Kareem Selim has built a career around the moment software stops behaving politely. A mobile app leaves the safety of its development environment, lands on a stranger's phone and meets the inventive attention of someone trying to pry it open. Selim spent years on that attacking side of the table, testing applications for banks, fintech companies and enterprises. The work taught him a useful form of pessimism: a protected backend does not automatically produce a protected app.
Now he is selling the opposite experience. At RASPIRE, the San Francisco company he co-founded with Hassan Mostafa, a team uploads a compiled Android or iOS build. The platform applies runtime defenses without asking for source-code changes or another SDK. The hardened app can plug back into the release workflow while its security team receives live information about suspicious devices and attacks.
The contrast is neat enough for a founder bio. Selim puts it in seven words: “Used to break apps for a living.” But the story behind the line is less tidy, and more useful. It runs through college capture-the-flag competitions, security-awards lists, a winning game called League of Leets, hundreds of audits, a national hackathon and ten years of working beside the same collaborator. The one-click product sits on top of a great many decidedly non-one-click lessons.
Learning to see the hidden door
Capture-the-flag contests reward a particular habit of mind. The obvious entrance is rarely the interesting one. You inspect assumptions, follow odd behavior and keep pulling a thread after the interface has assured you everything is fine. Selim remembers joining CyberTalents CTFs in college. By December 2017, his public record lists him as a cybersecurity mentor with Major League Hacking. He was not only collecting flags. He was helping other people understand why the flag had been hidden there.
The scorecard filled quickly. In 2019, he recorded runner-up finishes in the Kaspersky Secure'IT Cup, Trend Micro's CloudSec CTF and Arab Security Cyber WarGames. In 2020 came another string of results: runner-up in the Egyptian Junior Researcher Competition and Arab Security Cyber Wargames Championship, plus a place among the global top 20 in Google's Solution Challenge.
That October, Selim, Mostafa and Abdul Rahman Yousry entered Kaspersky's Middle East Secur'IT Cup as 1337 Geeks. Their project, League of Leets, was a security-awareness game. It won. The detail matters because it shows Selim's instinct before RASPIRE: take specialist security knowledge and turn it into something a wider group can actually use.
“Protecting the backend is only half the problem.”Kareem Selim
Selim kept adding formal proof to practical work. He earned eWPTXv2, an AWS cloud security credential, Offensive Security Web Expert, Certified Red Team Professional and Certified Cloud Native Security Expert certifications between 2021 and 2023. In November 2021, he appeared on Google's Vulnerability Reward Program leaderboard. The list suggests range, but its underlying theme is narrower: how an attacker reaches, examines and changes a live system.
A hackathon gave the problem a name
In May 2023, Selim and Mostafa entered the WE INNOVATE Cybersecurity Hackathon, staged with Telecom Egypt and Egypt's national computer emergency team. More than 1,500 participants submitted hundreds of ideas. The pair reached the final and spent three days developing a software-security solution. They called it RASPIRE.
The pitch was multi-layered application shielding: protect mobile apps from malicious attacks while they run. It won first place. A hackathon is not a company, of course. It is a compressed laboratory with a deadline, judges and no place for a sprawling explanation. Winning suggested the pair could state a real problem and demonstrate a credible answer. Consulting work supplied the rest of the evidence.
Across audits for banks, fintech companies and enterprises, Selim and Mostafa saw the same awkward handoff. Scanners and penetration tests identified vulnerabilities before release. Then the application shipped into environments its developer did not control. Attackers could inspect business logic, tamper with code, hook functions, run the app on compromised devices or abuse the APIs it called. Conventional protection often introduced an SDK, configuration work and changes inside the source tree. Security became another integration project, complete with its own calendar.
The post-build protection loop
RASPIRE's product thesis is that the defense should meet the app after compilation. Upload the binary, let the system choose and apply relevant protections, sign the result, return it to the pipeline. The company describes an under-60-minute path and zero required code changes. Its controls cover tampering, reverse engineering, debugging, hooking, risky devices, screen capture and suspicious network behavior. Security teams can send events into monitoring systems they already use.
