Three Stanford engineers are building LLM-powered communications monitoring that promises to catch financial fraud, IP theft, and compliance violations before they become headlines.
FedRAMP compliance is the toll booth between software companies and the $100 billion federal IT market. It takes 16 months and costs over a million dollars. Archon says they can do it in six months and save you seven figures.
Wiz sold to Google for $32 billion. SubImage thinks the same problem can be solved with open-source foundations and without the vendor lock-in. They might be right.
Deploying a compliant application used to mean hiring a DevOps team and a compliance consultant. Aptible packages secure, compliant hosting into a platform that startups can actually set up themselves.
A Chrome extension that summarizes the legal fine print you've been clicking through for twenty years — sensible idea, crowded-ish space, 105 users so far.
Traditional penetration testing is slow, expensive, and happens maybe once a year. Astra Security built an automated pentest platform that scans continuously and has the compliance certifications to prove the results actually mean something.
The supply chain attack problem is real, unglamorous, and quietly getting worse — and Koidex just built a search bar for it.
Somewhere in your org right now, an engineer has Claude querying your production database, and your security team has no idea.
Every crypto exchange on earth asks new users to hand over a passport scan, a selfie, and a proof of address — data that then sits on a centralized server, waiting. Zyphe was built specifically to fix that contradiction.
Formal verification has always been powerful and almost completely impractical. Theorem is training models to make it 10,000 times faster, and the early results on GPU code and cryptography are hard to ignore.
Penetration testing has always been expensive, slow, and bottlenecked by a global shortage of people who know how to do it. MindFort wants to replace the wait with agents that run for hours and find what humans miss.
Every AI company promises your data is safe. Tinfoil skips the promise and gives you a mathematical proof instead.
Auth0, Clerk, and Supabase Auth all want to host your authentication. Better Auth thinks you should own it yourself. With 13K GitHub stars and 350K monthly npm downloads, developers seem to agree.
Penetration testing is a $3 billion market dominated by firms that send humans to do what AI agents could do faster, cheaper, and more thoroughly. Riverbank, founded by an ex-NSA operator, is deploying swarms of AI agents to find the vulnerabilities that conventional scanners miss and human pentesters run out of time to discover.
AI agents are calling APIs, querying databases, and executing transactions with long-lived API keys and zero oversight. Alter intercepts every tool call an AI agent makes and enforces parameter-level authorization, ephemeral credentials, and real-time guardrails. Two founders in New York are building the identity layer that the AI agent ecosystem forgot to build.
Cloudflare Tunnels, Zscaler ZPA, and Ngrok all let you expose internal services to the internet. Pangolin does the same thing, built on WireGuard, fully self-hosted, with identity-based access controls and 19,000 GitHub stars to prove people want it.
Granola and Otter record your meetings and send everything to the cloud. Char does the same thing but stores everything locally in plain markdown files you actually own. Seven thousand GitHub stars suggest people care about the difference.
Security awareness training has been stuck on fake phishing emails for a decade. GhostEye builds exposure maps of employees and launches autonomous simulated attacks across email, voice, SMS, and deepfakes.
AI coding agents have full access to your file system, your secrets, and your network. ContextFort gives security teams a way to see exactly what those agents are doing, without trusting the agents to self-report.
Annual pentests are a compliance checkbox, not a security strategy. Veria Labs replaces them with AI agents that hack your application continuously, prove exploits are real, and suggest fixes. The founders are ranked number one in US competitive hacking, which is exactly the kind of credential that makes this believable.
Kubernetes incident response is a nightmare of runbooks, alert fatigue, and 3 AM pages. Kestrel AI deploys agents that find root causes and generate production-ready fixes automatically.
Every company deploying AI agents will eventually ask who has access to what. Agentic Fabriq is building the answer before the question becomes a crisis.
Princeton researchers who helped secure every HTTPS connection on the web are now building a platform to detect impersonation attacks before they hit.
Oximy deploys a lightweight desktop agent that monitors AI tool usage across an organization, tracking adoption, spend, and security risks across 3,500+ AI tools.
Protent analyzes live video feeds to identify early escalation patterns and predictive threat signals, giving surveillance staff the immediate context they need to intervene before situations become dangerous.
AI agents like OpenClaw can do almost anything, including leak your SSN, execute malicious code, and fall for prompt injections. Clam puts a semantic firewall around them to stop the bad stuff.
Lexius adds an AI layer to existing security cameras that detects shoplifting, slip-and-fall incidents, and known offenders in real time. No new hardware. Clients include 7-Eleven, Erewhon, and Prada.
BeeSafe deploys AI agents that engage with scammers directly, wasting their resources and uncovering the financial accounts used for fraud. Backed by YC, Obvious Ventures, and America's Seed Fund.
Carson combines deep prospect research, branded deck generation, and plain-English workflow automation in a desktop app built by ex-Palantir engineers who take data security as seriously as their former employer did.
Hex Security builds AI agents that run continuous penetration tests against your apps and infrastructure, replacing the once-a-year pentest with an always-on attack simulation that finds vulnerabilities before real attackers do.
Salus is an API that wraps around AI agents to inspect and block incorrect actions before they execute, preventing the kind of costly mistakes that evals and observability tools only catch after the damage is done.
Every AI meeting tool in 2025 is quietly uploading your conversations to someone's server. talat is betting that's the part you actually care about.
