SafeStack
SafeStack is a New Zealand-based AppSec education and program management platform providing secure development training, security awareness courses, and OWASP SAMM/NIST SSDF-aligned program management to over 1,500 organizations worldwide, primarily serving software development teams and broader workforces.
- Company typePrivate
- Founded2020
- HeadquartersAuckland, New Zealand
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What SafeStack does
SafeStack is a New Zealand-based application security (AppSec) education and program management platform founded in July 2020 in Auckland by Laura Bell Main, a former software engineer for CERN's Large Hadron Collider. The company serves over 1,500 organizations globally — including named customers Octopus Deploy, Prospa, Fastly, NAB, Envato, Vista Entertainment, Timely, Auror, Assignar, and Gumtree — with secure development training, security and privacy awareness courses, and the recently launched SafeStack: Horizon AppSec program management platform built on OWASP SAMM and NIST SSDF frameworks. Its core differentiator is a systems-level pedagogy that teaches vulnerability design patterns independent of programming language, paired with continuously updated content (quarterly for secure development, monthly for security awareness), hands-on labs, monthly seminars, and a community platform bundled with paid memberships.
The platform comprises three core products — SafeStack: Horizon (central AppSec program management, launched February 2025), the Secure Development Program (role-specific training for developers, QA, DevOps, and architects), and the Security and Privacy Awareness Program (company-wide training) — supported by features such as the SafeStack Community, Learning Paths, the Certified Secure Development Professional (CSDP) credential delivered via Credly, SSO integration, SCORM content licensing, and a Drata integration for compliance evidence sync. The company also operates a Student Sponsorship Program providing free access to final-year and recent graduates from New Zealand and Australian tertiary institutions, and a SafeStack Faculty of secure development specialists.
SafeStack is venture-backed with NZ$6.3 million raised across a NZ$2.3 million pre-seed led by Jelix Ventures (October 2021) and a NZ$4 million seed led by Blackbird (December 2022), with a 14-person specialist team split across New Zealand and Australia. Revenue is generated primarily through per-seat annual subscriptions (with no minimum seat requirement on the Team plan), managed AppSec services starting at NZ$17,750/year for 20-100 developer teams, and SCORM content licensing for LMS integration. Distribution combines a self-serve PLG website motion, an enterprise sales motion for 100+ seat deployments, and a global partner network of 15+ resellers and integrators across Oceania, North America, the Middle East, and South and Southeast Asia.
SafeStack firmographics
Firmographics- Name
- SafeStack
- Legal name
- SafeStack
- Website
- https://safestack.io
- Company type
- Private
- Founded year
- 2020
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- SafeStack is a New Zealand-based AppSec education and program management platform providing secure development training, security awareness courses, and OWASP SAMM/NIST SSDF-aligned program management to over 1,500 organizations worldwide, primarily serving software development teams and broader workforces.
- Ownership category
- akta.pro rank
SafeStack industry classification
Industry- Product category
- Application Security Training
- SIC
- Services-Educational Services (8200), Services-Prepackaged Software (7372)
- akta.pro primary industry
- Secure Software & DevOps Awareness (Secure Coding Basics) (EDABAGAN)
- akta.pro secondary industry
- Content Moderation, Safe Messaging & Classroom Communication Safety (EDAFALAE)
Keywords
Where SafeStack is headquartered
LocationHeadquarters
- HQ city
- Auckland
- HQ country
- New Zealand
- HQ region
- Oceania
Offices1 record
Markets served
SafeStack business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure
Revenue model
- Subscription-based Secure Development Training: Annual subscription model charged per learner, per year. Customers access the Secure Development program, Security and Privacy Awareness program, or both. New courses are released quarterly for Secure Development and monthly for Security and Privacy Awareness, with additional content included throughout the subscription year.
- Subscription-based Security Awareness Training: Annual subscription providing bite-sized, interactive security and privacy awareness courses with fresh content released monthly, designed for organizations without dedicated security or L&D teams.
- SCORM Content Licensing: Organizations can license SafeStack training content in SCORM format for use within their own existing LMS platforms, providing an alternative to the SafeStack-hosted platform experience.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Team Plan — for small-to-mid-sized software development teams |
| Subscription | Annual | Enterprise Plan — for larger organizations with 100+ seats |
| Freemium | Annual | Student Sponsorship — free access for eligible students |
Go-to-market motion3 records
Distribution channels4 records
Marketing channels8 records
SafeStack product offering
Product offeringCore offering
SafeStack is a complete AppSec program platform that delivers secure development training, application security program management (SafeStack: Horizon), and security awareness education. The platform provides role-specific training, hands-on labs, monthly seminars, and globally recognized certifications mapped to OWASP SAMM and NIST SSDF frameworks, embedding security practices across the entire software development lifecycle.