There is an appealing editorial economy to this. Developers get to continue being developers. Security teams get controls and visibility. The app gets armor without a long appointment at the tailor. It is also a demanding promise. Runtime protection must be strong enough to matter, quiet enough not to disrupt users and simple enough that release teams keep it switched on.
Ten years before the first application
Founders often meet through an optimized search: a matching platform, a warm introduction, a networking dinner where everyone is mentally checking boxes. Selim and Mostafa had already spent a decade solving problems together. They had competed together, lost together, won together and examined real applications under pressure. By the time RASPIRE applied to Y Combinator, the co-founder interview had effectively lasted years.
They applied once. Y Combinator accepted them into its Spring 2026 batch. Selim and Mostafa packed their gear and moved to San Francisco. The clean first-try result makes a good post. It becomes more instructive when viewed as the final click after years of loading the page.
Begins mentoring cybersecurity participants through Major League Hacking.
Wins Kaspersky's Middle East Secur'IT Cup with the League of Leets team.
Appears on Google's VRP leaderboard and earns the OSWE certification.
Wins WE INNOVATE with the first RASPIRE application-shielding concept.
Co-founds RASPIRE and brings its demo to Black Hat MEA in Riyadh.
Joins YC P26, moves to San Francisco and launches RASPIRE publicly.
Near the end of the batch, Selim listened to Paul Graham talk about Y Combinator's beginning and its early struggles. He described the moment as a reminder of how unlikely durable institutions can look at the start. Then he managed to get a selfie with Graham and added a small founder-era joke: he promised the photo was not AI-generated.
His more serious test for YC's “Make Something People Want” is customer feedback. RASPIRE says applications using its protection now serve more than 20 million end users across regulated and high-risk businesses. Its YC launch presents a three-person company founded in 2025. Small team, large distribution surface: exactly the sort of asymmetry software founders adore and security people learn to distrust. Selim's job is to make the asymmetry defensible.
“If you can build an app in one click, you should be able to secure it in one click.”RASPIRE's founding proposition
What builders can steal
The first lesson is that simplicity can be the product of accumulated scar tissue. RASPIRE's no-code workflow did not come from avoiding technical depth. It came from seeing where technical depth repeatedly turned into integration drag. Selim's offensive-security background gave him the vocabulary to build controls. His consulting background showed him which controls organizations could realistically deploy.
The second lesson is to treat distribution as a design input. A mobile defense that requires a source rewrite must win cooperation from every team touching the application. A post-build system can enter closer to the release gate. This does not remove the hard security work. It moves organizational friction out of the customer's path.
Years of audits made the final product sentence smaller, not bigger.
Competitions created deadlines, disagreement and feedback long before incorporation.
No SDK and no source changes are product features because calendars are part of security.
Runtime telemetry turns protection from a launch task into an operating habit.
The third lesson concerns partnership. Ten years is not a guarantee against founder trouble. It is, however, a useful archive. Selim and Mostafa knew how the other behaved when a challenge was ambiguous, a clock was running and the first attempt failed. Their old competition record became quiet diligence for the new company.
RASPIRE is still early. Its current chapter is a founder and a small team converting a specific professional frustration into a repeatable product. The ambition is not to make every developer a security expert. Selim has spent enough time becoming one himself. The ambition is to package that expertise so a team can secure what it ships, watch what happens next and release again without turning protection into a season-long project.
There is a final symmetry in Selim returning to CyberTalents for the community's tenth-anniversary celebration. He had once joined its CTFs as a college student. He came back as a founder invited to discuss how the regional cybersecurity ecosystem had evolved. In between, the student learned to break applications, the consultant learned why they stayed breakable, and the founder decided the fix should begin with an upload button.