The annual penetration test has the timing of a Victorian postman. It arrives with ceremony, delivers a bundle of findings, and leaves while the software keeps changing. Brandon Veiseh has spent much of his career watching that mismatch from unusually useful seats: inside an open-source security company, inside a major penetration-testing firm, and now inside the startup he co-founded to make security testing continuous.
At MindFort, Veiseh’s title is co-founder and CEO. The more revealing description is product translator. His work has repeatedly sat between security researchers, software engineers, and the enterprises expected to turn an alarming technical discovery into an ordinary Tuesday fix. That middle ground is where excellent research can become a durable product, or a very expensive PDF.
MindFort’s wager is that autonomous agents can do more of the journey: examine an application, test possible weaknesses, validate which ones can be exploited, and prepare the patch or ticket that moves an engineer toward resolution. The company calls the destination an autonomous security engineer. Veiseh arrived at it by following a problem that refused to stay solved.
The first pass at machine-made security
Before MindFort, before Y Combinator, and before agent was the industry’s favorite noun, Veiseh founded a startup building natural-language-processing models for network packet inspection. Public professional listings identify that company as SkyFort. The premise already contained the outline of his later work: take a security task filled with dense, fast-moving information and use machine intelligence to help make sense of it.
He later worked in product at Topsort, then joined ProjectDiscovery. The latter had something security teams already loved: Nuclei, an open-source vulnerability scanner built around community-authored templates. Veiseh led product and helped build the enterprise platform around that ecosystem. It was a practical education in the distance between a tool people admire and a system companies can trust, buy, operate, and fit into existing work.
An open-source scanner can win affection through speed and flexibility. An enterprise platform must also answer less glamorous questions. Who can run it? What is tested? How are results organized? Can a team repeat the process without creating a second job devoted to the first? Product work is where technical possibility meets the calendar, the budget, and the human tolerance for another dashboard.
“Software is being written faster than it can be secured.”Brandon Veiseh, April 2026
In 2023, Veiseh publicly announced that he was joining NetSPI’s product team. There he led development of generative AI tools for offensive security. NetSPI’s business put him close to human penetration testers and the customers hiring them. The work added another angle to the same puzzle. Scanners offered scale but often produced noise. Skilled humans offered judgment but were finite, costly, and usually engaged at intervals.
The obvious answer would be a faster scanner. Veiseh and his eventual co-founders chose a more demanding one: software that behaves less like a checklist and more like a tester, reasoning about an application, pursuing a possible attack path, and producing evidence before it asks a busy engineer to care.
A finding is only useful if it moves
Veiseh met co-founders Akul Gupta and Sam through work and research. Their experience approached the problem from three directions. Veiseh brought product work across scanners and AI-assisted offensive security. Gupta had researched large language models in cybersecurity and participated in model-safety red teaming. Sam had dealt with product security inside Salesforce and Tableau. Their shared conclusion was brisk: AI was increasing the amount and velocity of code, and security needed machinery of comparable speed.
The vulnerability has somewhere to go
This sequence is the center of MindFort’s product thesis. The company is not satisfied with finding a zero-day and ringing a tasteful bell. Veiseh has said he wants to address the entire vulnerability lifecycle, from detection and validation through triage and patching. The distinction matters because the customer’s problem does not end when a flaw acquires a name. It ends when the software is safer.
MindFort’s agents can test a web application from the outside, or use source code for additional context. Assessments can run on a schedule and can connect to continuous integration workflows. When a fix is ready, the platform can open a pull request or place the work into Linear or Jira. The product’s unit of value is less an alert than a completed handoff.
Autonomy in cybersecurity comes with a comic complication: the software is being asked to break things responsibly. During MindFort’s Hacker News launch, readers pressed Veiseh on what the system might do after finding elevated privileges, whether customers could point it at any domain, and if patches appeared automatically. His answers drew deliberate limits. Customers verify ownership. The system tests exploitation without destructive behavior. Patches go to a pull request or ticket for human review.
That is a product operator’s version of ambition. The agent gets a broad job and narrow permissions. It can reason, investigate, and recommend, but deployment trust comes from knowing where the machinery stops. In security, a flamboyant demo wins attention. A controlled workflow wins access to production.
“The system is designed to safely test exploitation, and not perform destructive testing.”Veiseh, answering launch questions
The model behind the agent becomes the company
MindFort joined Y Combinator’s 2025 cohort and launched publicly that June. In April 2026, the company announced a seed round of more than $3 million led by Soma Capital, with Y Combinator, 468 Capital, CRV, Sandwith Ventures, and Blast participating. The money was assigned to capacity, hiring, broader product coverage, and an increasingly important part of the plan: developing specialized intelligence for offensive security.
Veiseh has written that MindFort does not want its future to depend entirely on general-purpose models from the major AI labs. The company is developing MF-1, a model intended for offensive-security reasoning, and HillClimb, infrastructure that lets agents build a knowledge graph of a target and compound what they learn during an engagement. The pitch is vertical integration, but the motivations are plain: control cost, protect privacy, improve performance, and reduce reliance on another company’s policies.
Surfaces on the roadmap: web applications, APIs, networks, and cloud infrastructure. The expansion matters because vulnerabilities are often chains, slipping through the seams between code, identity, configuration, and third-party systems.
Specialization also fits the career that preceded it. Veiseh did not arrive at AI security from a general chatbot and a market map. His first startup examined network traffic. ProjectDiscovery taught him about scalable scanning and enterprise packaging. NetSPI put AI beside human offensive-security work. MindFort combines those lessons into a single system, then tries to make that system learn.
The company’s published mission reaches further than automated pentesting. It imagines security that fades into the background, compared on its site to error-correcting memory or an immune system. There is a pleasing modesty hidden inside the grand ambition. Successful infrastructure rarely asks to be admired. It removes a category of worry, then quietly sends a bill.
Follow the bottleneck across jobs
Veiseh’s story offers a useful pattern for founders: expertise compounds when the same stubborn problem appears in different forms. At one company, the challenge was interpreting packets. At another, it was turning open-source scanning into an enterprise platform. At another, it was giving human testers better AI tools. Each role added context that a single clever weekend could not supply.
The result is founder-market fit in its least theatrical form. It is repetition with attention. Stay near a workflow long enough, notice where the handoffs fail, and the missing product eventually becomes embarrassingly visible. MindFort is Veiseh’s answer to the handoff between finding a vulnerability and fixing it, and to the gap between the pace of code and the pace of review.
There are still hard questions inside that answer: how reliably agents generalize, how their performance is measured, how costs behave at scale, and where customers will insist on a human judgment. Veiseh has publicly said benchmarks are in development, while keeping human review in the remediation loop. The shape of the bet is clearer than its final score.
For now, the company is hiring across engineering, research, growth, and sales. It is expanding beyond web applications toward APIs, networks, cloud environments, and remediation wherever the underlying flaw lives. The aspiration is a security team that is always present but seldom in the way, continuously testing the software and moving confirmed problems toward repair.
That would make the annual security report feel less like an event and more like an archaeological artifact. Somewhere, the Victorian postman may object. Everyone shipping code on Friday will probably cope.