Raven.io

**Product and the concrete problem it solves.** Raven.io is aimed at a gap between conventional application security and conventional runtime infrastructure security. Organizations can scan source code and dependencies before deployment, inspect hosts and containers while they run, and filter requests at a web boundary, but those controls do not necessarily explain which application library or function actually executed an attacker-controlled path in production. Raven’s product thesis is that the application itself should become observable and protectable while it is running. The practical customer problem is prioritization and response: large teams receive lists of CVEs and suspicious process events, yet cannot reliably tell whether a vulnerable function is loaded, reachable, or being abused in a live service. Raven combines runtime software-composition analysis, application detection and response, and prevention so a security or engineering team can move from an application event to the responsible package, function, and call chain. That is particularly relevant as AI-assisted development increases the volume of code and dependencies entering production faster than manual AppSec review can keep up.

**Core technology and how it actually works.** Raven’s public technical material describes a sensor architecture built on eBPF plus patented library-level monitoring. The intended output is not merely that a Python process spawned a child process or that a container made a network connection; it is a deterministic execution trail showing which application libraries executed, in what order, and where behavior deviated. Raven says it can observe runtime software components and connect an observed action to a language runtime, package, library, function, and call path. Its examples span Java and JVM languages, JavaScript and Node.js, Python, Go, Ruby, C++, C, Rust, PHP, Scala, and Kotlin. The company emphasizes no code injection, no request replay, and no data-exfiltration pipeline as part of its production design, although those claims require independent performance and security testing. The engineering challenge is substantial: runtime instrumentation must preserve latency and availability, maintain context across language runtimes and native libraries, handle containers and modern deployment patterns, and avoid collecting sensitive application data. A successful implementation would turn execution evidence into both detection and an explanation suitable for remediation, whereas a noisy or high-overhead sensor would be difficult to deploy in high-throughput services.

**Market, customers, and go-to-market.** Raven sells into the overlap of application security, cloud security, vulnerability management, and security operations. Its natural buyers include CISOs and AppSec leaders who need to reduce a backlog of dependency findings, cloud-security teams that need more context than process and network events provide, and engineering organizations responsible for fixing production risk without taking services offline. The go-to-market is initially enterprise and U.S.-oriented: Raven’s March 2026 funding coverage says the capital would accelerate product development, U.S. go-to-market activity, and hiring. Geektime reported that the company already had a double-digit number of customers, mostly large organizations in finance, banking, and insurance; that is a useful early traction signal, but it is media-reported and does not establish customer names, recurring revenue, retention, or production scale. Raven’s technical blog is also a distribution asset: it explains the runtime-application-security category in concrete terms and positions the company against EDR, cloud workload protection, WAF, and software-composition analysis. The sales wedge is credible because teams can use runtime evidence to make existing security investments more actionable, but a new runtime sensor still has to earn deployment approval, integrate with CI/CD and SOC workflows, and prove that it reduces incidents or remediation time rather than adding another console.

**Traction, funding, and third-party validation.** Raven emerged publicly with a combined $20 million Seed and post-Seed financing, reported in March 2026. The Seed was led by Norwest Venture Partners and the post-Seed extension by Elron Ventures, with participation reported from UpWest, RedSeed, SentinelOne, Jibe Ventures, Dnipro VC, and Elron’s CyberFuture microfund. SentinelOne’s participation is strategically notable because an endpoint-security incumbent is also a potential partner, channel, or future competitor. The company says it is built for production and has published language-support and runtime-ADR material, while independent coverage describes a double-digit customer base concentrated in large financial institutions. These are meaningful validation signals for a young Israeli cyber company, but the public record is still thin on hard operating metrics. No audited revenue, annual recurring revenue, renewal rate, customer list, deployment count, false-positive rate, benchmark suite, or independently reproduced exploit-prevention result was found in the sources reviewed. Raven’s patent claim is also described publicly but the specific patent numbers, jurisdictions, claim scope, and freedom-to-operate position are not disclosed in the material used here. The appropriate conclusion is that Raven has credible technical and financing validation and early customer adoption, not that its product-market fit or defensive moat is already proven.

