Pi

**Product and the concrete problem it solves.** Pi is aimed at the part of application security that remains stubbornly manual after vulnerability discovery: deciding what a finding means in a particular environment, locating every related instance, fixing it without breaking the product, and preventing the same mistake from returning. AI-assisted coding has increased the volume and speed of software production, but it also multiplies the number of places where an insecure pattern can be introduced. A conventional scanner usually emits a finding or ticket tied to one file, package, or endpoint. Pi's thesis is that a finding is evidence of an underlying behavioral or architectural mistake, not an isolated event. Its platform is designed to ingest the codebase, design and architecture documents, cloud infrastructure, penetration-test reports, tickets, past incidents, prior fixes, and accepted-risk decisions into what it calls institutional security memory. That context is meant to help a security team distinguish exploitable risk from noise, explain why a weakness matters in the organization's real architecture, and move from repeated ticket handling toward permanent remediation. The practical promise is a shorter path from a report to a safe fix and fewer repeat vulnerabilities across repositories, services, and teams.

**Core technology and how it works.** The most specific technical differentiator in Pi's public material is root-cause and variant analysis rather than simple pattern matching. Pi says it traces a vulnerability to its architectural source, abstracts the mistake into a behavioral anti-pattern, then searches for related manifestations across languages, repositories, and services. Its platform page describes a pipeline of ingesting and indexing security history, detecting root causes, generating fixes in the conventions of a customer's codebase, delivering those fixes into developer workflows, and enforcing the lesson as a guardrail in IDEs and pull requests. The company's August 2026 research post provides a concrete example. During an authorized proof of value, Pi says it found an AWS credential-leak path caused by an AWS SDK region value being inserted into an endpoint without adequate host validation. It then abstracted the defect and found related instances across C#/.NET, JavaScript, C++, Swift, Rust, and Go SDKs. Pi reports 2,024 affected packages across seven SDK families and says the variants were manually confirmed before coordinated disclosure. This is company research and not an independent benchmark, but it demonstrates the intended mechanism: generalize from the shape of a defect, not the exact syntax, then connect discovery, remediation, and prevention.

**Market, customers, and go-to-market.** Pi sells into the overlap between application security, product security, cloud security, and software engineering. The buyer is likely a security leader or product-security team that already owns scanners, penetration testing, bug bounty intake, cloud controls, and developer tooling but cannot provide enough expert attention to every finding. The adjacent user is the engineering organization that must understand and safely implement a remediation without stopping delivery. Pi's public website presents a direct enterprise motion with a demo request, integrations into existing development workflows, and an AI security assistant named Sloane that answers questions about the codebase and security history. Its company page shows a product intended to sit alongside the tools a team already uses rather than replace every scanner or CI system. The official site displays customer-reference logos for Lemonade, Teramind, and Navan, while Israeli business reporting describes additional unnamed customers including a leading AI laboratory, cybersecurity companies, a global social network, and companies in travel and insurance. Those references indicate early commercial access, but the public record does not disclose contract values, recurring revenue, retention, deployment counts, or the precise scope of each customer relationship. The natural expansion path is from triage and variant discovery into automated remediation, threat modeling, secure design review, and preventative controls for AI-generated code.

**Traction, funding, and third-party validation.** Pi emerged from stealth on June 10, 2026 with approximately $35 million raised in two rounds. CTech and other Israeli technology outlets report a $10 million Seed round led by Brightmind Partners in early 2025 and a $25 million Series A led by Third Point Ventures, with participation from George Kurtz of CrowdStrike and Armis founders Yevgeny Dibrov and Nadir Izrael. The capital and investor composition are meaningful signals for a company whose product depends on both offensive-security judgment and enterprise software execution, but they are not proof of product-market fit. Pi's own website identifies Brightmind Partners, Third Point Ventures, Recursive Ventures, and QP Ventures among its investors. Public technical validation is stronger than a generic launch claim because Pi has published a detailed coordinated-disclosure account of the AWS SDK vulnerability and because independent reporting explains the company's approach in terms of variant analysis, contextual repair, and security memory. In that research account, Pi says it closed a customer mitigation 26 days before an upstream SDK patch existed and disclosed related instances to affected companies. These statements remain primarily company-reported, and the human verification described in the write-up is an important limitation: the machine generalized the pattern, but researchers made the final disclosure decision. The record should therefore treat the research as a credible demonstration of method and security seriousness, not as a substitute for independent efficacy testing.

