SEWORKS

What SEWORKS does

SEWORKS, commercially operating through Delaware-incorporated SEW INC., is a San Francisco-based offensive-security vendor founded in 2013 by Min Pyo Hong and a team descended from WOWHACKER, one of Korea's oldest white-hat collectives (7 appearances at the DEF CON CTF finals). The company has raised $12M in cumulative funding from investors including Qualcomm Ventures, Samsung Ventures, Smilegate Investment, SBVA, Fast Ventures, and WONIK Investment Partners, and operates with 11–50 employees serving 100+ enterprise clients worldwide across healthcare, financial services, SaaS/technology, retail, manufacturing, government, and education.

SEWORKS delivers its offensive-security portfolio through three products built on the proprietary GAMAN® AI engine. Pentoma® is an AI-powered penetration testing service that performs agentic discovery, deterministic replay, and human-validated exploitation across web applications, APIs, source code, and AI/LLM systems, producing auditor-ready control mappings for SOC 2 and ISO 27001 with a stated zero-false-positive SLA. LeakJar™ is an API-first breached-credential defense product that screens sign-ups, logins, and password resets against billions of breached credentials using k-anonymity, integrating natively with Auth0, Okta, Cognito, and Firebase. AppSolid® provides mobile application hardening and runtime protection for iOS/Android. SEWORKS is a Drata Authorized Reseller and bundles Drata compliance automation with Pentoma® testing into single-vendor SOC 2 Type II and ISO 27001 certification packages.

The business model combines quote-based annual subscriptions for Pentoma® engagements, freemium and usage-based API revenue from LeakJar™, multi-year bundled compliance engagements, one-time mobile-hardening licensing for AppSolid®, and up to 30% channel-partner commissions. Go-to-market is hybrid: sales-led direct enterprise motion for Pentoma® and compliance bundles (with 24-hour consultative response), self-serve product-led growth for LeakJar™ via a free API key, and channel sales through the Partner Program and Drata reseller relationship. Ecosystem validations include AWS Technology & Public Sector Partner status, NVIDIA Inception Program membership, and press features in Forbes, TechCrunch, VentureBeat, and Network World.

Name

SEWORKS

Legal name

SEW INC.

Website

https://se.works

Company type

Private

Founded year

2013

Operating status

Operating

Headcount range

11–50 employees

Short description

SEWORKS is a San Francisco-based offensive-security vendor founded in 2013 that delivers AI-powered penetration testing (Pentoma®), API-first breached-credential defense (LeakJar™), and mobile app hardening (AppSolid®) to 100+ enterprise clients across healthcare, finance, SaaS, retail, manufacturing, government, and education.

Ownership category

akta.pro rank

Product category

Offensive Security Software

NAICS

Computer Systems Design and Related Services (54151), Computer Systems Design and Related Services (5415), Security Systems Services (56162)

akta.pro primary industry

Code & Repository Security (Git Security, Code Integrity) (HDADACAG)

Keywords

• AI penetration testing
• Breached credential screening
• Mobile app hardening
• Offensive security platform
• Compliance readiness services

Headquarters

HQ city

San Francisco

HQ country

United States

HQ region

North America

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations

Revenue model

1. Pentoma® AI penetration testing subscriptions: Recurring subscription / project-based revenue from Pentoma® web, API, source-code, and AI red-teaming engagements, sold as ongoing offensive-security subscriptions with continuous testing cadence.
2. LeakJar™ API usage: Usage-based, API-first revenue from LeakJar™ credential-screening calls at sign-up, login, and password reset; free API key available with paid tiers for higher volume / continuous domain monitoring.
3. SOC 2 Type II compliance package: Bundled Drata compliance platform + Pentoma® pen testing sold as an all-in-one SOC 2 Type II readiness and certification package, typically 4–6 months in duration.
4. ISO 27001 certification support: End-to-end ISO 27001 implementation and certification support bundled with Drata platform access and Pentoma® technical control validation, sold as a multi-month certification project.
5. AppSolid® mobile app hardening: Mobile application hardening and protection licensing sold as a software product to mobile app publishers and enterprises.
6. Partner / referral program: Channel revenue via the SEWORKS Partner Program offering up to 30% commission on referred deals, plus Drata Authorized Reseller margin on bundled compliance engagements.

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels5 records

Core offering

SEWORKS builds and sells AI-powered offensive-security software products that let enterprise security teams discover and remediate vulnerabilities the way a real attacker would. Its three core products — Pentoma® (AI penetration testing across web apps, APIs, source code, and AI/LLM systems, powered by the proprietary GAMAN® engine), LeakJar™ (an API-first breached-credential defense that screens sign-ups, logins, and password resets against billions of breached credentials using k-anonymity), and AppSolid® (mobile app hardening and runtime protection) — are sold primarily via subscriptions, project engagements, and usage-based API tiers, and are bundled with Drata compliance automation to deliver SOC 2 Type II and ISO 27001 readiness packages.

Product overview

SEWORKS delivers an offensive-security product suite built around the attacker's perspective, organized around three core products: Pentoma® (AI-powered penetration testing platform using the proprietary GAMAN® engine for web, API, source code, and AI-system red teaming), LeakJar™ (API-first breached-credential screening with native support for identity providers such as Auth0, Okta, Cognito, and Firebase), and AppSolid® (mobile app hardening and protection). On top of these products, SEWORKS offers bundled SOC 2 Type II readiness and ISO 27001 certification support packages that combine Drata compliance automation with Pentoma® testing from a single team, positioning the company as a one-stop offensive-security and compliance provider.

