Corgea
Corgea is an AI-native application security platform that delivers multi-agent SAST, dependency, IaC, and container scanning, autonomous penetration testing, and security design reviews to CISOs, security engineers, developers, and DevOps teams in fintech, SaaS, healthcare, energy, retail, and manufacturing.
- Company typePrivate
- Founded2023
- HeadquartersSan Francisco, United States
- Headcount1–10
- GTM typeB2B
- OfferingSoftware
What Corgea does
Corgea is an AI-native application security (AppSec) platform founded in 2023 and headquartered in San Francisco. It provides an integrated suite of security testing tools including AI SAST (static analysis with business-logic awareness and auto-fix generation across 20+ languages), dependency scanning, IaC scanning, container scanning, secrets scanning, attack surface mapping, code quality scanning, SBOM and license enforcement, AI Pentest, security design reviews, and skills scanning and registry. The platform is built on a multi-agent architecture in which a coordinator agent orchestrates hundreds of specialized sub-agents that autonomously perform reconnaissance, attack simulation, exploit chaining, and validation, and is integrated natively with major SCM (GitHub, GitLab, Azure DevOps, Bitbucket), CI/CD (Harness), IDE (VS Code, Cursor, IntelliJ, Visual Studio), and AI coding agent platforms (Claude Code, Codex, GitHub Copilot, Windsurf).
The company monetizes through a hybrid model: a product-led growth motion anchored by a 14-day free trial of its Growth tier with self-serve onboarding, sales-assisted enterprise contracts, and unit-priced AI Pentest engagements ($4,000 Standard, $8,000 Comprehensive, custom Enterprise). Target buyers include CISOs, security engineers, developers, DevOps teams, and AI coding agents, with vertical emphasis on fintech and financial services, enterprise SaaS, healthcare and biotech, energy, startups, consumer and retail, and hardware and manufacturing. Named customers include Zapier, YAGEO, Sonae, epilot, a top-5 energy company, and a top-100 commercial bank.
Corgea is backed by Y Combinator and closed a $2.6 million funding round in November 2024 led by Shorooq Partners, with participation from Decacorn Capital, Ironwood Ventures, Propeller Inc., and Unbound Ventures. In early 2026 the company achieved SOC 2 Type II certification, was selected as a winner of ADIB's UAE Cybersecurity Innovation Challenge from over 50 global pitches, and launched four major platform capabilities including AI Pentest and Security Design Review.
Corgea firmographics
Firmographics- Name
- Corgea
- Legal name
- Corgea
- Website
- https://corgea.com
- Company type
- Private
- Founded year
- 2023
- Operating status
- Operating
- Headcount range
- 1–10 employees
- Short description
- Corgea is an AI-native application security platform that delivers multi-agent SAST, dependency, IaC, and container scanning, autonomous penetration testing, and security design reviews to CISOs, security engineers, developers, and DevOps teams in fintech, SaaS, healthcare, energy, retail, and manufacturing.
- Ownership category
- akta.pro rank
Corgea industry classification
Industry- Product category
- Application Security Platform
- NAICS
- Security Systems Services (except Locksmiths) (561621), Security Systems Services (56162)
- SIC
- Services-Prepackaged Software (7372), Services-Computer Programming Services (7371), Services-Computer Integrated Systems Design (7373)
- akta.pro primary industry
- Application Security Testing (SAST/DAST/IAST/SCA) (HDADACAC)
- akta.pro secondary industries
- Vulnerability Assessment & Scanning (HDADAHAA), App Security, Compliance & Review Automation Platforms (BPAMADAJ)
Keywords
Where Corgea is headquartered
LocationHeadquarters
- HQ city
- San Francisco
- HQ country
- United States
- HQ region
- North America
Markets served
Corgea business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations
Revenue model
- AI Pentest - Standard: Per-pentest pricing at $4,000 for a fast external pentest including authenticated testing, business logic & auth testing, automated reconnaissance, OWASP Top 10 coverage, ~4 hour turnaround, and free re-test after fixes
- AI Pentest - Comprehensive: Per-pentest pricing at $8,000 covering complex attack chains, hundreds more attack agents, ~8 hour turnaround, SOC 2 & ISO 27001 evidence
- AI Pentest - Enterprise: Custom pricing for continuous & scheduled pentests, multiple apps & environments, custom scope & SLAs, dedicated security advisor, SSO & audit logs
- Platform Subscription: 14-day free trial of Growth tier; full platform access including AI SAST, dependency scanning, IaC scanning, container scanning, secrets scanning, code quality scanning, SBOMs, attack surface mapping, and developer experience tools
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Unit Pricing | Pay-as-you-go | Standard pentest at $4,000 per engagement |
| Unit Pricing | Pay-as-you-go | Comprehensive pentest at $8,000 per engagement |
| Subscription | Multi-year contract | Enterprise custom pricing for continuous pentesting |
| Freemium | Monthly | 14-day free trial of Growth tier |
Go-to-market motion1 record
Distribution channels5 records
Marketing channels8 records
Corgea product offering
Product offeringCore offering
Corgea is an AI-native application security (AppSec) platform that combines static analysis, dependency scanning, infrastructure-as-code scanning, container scanning, secrets scanning, attack surface mapping, and autonomous AI-driven penetration testing. Findings are prioritized by reachability and exploitability, with review-ready auto-fixes delivered directly into developer workflows via IDE, SCM, and CI/CD integrations. The platform also provides pre-code security design reviews and a skills registry for AI coding agents.