**Founders and team background.** Raven was founded in 2023 by Roi Abitboul, Guy Franco, and Omer Yair. Abitboul is identified as chief executive, Franco as chief technology officer, and Yair as chief research officer. The three founders previously worked together at Javelin Networks, an Israeli endpoint-protection company founded by Abitboul and Franco that was acquired by Symantec; after that transaction they held senior roles connected to Symantec’s endpoint-detection and cloud-protection work. Public reporting also describes the founders as veterans of Israeli military technology and cyber units, and Geektime identifies a shared project involving the Israeli Air Force and Unit 9900. That combination gives Raven unusually direct experience with detection engineering, endpoint telemetry, malware research, and enterprise security product development. It also makes the Javelin relationship a diligence point: Javelin Networks is a historical, acquired company already represented separately in this database, while Raven is a new legal and product venture formed years later, not a rebrand or surviving product line. The team’s strongest apparent asset is problem familiarity across low-level security and commercial productization. The missing evidence is equally important: the size and composition of Raven’s current engineering team, the depth of its language-runtime expertise, its security research staffing, and its experience operating a global enterprise-support function are not publicly quantified.

**Competitive dynamics.** Raven faces competition from both specialists and platform vendors. Contrast Security offers application security testing and runtime protection with a strong established brand; Datadog and Dynatrace can extend application observability into security for customers already using their agents; Snyk and Endor Labs compete for dependency intelligence, reachability analysis, and developer workflow; and Wiz, Palo Alto Networks, Aqua Security, Sysdig, and CrowdStrike can bundle cloud, workload, or application controls into broader security platforms. Raven’s most direct Israeli comparisons include Oligo Security, which also uses runtime evidence to connect vulnerable components to observed execution, and Sweet Security, which correlates workload, application, identity, and AI behavior in a broader CNAPP model. Raven’s differentiation is narrower and potentially deeper: it claims to see inside the application at library and function level, not only the surrounding process, container, or cloud account. The strongest potential edges are 1) precise execution context for vulnerability prioritization, 2) detection of attacks that do not map cleanly to known CVEs or signatures, 3) a single approach across many programming languages, and 4) prevention or response tied to the code path that caused the behavior. The main competitive risk is convergence. If observability, CNAPP, SCA, and EDR platforms add comparable function-level context, Raven must show that its data is more accurate, its overhead lower, and its workflow outcomes materially better.

**Defense, security, and resilience dual-use relevance.** Raven’s core technology credibly serves both commercial and security-sensitive contexts, although no public source reviewed here establishes a defense contract, classified deployment, or government program. Modern defense contractors, government agencies, aerospace firms, banks, hospitals, and critical-infrastructure operators all run software assembled from open-source packages, third-party libraries, cloud services, and internally developed applications. Runtime proof can help these organizations distinguish a theoretical dependency exposure from a reachable execution path, investigate exploitation in a live mission-support service, and contain malicious behavior without waiting for a complete rebuild or patch window. The capability is especially relevant to software supply-chain resilience: an application-level sensor may reveal that a compromised or unexpected library is executing a dangerous function even when a package name looks legitimate and no conventional signature exists. It could also support software assurance for AI-enabled services, where generated code and agent frameworks introduce fast-moving dependencies and behavior. The calibration matters. Raven is not publicly presented as a weapons, military-autonomy, or classified-network company. Defense adoption would require evidence of on-premises or disconnected operation, secure sensor updates, strict data minimization, compliance and supply-chain review, predictable behavior under availability constraints, and integration with government SOC and incident-response systems. Until those points are demonstrated, the dual-use thesis is a strong cyber-resilience adjacency rather than fielded defense capability.

**Growth stage, trajectory, and key diligence risks.** Raven is best classified as early: it is a 2023-founded private company, has recently emerged from stealth, has raised substantial early capital, and reports initial enterprise customers, but it has not disclosed the commercial and technical metrics associated with a mature scale-up. The trajectory is attractive if runtime application evidence becomes the missing connective tissue between AppSec findings, cloud telemetry, and SOC response. The company could expand from vulnerability prioritization into exploit prevention, runtime policy, software assurance, and AI-application protection, while its founders’ prior exit may help with enterprise hiring and distribution. The diligence risks are significant: 1) sensor performance, latency, memory overhead, and failure behavior in production; 2) false negatives against obfuscated, fileless, supply-chain, and logic-abuse attacks; 3) false positives that cause a security control to disrupt a business-critical service; 4) privacy and data-residency exposure from observing application execution; 5) integration friction across languages, frameworks, serverless workloads, containers, and proprietary runtimes; 6) competition from bundled platforms with larger installed bases; and 7) limited public proof on revenue quality, retention, patents, headcount, and customer concentration. The most important milestones are independently measured overhead and detection results, additional named reference customers, repeatable deployment across heterogeneous stacks, evidence of converting runtime findings into remediation, and a restricted-environment offering that would turn cyber-resilience adjacency into credible strategic deployment.