense system for cyber attack", "team_size": 4, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1783007241, "tags": [ "B2B", "Security", "Cybersecurity", "Enterprise", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2026", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Fully Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/nebusec", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2026/nebusec.json", "year_founded": 2026, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/125323912", "x_url": "https://x.com/nebusecurity", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/c60d9cd12e8c1b315e07ee45555c24b5f74d5654.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Ankit Gupta", "url": "https://www.ycombinator.com/people/ankit-gupta" }, "founders": [ { "user_id": 1626290, "full_name": "Eten Zou", "title": "Founder/CEO", "founder_bio": "CEO & Founder @ Nebula Security (YC S26). PhD in Cybersecurity.\nFocus on automated vulnerability research.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/xiaochen-zou-phd-29540b168", "x_url": "https://x.com/etenal7", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/57bbc9606ef7588538536a132b2206290ce936f1.jpg" }, { "user_id": 3676420, "full_name": "Yuan Tan", "title": "Founder/CTO", "founder_bio": "Founder at Nebula Security (YC S26). Black Hat USA speaker. PhD dropout in System Security with experience in DARPA-funded fundamental research on program analysis.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/yuantan1/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/da759eb576807bd53522ad4e38bb45e06f4c0862.jpg" }, { "user_id": 3676409, "full_name": "Frank Wu", "title": "Founder/COO", "founder_bio": "Founder of Nebula Security (YC S26). Black Hat USA speaker and DEF CON finalist with r3kapig, the world's No. 1 hacking team in 2025. He led the DARPA AIxCC automated program repair team and shipped end-to-end RCE/LPE exploit chains on Chrome, Firefox, Linux, and Android. He pwned Google's kernelCTF multiple times with zero-days, and has published research at top academic venues such as USENIX Security and NDSS. Ph.D. dropout.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/yifan-wu-cs", "x_url": "https://x.com/FrankOverF1ow", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/54eba66a2435edef35054374d3e93dbb8d0af4ba.jpg" }, { "user_id": 3680004, "full_name": "Xiaochuan Yu", "title": "Founder/VP of Vulnerability Research", "founder_bio": "Founder at Nebula Security (YC S26). Hacked into iPhone, Chrome, Firefox, Safari, QEMU, and various things in your daily life. DEFCON finalist for 3 consecutive years. $200k+ Bug Bounty in Chrome. Core member of r3kapig, the #1 hacking team in the world in 2025, on CTFTime. M.S. from UC San Diego. Research published at USENIX Security, BlackHat USA. Ph.D. droped out. ", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/xiaochuan-yu-3103a5297", "x_url": "https://x.com/Nyaaaaa_ovo", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/8c980e06818698012626c4e85e58e70351bf6003.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 106602, "title": "Nebula Security: Bringing beyond Mythos protection to your product", "tagline": "#enterprise #cybersecurity #security #pentest #b2b", "body": "**TL;DR:** AI has changed cybersecurity. Don't let the next HuggingFace incident happen to your product. Hire VEGA, your best security engineer — a cybersecurity agent built by the world's best hacking team. It brings the same capabilities used to uncover critical vulnerabilities in browsers, operating systems, and internet infrastructure to protect your product. [Book a demo](https://nebula-security.cal.com/etenz/30min?overlayCalendar=true) today or find us at \n\n**The Problem:** Cybersecurity has changed. When the attackers have AI, how do you prevent the next HuggingFace incident from happening to your product?\n\nWe are here at Nebula Security for one reason, we are building the **world’s best cybersecurity agent**, bringing beyond Mythos protection to your product. \n\n### AI makes you fast. We make you secure\n\nIntroducing **VEGA**, the best cybersecurity agent that is built by the world's best hackers. An agent that has discovered critical vulnerabilities in major infrastructure and earned over **$400K** in rewards from Google.\n\nWatch our [launch video](https://youtu.be/gOzg5M5DhXI)\n\nWith VEGA, you can:\n\n* Autonomously find bugs in your codebase\n* Monitor code changes 24/7\n* Analyze root causes and generate Proofs of Concept\n* Provide ready-to-use patches\n* Understand the overall code health\n\nYou focus on bringing your product to the world. We manage the security.\n\n# The world saw the proof\n\nWhile ~~other companies~~ create hypes, we show you the proof.\n\nVEGA discovered\n\n* [IonStack](https://x.com/nebusecurity/status/2069707520160227688?s=20): the world's first fullchain exploit to root Android 17.\n* [GhostLock](https://thehackernews.com/2026/07/15-year-old-ghostlock-flaw-enables-root.html): a 15-year-old Linux kernel vulnerability capable of compromising nearly all the Linux devices in the world.\n* [nginx-poolslip](https://x.com/nebusecurity/status/2057071579876753643?s=20) and nginx-quicburst: the world's first and second vulnerabilities capable of remotely control your Nginx servers\n* And 91 more CVEs from Linux, Windows, Chrome Browser, Firefox, Nginx, Wordpress, and the other software you use every day.\n\nWe found vulnerabilities in the world's most complex software. Let us protect your product too.\n\n# The epic hacker team\n\n* Eten (CEO): PhD in Cybersecurity; Pwn2Own winner; speaker at Linux Security Summit, Off-by-One, IEEE S&P, USENIX Security, and NDSS. Previously worked at Microsoft.\n* Yuan (CTO): Previous cybersecurity PhD; Black hat speaker; Bringing VEGA to secure Linux Kernel.\n* Xiaochuan (Research Lead): From the world's #1 hacking team; three-time DEFCON participant; Jailbreak iPhone; Black Hat speaker; Previously worked at Zellic.\n* Frank (Research Lead): From the world’s #1 hacking team; DEFCON participant; Black hat speaker. Built the world’s first Android 17 root exploit.\n\nWe have won over **$400,000** from Google by breaking into their safest system.\n\nLet us show you what we can find in your system. [Book a demo](https://nebula-security.cal.com/etenz/30min?overlayCalendar=true) today.\n\nFind us at | Email to [founders@nebusec.ai](mailto:founders@nebusec.ai)\n\n![uploaded image](/media/?type=post&id=106602&key=user_uploads/1626290/4c0c365e-7cc4-469f-9c1c-c04a82c4f1b7)\n\n", "url": "https://www.ycombinator.com/launches/RjO-nebula-security-bringing-beyond-mythos-protection-to-your-product", "votes": 12, "created_at": "2026-07-23T21:25:03.912Z" } ] }, { "id": 32418, "name": "Traceforce", "slug": "traceforce", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/8a31e3b43130c5974d52608c066ff45cc746112f.png", "website": "https://www.traceforce.ai", "all_locations": "San Francisco, CA, USA", "long_description": "AI apps such as ChatGPT and Claude have become part of everyone's daily workflow, but they introduce new security risks that traditional security tools weren't built to handle. Security teams at companies from startups to Fortune 500s, are struggling to keep up.