vulnerability-detection
(6)
Wazuh makes security free. The work still costs.
An open-source security platform lets teams see more without buying another software licence. Its customers reveal where the savings begin, and where the real work moves.
winfunc
winfunc (formerly Asterisk, YC S24) is an AI-native security engineering platform that behaves like an autonomous hacker: it finds, verifies, and patches vulnerabilities in codebases. Instead of dumping thousands of unverified SAST alerts on engineers, winfunc spins up sandboxes, writes working proof-of-concept exploits, and only reports bugs it can actually trigger - aiming for near-zero false positives. Its agent has surfaced real vulnerabilities in Node.js, React, NGINX, Supabase, Bun, Sentry, Gumroad, Anthropic's MCP SDK, and others. Founded by Mufeed VH and Vivek R, the team previously built Devika, a popular open-source AI software engineer.
Veridise
Veridise is an Austin-based blockchain security company spun out of the UToPiA program-analysis research group at the University of Texas at Austin. It hardens Web3 by pairing expert human auditors with proprietary tools built on formal methods, fuzzing and program analysis. Veridise audits smart contracts, zero-knowledge circuits, blockchain implementations and dApps, and has completed 150+ audits for infrastructure protocols including Scroll, Linea, Succinct, Manta Network, RISC Zero and Semaphore.
depthfirst
depthfirst is a San Francisco applied AI lab building an AI-native security platform that detects, triages and remediates software vulnerabilities before attackers can exploit them. Its 'General Security Intelligence' uses custom AI agents and purpose-trained security models to read a company's code, business logic and infrastructure, surfacing more true-positive vulnerabilities while cutting false positives and delivering developer-ready fixes. Founded in 2024 by leaders from Databricks, Google DeepMind and Faire, the company raised $120M across Series A and B within a few months of leaving stealth.
Binarly
Binarly is a firmware and software supply chain security company that reads the code no one else looks at - the layer below the operating system. Its AI-powered Transparency Platform analyzes firmware binaries to surface known and unknown vulnerabilities, malicious implants, misconfigurations and cryptographic weaknesses, then builds a genuine software bill of materials by reconstructing dependencies from the binary itself rather than trusting a manifest. Founded in 2021 by veteran reverse engineers Alex Matrosov and Claudiu Teodorescu, the company has disclosed hundreds of high-impact firmware vulnerabilities, including the widely covered PKfail Secure Boot flaw.
ZeroPath
ZeroPath is an AI-native application security platform that automatically finds and fixes software vulnerabilities. Founded in 2024 by four security and engineering veterans - including a former Google Security Engineer and a former Tesla Red Team engineer - ZeroPath replaces noisy legacy SAST tools with an LLM-powered engine that understands code semantics, verifies exploitability, and generates working patches. Within a year of launch, over 1,000 organizations trust ZeroPath to scan more than 200,000 codebases per month.