Product overview
SafeStack is a complete AppSec program platform offering three core programs: SafeStack: Horizon (central program management), the Secure Development Program (training for development teams with hands-on labs and courses), and the Security and Privacy Awareness Program (company-wide security awareness training). The platform supports these programs with features including the SafeStack Community for peer collaboration, monthly online seminars, hands-on labs, and Learning Paths for team training. SafeStack also offers certifications (CSDP, Digital Credentials via Credly), SCORM content licensing for LMS integration, and the Student Sponsorship Program for free training access. The platform is designed to embed security throughout the entire software development lifecycle, helping organizations build secure software and meet compliance requirements.
Differentiator
Problem solved
Functional benefit
Products and services
- SafeStack: Horizon Central AppSec program management platform that tracks security maturity, follows structured programs based on OWASP SAMM and NIST SSDF, and engages the entire development team in security practices.
- Secure Development Program Ongoing secure development training for software development teams covering the entire SDLC, featuring hands-on labs, courses organized in modules of up to 20 minutes, and digital credentials earned upon completion.
- Security and Privacy Awareness Program Bite-sized (5-12 minute) security and privacy awareness courses for all employees, with fresh content released monthly. Designed for organizations without dedicated security or L&D teams.
- Certified Secure Development Professional (CSDP) Globally recognized secure development credential for validating expertise and building career paths, issued in partnership with Credly as shareable digital badges.
- SCORM Content Licensing License SafeStack training content in SCORM format for integration into an organization's existing Learning Management System, providing an alternative to the hosted platform.
- Managed AppSec Services Enterprise-grade managed application security service for teams of 20-100 developers without dedicated security hires, priced starting at NZD 17,750 per year.
Quantifiable outcome
- Organizations report catching more vulnerabilities before delivery and reducing application risk
- +4 more outcomes
Companies that use SafeStack
Customer profileNamed customers13 records
Segments5 records
Ideal customer profiles5 records
SafeStack technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Integration2 records
Feature12 records
SafeStack partnerships and signals
Strategic signalPartnerships
17 partnerships are on record, tiered minor.
- NINJIOminorPartnership announced to add developer training to NINJIO's human risk mitigation platform, expanding reach for SafeStack's secure development content.
- Advantage (New Zealand)minorNew Zealand-based reseller partner providing local sales and support for SafeStack training in the NZ market.
- Aquion (Australia)minorAustralia-based reseller partner providing local sales and support for SafeStack training in the AU market.
- DatacomminorLarge NZ-based IT services company acting as a reseller and implementation partner for SafeStack training programs.
- Software Hub (Australia & Singapore)minorRegional reseller partner covering Australia and Singapore markets for SafeStack training.
- Cynch (Australia)minorAustralia-based cybersecurity training and consulting reseller partner.
- Blueside (Australia)minorAustralia-based partner providing SafeStack training to their customers.
- Cyber MattersminorCybersecurity-focused consulting partner offering SafeStack training as part of their service portfolio.
- Phew (New Zealand)minorNew Zealand-based managed services and IT provider acting as a reseller for SafeStack.
- SafeAdvisory (New Zealand)minorFormerly SafeStack's advisory team, now an independent partner providing advisory and consulting services that may recommend or implement SafeStack training.
- appsec (Saudi Arabia)minorSaudi Arabia-based application security reseller partner.
- Daakyi (United States)minorUnited States-based reseller partner for SafeStack training programs.
- DefensaNet (India)minorIndia-based cybersecurity reseller partner.
- Hadi-E (Pakistan)minorPakistan-based learning and development partner offering SafeStack training.
- NetLabs (Dubai)minorDubai-based IT and security solutions partner for SafeStack in the Middle East market.
- Intalock (Australia)minorAustralia-based cybersecurity services partner with a security practice offering SafeStack training.
- Summer of Tech (New Zealand)minorIndustry partner collaborating with SafeStack on the student sponsorship program to train a new generation of secure software developers in New Zealand.