\r\n\r\nTraceforce gives a company’s security team visibility of how AI apps are being used across company’s devices, and the ability to detect and prevent security breaches and unsafe actions as early as possible.", "one_liner": "CrowdStrike for AI Agents", "team_size": 2, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1785015608, "tags": [ "SaaS", "Security", "Cybersecurity", "Enterprise", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2026", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Partly Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/traceforce", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2026/traceforce.json", "year_founded": 2025, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/traceforce-security", "x_url": "", "fb_url": null, "cb_url": "Traceforce, Inc", "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/8a31e3b43130c5974d52608c066ff45cc746112f.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Brad Flora", "url": "https://www.ycombinator.com/people/brad-flora" }, "founders": [ { "user_id": 2775802, "full_name": "Xia Hua", "title": "Founder/CEO", "founder_bio": "Founder at Traceforce. Previously Director of Engineering at Clumio, managing all flagship ransomware protection products. PhD in Applied Math from MIT.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/xia-hua-ph-d-28856a30/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/2f3e3c63d811c56302968adf9fea80553cf68f79.jpg" }, { "user_id": 3675843, "full_name": "Varun Wadhwa", "title": "Founder/CTO", "founder_bio": "Co-founder & CTO at TraceForce. Previously Senior Software Engineer at LinkedIn, leading high-performance database systems for RAG. Before that, Staff Software Engineer at Clumio, leading distributed data infrastructure and backup. Earlier built distributed payments systems at Microsoft. BS in EECS, UC Berkeley.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/varunwadhwarcds", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/3bb82e62b797bba9d01efa60a14cb9d26fe41a26.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 117100, "title": "Traceforce TraceGraph – Ask anything about your company's AI usage", "tagline": "Know where every AI token goes", "body": "**TL;DR:** TraceGraph turns every AI interaction in your company into a fully queryable graph linking users, apps, models, MCPs, and tokens. You can ask questions in plain English, slice the data any way you want, and build agentic workflows on top of it out of the box. Try it free at [traceforce.ai](http://www.traceforce.ai).\n\n**👋 Hi YC, we're Xia and Varun**\n\nWe're the founders of Traceforce (S26), and we're building security and visibility for AI agents running on company devices. We previously built one of the world’s most scalable cyber-resillience systems at Clumio.\n\n**🔥 The problem**\n\nAI usage is exploding, but the data about it is stuck in billing totals and static dashboards. When you want to know which team's agents are burning tokens, which MCPs get called most, or who is using AI in ways that don't fit policy, you end up exporting CSVs or waiting on someone to build a report.\n\n**🕸️ How TraceGraph works**\n\nTraceforce runs on the endpoint, so it captures AI activity across every app and agent. TraceGraph connects that activity into one graph, and that graph lets you do three things:\n\n* **Query anything.** Every user, team, app, model, MCP, and token is a connected node, so you can slice the data in any combination with no predefined dashboards.\n* **Ask in natural language.** For example: _\"Which teams' token usage doubled this month?\"_ or _\"Show Claude Code sessions that called the Supabase MCP.\"_\n* **Build agentic workflows out of the box.** Put agents on top of the graph to flag spend spikes, send weekly usage reports, or escalate risky patterns automatically.\n\n🎥 **Demo:**\n\n\n\n**🙏 Our asks**\n\n* **Try it:** Install in under 5 minutes and see your team's token usage today.\n* **Intros:** Heads of engineering, IT, finance, or security leaders managing AI rollouts and spend.\n* **Feedback:** What would you ask your AI usage data? We'll show you the answer.\n\n📩 xia@traceforce.ai\n\nBook a time ", "url": "https://www.ycombinator.com/launches/USi-traceforce-tracegraph-ask-anything-about-your-company-s-ai-usage", "votes": 7, "created_at": "2026-09-28T14:55:58.682Z" }, { "id": 107460, "title": "Traceforce — Catch risky agent actions your security gateway will never spot", "tagline": "Company-wide security monitoring for AI apps", "body": "# \\*\\*\\*\\*\n\n**TL;DR:** AI agents are quietly pulling secrets off your employees' laptops — and your security gateway can't see it. Traceforce installs in under 5 minutes and gives you a full inventory of every AI app, MCP, and skill running on every device, then lets you block the dangerous stuff in real time. Built by the ex-Clumio engineering team. Traceforce is already deployed on 6,000+ devices across 10+ enterprise customers, with 40+ active pilots worth $3M+ in ARR. Try it free at [www.traceforce.ai](http://www.traceforce.ai).\\\n\\\n**The incident that started this**\\\nAt our last company, an AI coding agent running on a developer's laptop scraped what looked like database credentials and pushed them straight into a public GitHub repo. It took us _weeks_ to investigate, rotate credentials, and clean up the fallout. We got lucky — they were dev-environment creds, so no customer was affected. Next time, nobody will be that lucky.\\\n\\\nThat's the whole problem with AI at work now: ChatGPT, Claude, Cursor, and Claude Code are everywhere on employee devices, wired into your data through MCPs and skills that no one is tracking. The tools your security team already owns — gateways, proxies, enterprise APIs — never see any of it, because the risky action happens _on the device_, before it ever hits the network.\\\n\\\n**Why us**\\\nWe're Xia and Varun. We ran engineering at Clumio, a cyber-resilience company acquired by Commvault in 2024, where Xia was Director of Engineering and Varun was tech lead. We've spent our careers building security infrastructure — and we validated this problem with 50+ CISOs and CIOs before writing a line of code. Every one of them said the same thing: \\_I need to see and control this without slowing my engineers down.\\_\\\n\\\n**Why on-device — and why gateways can't do this**\\\nCompetitors sit at the gateway or plug into enterprise APIs. That misses the self-adopted AI tools employees install themselves, and it can't see how an agent is actually connected to your data via MCPs. Traceforce runs on the endpoint, so we see the full picture — which AI apps are running, what MCPs and skills they're wired to, what data they can reach — and we can _warn or block_ an unsafe action the moment it happens, not after it's already on the network.\\\n\\\n**What you get**\n\n* Install in <5 min. Full inventory of every AI app, MCP, and skill across your devices within 30 minutes.\n* Discover shadow AI and see exactly how each agent connects to your data sources.\n* Real-time controls: warn and block unsafe actions (like uploading a client list to a chatbot) before they happen.