**Founders and team background.** Pi was founded by Guy Arazi and Yoni Ramon in 2025. Pi's official About page identifies Arazi as CEO and Ramon as CPO. Geektime reports that Arazi previously worked as a security researcher at Microsoft, where variant analysis was a significant part of his work, while Ramon led offensive security and internal hacking teams for Tesla and accumulated engineering experience at SpaceX. Their backgrounds are unusually complementary for the problem Pi is tackling. Arazi's experience points toward understanding how a single vulnerability can recur across a large software estate, while Ramon's work in vehicle and robotics security implies experience with distributed, safety-sensitive systems in which a compromise can propagate through software, cloud services, and physical operations. The founders also bring a security-research orientation rather than only a generic enterprise-AI profile. Public materials do not provide a complete headcount breakdown, detailed biographies for other employees, military-unit affiliations, patent counts, or the company's precise R&D allocation between Israel and the United States. Israeli reporting puts the company at approximately 23 employees across Tel Aviv and San Francisco in June 2026. That is a credible early team size for a focused product-security platform, but it also means Pi must scale model evaluation, integrations, customer support, and security operations without losing the expert judgment its product is trying to encode.

**Competitive dynamics.** Pi faces competition from several categories with different strengths. Static and dynamic application-security vendors such as Snyk, Checkmarx, Veracode, and GitLab can identify large volumes of code and dependency weaknesses and already sit in developer workflows. Apiiro and OX Security compete on application-risk context, software supply-chain visibility, and prioritization. Semgrep and Endor Labs bring developer-facing analysis and code or dependency intelligence. Large cloud and security platforms, including Microsoft, Palo Alto Networks, and CrowdStrike, can bundle AI-assisted vulnerability triage into existing enterprise contracts. Pi's claimed advantage is not that it finds more individual bugs; it is that one validated finding can be converted into a generalizable anti-pattern, searched across the estate, fixed in context, and remembered as a future control. That could reduce repetitive expert work and create a data flywheel in which every customer fix improves its organization's security memory. The vulnerability is that this advantage may be difficult to defend if foundation models and incumbent platforms become good at repository-wide reasoning. Pi also has to prove that autonomous changes are safe, reviewable, reversible, and compatible with a customer's coding conventions. Its strongest current edge is the combination of offensive-security expertise, cross-language variant analysis, and a product that connects research, remediation, and prevention rather than stopping at a scanner alert.

**Defense, security, and resilience dual-use relevance.** Pi's core technology is directly dual-use because product security protects both commercial software and the software supply chains supporting defense, government, critical infrastructure, healthcare, transportation, and financial systems. A defense contractor may have thousands of repositories, inherited libraries, cloud services, embedded components, and engineering teams, making a single recurring vulnerability class more consequential than one ticket suggests. Root-cause analysis and variant hunting can help identify the same insecure behavior across mission software, logistics systems, identity services, operational technology gateways, or vendor dependencies. Contextual fixes and pull-request guardrails are also relevant to resilience because they can stop a previously learned failure mode before it enters a release, while the company's security-memory thesis addresses the loss of expertise when personnel rotate or projects change hands. Ramon's reported experience securing vehicle and robotics systems strengthens the adjacency to autonomy and defense systems, although it does not establish that Pi itself has built a defense product. No public source reviewed discloses an Israeli Ministry of Defense contract, classified deployment, government accreditation, or military customer. The responsible interpretation is therefore a high-relevance cyber-resilience capability with a credible path into defense-industrial and critical-infrastructure environments, subject to data-residency, secure-development, human-approval, isolated-deployment, and export-control diligence.

**Growth stage, trajectory, and key diligence risks.** Pi is best classified as early stage. It was founded in 2025, emerged from stealth in 2026, has a reported 23-person team, and has raised substantial early capital, but its public commercial history is short. The trajectory depends on converting a technically compelling research workflow into a repeatable enterprise product. The bull case is that AI-generated code and rising vulnerability volume make repository-wide context and permanent prevention more valuable than another incremental detector; the founders' backgrounds and early customer references give that thesis credibility. The principal risks are: (1) **automation safety**, because a bad fix or over-aggressive guardrail can break production software or create a new vulnerability; (2) **validation risk**, because the strongest public results are company-reported and include human confirmation; (3) **data and trust risk**, because Pi needs access to sensitive source code, architecture, incidents, tickets, and cloud context; (4) **incumbent bundling**, because established application-security and cloud platforms can add agentic remediation to distribution they already own; (5) **model reliability and cost**, because cross-language reasoning, codebase indexing, and repeated scans may be expensive and inconsistent at scale; (6) **customer concentration and disclosure**, because public references do not establish revenue, retention, or large deployment counts; and (7) **defense-readiness gap**, because no public evidence yet shows government accreditation, disconnected operation, or defense procurement. Milestones that would move Pi toward mid-stage include independently reproducible variant-analysis results, referenceable production customers, measured remediation time and recurrence reduction, audited data-isolation controls, retention and expansion evidence, and a first high-assurance or defense-industrial deployment.