What it sells
Software supply chain security.
Business model breakdown
Buyer: who owns the budget?
UnverifiedEngineering and security leads at teams of 5+ developers for paid tiers.
Trigger: what makes them buy now?
UnverifiedMalicious or vulnerable open-source dependencies entering builds; Free plan promises to block malicious dependencies automatically and the Team plan cuts 60% of CVE false positives via reachability analysis.
Workflow: what inputs become what output?
Scans dependencies in repos and CI, flags risk types, blocks malicious packages and prioritizes by reachability.
Economics: what it saves and how it charges
Per-developer subscription tiers plus custom enterprise.
Distribution: how it reaches customers
Self-serve signup for Free, Team and Business; sales and GCP Marketplace for Enterprise.
Funding history and coverage
| Round date | Stage | Amount | Investors | Source |
|---|---|---|---|---|
| 2026-05-21 | — | $60M | — | news.google.com |
Profiles summarize public reporting and company websites. Business-model notes are MaxBC's reading of that material, not confirmed facts; unknowns are left blank rather than guessed. Updated 2026-10-12.