\n* Open-source MCP pentesting: we also built [mcp-xray](https://github.com/traceforce/mcp-xray) to dynamically detect vulnerable MCPs — try it today.\n\n\\\n**Traction**\n\n* Securing 6000+ employee devices across 10+ enterprises.\n* Customer quote from a leading database provider with over 500 employees: “To govern AI, we need full visibility into AI usage before we can place any type of controls. Traceforce gives us both visibility and control we needed”.\n* 40+ Active pilots including multiple Fortunate 500 enterprises.\n\n\\\n\\\n**Our ask**\n\n* **Intros** to security engineers, security architects, DevSecOps teams, or CISOs securing AI adoption. (We're the ex-Clumio team — that's usually enough to get a conversation.)\n* **Try Traceforce free** on your own laptop — <5 min to install, and we want candid feedback, good or bad.\n* **Challenge us:** tell us which AI apps, MCPs, or workflows we should support next.\n* **Share** with anyone wrestling with security over ChatGPT, Claude, Cursor, Claude Code, or custom MCPs.", "url": "https://www.ycombinator.com/launches/RxE-traceforce-catch-risky-agent-actions-your-security-gateway-will-never-spot", "votes": 7, "created_at": "2026-07-28T16:50:42.184Z" } ] }, { "id": 32624, "name": "Fabraix", "slug": "fabraix", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/d3d83aa2013bbe6b22b37f316b294d0c717eea35.png", "website": "https://fabraix.com", "all_locations": "San Francisco, CA, USA", "long_description": "Fabraix builds state-of-the-art AI red-teaming agents that continuously detect security vulnerabilities in customer-facing AI. Our product, Nyx, has already found vulnerabilities in agents at dozens of Fortune 500 companies. On AgentHarm, the leading benchmark for offensive AI security, Nyx achieved a 78% attack success rate, compared with 67% for GPT-5.6 Sol.\r\n\r\nAI agents can change more often than teams can test them. A new model, prompt, tool, permission, or data source can change what an agent does, even when the application code stays the same. And AI is also increasing how much software companies produce and how often it changes. We built Nyx to automate the work required to red-team AI agents. It is multi modal by design and interacts with the target indirectly through controlled replicas of SaaS products and websites that we maintain, placing malicious payloads in webpages, documents, files, messages, and tool outputs to test how an agent behaves under different conditions.\r\n\r\nNyx often finds its first vulnerability within minutes or hours rather than days or weeks. Because the work is fully automated, companies can repeat the test with every change and at a much lower cost than what a 7-figure red-teaming (and point-in-time) engagement would require.\r\n\r\nWe're also the team behind ACE (Adversarial Cost to Exploit), a benchmark that measures AI security in terms of how much it costs attackers to break an AI system; providing a game-theoretic framework to understand how motivated a rational attacker would be in exploiting the system.", "one_liner": "The world's frontier hacker of AI agents.", "team_size": 2, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1783913331, "tags": [ "Reinforcement Learning", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2026", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/fabraix", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2026/fabraix.json", "year_founded": 2026, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/fabraix/", "x_url": "https://x.com/FabraixHQ", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/d3d83aa2013bbe6b22b37f316b294d0c717eea35.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Jon Xu", "url": "https://www.ycombinator.com/people/jon-xu" }, "founders": [ { "user_id": 693526, "full_name": "Ahmed Aly", "title": "Founder/CEO", "founder_bio": "Co-founder @ Fabraix, building a frontier hacker agent that finds failure modes and security exploits in AI systems before real users do. Previously the first data scientist at Sequoia-backed Two, where he built AI systems for adversarial environments from scratch and scaled them to process $1B+ in annual B2B transactions, averting $50M in losses for multiple Fortune 150 companies. A published researcher with multiple papers in Q1 journals and a UCL PhD drop-out.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/ahmed-a-657264b4/", "x_url": "https://x.com/zachdotai", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/72bc6e2cde8727671fbf9c026c0c9a0ffcc80f4f.jpg" }, { "user_id": 2769430, "full_name": "Ibrahim Abdu", "title": "Founder/CTO", "founder_bio": "Red-teamed AI agents in Meta's Privacy org; built an SRE agent triaging 3M+ errors/month, saving 10,000+ engineering hours a year. Built a compiler for insider-trading detection at TradingHub: $100M+ in daily trades; Oxford PPE, top 8% of cohort.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/i-a-7352b7137/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/e3d923fd8bbb4ccfb176340c73f6ebc968516321.jpg" } ], "jobs": [], "news": [ { "title": "Meet The YC Startups Betting On What Comes Next", "url": "https://www.forbes.com/sites/dariashunina/2026/09/03/meet-the-yc-startups-betting-on-what-comes-next/", "date": "Sep 03, 2026" } ], "launches": [ { "id": 106270, "title": "Fabraix: The Frontier Agent that Hacks Customer-facing AI.", "tagline": "Fabraix builds AI red-teaming agents that continuously detect security vulnerabilities in customer-facing AI. We already found vulnerabilities in agents at dozens of Fortune 500 companies.", "body": "**TL;DR**: Fabraix builds AI red-teaming agents that continuously detect security vulnerabilities in customer-facing AI. Our product, Nyx, has already found vulnerabilities in agents at dozens of Fortune 500 companies, and hits a 78% attack success rate on AgentHarm (leading offensive AI security benchmark) vs. 67% for GPT-5.6 Sol.\n\n**Ask**: If your team ships customer-facing AI agents (chat, voice, browser, or coding) and needs to continuously test them for security vulnerabilities, find us at [founders@fabraix.com](mailto:founders@fabraix.com).\n\n\n\n**The Problem**\n\nAI agents introduce new vulnerabilities not present in traditional software..\n\nIn order for agents to be truly useful, they must be trusted to interact with untrusted surfaces like MCPs, websites and files, take real actions, and have access to confidential data. You can’t tell your defenses are sound by just reading your prompts since the agent's behaviour is not deterministic. The best thing to do is run your agent and really try to break it.  \n\nDoing this red-teaming process manually is time consuming, costly, and you are unlikely to catch everything. And as soon as the agent is updated, you need to repeat it. Security teams simply don’t have the bandwidth to keep up with the rapid deployment inside organisations.\n\n**Our Solution**\n\nNyx is our red-teaming agent that tests customer-facing AI agents, via direct interaction and also indirectly via its environment. It requires no access to your agent’s source code in order to test.