A Security

**Product and the concrete problem it solves.** A Security emerged from stealth on 8 June 2026 with a single, sharply framed thesis: the attacker's economics have inverted. Where breaching a large enterprise once required scarce, expensive human red-team talent working in periodic engagements, AI-enabled adversaries can now search for weaknesses, chain them together, and automate large parts of an intrusion far faster and cheaper than any human team. A Security's answer is an autonomous platform that runs the full offensive lifecycle continuously — it maps an environment, finds vulnerabilities, and, crucially, chains them into the actual multi-step exploit paths an attacker would traverse, then validates that those paths are truly exploitable and helps eliminate them. The concrete problem it attacks is the gap between "you have 40,000 vulnerabilities" (the output of most scanners and posture tools) and "here are the three chained paths that actually lead an intruder to your crown-jewel data, proven exploitable, and here is how to cut them." CEO Yossi Torati's framing is blunt: the company claims to be "the only platform built to beat weaponized AI at its own game."

**Core technology and how it actually works.** The platform is built around paired **offensive and defensive AI agents**. Offensive agents operate with contextual awareness of the environment, continuously stress-testing domains and services under **scoped execution with full audit trails** — a design choice meant to make autonomous adversarial testing safe enough to run against production rather than only in isolated labs. Rather than stopping at isolated vulnerability identification, the offensive agents discover cross-domain exploit paths and prove exploitability, distinguishing a theoretical CVE from a live, reachable attack chain. Defensive agents then close the loop: once a path is validated, the system initiates remediation at the source and adjusts compensating controls so the same chain cannot be re-walked. The intended effect is a continuous, self-driving "purple team" — red and blue working in one loop — that compresses the discover-validate-fix cycle from quarterly engagements into an always-on process. The technical bet is that agentic automation is the only way to keep pace with attackers who are themselves becoming agentic; the calibration risk is that autonomous offensive tooling must be extraordinarily well-bounded to avoid causing the very disruption it is meant to prevent.

**Market, customers, and go-to-market.** A Security targets **large organizations in finance, healthcare, critical infrastructure, and technology** — precisely the sectors where a validated breach path carries regulatory, safety, and national-security consequences. Its go-to-market leans on design partners and named references that lend early credibility beyond a press release: PTC's CISO Matt Hart and Beazley Security's Chief Product and Technology Officer Francisco Donoso are cited as endorsing voices, and the company has described a case in which an organization warned by the FBI about a Russian cyber campaign used A Security to identify the relevant attack path and help prevent exploitation. The product sits in the fast-consolidating "autonomous security validation / exposure management" category, where buyers are shifting budget from periodic manual penetration tests and static vulnerability scores toward continuous, exploitability-driven validation. The natural GTM motion is land-and-expand into CISO organizations that already run vulnerability-management and breach-and-attack-simulation programs and are frustrated by alert volume decoupled from real risk.

**Traction, funding, and third-party validation.** A Security is unusually well-capitalized for a company just out of stealth: it has raised a total of **$37 million across two rounds** — a **$5M seed led by Cyberstarts** followed by a **$32M Series A co-led by Cyberstarts and Lightspeed Venture Partners** — with a striking angel roster that reads as a founder-to-founder vote of confidence from the top of the Israeli cyber ecosystem: **Assaf Rappaport (CEO of Wiz), Yotam Segev (CEO of Cyera), and Merav Bahat (founder of Dazz)**, alongside Cerca Partners. Cyberstarts and Lightspeed are among the most successful backers of the last decade of Israeli security exits, and their conviction — together with named enterprise design partners in PTC and Beazley Security — constitutes the strongest available third-party validation for a company that has not yet published customer counts, revenue, or independent benchmark results. The absence of disclosed hard metrics (headcount, ARR, number of paying customers) is the appropriate calibration point: the signals here are pedigree and backing, not yet proven scale.

