API and runtime

OpenAPI-first API security that audits the contract, tests it, then wraps a micro-firewall around the live endpoint.

Released OAS 3.1 support for API Protection in the 42Crunch platform, February 2026

IAST, RASP, and ADR that instrument the running app so exploits are seen in the code path, not the packet.

Published the Software Under Siege 2025 report on application-layer attacks, August 2025

AI pentesting for APIs and web apps that proves exploitability, including IDOR and business logic, not just crawler noise.

Raised $18M to expand agentic pentesting for APIs and business logic, March 2026

Runtime API and AI security with eBPF visibility, agentless discovery, and inline protection that stays off the data path for privacy.

Shipped Launch Week 2026 with AI Firewall, AI Gateway, and MCP discovery and testing, February 2026

Application detection and response that watches live code execution and blocks exploits as they run.

Raised $60M, crossing $140M in total funding, August 2026

Runtime API security that discovers shadow and zombie APIs, then spots business-logic abuse in live traffic.

Published a year of monthly API and AI security releases, December 2025

Developer-first API DAST that runs in CI so AI-generated endpoints get tested before they ship.

Raised $12M strategic round from Sapphire and Costanoa, total $47.3M, May 2025

Inline API and agent security that blocks abuse in real time instead of paging after the request lands.

Raised $55M Series C led by Toba Capital, July 2025