\n\nNyx is highly adaptive when attacking. Rather than cycling through hard coded payloads like existing tools, it dynamically adjusts its attack strategies based on your agents defenses and responses. It probes your agent over a wide surface area of attack vectors, and deep dives This adaptive approach makes it 20x more effective as a red-teamer compared to other solutions.\n\nWe maintain a library of over 10,000 attack strategies and jailbreaks. These are high level strategies which are used by Nyx to generate dynamic adaptive attacks, over multiple turns. \n\nEvery finding includes the attack steps, the agent’s responses, and the resulting failure for you to reproduce. You can then rerun the same test after a release to check whether the failure remains fixed. \n\nOn the AgentHarm benchmark, Nyx achieved a 78% attack success rate, compared with 67% for GPT-5.6 Sol. Nyx has also found exploitable failures in public-facing agents operated by dozens of Fortune 500 companies.\n\nWe also built ACE (Adversarial Cost to Exploit), a benchmark that measures AI security in terms of how much it costs attackers to break an AI system; providing a game-theoretic framework to understand how motivated a rational attacker would be in exploiting the system.\n\n**The Team**\n\nWe both have a lot of experience building and securing AI agents at scale.\n\nIbrahim built AI agents at Meta that diagnosed and fixed production errors. Before that, he built compilers and database engines in Fintech. He graduated from Oxford in the top 8% of his cohort.\n\nAhmed led international payments fraud team at Monzo. Before that, he was the first data scientist at a Sequoia-backed startup, where he built its fraud engine from scratch into processing more than $1B in annual B2B transactions and preventing tens of millions in losses for Fortune 150 companies. He has published several peer-reviewed research papers in Q1 journals.\n\nWe previously worked together, and have known each other for almost four years.\n\n![uploaded image](/media/?type=post&id=106270&key=user_uploads/693526/5f437cbd-2009-40cc-8c69-746da9ea8300)\n\n**The Ask**\n\nIf you ship a customer-facing (chat, voice, browser, or coding) agent, we can help you find all the failure modes and built a self-healing loop to discover, triage, and maintain secure AI agents.\n\n[founders@fabraix.com](mailto:founders@fabraix.com)", "url": "https://www.ycombinator.com/launches/Re2-fabraix-the-frontier-agent-that-hacks-customer-facing-ai", "votes": 127, "created_at": "2026-07-20T15:06:58.917Z" } ] }, { "id": 33059, "name": "Palisade", "slug": "palisade-2", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/15205df0821b37ecf5cd82136bd682c2cb65c1b2.png", "website": "https://palisade-ai.com/", "all_locations": "San Francisco, CA, USA", "long_description": "", "one_liner": "AI that finds and fixes OS-level vulnerabilities across device fleets", "team_size": 1, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1784742432, "tags": [ "SaaS", "B2B", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2026", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/palisade-2", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2026/palisade-2.json", "year_founded": 2026, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/palisade-ai/", "x_url": "", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/15205df0821b37ecf5cd82136bd682c2cb65c1b2.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Jon Xu", "url": "https://www.ycombinator.com/people/jon-xu" }, "founders": [ { "user_id": 2688178, "full_name": "Fnu Prince", "title": "Founder", "founder_bio": "Left Caltech at 18 to start Palisade (YC S26). Previously did red-teaming at 16, USACO Platinum/USAPhO HM/AIME, built my own OS for fun (pre-Claude/Codex)", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/fnu-prince-a98405276/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/382f016fead85bdbb69a24e2165f092473c60b9c.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 106995, "title": "Palisade - AI that detects and fixes OS vulnerabilities across every endpoint in minutes", "tagline": "AI that finds and fixes OS-level vulnerabilities across device fleets", "body": "**TL;DR:** For companies running large fleets of OS-level endpoints (running GPU clusters, having a network of cloud devices, or deploying on-device), Palisade detects and fixes operating-system vulnerabilities (privilege escalation, remote code execution, memory corruption) that are extremely hard to detect and mitigate without applying AI to kernel-level data (syscalls, eBPF traces, process/memory events, network packets). A fix that used to take weeks to roll out, Palisade now applies in minutes across every endpoint.\n\nHey YC! I'm Prince, an ML researcher and engineer who dropped out from Caltech at 18 to build Palisade.\n\n**What’s the problem:** Modern attacks increasingly target the operating system, but most security products only observe the network, cloud, or application layers. That leaves OS vulnerabilities among the hardest problems to detect and the slowest to remediate across a fleet.\n\n**Why I’m building this:** Since I was 16, I have done plenty of professional red-team and blue-team security work. One pattern kept showing up: OS-level vulnerabilities were consistently the hardest to handle. Detection required low-level visibility, and even after identifying a vulnerability, rolling out a mitigation across hundreds or thousands of machines often took weeks. My background in both machine learning and operating systems convinced me this didn't have to be a manual process, so I built Palisade to automatically detect and remediate these vulnerabilities at the kernel level across an entire fleet.\n\n**What Palisade does:** Palisade watches your systems at the kernel level—syscalls, eBPF traces, process and memory events, and network packets—and uses AI to find OS vulnerabilities other tools miss, then implement the fix automatically across every endpoint.\n\n![uploaded image](/media/?type=post&id=106995&key=user_uploads/2688178/fa8c6d6a-b058-4f44-87d0-5511d038718b)\n\n_The Palisade control plane, live against a real kernel (LSM-BPF). The live feed at the bottom: every row is a real syscall decision._\n\nThe vulnerabilities it catches are the ones you can't see from the app or network layer alone:\n\n* Privilege escalation\n* Remote code execution\n* Memory corruption\n\nMost are caught before an exploit ever happens, and the fix is applied immediately, fleet-wide. The same patch that used to take weeks now lands in minutes.\n\n![uploaded image](/media/?type=post&id=106995&key=user_uploads/2688178/2f4e756d-1348-44a2-bdce-bb3491925da5)\n\n_The host audit: real findings ranked by severity. The bottom one is the cloud-metadata exposure: the same path behind the Capital One breach. One click on **Apply fix** and it's installed as a kernel rule._\n\nPalisade can already detect and fix real problems:\n\n* CVE-2024-1086: use-after-free in the Linux kernel's netfilter (nf_tables); local privilege escalation to root\n* CVE-2025-6019: libblockdev/udisks privilege escalation to full root\n* CVE-2025-32463: sudo --chroot local privilege escalation to root\n\n**Who it's for:** Companies running a lot of OS-level endpoints, where a single kernel vulnerability multiplies across the whole fleet. Whether it’s network servers or GPUs, we have you covered.