Cybersecurity · sub-niche
Supply chain attack detectors.
Catch malicious npm / PyPI packages before they land in production.
One-quarter buildHot — multiple deals per month
Why now
Supply-chain attacks doubled YoY. Most teams still trust npm install blindly.
What the signal looks like
Repos with package-registry scanners, dependency-graph libraries, and CI integration flows.
Public examples
We name publicprojects + categories only — never founders we track inside the paid product. The buyer’s edge stays inside the product.
- Socket / Phylum-style package scanners
- Snyk shape
- OSV / GitHub Advisory integrations
What this displaces
Dependabot + a Snyk free tier + crossed fingers.
Our build-vs-invest call
Steady demand, real budgets. The wedge is real-time detection vs. periodic scanning. Fund teams shipping deep dependency graph + behavioral analysis.
Common questions about this niche
- Isn't Snyk this?
- Snyk is broad. The behavioral-analysis wedge is real-time and complementary.
- Pricing?
- Per developer or per scan.
- Moat?
- Malware corpus + behavioral analysis model + integration footprint.
More inside Cybersecurity
- LLM firewall tooling — WAF for AI agents — prompt injection blocking, output sanitization, policy enforcement at the API boundary.
- Secret rotation automation — Secrets that rotate themselves — across HashiCorp Vault, AWS Secrets Manager, GitHub, and your CI.
- OSS vulnerability graphs — The dependency graph for open source vulnerabilities, indexed for AI agents and humans.
- Cloud config drift detection — Continuous detection of AWS / GCP / Azure config drift, plus AI-suggested remediation.