Scale indicators7 records
Recent moves6 records
Expansion highlights6 records
SafeStack competitors and assessment
Company assessmentDirect peers
- Secure Code Warrior: Secure Code Warrior is the most direct competitor — a Sydney-based platform providing secure code training, tournaments, and developer enablement for organizations. It targets the same software development team buyer with similar role-based training, hands-on labs, and language-specific content.
- Security Journey: Security Journey (formerly HackEDU) provides role-based secure development training with hands-on labs and a learning management platform for engineering teams. It competes head-to-head with SafeStack's Secure Development Program, particularly for US enterprise customers.
- NINJIO: NINJIO is a security awareness training platform producing animated episodes and micro-learning content for general employees. SafeStack has a partnership with NINJIO to add developer training to NINJIO's human risk platform, but they also overlap directly in security awareness training for non-technical staff.
- Cybrary: Cybrary is an online cybersecurity training platform offering courses across offensive, defensive, and secure development topics, with subscription-based access for individuals and teams. It targets a similar audience of practitioners and enterprise teams but with broader security coverage beyond software development.
- Codebashing (Checkmarx): Codebashing is Checkmarx's developer secure coding training product, embedded within a broader application security testing platform. It competes with SafeStack for engineering team training budget, with the added advantage of being bundled with an established AST tool vendor.
Broad incumbents
- KnowBe4: KnowBe4 is a publicly-traded security awareness and human risk management platform that directly overlaps with SafeStack's Security and Privacy Awareness Program. While focused on phishing and broad awareness rather than developer-specific training, it is a much larger incumbent competing for the same enterprise security training budget.
- SANS Institute: SANS is a long-established cybersecurity training and certification organization offering courses across offensive, defensive, and secure development topics. It competes for the same enterprise and government training dollars and holds recognized credentials in adjacent areas, though its content cadence and delivery model differ significantly from SafeStack's ongoing subscription model.
- Pluralsight: Pluralsight is a broad technology skills training platform that includes security and secure development courses. While not security-specialized, it competes for the same enterprise L&D budget and has a larger library and customer base, particularly among large enterprises.
Emerging players
- Kontra: Kontra is an emerging secure code training platform that delivers interactive, story-based application security training for developers. It overlaps with SafeStack's developer-focused mission and is gaining traction among enterprise engineering teams as a newer alternative.
Others
- Veracode: Veracode is a leading application security testing vendor (acquired by CA/Broadcom) that does not directly compete in training but is an adjacent ecosystem player. Its eLearning offerings and developer-focused tooling place it in the broader AppSec value chain where SafeStack's training is often consumed alongside AST tools.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat4 records
Key risks6 records
Key highlights7 records
Customer concentration
SafeStack social profiles
Digital presenceSafeStack compliance and trust
Trust signalCompliance3 records
SafeStack financial estimates
Financial estimateRevenue estimate
Valuation estimate
SafeStack leadership team
Management profileNumber of profiles
Profiles4 records
SafeStack funding detail
Funding detailFunding overview
Funding rounds3 records
Investors7 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
SafeStack M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about SafeStack
What does SafeStack do?
SafeStack is a complete AppSec program platform that delivers secure development training, application security program management (SafeStack: Horizon), and security awareness education. The platform provides role-specific training, hands-on labs, monthly seminars, and globally recognized certifications mapped to OWASP SAMM and NIST SSDF frameworks, embedding security practices across the entire software development lifecycle.
Is SafeStack a public or private company?
SafeStack is a private company. It is classified as venture growth investor backed and is currently operating.
When was SafeStack founded?
SafeStack was founded in 2020. It employs 11 to 50 people.
Where is SafeStack based?
SafeStack is headquartered in Auckland, New Zealand, in the Oceania region.
How does SafeStack make money?
Three revenue lines are on record. Subscription-based Secure Development Training is the primary driver. The others are subscription-based Security Awareness Training and SCORM Content Licensing.
Who are SafeStack's main competitors?
Direct peers on record are Secure Code Warrior, Security Journey, NINJIO, Cybrary and Codebashing (Checkmarx). Broad incumbents are KnowBe4, SANS Institute and Pluralsight. Kontra is listed as an emerging player. Veracode is listed as an others.
Does SafeStack have an API?
No public API is recorded for SafeStack.
What industry is SafeStack in?
SafeStack's product category is Application Security Training. Its primary akta.pro industry code is EDABAGAN, Secure Software & DevOps Awareness (Secure Coding Basics), with a secondary code of EDAFALAE, Content Moderation, Safe Messaging & Classroom Communication Safety. Its SIC code is 8200.