\n\n\n\n**Our asks:**\n\n* Intros: if you run a large fleet of OS-level endpoints, or know a security/infra lead who does, I'd love an intro.\n* See the demo and tell me if you’d use it. Brutal feedback welcome.\n\n— [prince@palisade-ai.com](mailto:prince@palisade-ai.com), , DMs welcome", "url": "https://www.ycombinator.com/launches/Rpj-palisade-ai-that-detects-and-fixes-os-vulnerabilities-across-every-endpoint-in-minutes", "votes": 8, "created_at": "2026-07-23T00:33:01.523Z" } ] }, { "id": 33673, "name": "Caution", "slug": "caution", "former_names": [ "Caution SEZC" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/a0571039e7dc6cc20c7a181c0b7ffa967bc5c6d3.png", "website": "https://caution.co", "all_locations": "George Town, George Town, Cayman Islands", "long_description": "Caution is a hosting platform for software you can't afford to get hacked. It simplifies and extends confidential compute, and lets developers deploy workloads to secure enclaves in minutes and give customers, auditors, and counterparties cryptographic proof that production is running the exact reviewed source code, build, configuration, and runtime - not an opaque binary controlled by a cloud operator or internal admin.\r\n\r\nConfidential computing hardware exists, but the tooling is too fragmented and incomplete for most teams to use well. Today, attestation often proves only that a binary has a certain hash; it does not prove what source code produced that binary. Building the missing deployment, reproducibility, and verification layer requires specialized security engineering and often locks teams into one cloud or hardware stack. Caution turns that into a simple git-based workflow that builds reproducible enclave images, provisions infrastructure, and lets anyone independently verify what is running.\r\n\r\nWe built Caution after years securing high-risk systems through Distrust, where we worked with hedge funds, custodians, blockchain teams, cloud platforms, and critical grid operators on systems responsible for more than $600B in assets. Again and again, the same problem showed up: teams running mission-critical infrastructure could not reliably prove what was executing in production.\r\n\r\nAs AI, fintech, healthcare, and regulated data collaboration move into the cloud, \"trust us\" is no longer enough. Caution is a general-purpose platform: if it runs on a server, it can run verifiably on Caution. We're starting where trust failures cost the most, but we believe verifiable compute will become the default way software runs, the same way HTTPS became the default way it's served. Infrastructure you can verify, not trust.", "one_liner": "Hosting platform for software you can't afford to have hacked", "team_size": 5, "industry": "B2B", "subindustry": "B2B -> Infrastructure", "launched_at": 1785719703, "tags": [ "Cybersecurity", "Cloud Computing", "Infrastructure" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Summer 2026", "status": "Active", "industries": [ "B2B", "Infrastructure" ], "regions": [ "Cayman Islands", "Latin America", "Remote", "Partly Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/caution", "api": "https://devasheeshg.github.io/yc-api/batches/summer-2026/caution.json", "year_founded": 2025, "city": "George Town", "country": "KY", "linkedin_url": "https://www.linkedin.com/company/cautionco", "x_url": "https://x.com/CautionHosting", "fb_url": null, "cb_url": null, "github_url": null, "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/a0571039e7dc6cc20c7a181c0b7ffa967bc5c6d3.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Brad Flora", "url": "https://www.ycombinator.com/people/brad-flora" }, "founders": [ { "user_id": 3655130, "full_name": "Anton Livaja", "title": "Founder/CEO", "founder_bio": "Co-founder/CEO of Caution (YC S26). We give teams a hosting platform to run sensitive workloads in secure enclaves and cryptographically prove what code is running in prod. Previously co-founded Distrust, securing systems for hedge funds, custodians, and critical infra responsible for $600B+ in assets. Deep in confidential computing, supply chain security, and applied cryptography. Mission: improve the freedom, security, and privacy of as many people as possible.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/alivaja/", "x_url": "https://x.com/antonlivaja", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/f6dddfa8391b5f9fce21fa7496e2368d59ef6987.jpg" }, { "user_id": 3654857, "full_name": "Ksenia Lesko", "title": "Founder", "founder_bio": "Co-founder at Caution, where we help teams run sensitive workloads in secure enclaves and cryptographically prove what code is running in production. I lead the business and product side; previously ran strategy and ops at Distrust (distrust.co) and led customer education and activation at Ada (ada.cx).", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/ksenialesko/", "x_url": "https://x.com/xenush", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/4ecf3715be1ffcf30eedb062148902b9a1458237.jpg" }, { "user_id": 52788, "full_name": "Lance Vick", "title": "Founder/CTO", "founder_bio": "Technology sovereignty maximalist. Lead security architect at Caution. Former security lead at Turnkey, BitGo, Unit 410, Pebble. Founded Stagex Linux distribution, and #! decentralized hackerspace. Experienced in Linux hardening, privacy, software engineering, security auditing, cryptographic key management, tamper evidence, HSMs, and supply chain security. Frequently internet infamous for exposing security negligence. Prolific mechanical puzzle collector, lockpicker, and hardware hacker.", "is_active": true, "linkedin_url": "https://lance.dev", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/45728fc907c9915858fe6304bbdb25700f05d67b.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 108800, "title": "Caution: Hosting platform for software you can't afford to have hacked", "tagline": "Deploy to secure enclaves in minutes, isolate sensitive workloads, cryptographically prove what code is running.", "body": "Hey everyone! We're [Anton Livaja](https://www.linkedin.com/in/alivaja/), [Lance Vick](https://lance.dev), and [Ksenia Lesko](https://www.linkedin.com/in/ksenialesko/) from [Caution](https://caution.co).\n\n**TL;DR:** Caution is a hosting platform for software you can't afford to have hacked. Your software and data Istay protected even if your CI/CD pipeline, host infrastructure, or a developer laptop gets compromised. You go from source to a verifiable deployment in three commands. \n\n**Built for:** payment processors, PHI processors, AI agents, policy and fraud engines, secrets management, and other sensitive workloads.\n\n[https://drive.google.com/file/d/1u-l2TSBQO2t5dbhBsatCkZf5earCTyDD](https://drive.google.com/file/d/1u-l2TSBQO2t5dbhBsatCkZf5earCTyDD/view?usp=sharing)\n\n### **Why we built this**\n\nOn February 21, 2025, attackers stole **$1.5 billion** worth of Ethereum from Bybit, the largest digital heist in history. They never breached Bybit's own infrastructure: North Korea's Lazarus Group compromised a single developer machine at Safe{Wallet}, Bybit's multisig provider, and injected malicious JavaScript into the signing interface. Bybit's team approved what looked like a routine transfer and handed over a cold wallet to the attackers. The code everyone trusted was not the code that was running.