What Archipelo does

Archipelo, Inc. is a private, venture-backed cybersecurity company headquartered in San Francisco that has self-positioned as the category creator of Developer Security Posture Management (DevSPM). The company's platform is built on Salmon, a proprietary execution provenance protocol comprising two primitives — an Artifact Execution Protocol (AEP) that records each software production event as a content-addressed, append-only entry, and a Responsibility Chain Protocol (RCP) that deterministically assigns responsibility to each event based on actor identity and authorization context. On top of Salmon, the platform exposes four modules: Developer Vulnerability Attribution (linking CVE scan results to specific developer, copilot, or agent actions), AI & Agent Actions Monitor (visibility into AI copilot and autonomous agent activity), Developer Tool Inventory (centralized inventory of CI/CD and developer tools across Git, GitHub Actions, CircleCI, Travis CI, GitLab CI, Claude Code, and browser/IDE extensions), and Developer Security Posture (a developer-centric risk view).

The company targets Fortune 500 enterprises in regulated industries — healthcare, financial services, defense, and technology — with an enterprise field-sales motion evidenced by Book Demo CTAs throughout its website and a published CISO testimonial from a Fortune 500 Financial Services customer. Its go-to-market is reinforced by a technical partnership with Checkmarx (announced March 3, 2026) that correlates Checkmarx AST/ASPM findings with Archipelo's developer-attribution context, and a content-led marketing strategy anchored on DevSPM thought leadership. Revenue is generated through a cloud-hosted SaaS subscription model with free trials and demo-based enterprise sales; no pricing tiers are publicly disclosed. The company was founded with an all-remote team distributed across 9 countries, has between 11 and 50 employees, and is led by CEO & Cofounder Matthew Wise, CISO & Chief Strategy Officer Paul Calatayud (formerly of Palo Alto Networks and Aqua Security), and Product Lead Kacper Skawinski. Archipelo emerged from stealth in February 2025 with $12 million in total funding, comprising a $4 million pre-seed round and an $8 million seed round led by Dell Technologies Capital.

Name

Archipelo

Legal name

Archipelo, Inc.

Website

https://archipelo.com

Company type

Private

Founded year

2025

Operating status

Operating

Headcount range

11–50 employees

Short description

Archipelo is a private cybersecurity company that sells a Developer Security Posture Management (DevSPM) SaaS platform powered by its proprietary Salmon execution provenance protocol, targeting Fortune 500 enterprises in healthcare, financial services, defense, and technology.

Ownership category

akta.pro rank

Product category

Developer Security Posture Management

NAICS

Software Publishers (513210)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

SaaS Security Posture Management (SSPM) (HDADADAI)

akta.pro secondary industries

SaaS Security Posture Management (SSPM) (HDABAHAE), DevSecOps & Supply Chain Security (DevOps toolchain security) (BPAEAKAI), Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ)

Keywords

• Developer security posture
• Software supply chain security
• Application security posture
• AI code security
• DevSecOps platform

Headquarters

HQ city

San Francisco

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. SaaS/Platform Subscription: Cloud-hosted platform providing DevSPM services. Customers can book demos, request free trials, and create accounts to access the platform. The platform is accessed online as a service.

Go-to-market motion1 record

Distribution channels1 record

Marketing channels5 records

Core offering

Archipelo offers a unified Developer Security Posture Management (DevSPM) platform that establishes deterministic execution provenance across multi-actor software production — attributing code changes, vulnerabilities, and AI/agent actions to specific human developers, AI copilots, and autonomous agents. The platform is powered by the proprietary Salmon execution provenance protocol and is delivered as a cloud-hosted SaaS solution to Fortune 500 enterprises in healthcare, finance, technology, and defense.

