The pitch takes one sentence, which is unusual for a security company. You upload a compiled mobile app. A few minutes later you get the same app back, hardened - able to spot when someone is trying to reverse-engineer it, tamper with it, or run it on a rooted device, and able to fight back on its own. No SDK to wire in. No code to change. No configuration file to fill out. That is RASPIRE, and the founders will tell you the hard part was not building it. The hard part was watching, for years, how badly it was needed.
RASPIRE - a play on RASP, the industry term for Runtime Application Self-Protection - joined Y Combinator's P26 batch with a launch titled, plainly, "App Security at AI Speed." The company is small, three people, headquartered in San Francisco with Egyptian roots. But it is already protecting more than 25 production apps used by over 20 million people, most of them in banking, fintech, insurance and government services. Those are the sectors where a breach is not embarrassing. It is expensive, regulated, and sometimes front-page news.
The ProblemWhen building got cheap, securing became the bottleneck
There is a pattern that repeats in every technology shift. Whatever gets cheap gets abundant, and whatever sits next to it becomes the constraint. AI made writing an app dramatically cheaper. A team can now ship a mobile product in weeks that once took quarters. What did not get cheaper, or faster, or easier, was making that app safe to run in the wild.
Ask most engineering teams how they handle mobile security and you get some version of the same answer: it is the last box before launch, if it gets ticked at all. The existing tools do not help the timing. They ask for SDK integrations, configuration files, and someone on staff who understands the threat model well enough to tune them. That is real work, and real work always loses to a shipping deadline. So security gets deferred, or skipped, or quietly assumed to be the app store's job.
RASPIRE's founders, Kareem Selim and Hassan Mostafa, had a front-row seat to that gap. They met roughly a decade ago and spent years on the offensive side of security - winning capture-the-flag competitions and hackathons, then running hundreds of audits for banks, fintechs and enterprises. Between them they count around 15 years of finding ways into applications other people believed were locked. When you spend that long breaking things, you develop opinions about how they should have been built.
What It DoesProtection that happens after compile
RASPIRE's core idea is to move security to the one place that fits how teams actually work: after the build, not during it. A developer drops in a compiled file - an .apk, .aab, .ipa or .xcarchive. RASPIRE's AI reads the binary, works out the platform, stack and likely threats, and enables the right defenses automatically. What comes back is a hardened, signed app carrying protections against fraud, tampering, reverse engineering, and API abuse, plus root and jailbreak detection - none of which the customer had to write.
The word doing a lot of work there is runtime. Older, perimeter-style tools sit outside an application and filter what comes and goes. RASP lives inside it. It wraps around the app's own code and watches behavior as the app executes on a real device - intercepting suspicious calls, catching anomalies, and responding the moment something looks wrong. Perimeter tools guard the door. RASPIRE is in the room.
When it catches something, the event does not vanish into a log nobody reads. Each blocked attack streams to a dashboard with severity, context, and the mitigation RASPIRE already applied. Those events also flow into tools teams already run, such as Sentry and Datadog, so security shows up where engineers are already looking. RASPIRE can also identify an attacker at the device level and block that device for good, which matters when the same actor keeps knocking.
An SDK is a commitment: you integrate it, you maintain it, you ship around it. By hardening after compile instead, RASPIRE removes the integration project entirely. Security stops competing with the roadmap - it becomes a step in the pipeline that runs on every build.
Who Uses ItThe customers who cannot afford to guess
RASPIRE reports 16 customers across banking, fintech, healthcare and e-commerce. That mix is not an accident. These are the businesses where a compromised mobile app translates directly into stolen money, leaked medical records, or a compliance failure with regulators attached. They have the most to lose and the least patience for a six-month security integration, which makes them the natural first market for a tool that promises protection in minutes.
For a company this young, the traction numbers are the argument. More than 20 million end users sit behind apps RASPIRE protects, and its systems have blocked over 50,000 attacks in production. Each of those blocks is a small, unglamorous event - a tamper attempt, a reverse-engineering probe, a fraud script - stopped before it became a headline. The people using those apps will never know RASPIRE exists, which is exactly what good runtime protection looks like.
The DifferenceSame category, opposite friction
RASPIRE is not inventing app shielding. It sits in a category with established names - Guardsquare, Appdome, Promon, OneSpan, Zimperium - vendors that have protected mobile apps for years. What RASPIRE is betting on is not a new defense but a new default. The incumbents largely grew up in an SDK-and-integration world, where adding protection is a project with a timeline. RASPIRE's wager is that the timeline is the problem, and that a fully no-code, AI-tuned, post-compile workflow is what teams shipping at AI speed will actually adopt.
There is a quiet piece of product wisdom underneath that. The most durable security tools are the ones that disappear into a workflow, because anything that adds friction eventually gets turned off or worked around. By making protection a step that runs automatically in CI/CD, RASPIRE is trying to make the safe path the default path - so a team stays protected not through discipline, but through inertia. That is a better bet than hoping everyone remembers to be careful.
Business & BackingA small team with an outsized footprint
The model is business-to-business software: RASPIRE sells runtime protection as a service, with cloud or on-premise deployment for customers whose compliance rules demand it. On the funding side, the company has raised $505K from investors including 500 Global, the Sanabil 500 MENA Seed Accelerator, and Plus Venture Capital, and has been raising a seed round on top of its Y Combinator batch. Its most recent raise closed in early 2026.
What is notable is the ratio. Three people, roughly half a million dollars in early capital, and an app footprint reaching tens of millions of users. That leverage is the tell of infrastructure done right - a small team can protect a very large surface when the product does the hard work and the customer does almost none. It is also, not coincidentally, the shape of company Y Combinator likes to bet on.
RASPIRE's spec was written by scar tissue. Selim and Mostafa spent years finding their way into applications that were supposed to be secure. The product is, in effect, every lesson from those audits turned into a default - the defense they wished every app they broke into had already been running.
Where RASPIRE fits in the market is easy to state and hard to execute. It wants to be the layer that sits between "we built an app" and "we shipped a safe one," and to make those two things feel like a single action. If AI keeps accelerating how fast software gets built, the gap RASPIRE is standing in only gets wider - and a tool that closes it without asking anyone to slow down starts to look less like a nice-to-have and more like part of the pipeline.