\n\nThis keeps happening because nearly all software runs on blind trust:\n\n* trust in the cloud host\n* trust in production admins\n* trust in CI/CD\n* trust that the code you reviewed is the code actually running\n\nIf any part of that chain is compromised, an attacker can read your secrets, tamper with your business logic, or quietly run code your team never reviewed. It's the same failure behind SolarWinds and Codecov: tampered code arriving through a trusted channel, passing every check. Caution exists to shrink that attack surface and make the most sensitive systems verifiable.\n\n### **Caution proves exactly what's running on your server**\n\nCryptographically, and in real time. Deploying into secure enclaves normally takes a specialist team and months of integration. Caution automates the entire flow: source to verifiable deployment in minutes, with three commands:\n\n![uploaded image](/media/?type=post&id=108800&key=user_uploads/3654857/f3161435-2a97-4207-915a-96375a72be82)\n\n**🎥** [Watch Anton walk through the platform](https://caution.co/platform-tour.html)\n\nUnder the hood, **Caution is a verifiable confidential compute platform:** hardware-backed cryptography isolates your workloads, preserves data privacy, and proves what software is running on a server in real time. The entire platform is open source, so verification never requires trusting us. In practice, this eliminates entire classes of attacks out of the box:\n\n* **Build & CI/CD tampering**: reproducible, multi-party signed builds mean injected code can't pass as a legitimate release.\n* **Infrastructure & insider compromise**: a compromised cloud account, admin, or laptop can't silently swap what's running.\n* **Runtime data theft**: data is processed in hardware-isolated enclaves, unreadable even to the host, the cloud provider, or us.\n\nCaution guards against everything but first- or third-party code bugs: if the release you approve has a flaw, that's what runs. Nothing can be added, no fix can be stripped out, and every patch is provably live.\n\n### **Why now**\n\nWith advances in AI, attacks that used to require rare, expensive expertise are now cheap and scalable, and the gap between a vulnerability existing and being exploited is collapsing toward zero. Reactive patching was already losing. It can't win a race against automated attackers.\n\nIn the post-Mythos world, the security model has to flip. Infrastructure can no longer assume it won't be compromised. It has to be built to stay secure even when the host, the pipeline, or individuals with privileged access are compromised, and to prove, cryptographically, that it has. That's what Caution does.\n\nCaution is a general-purpose platform: if it runs on CPU or GPU, it can run verifiably on Caution. We're starting where trust failures cost the most, but we believe verifiable compute will become the default way software runs, the same way HTTPS became the default way it's served.\n\n### **Why us**\n\n[Anton](https://www.linkedin.com/in/alivaja/) and [Lance](https://lance.dev) have spent their careers securing some of the most security-critical systems in the world: BitGo, Ledn, Turnkey, OpenZeppelin, and Unit 410 (later acquired by Coinbase). Across hundreds of engagements, from hedge funds to critical grid operators, the systems we've helped secure hold more than **$600B** in digital assets. [Ksenia](https://www.linkedin.com/in/ksenialesko/) spent years helping enterprises adopt new technology, and now leads go-to-market, customer education, and operations at Caution, turning deep security engineering into a product companies can understand, buy, and use.\n\nWe've been the people companies call in when this class of attack hits. Teams needed stronger guarantees against supply chain and runtime attacks, but existing solutions were too hard, too bespoke, or too expensive. So we built the platform we kept wishing existed.\n\n### **Traction**\n\nCaution is in production and onboarding customers spanning crypto infrastructure, blockchain labs, digital asset lending, consumer hardware, post-quantum security, and private AI inference.\n\nWe support AWS Nitro Enclaves today. Intel TDX, AMD SEV-SNP, TPM 2.0, NVIDIA Confidential Computing, and broader cloud support is in active development and coming soon.\n\n### **Our ask**\n\nIf you're running software where sensitive data must stay private or business logic can't be tampered with, we'd love to help you level up your security. [Book 20 minutes with us](https://caution.co/contact.html) or email us at [founders@caution.co](mailto:founders@caution.co).\n\nWe'd especially love to hear from you if you're a:\n\n* security team that wants proof, not promises, from your infrastructure\n* fintech running payments, policy, or fraud engines\n* crypto custodian, exchange, or wallet team that can't afford another Bybit\n* healthcare or AI company processing PHI or other regulated data\n* team giving AI agents production credentials and losing sleep over it\n* company using AI inference with sensitive data\n\nYou can also learn more on our [blog](https://caution.co/blog.html), and follow us on [LinkedIn](https://www.linkedin.com/company/cautionco/) and [X](https://x.com/CautionHosting) for updates.", "url": "https://www.ycombinator.com/launches/SIq-caution-hosting-platform-for-software-you-can-t-afford-to-have-hacked", "votes": 59, "created_at": "2026-08-04T17:02:42.242Z" } ] }, { "id": 35096, "name": "Stacktrace", "slug": "stacktrace", "former_names": [ "OpenACA" ], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/e79ba1ad9464ac22023bbed994e2299d2ae8addf.png", "website": "https://stacktrace.ai", "all_locations": "San Francisco, CA, USA", "long_description": "Agents will do most of the work in the future, but only if teams can trust them unsupervised.\r\nStacktrace is the control layer for every agent: it sees every action, detects risky behavior, enforces the bounds your team sets, and steps in when an agent drifts from intent.", "one_liner": "See and control what your agents actually do", "team_size": 3, "industry": "B2B", "subindustry": "B2B -> Infrastructure", "launched_at": 1790912378, "tags": [ "DevSecOps", "Cybersecurity", "Infrastructure", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Fall 2026", "status": "Active", "industries": [ "B2B", "Infrastructure" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/stacktrace", "api": "https://devasheeshg.github.io/yc-api/batches/fall-2026/stacktrace.json", "year_founded": 2026, "city": "San Francisco", "country": "US", "linkedin_url": "https://linkedin.com/company/stacktrace-ai", "x_url": "https://x.com/stacktrace_ai", "fb_url": null, "cb_url": null, "github_url": "https://github.com/stacktrace-ai", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/e79ba1ad9464ac22023bbed994e2299d2ae8addf.png", "app_video_url": null, "dday_video_url": null, "company_photos": [ "https://bookface-images.s3.us-west-2.amazonaws.com/attachments/97ebc6a4c3219347dbe275d978f58b9c967b1ffc.png" ], "primary_partner": { "name": "Christopher Golda", "url": "https://www.ycombinator.com/people/christopher-golda" }, "founders": [ { "user_id": 3627108, "full_name": "Vinod Kone", "title": "Founder/CEO", "founder_bio": "Vinod Kone, Founder and CEO of Stacktrace (YC F26). Previously VP of Engineering at Harness, where he led platform engineering and owned software supply-chain security, and Senior Director at Twilio Segment. Former Apache Mesos PMC Chair; scaled Mesos to 30,000 nodes at Twitter. PhD in CS from UC Santa Barbara.