**Founders and team background.** The founding team is the core of the diligence case. **Yossi Torati (CEO)** brings roughly two decades in enterprise cybersecurity, including about seven years in the Israeli Navy in computing and cyber roles and, most recently, service as Director of Enterprise Security at incident-response leader **Sygnia** — giving him a defender's-eye view of how real breaches unfold. Co-founders **Omer Gull (CPO)** and **Yuval Itzchakov (CTO)** are veterans of **IDF Unit 8200** and held senior roles at **Check Point Software** and the security-analytics company **Hunters** — a background that pairs elite offensive-signals heritage with commercial detection-and-response product experience. This blend — an operator-defender CEO plus two offense-steeped product/engineering leaders — is well matched to a product that must credibly automate both attack and defense. The principal team gap visible from public sources is go-to-market scale: enterprise security-validation sales are long and reference-driven, and the company's revenue leadership and customer-success bench are not yet documented.

**Competitive dynamics.** A Security enters one of the most crowded and best-funded corners of security. It competes with (1) **Pentera** (Israeli automated security validation / autonomous penetration testing, publicly the category leader); (2) **XM Cyber** (Israeli attack-path management and exposure analytics); (3) **Cymulate** (Israeli breach-and-attack-simulation and exposure validation); (4) **Horizon3.ai** (US, NodeZero autonomous pentesting); (5) a wave of AI-native pentest-agent entrants such as **XBOW, Terra Security, and Xint**; and (6) the incumbent alternative of **human red teams and consultancies** (Mandiant, Sygnia, and boutique offensive shops). A Security's claimed edge is threefold: (i) a **single autonomous loop that both attacks and remediates** rather than only reporting findings; (ii) an explicit design against **AI-enabled attackers**, betting the category is being redefined by agentic offense; and (iii) **safe scoped execution with audit trails** aimed at winning the trust needed to run continuously in production. Whether these amount to a durable moat versus a well-funded incumbent like Pentera — which already has customers, benchmarks, and channel — is the central competitive question, and it is unresolved.

**Defense, security, and resilience dual-use relevance.** The dual-use relevance is real but should be framed as adjacency plus capability, not as a fielded military system. Two threads make it credible. First, **critical-infrastructure protection**: A Security explicitly targets energy, utilities, healthcare, and other operators whose compromise is a national-resilience event, and its FBI/Russian-campaign case study places it squarely in the threat-informed-defense space that governments care about. Second, **the offensive-security capability itself is inherently dual-use**: autonomous, agentic red-teaming that discovers and chains exploit paths is exactly the kind of capability that national cyber commands, defense primes, and allied CERTs use for both hardening and operations. The founders' IDF Unit 8200 and Israeli-Navy provenance reinforces the pipeline between commercial and national-security cyber. The honest calibration: this is a commercial enterprise product sold to CISOs, and any defense or government use is a plausible extension rather than a disclosed, contracted reality as of mid-2026.

**Growth stage, trajectory, and key diligence risks.** A Security is best read as an **early-stage, top-tier-backed cyber venture with an unusually strong pedigree and an unusually unproven track record** — a classic Israeli-security "pedigree seed/Series A" profile. The bull case: an offense-native founding team, marquee investors (Cyberstarts, Lightspeed) and angels (Wiz, Cyera, Dazz founders), a genuinely timely thesis (agentic defense against agentic offense), and named enterprise design partners. The bear case should dominate diligence: (1) **crowded, well-funded market** where Pentera, XM Cyber, Cymulate, and Horizon3.ai already hold ground; (2) **no disclosed hard metrics** — customers, revenue, retention, or independent efficacy benchmarks — so the product's real-world exploit-validation quality is unverified; (3) **autonomous-offense safety risk** — a platform that actively exploits production systems carries operational and liability exposure that must be flawlessly bounded; (4) **thesis risk** — "weaponized AI" is a compelling narrative but partly aspirational, and buyers may not yet budget for it as a distinct category; and (5) **execution/GTM risk** — converting elite technical founders into an enterprise sales machine is non-trivial. Progression to a "mid" stage would require disclosed paying customers, independent validation of exploit-path accuracy, and evidence of net-new displacement of incumbent validation tools.