Product overview

Archipelo is a unified Developer Security Posture Management (DevSPM) platform powered by Salmon, an execution provenance protocol. The platform provides deterministic recording of software production across human developers, AI copilots, and agents. Core modules include Developer Vulnerability Attribution (tracing CVEs to developer identities), AI & Agent Actions Monitor (visibility into AI coding activity), Developer Tool Inventory (centralized tool tracking), and Developer Security Posture (developer-centric risk view). The Salmon protocol serves as the foundational execution provenance layer, enabling deterministic attribution and responsibility assignment. The platform integrates across development environments including Git, CI/CD pipelines (GitHub Actions, CircleCI, Travis CI, GitLab CI), AI coding tools (Claude Code), and developer/browser/IDE extensions.

Differentiator

Problem solved

Functional benefit

Products and services

• Archipelo Platform
• Salmon Execution Provenance Protocol

Quantifiable outcome

• 74% of software security risk originates from developers — human and AI
• +4 more outcomes

Named customers1 record

Segments5 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration9 records

AI capability4 records

Feature5 records

Partnerships

One partnership is on record.

• CheckmarxcoreTechnology or Integration · 3 March 2026Technical partnership to correlate application vulnerability findings with development-origin context in software delivery workflows. The integration combines Checkmarx's application security testing and Application Security Posture Management (ASPM) with Archipelo's Developer Security Posture Management (DevSPM). Organizations can analyze both where risk exists and the conditions under which it was introduced, linking vulnerability detections with developer identity, workflow metadata, AI-assisted coding conditions, and code provenance information.

Scale indicators3 records

Recent moves5 records

Expansion highlights5 records

Direct peers

• Snyk: Snyk is a developer security platform covering SCA, SAST, IaC, and container security, deeply embedded in developer workflows. Like Archipelo, it sells to engineering and security teams and is racing to add visibility into AI-generated code, making it the closest direct competitor for DevSPM mindshare.
• Checkmarx: Checkmarx provides application security testing and Application Security Posture Management (ASPM) — directly adjacent to Archipelo's DevSPM. The companies have a formal partnership, but Checkmarx could expand into developer-attribution territory independently.
• Apiiro: Apiiro is an ASPM platform that maps code-to-runtime risk and prioritizes vulnerabilities based on code, developer, and business context. Its focus on developer-attributed risk and code risk graph is the closest architectural analog to Archipelo's developer-centric posture approach.
• Cycode: Cycode is an ASPM platform focused on software supply chain security, integrating SAST, SCA, secrets, and IaC scanning with pipeline-native controls. It competes with Archipelo for the developer-security-posture budget and increasingly positions around AI code risk.

Broad incumbents

• GitHub Advanced Security: GitHub Advanced Security bundles code scanning, secret scanning, and dependency review natively inside the GitHub platform. As the dominant developer hub (and owner of Copilot), it is a broad incumbent that could add developer-attribution features and undercut standalone DevSPM tools.
• GitLab: GitLab offers an integrated DevSecOps platform with SAST, DAST, dependency, and container scanning built into the CI/CD platform. As a broad incumbent with end-to-end SDLC coverage, it competes for the same buyer and could absorb DevSPM capabilities into its platform.
• Veracode: Veracode provides application security testing (SAST, DAST, SCA) as a broad incumbent vendor to large enterprises. Its installed base in regulated industries overlaps with Archipelo's target buyers and could expand into developer-attribution.

Emerging players

• Endor Labs: Endor Labs focuses on software supply chain security and dependency-risk management for AI and open-source code. Its emphasis on dependency graph and policy enforcement makes it a comparable emerging player in the same developer-security-posture theme.
• Sonar (SonarQube / SonarCloud): Sonar provides code quality and code security analysis integrated into developer workflows. It overlaps with Archipelo's developer-centric visibility theme and is expanding AI code analysis features, making it a relevant emerging competitor.
• Jit: Jit is a developer security orchestration platform that unifies multiple scanners (SAST, SCA, secrets) into a developer-centric experience. Its positioning around developer-first security posture overlaps with Archipelo's buyer message and use cases.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/archipelodevspm

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds4 records

Investors5 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Archipelo