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/vinodkone/", "x_url": "https://x.com/vinodkone", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/07509a698362739d61f5c057b0593225a4683051.jpg" }, { "user_id": 12339, "full_name": "Micheal Benedict", "title": "Founder", "founder_bio": "Founder of Stacktrace (YC F26). Previously Head of Infrastructure, Security and AI Platforms at Airtable. Before that, he led developer platform and cloud infrastructure orgs at Databricks, Pinterest and Twitter. He holds an MS in Computer Science from SUNY.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/michealb/", "x_url": "https://x.com/micheal", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/a837aeada7890b6fce994e84e3d41538dee1899c.jpg" }, { "user_id": 4009296, "full_name": "Prasanth Ganta", "title": "Founder", "founder_bio": "Founder at Stacktrace (YC F26). Previously Engineering Leader at Amazon (2011-2026), where he built GenAI systems at Amazon Ads and foundational services across AWS and Alexa. MS in CS from Texas A&M, B.Tech from IIT Guwahati.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/prasanthganta/", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/4eca3ebbc9bbc98ad81b1f159c0ec6a7c41e4d72.jpg" } ], "jobs": [], "news": [], "launches": [] }, { "id": 35126, "name": "Armorer Labs", "slug": "armorer-labs", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/9fd9c58c48b1017644c81d6d495140aab28b5782.png", "website": "https://armorerlabs.com", "all_locations": "San Francisco, CA, USA", "long_description": "Armorer helps companies in regulated industries ship their own AI agents faster and keep them secure in production.\n\nMost security tools flag an issue and file a ticket. Armorer assesses your agent and simulates attacks to find the real issues. Then it creates a verified fix that stops the attack without breaking the business, ready for your approval in about 4 hours.\n\nIn production, Armorer checks every agent action in milliseconds, with no GPU needed. It detects malicious behavior such as prompt injection, goal hijacking and data leaks, then allows, holds or denies the action.\n\nArmorer's detection models beat every other detector we tested on six public benchmarks. Armorer is 22% more accurate than JEV while being 88x faster, so users won't feel the delay.\n\nWe spent years building and evaluating AI security systems together at AWS, including its first customer-facing AI security agent, which scaled to 100k+ customers. Armorer is backed by Paul Vixie, Internet Hall of Fame inductee and former AWS Deputy CISO.", "one_liner": "Continuous security verification for AI agents in regulated industries", "team_size": 2, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1792423718, "tags": [ "Developer Tools", "DevSecOps", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Fall 2026", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/armorer-labs", "api": "https://devasheeshg.github.io/yc-api/batches/fall-2026/armorer-labs.json", "year_founded": 2026, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/armorer-labs/", "x_url": "https://x.com/Armorer_Labs", "fb_url": null, "cb_url": null, "github_url": "https://github.com/ArmorerLabs", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/9fd9c58c48b1017644c81d6d495140aab28b5782.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Kulveer Taggar", "url": null }, "founders": [ { "user_id": 3565232, "full_name": "Daniel Begimher", "title": "Founder/CEO", "founder_bio": "Co-founder of Armorer Labs. Previously led the global Application Security technical field community at AWS, where he led development of AWS Security Incident Response's AI-powered investigative agent from early development through public launch. Author of SIR-Bench - evaluation method for security agents; author of ASH code scanner (200K+ monthly clones); co-created ThreatForest, selected for Black Hat USA 2026 briefing. Led incident response for Fortune 500 breaches and red-team operations.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/begimher", "x_url": "https://x.com/begimher", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/65ec4b4f705715309b8e611b94be913d1dd8b4bb.jpg" }, { "user_id": 2650696, "full_name": "Cristian Leo", "title": "Founder/CTO", "founder_bio": "Co-Founder of Armorer Labs (YC F26). Led AI security science at AWS, building and evaluating AI systems for security.\n\nHe is the creator of ThreatForest, the first open source automated threat modeling agent, and a co-author of SIR-Bench, a benchmark for evaluating AI security investigations. He is a Black Hat and re:Invent speaker.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/cristian-leo", "x_url": "https://x.com/cristian_le0", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/4915942599f3bc8c2903c0737b6be6746b2d15a9.jpg" } ], "jobs": [], "news": [], "launches": [] }, { "id": 37864, "name": "OpenHack", "slug": "openhack", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/3665e2fbd95736778f3748429060face49d74d6d.png", "website": "https://openhack.com", "all_locations": "San Francisco, CA, USA", "long_description": "OpenHack is an always on AI Security Engineer. OpenHack understands your business, system design and developer intent like a real security engineer. It ingests all this context to find the hardest vulnerabilities through AI codebase scanning, AI pentesting and Supply Chain Security. It verifies and prioritizes vulnerabilities automatically, and filters out false positives like a real security engineer drastically reducing overhead.", "one_liner": "Always-on AI security engineer", "team_size": 1, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1790387763, "tags": [ "DevSecOps", "Cybersecurity", "AI" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Fall 2026", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Partly Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/openhack", "api": "https://devasheeshg.github.io/yc-api/batches/fall-2026/openhack.json", "year_founded": 2025, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/openhackai", "x_url": "https://twitter.com/openhack", "fb_url": "https://www.facebook.com/openhackai", "cb_url": null, "github_url": "https://github.com/openhackai", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/3665e2fbd95736778f3748429060face49d74d6d.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Max Kolysh", "url": null }, "founders": [ { "user_id": 318539, "full_name": "Ananay Arora", "title": "Founder/CEO", "founder_bio": "Founder/CEO at OpenHack (YC F26). \n\nHacking for over 12 years, with bug bounties from Meta, Apple, Perplexity, YC, Department of Homeland Security and more. Author of CVE-2026-36755. \n\nPreviously SWE @ Apple and Cybersecurity @ ASU.