SubImage wants to hand every security team a map of their own cloud

Ask a security team a simple question - if one API key leaked right now, what could it reach? - and watch the room go quiet. Most companies cannot answer quickly. Their infrastructure is spread across a dozen cloud accounts, a stack of SaaS tools, and years of permissions nobody remembers granting. The information exists. It just isn't connected. SubImage, a five-person company out of San Francisco, is built around closing that gap.

The pitch is unusually concrete for a security startup. Instead of another feed of red alerts, SubImage builds a graph of your entire environment - every asset and every relationship between them - and lets you query it. Who can access this database? What sits between the public internet and our secrets? Show me the shortest path an attacker would take. The company calls it "the open-core security graph," and describes what it produces as "a complete, queryable map of who can access what, and why."

01 / The OriginA tool built at Lyft, years before the company existed

The unusual thing about SubImage is that the hard part was finished before the company started. In 2019, a team at Lyft open-sourced a Python tool called Cartography. Its job was to pull infrastructure assets and the relationships between them into a Neo4j graph database, so that service owners, red teamers, and defenders could all reason about the same map. One of its creators was Alex Chantavy, then a staff engineer on Lyft's security team.

Cartography did not stay a Lyft project. It was accepted into the Cloud Native Computing Foundation in August 2024, the same body that stewards Kubernetes. Today it carries roughly 4,000 stars on GitHub, ships more than 30 integrations - AWS, GCP, Azure, Okta, GitHub, Kubernetes, and on - and, by the company's account, is run by more than 70 organizations, including seven of the Fortune 100. That is a rare position for a founder to start from: a product-shaped thing that thousands of engineers already trust, built by the people now selling the commercial version.

02 / The FoundersFifteen years of breaking in, applied to keeping people out

Chantavy is the co-founder and CEO. Before Lyft he spent time at the NSA and on Microsoft's Red Team, the internal group paid to attack the company the way a real adversary would. That background matters for how SubImage thinks: attackers do not read a list of misconfigurations top to bottom. They follow paths - from a foothold, to a credential, to the thing they actually want. A graph is how you see those paths coming.

His co-founder, Kunaal Sikka, is the company's president. He went from new grad to staff engineer at Lyft in four years, worked on the systems behind SIEM, insider-abuse detection, and vulnerability management, and later spent time at Anthropic before the two reunited to build SubImage. They co-created Cartography together. In a field crowded with founders who discovered a problem in a pitch deck, SubImage's team lived inside this one for the better part of a decade.

03 / The ProductFrom a list of problems to a map of connections

The managed platform is agentless. It connects to your environment with read-only API access, which means there is no software to install on every machine and no new attack surface to defend. From there it assembles the graph and layers on the things security teams actually do all day: attack path analysis, cloud security posture management, an AI-assisted asset inventory, and a natural-language query interface so you can ask questions without learning a graph query language. It plugs into the SIEM, SOAR, and ticketing tools teams already run.

The demo the founders like to give is a leaked key. You start from a single stolen credential and watch the graph light up every place it can reach - which is usually more, and more surprising, than anyone in the room expected. That is the product in one image: not a longer list of things that are wrong, but a map of how the wrong things connect.

The graph model is doing quiet work here. A conventional scanner treats each finding as an island - this bucket is public, that role is over-permissioned, this instance is unpatched - and leaves a human to guess whether any of them line up into something dangerous. Cartography's contribution was to store the relationships as first-class data, so the connection between a leaked key and a production database is a query, not a hunch. The roadmap the founders describe extends that idea: permission management and enforcement, continuous alerting when a risky change lands, and agentic remediation that helps close the gap rather than just naming it.

04 / The BetAn open-core alternative to a very well-funded incumbent

There is no polite way to say who the giant in this room is: Wiz, the cloud security company Google agreed to buy for a reported $32 billion. SubImage does not pretend to match that budget. It picks a different axis to compete on. Where the incumbents ship a polished black box, SubImage's foundation is open source and community-governed. For a buyer who has been burned by tools they could not inspect, the ability to read the code - and to have already been running it for years - is not a footnote. It is the reason to take the call.

Approach	SubImage	Typical CNAPP
Core engine	Open source (Cartography, CNCF)	Proprietary / closed
Model	Graph of relationships	Findings list
Deployment	Agentless, read-only API	Mixed / agents
Query	Natural language	Predefined dashboards

The strategy has a name in developer tools: open-core. The project earns trust and distribution the slow way, one integration and one grateful engineer at a time. The company monetizes the teams who would rather pay for a managed, supported version than run the graph themselves. SubImage did not manufacture demand. It grew a company inside a community that already existed.

05 / The MarketSelling to the CISO on an enterprise clock

SubImage sells to security leaders and the engineers under them, on enterprise terms - six-figure annual contracts, procurement reviews, the works. That reality collided with startup life in an instructive way. During Y Combinator's Winter 2025 batch, the founders have recounted, a partner warned them that their fundraise was at risk if a stalled first enterprise deal did not close. It was week ten. The contract was stuck in procurement. YC's playbook is built for fast, self-serve growth; enterprise security moves on a slower clock. Learning to hold both timelines at once was, by their telling, the harder skill than any of the engineering.

The money followed. SubImage closed a $4.2 million seed round announced in late November 2025, with Y Combinator, Funders Club, Transpose Platform, Phosphor Capital, and a group of angels. Named customers so far include Veriff and Corelight. It was, notably, the only security company in its YC batch - a lonely spot that doubled as a filter on whose advice to take.

06 / Why It MattersClarity as a product, not fear

Most of the security industry sells fear, and most security dashboards are built to produce it: more findings, more red, more things you did not know were broken. SubImage is selling the opposite. When you can see the whole board - every asset, every path, every access grant, connected - you stop reacting to alerts and start making decisions. That is a smaller promise than "we will stop every breach," and a more honest one.

There is a second audience worth naming: the security engineer who is already tired. Cloud estates keep growing, SaaS keeps multiplying, and the person on call is expected to hold the whole shape of it in their head. A queryable map is not a luxury for that person - it is the difference between answering an incident question in minutes and spending an afternoon spelunking through consoles. What people can do with SubImage, in plain terms, is ask their infrastructure a question and get an answer they can act on before the next alert fires.

Whether open-core is a durable moat against a $32 billion incumbent is the open question, and it will take years to answer. But the shape of the bet is clear, and it rests on something real: a tool thousands of engineers already run, built by the people now asking to be paid for the managed version. In security, where trust is the whole game, starting from trust is not the worst place to begin.