What it sells
Protects organizations from getting breached through their APIs.
Business model breakdown
Buyer: who owns the budget?
UnverifiedCISO / application security and API security teams.
Trigger: what makes them buy now?
Shadow APIs, behavioral API attacks and new risk from AI agents and MCP expanding the attack surface.
Workflow: what inputs become what output?
Discover APIs (Surface, Connect, Collect) -> build inventory and posture governance -> detect and block logic-based attacks (Protect) -> enforce policy inside AI coding agents (Code).
Distribution: how it reaches customers
Enterprise sales plus partners/integrations (CrowdStrike, AWS, Azure, Google, Kong, HCL), free API attack surface assessment as lead magnet.
Funding history and coverage
| Round date | Stage | Amount | Investors | Source |
|---|---|---|---|---|
| — | Y Combinator Winter 2016 | — | Y Combinator | ycombinator.com |
Profiles summarize public reporting and company websites. Business-model notes are MaxBC's reading of that material, not confirmed facts; unknowns are left blank rather than guessed. Updated 2026-10-12.