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/ananay", "x_url": "https://twitter.com/ananayarora", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/d72b9a8183ee048345720aed35bf764c7239d713.jpg" } ], "jobs": [], "news": [], "launches": [] }, { "id": 38127, "name": "DeepMark", "slug": "deepmark", "former_names": [], "small_logo_thumb_url": "https://bookface-images.s3.amazonaws.com/small_logos/4dfcb45ad1cf6b4da58c1a44a770eb98ac4ec79b.png", "website": "https://www.deepmark.me", "all_locations": "San Francisco, CA, USA", "long_description": "DeepMark is the authentication layer for AI voice. When an AI agent speaks, we embed a compact, machine-readable ID directly into the audio, not in metadata, which gets stripped the moment a file is touched. The ID resolves to a trust record, so a bank, a call center, or the person on the line can verify in real time who the agent is.", "one_liner": "A live watermark inside AI voice that survives phone calls", "team_size": 5, "industry": "B2B", "subindustry": "B2B -> Security", "launched_at": 1789029188, "tags": [ "B2B", "Cybersecurity" ], "tags_highlighted": [], "top_company": false, "isHiring": false, "nonprofit": false, "batch": "Fall 2026", "status": "Active", "industries": [ "B2B", "Security" ], "regions": [ "United States of America", "America / Canada", "Remote", "Partly Remote" ], "stage": "Early", "app_video_public": false, "demo_day_video_public": false, "app_answers": null, "question_answers": null, "url": "https://www.ycombinator.com/companies/deepmark", "api": "https://devasheeshg.github.io/yc-api/batches/fall-2026/deepmark.json", "year_founded": 2025, "city": "San Francisco", "country": "US", "linkedin_url": "https://www.linkedin.com/company/deepmark-me/", "x_url": "https://x.com/deepmark_me", "fb_url": null, "cb_url": "https://www.crunchbase.com/organization/deepmark-inc", "github_url": "https://github.com/deepmark", "logo_url": "https://bookface-images.s3.amazonaws.com/small_logos/4dfcb45ad1cf6b4da58c1a44a770eb98ac4ec79b.png", "app_video_url": null, "dday_video_url": null, "company_photos": [], "primary_partner": { "name": "Max Kolysh", "url": null }, "founders": [ { "user_id": 2023960, "full_name": "Slavko Kovačević", "title": "Founder/CEO", "founder_bio": "Founder/CEO at DeepMark (YC F26). PhD candidate in Computer Science. Cited by Meta, Microsoft, Sony, and Adobe.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/slavkokovacevic/", "x_url": "https://x.com/realslavko", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/de19c1d8562fd357c3a264bee57209047824e480.jpg" }, { "user_id": 2547276, "full_name": "Kosta Pavlović", "title": "Founder/CSO", "founder_bio": "Founder/CSO at DeepMark (YC F26). PhD in Computer Science. Pioneer of learning-based digital audio watermarking.", "is_active": true, "linkedin_url": "https://www.linkedin.com/in/kosta-pavlovic", "x_url": "", "avatar_thumb_url": "https://bookface-images.s3.us-west-2.amazonaws.com/avatars/283edba47bb01fec63f8e445013165464636ab64.jpg" } ], "jobs": [], "news": [], "launches": [ { "id": 116233, "title": "DeepMark - Reinventing Trust in Voice", "tagline": "A live watermark inside AI voice that survives phone calls", "body": "\n\nHey, we are Slavko and Kosta 👋\n\nWe have been working together for six years, first as two researchers at the University of Montenegro, now as founders. Somewhere along the way, we became best friends. Kosta is our CSO, and I am the CEO.\n\n**The problem**\n\nVoice is uniquely vulnerable to impersonation. A few seconds of audio is enough to clone anyone, and the same voice agents that answer a bank's phone can be turned around and pointed at the bank's customers. People have started to hesitate before picking up. Good technology scales good outcomes, and it scales bad ones just as well. Our job is simple. Restore trust in voice.\n\n**What we built**\n\nDeepMark is real-time audio watermarking for AI voice. When an AI agent speaks, we put a certificate inside the sound itself, on the voice company's side, as the voice is being generated. Not metadata, which gets stripped the moment a file is touched. The certificate becomes part of the voice.\n\n![uploaded image](/media/?type=post&id=116233&key=user_uploads/2023960/b3239118-82c1-4fb4-82c2-f4363685a0be)\n\nThen the voice goes out into the real world, and the real world is rough on audio. Compression, codecs, a bad connection, a cheap speaker, a worse microphone. Think about how flat a human voice sounds over the phone. Our certificate survives the trip. On the other end, a phone, a call center, or an API reads it and shows who is speaking, who issued the certificate, and whether this agent is allowed to be on the line. Detectors ask whether audio is fake. We answer who is authorized to speak.\n\n![uploaded image](/media/?type=post&id=116233&key=user_uploads/2023960/171abdf5-efb9-442b-a153-dbbb1ba981d4)\n\n**Why this is hard**\n\nFour things have to hold at the same time. It has to be real time, or a phone call makes no sense, and voice companies already fight for every millisecond. It has to leave the audio quality alone, nobody trades a worse voice for a safer one. It has to survive the phone line. And the ID has to be long enough, because the longer the ID, the more certificates we can issue. A watermark that works beautifully in the lab falls apart the moment audio meets a phone line. And a live call has no file to sign. Nothing survives the trip except the sound itself, so the identity has to live inside the sound. We spent years hitting that wall. Then we built a tool that measures all four at once and published it, so anyone can check our work, and everyone else's.\n\n![uploaded image](/media/?type=post&id=116233&key=user_uploads/2023960/a9930538-1deb-4609-8938-4bdbcf8c88ce)\n\n**How we got here**\n\nOur mentor, who did his PhD in digital watermarking, told us not to bother. The field was saturated, nothing left to contribute. We were too stubborn to listen, and our learning-based approach turned out to be one of the first of its kind.\n\nKosta wrote his PhD on watermarking along the way. I am still writing mine! We published some of the earliest work in deep audio watermarking, cited by teams at Meta, Microsoft, Sony, and Adobe. This year our robustness benchmark landed in IEEE Access, and our AWARE paper was accepted at EUSIPCO. Before YC, we signed our first platform license with a leading voice AI provider, and it is now in production.\n\n**Our ask**\n\nWe want to meet voice AI companies. If you build voice models, book 20 minutes with us and we will run DeepMark on your own audio, so you can see the mark survive your calls. The EU AI Act's marking rules already apply and the 2 December deadline for systems on the market is close, so this is a good month to talk. If you know someone at a voice AI platform, an intro means a lot to us.\n\n[slavko@deepmark.me](mailto:slavko@deepmark.me), or book a demo at [deepmark.me](http://deepmark.me). Thanks for reading. 🇲🇪 → 🌉", "url": "https://www.ycombinator.com/launches/UEj-deepmark-reinventing-trust-in-voice", "votes": 29, "created_at": "2026-09-22T16:00:00.415Z" } ] } ]