Product overview
Corgea is an AI-native application security platform that offers a unified control plane combining multiple security scanning modules. The platform provides AI SAST (static analysis with business-logic awareness and auto-fixes), Dependency Scanning (reachability-aware SCA), IaC Scanning, Container Scanning, Secrets Scanning, Attack Surface Mapping, Code Quality Scanning, SBOMs & License Enforcement, Developer Experience (IDE and PR integrations), AI Pentest (agent-driven autonomous penetration testing), Security Design Reviews (pre-code architectural analysis), and Skills Scanning & Registry (agentic development security). All modules share context and prioritize findings by exploitability, with fixes delivered directly in developer workflows.
Differentiator
Problem solved
Functional benefit
Products and services
- AI SAST AI-powered static application security testing with business-logic awareness, cross-file reachability, and accurate auto-fixes across 20+ programming languages. Designed for security engineers, developers, and DevOps teams.
- Dependency Scanning Reachability-aware software composition analysis that prioritizes exploitable open-source packages and provides upgrade guidance across major package ecosystems. Designed for engineering and security teams managing third-party risk.
- IaC Scanning Infrastructure-as-code misconfiguration and policy risk detection that performs shift-left cloud policy checks before deployment. Designed for DevOps and platform engineering teams.
- Container Scanning
Quantifiable outcome
- 2x more true positives
- +3 more outcomes
Companies that use Corgea
Customer profileNamed customers9 records
Segments10 records
Ideal customer profiles4 records
Corgea technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration14 records
AI capability7 records
Feature6 records
Corgea partnerships and signals
Strategic signalPartnerships
Three partnerships are on record, tiered flagship.
- Abu Dhabi Islamic Bank (ADIB)flagshipADIB selected Corgea as a winner of its UAE Cybersecurity Innovation Challenge, organized in partnership with UAE Cyber Security Council and DIFC Innovation Hub. The challenge reviewed over 50 global pitches and selected Corgea among three winners. ADIB Ventures indicated it will continue acting as a catalyst for transformative change through open innovation.
- UAE Cyber Security CouncilflagshipCo-organized the UAE Cybersecurity Innovation Challenge with ADIB and DIFC Innovation Hub, aligned with UAE National Cybersecurity Agenda. Corgea was selected as one of three winners from over 50 global startup pitches.
- DIFC Innovation HubflagshipCo-organized the UAE Cybersecurity Innovation Challenge with ADIB and UAE Cyber Security Council, aimed at strengthening national cyber resilience and reinforcing UAE's position as a hub for fintech innovation.
Scale indicators3 records
Recent moves6 records
Expansion highlights6 records
Corgea competitors and assessment
Company assessmentDirect peers
- Snyk: Leading developer security platform offering SAST, SCA, IaC, and container scanning. Corgea publishes a direct comparison page against Snyk, indicating head-to-head competition for AppSec budgets at developer-led organizations.
- Semgrep: Developer-first SAST and supply-chain security platform with code-aware scanning rules. Corgea positions its AI SAST as a higher-signal alternative to Semgrep for static analysis and auto-fix workflows.
