Alex Chantavy once had a job where a twenty-something engineer could stand before 1,200 people at a Microsoft conference and explain how to improve their security. He was on the Red Team, planning attacks, studying targets, and making cloud systems do things their owners had not intended. He loved it. He left anyway.
The trouble was the ending. A red-team operation concluded with a report. Once Chantavy knew a company well enough, the moves could become familiar and the prose could begin writing itself. For someone who liked building software, the applause did not change the shape of the artifact. He wanted to make something people could run.
So he followed his mentor Sacha Faust to Lyft. There, a project called Cartography gave his career a more durable object. It pulled facts about cloud assets, identities, permissions, repositories, devices, and services into a graph, preserving the relationships between them. An inventory could tell a team that a server existed. A graph could show what the server touched, who controlled it, whether the internet could reach it, and which route led onward to something valuable.
“Strangers I've never met were running our code to defend their companies.”Alex Chantavy on Cartography
01 / OriginA builder leaves the breaking room
Chantavy's public biography begins in Hawaii and runs through government cybersecurity work at the National Security Agency, cloud penetration testing at Microsoft, and security engineering at Lyft. The details of the government assignment remain, appropriately, redacted. The connecting interest is less secretive: he likes understanding the easy ways computers can be made to misbehave, then making that understanding useful to other people.
At Microsoft, he learned to see a target as a whole environment. At Lyft, moving to the defensive side exposed an organizational comedy. A flaw in application code might belong to application security. A server open to the internet might be routed to cloud security. A suspicious continuous-integration job could bounce between teams while everyone debated whose acronym covered it. Attackers, famously poor students of org charts, simply took the available route.
A path has no respect for the org chart
Cartography made those crossings visible. The project began inside Lyft in 2018 and was open-sourced in 2019. Chantavy became one of its main builders and its most persistent steward, although he is careful not to claim the original idea as his alone. He credits Faust and a broader early team. His own particular contribution was technical endurance plus community: answering questions, choosing schemas, recruiting maintainers, and discovering which use cases could survive production.
02 / The long middleSix years, two jobs, one graph
For stretches of his Lyft career, Chantavy felt he was working two jobs. One was securing a fast-growing transportation company. The other was keeping Cartography healthy enough for outsiders to trust. His perfect day arrived when the two jobs wanted the same feature. Most days were less obliging. Open source depended on long nights, ruthless scoping, generous maintainers at other companies, and accepting that some things would slip.
The work found an important second life in vulnerability management. Companies can discover millions of software findings. Treating every one as equally urgent produces tickets, exhaustion, and a familiar security ritual: make the scary number smaller. Chantavy's red-team instinct objected. A vulnerability that cannot participate in a plausible path to a valuable target has a different meaning from one sitting on an exposed machine with powerful credentials.
At Lyft, he and Kunaal Sikka used the graph to connect vulnerable container images to base-image inheritance, running services, repositories, owners, internet exposure, and access to data. The difficult part was not spotting a flaw. It was determining which team could fix the underlying cause once, rather than asking twenty service owners to patch the same inherited problem twenty times.
This is where Chantavy's approach becomes stealable. Never send work to another team unless the fix is clear. Make the repair yourself when you safely can. Help partners move faster. Let collaborators receive visible credit. Break bread often enough that a ticket arrives from a person, not a machine with a clipboard. Security, in this telling, scales through technical context and accumulated trust.
03 / Founder modeThe side project clocks in full time
By 2024, Chantavy and Sikka had decided to build a company around the graph. SubImage became a managed platform for teams that wanted Cartography's model without maintaining databases and synchronization jobs themselves. The open-source core could remain inspectable and extensible. The company could build the polished workflows, remediation loops, and customer support that an internal project could rarely justify.
They entered Y Combinator in January 2025 as the only dedicated security company in the Winter batch. That distinction was less glamorous than it sounds. Security software often sells to larger organizations with procurement cycles that move at the speed of wet cement. During the batch, the founders tracked a field of prospects through discovery, demos, terms, and purchasing. Exactly one became a contract. It was also the contract that changed the fundraising story.
SubImage closed its seed round before Demo Day and announced $4.2 million in October 2025. By then, the founders could point to a project used by more than 70 companies, a place in the Cloud Native Computing Foundation ecosystem, and years of scars from running the same ideas at scale. The startup did not erase Cartography's awkward history. It productized the parts that history had proved necessary.
“I'm stubborn, and ownership is probably my strongest value.”Alex Chantavy on choosing founder life
04 / TranslationThe Hawaii problem in a San Francisco room
There was still the matter of explaining it. Chantavy has written candidly about freezing when someone asked what SubImage was building. He had too much context: red-team stories, graph tuning, open-source history, false positives, cloud permissions, customer behavior. Expertise made the simple answer harder.
He built himself a ladder. First, the what: SubImage maps an environment so a team can see how an attacker would move through it. Then the why: ordinary tools flood users with findings detached from actual paths. Finally, credibility: this work began at Lyft, matured in public, joined the CNCF ecosystem, and raised funding before Demo Day. The ladder is useful because it delays the machinery until the listener understands the pain.
A deeper communication habit came from Hawaii. Chantavy has recalled arriving at ‘Iolani School at 14 after being accustomed to feeling like the smartest kid in the room. Suddenly he was normal and, in algebra, behind. Hawaii's culture of understatement reinforced the lesson. Praise invited a smile and a quick minimization. Years later, investors sometimes read the reflex as uncertainty.
His correction was not to become louder. It was to become exact. Paying customers at six-figure contract values could be stated plainly. So could gaps, fears, and mistakes. “My goal is accuracy,” he wrote. It is a modest sentence with sharp edges: false humility distorts just as surely as hype.
05 / The next mapAgents enter the graph
The latest turn in Chantavy's work is artificial intelligence, but the argument remains pleasingly old-fashioned. Agents need context. If an agent investigates a security alert, it must know what the affected machine is, who owns it, whether it is exposed, what it can reach, and which identity it uses. A connected local subgraph can supply those answers without pouring an entire enterprise into a context window.
In 2026, Chantavy and Sikka spoke at Microsoft's BlueHat about treating AI agents as a new kind of microservice: compute with identity, permissions, dependencies, and a blast radius. SubImage also published work with Corelight, whose incident-response agents used the SubImage graph to gather infrastructure context as alerts arrived. The fashionable component is the agent. The hard requirement is still a reliable map.
Founder life has supplied its own cautionary tale. Chantavy and Sikka once spent sleepless nights fearing a breach at their young company. The culprit was a repeatedly mistyped database username, compounded by watching the wrong logs. They later told the story at BSidesSF, laughing because the danger had passed and teaching because embarrassment is a cheap price for a better runbook.
That candor fits the larger pattern. Chantavy writes about promotion attempts that failed, messaging that knots his tongue, open-source work that became lonely, and vulnerability programs that fired too many tickets. His career has not been a march from secret agency to inevitable founder. It has been a sequence of maps corrected by reality.
The aspiration now is expansive but not mystical: make open, interoperable, graph-shaped infrastructure context a standard layer for security teams and the agents working beside them. Beneath the databases and diagrams sits the same motive that pulled him away from the Red Team. Build something useful enough that a stranger runs it, sees the path, and stops the next move.