Differentiator

Problem solved

Functional benefit

Brands

• Pentoma®: AI-powered penetration testing product (web apps, APIs, source code, and AI systems red teaming) built on the proprietary GAMAN® engine.
• LeakJar™
• AppSolid®
• GAMAN®

Products and services

• Pentoma® AI-powered penetration testing service built on SEWORKS' proprietary GAMAN® engine. Pentoma® attacks web apps, APIs, source code, and AI/LLM systems the way a real adversary would, with deterministic replay and every confirmed finding human-validated and shipped with reproduction steps, severity rationale, and remediation guidance. Includes a specialized AI red-teaming (LLM and agentic) offering and produces auditor-ready control mappings for SOC 2 and ISO 27001.
• LeakJar™ API-first breached-password defense that screens sign-ups, logins, and password resets against billions of breached credentials using k-anonymity so that only a short hash prefix ever leaves the customer's servers. Works natively with Auth0, Okta, AWS Cognito, and Firebase, and provides continuous exposure monitoring for the customer's domains.
• AppSolid® Mobile application hardening and runtime protection product that secures iOS and Android apps against tampering, reverse engineering, and runtime attacks.
• SOC 2 Type II Readiness Package Bundled Drata compliance automation plus Pentoma® penetration testing sold as an all-in-one SOC 2 Type II readiness and certification package, typically 4–6 months in duration and stated by SEWORKS to be 75% faster than traditional approaches (4–6 months versus 9–15 months).
• ISO 27001 Certification Support End-to-end ISO 27001 implementation and certification support bundled with Drata platform access and Pentoma® technical control validation, covering all 93 ISO 27001:2022 Annex A controls across all four domains, sold as a multi-month certification project.

Quantifiable outcome

• 75% faster compliance than traditional approaches (SOC 2 in 4–6 months vs industry 9–15 months)
• +5 more outcomes

Named customers6 records

Segments8 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration4 records

AI capability8 records

Feature5 records

Partnerships

Eight partnerships are on record, tiered flagship ecosystem partner, flagship go-to-market partner, operational infrastructure and integration partner.

• Amazon Web Services (AWS)flagship ecosystem partnerTechnology or IntegrationSEWORKS holds AWS Technology & Public Sector Partner status, displayed on the homepage partner/logo strip. AWS provides the cloud / partner-program platform to SEWORKS — Them to Us.
• NVIDIAflagship ecosystem partnerStrategic or Co-development PartnerSEWORKS is a member of the NVIDIA Inception Program, highlighted on both the homepage and About page as a key ecosystem relationship supporting its AI-powered GAMAN® engine. Them to Us.
• Drataflagship go-to-market partnerChannel Partner/ Reseller/ DistributorSEWORKS is a Drata Authorized Reseller, bundling Drata's compliance automation platform with Pentoma® penetration testing as a single-vendor SOC 2 Type II and ISO 27001 package. Mutual, co-sold compliance offering.
• Stripeoperational infrastructureTechnology or IntegrationStripe is the payment-data processor disclosed in the SEWORKS privacy policy; all payment instrument data is stored by Stripe per se.works/privacy. Them to Us.
• Auth0integration partnerTechnology or IntegrationNamed integration target for LeakJar™ credential-screening API at sign-up, login, and password reset. Them to Us / integration-compatible.
• Oktaintegration partnerTechnology or IntegrationNamed integration target for LeakJar™ credential-screening API at sign-up, login, and password reset. Them to Us / integration-compatible.
• Amazon Cognitointegration partnerTechnology or IntegrationNamed integration target for LeakJar™ credential-screening API at sign-up, login, and password reset. Them to Us / integration-compatible.
• Firebaseintegration partnerTechnology or IntegrationNamed integration target for LeakJar™ credential-screening API at sign-up, login, and password reset. Them to Us / integration-compatible.

Scale indicators10 records

Recent moves4 records

Expansion highlights6 records

Direct peers

• Cobalt.io: Cobalt is a Pentest-as-a-Service platform that combines human testers with automation to deliver continuous web, API, and mobile pentesting. Direct overlap with Pentoma®'s AI-driven, recurring offensive-security subscription model and enterprise buyer.
• Synack: Synack runs a crowdsourced, AI-augmented pentest platform with an on-demand researcher pool and a results-based delivery model. Highly comparable to Pentoma®'s AI + human-validated testing positioning and enterprise GTM.
• HackerOne: HackerOne is the largest bug-bounty and vulnerability-disclosure platform, offering continuous offensive testing to enterprise security teams. Overlaps with SEWORKS's offensive-security DNA and enterprise customer base.
• Bugcrowd: Bugcrowd provides crowdsourced pentesting, bug bounty, and vulnerability disclosure programs. Competes for the same security-team budget as Pentoma® and serves overlapping enterprise verticals.
• Pentera: Pentera offers automated security validation / continuous red-teaming for enterprise networks. Direct competitor in the automated offensive-security category where SEWORKS positions Pentoma®.
• Detectify: Detectify delivers automated, crowdsourced vulnerability scanning for web applications and APIs. Closely comparable to Pentoma®'s continuous, automated external testing motion.
• SpyCloud: SpyCloud provides breached-credential and account-takeover defense, screening credentials against large breach corpora — the same problem space LeakJar™ addresses with its API-first design.
• Enzoic: Enzoic offers breached-password screening and continuous credential monitoring for enterprises, with integrations into identity providers. Direct overlap with LeakJar™'s use case.

Broad incumbents

• Snyk: Snyk is a broad developer-security platform spanning SAST, SCA, container, and IaC scanning. A larger incumbent that overlaps Pentoma®'s source-code and API testing surface as part of a wider appsec portfolio.
• Veracode: Veracode is a long-standing application-security testing vendor offering SAST, DAST, and software composition analysis. Competes with Pentoma®'s web/API testing capabilities inside enterprise appsec buying cycles.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/seworks
• Xx.com/seworks_twt

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds2 records

Investors5 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about SEWORKS