- Aikido Security: AI-native unified AppSec platform targeting developers and SMBs with SAST, SCA, IaC, secrets, and container scanning. Closest comparable in product scope, go-to-market (PLG + self-serve), and AI-driven positioning to Corgea.
- HackerOne: Bug bounty and pentest-as-a-service platform connecting organizations with security researchers. Competes with Corgea's AI Pentest for the external/internal pentesting budget category.
- Cobalt: Pentest-as-a-service platform offering on-demand manual penetration testing. Corgea's AI Pentest directly challenges Cobalt's traditional pentest model with a faster, lower-cost agent-driven alternative.
- Checkmarx: Enterprise AppSec platform providing SAST, SCA, IaC, and container scanning. Corgea publishes a direct comparison page targeting enterprise AppSec buyers evaluating Checkmarx.
- Mend (formerly WhiteSource): Application security platform focused on SCA, SBOM, and open-source license compliance. Comparable to Corgea's Dependency Scanning and SBOMs & License Enforcement modules for enterprise buyers.
- Invicti (Netsparker): DAST and AppSec platform with automated scanning and proof-based vulnerability detection. Overlaps with Corgea's Attack Surface Mapping and dynamic testing capabilities for enterprise security teams.
Broad incumbents
- Veracode: Established AppSec platform offering SAST, DAST, SCA, and manual penetration testing services. Overlaps with Corgea's AI Pentest and SAST offerings, particularly for regulated enterprise buyers.
- GitHub Advanced Security: Bundled security offering from GitHub covering code scanning, secret scanning, and dependency review. Direct comparison page by Corgea reflects competitive overlap, particularly for organizations already standardized on GitHub.
Market position
Strengths4 records
Weaknesses4 records
Competitive moat5 records
Key risks5 records
Key highlights6 records
Customer concentration
Corgea social profiles
Digital presenceCorgea compliance and trust
Trust signalCompliance1 record
Corgea financial estimates
Financial estimateRevenue estimate
Valuation estimate
Corgea leadership team
Management profileNumber of profiles
Profiles1 record
Corgea funding detail
Funding detailFunding overview
Funding rounds2 records
Investors7 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Corgea M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Corgea
What does Corgea do?
Corgea is an AI-native application security (AppSec) platform that combines static analysis, dependency scanning, infrastructure-as-code scanning, container scanning, secrets scanning, attack surface mapping, and autonomous AI-driven penetration testing. Findings are prioritized by reachability and exploitability, with review-ready auto-fixes delivered directly into developer workflows via IDE, SCM, and CI/CD integrations. The platform also provides pre-code security design reviews and a skills registry for AI coding agents.
Is Corgea a public or private company?
Corgea is a private company. It is classified as venture growth investor backed and is currently operating.
When was Corgea founded?
Corgea was founded in 2023. It employs 1 to 10 people.
Where is Corgea based?
Corgea is headquartered in San Francisco, United States, in the North America region.
How does Corgea make money?
Four revenue lines are on record. AI Pentest - Standard is the primary driver. The others are AI Pentest - Comprehensive, AI Pentest - Enterprise and platform Subscription.
Who are Corgea's main competitors?
Direct peers on record are Snyk, Semgrep, Aikido Security, HackerOne, Cobalt, Checkmarx, Mend (formerly WhiteSource) and Invicti (Netsparker). Broad incumbents are Veracode and GitHub Advanced Security.
Does Corgea have an API?
Yes. Corgea exposes API access for policies, enabling teams to list, create, retrieve, update, and deactivate policies programmatically. The API supports the full policy lifecycle: listing policies, creating new ones, fetching a policy by ID, partially updating a policy, and deactivating policies when no longer needed. Policy content updates create a new version, while simple active-status changes update the existing policy in place. This enables automation of AppSec policy workflows instead of relying only on the UI. Developer documentation is at docs.corgea.app.
What industry is Corgea in?
Corgea's product category is Application Security Platform. Its primary akta.pro industry code is HDADACAC, Application Security Testing (SAST/DAST/IAST/SCA), with a secondary code of HDADAHAA, Vulnerability Assessment & Scanning. Its NAICS code is 561621 and its SIC code is 7372.