There is a particular kind of confidence that comes from having already broken the thing everyone else is afraid of. The four people behind Nebula Security have spent years inside the Linux kernel and Google Chrome, the two most poked-at codebases on the planet, and they walked out with roughly $400,000 in bug bounties and a reputation. Now they have pointed that same instinct at a different target: the software your company ships every week.
Nebula Security is an AI-native cybersecurity company that came out of Y Combinator's Summer 2026 batch. The one-line version, taken from their own site, is almost aggressively plain: "a security engineer in your team." The longer version is more interesting, because the team is not a typical group of founders and the product is not a typical scanner.
The timing is not an accident. The same generative AI that lets a junior developer ship a feature over a weekend also lets an attacker read a codebase, spot a weakness, and write the exploit faster than any defender can review the pull request. Security has always been asymmetric - the attacker needs one hole, the defender has to cover all of them - and AI widens that gap. Nebula's founders looked at that shift and decided the only sane response was to hand defenders a tool built by the people who already win on the other side.
01 / What it doesAn audit that thinks like an attacker
Most security tooling checks your code against a list of known-bad patterns and hands back a report. Nebula's pitch is that this is the wrong shape for the problem. Real attackers do not read a checklist. They chain small, boring weaknesses into something that actually works, and they only care about the bugs that let them in.
So Nebula sells two things. The first is VEGA, their code-scanning agent, described as bringing "Mythos-level protection to everyone." The second is a hands-on security audit, run by the AI agent alongside the founders themselves, that looks at a product from code-level bugs all the way up to architectural weak points. The tagline for that service reads like a warning printed on the side of the box: "Don't let a data breach be your first security audit."
02 / The productFind the bug, prove it, then fix it
What separates VEGA from a linter is the loop it runs. It does not stop at flagging a suspicious line. According to the company, the agent autonomously discovers bugs in a codebase, keeps watching as the code changes, works out the root cause, then writes a proof-of-concept exploit to demonstrate the bug is real, and finally produces a ready-to-use patch. It also gives an overall read on how healthy the code is.
That "prove it" step matters more than it sounds. Anyone who has run a security scanner knows the real cost is not the bugs it finds, it is the false alarms it invents. A finding that arrives with a working exploit attached is one an engineer cannot argue with, and one they cannot safely ignore. It is the difference between a smoke detector and a photograph of the fire.
03 / The peopleA founding team from the world's #1 CTF squad
Security companies love to say they were "founded by hackers." Nebula has the receipts. The four cofounders are drawn from r3kapig, ranked the world's number-one hacking team in 2025, and their individual histories read like a capture-the-flag hall of fame.
Xiaochen Zou, who goes by Eten, is the CEO. He holds a PhD in cybersecurity focused on automated vulnerability research, has won Pwn2Own, and previously worked at Microsoft. Yuan Tan, the CTO, is a Black Hat USA speaker with a background in system security and DARPA-funded research. Frank Wu is a Black Hat speaker and DEF CON finalist who led a repair team in DARPA's AI Cyber Challenge. Xiaochuan Yu is a three-time DEF CON finalist who earned more than $200,000 on his own from Chrome bug bounties.
It is a specific kind of background, and it shapes what the company chooses to build. Automated vulnerability research - teaching a machine to hunt bugs without a human holding its hand - is exactly what Zou spent his PhD on, and it is the core of VEGA. DARPA's AI Cyber Challenge, which two of the founders touched, was essentially a public dress rehearsal for the idea that autonomous systems could find and repair flaws in real software. Nebula reads like that thesis turned into a company, with the competition trophies swapped for a product.
04 / The proofIonStack, and a scan that found 600 bugs
The clearest evidence that the approach works is the trail of things the team has already broken. They unveiled IonStack, a browser-to-kernel exploit chain built on two zero-day vulnerabilities affecting Firefox and Linux, bugs that had quietly survived roughly fifteen years of review. Both were discovered not by a human staring at a screen but by VEGA. The group has also claimed to be first to build a remote-code-execution exploit for Nginx and among the first to root Android 17.
At a Linux netdev conference, the team showed VEGA finding more than 600 vulnerabilities in a single scan, then sent over 100 patches upstream. That is the demo that reframes the pitch. It is one thing to say an AI can find bugs. It is another to point it at the operating system running most of the internet and watch it fill a page.
Figures self-reported by Nebula Security. Bars scaled for comparison, not to a single axis.
05 / Who it's forTeams that will never hire a hacker this good
The customer here is any company that ships code and cannot realistically staff a team of DEF CON finalists in-house. That describes almost everyone. A startup racing to launch does not have a Pwn2Own winner on payroll. A mid-size product team knows its architecture has soft spots but has no way to see them the way an attacker would. Nebula's answer is to rent out that perspective, part software, part human.
There is a second, subtler product buried in the model: the phrase "Audited by Nebula Security." The company positions it as a mark of credibility, a signal to customers, investors, and partners that a product has been reviewed by people who genuinely know how to break things. If that badge catches on, the audit stops being a cost line and becomes something a company wants to show off. Trust, packaged.
The business model follows the two products. VEGA is the software layer - a scanner that can run continuously against a codebase and flag trouble as it appears, priced to scale. The audit is the high-touch layer, where the founders themselves get involved for the reviews that matter most, the kind a startup runs before a big launch or a fundraise. One is a subscription; the other is closer to a service with a name attached. Together they cover both ends of a company's security budget, the always-on and the once-in-a-while.
06 / The marketEveryone has AI now, including the other side
Nebula is stepping into a field that is getting crowded fast. On one side sit the established application-security scanners, the Snyks and Semgreps and Veracodes of the world, tools engineers already run in their pipelines. On another sit the human penetration-testing firms, thorough but expensive and slow to schedule. And in the middle, a new wave of AI-security startups is racing to build autonomous agents that hunt bugs on their own.
Nebula's wager is that offensive pedigree is the hard-to-copy part. Plenty of teams can wire a language model to a codebase. Far fewer have personally chained zero-days through a browser and into a kernel, and know from experience which findings are noise and which are a door. The founders built VEGA to think the way they do, which is the way an attacker does. Whether that edge holds as the tools commoditize is the open question, and it is the one worth watching.
For now, the company is small - three or four people, remote, headquartered in Washington State, freshly stamped by Y Combinator. The ambition is not. If software is the thing the modern world quietly runs on, Nebula's goal is to be the crew that checks the locks before anyone else tries the handle.