Striga

What Striga does

Striga is a Warsaw-based AI-powered source code auditing platform that detects complex, multi-step vulnerabilities in software that conventional SAST tools and fuzzers miss. Founded in early 2025 by Franciszek Kalinowski and Bartłomiej Dmitruk and developed under strategic parent ISEC, the platform combines trained ML models with classical static analysis in a fully automated five-stage pipeline (reconnaissance, detection, evaluation, exploitation, reporting) across 30+ programming languages, with a working exploit proof-of-concept behind every reported finding. In 2026, Striga disclosed 20+ CVEs in widely-deployed production software including Apache httpd, Apache Tomcat, n8n, Ollama, Mattermost, axios, and pac4j, and published original research on LLM vulnerability detection benchmarks, mechanistic interpretability, and obfuscation-resistant evaluation.

The company operates three distribution models: one-off Code Audit engagements starting at $999 priced per lines of code, a managed Cloud subscription with a zero-data-retention option, and On-prem deployments for finance, public sector, and regulated workloads requiring DORA, NIS2, or Cyber Resilience Act compliance evidence. Go-to-market is research-driven and sales-led; public CVE disclosures, technical writeups, and earned media coverage from The Hacker News and Help Net Security drive inbound inquiries, with no paid advertising observed. Target customers include enterprise security and engineering teams, security consultancies and MSSPs, and regulated/sovereign organizations, with current operations across Europe and Asia. The company raised €1M in seed funding in June 2026 from a private cybersecurity investor and joined the NVIDIA Inception program the same month.

The business spans three product tiers with distinct pricing motions: a low-friction transactional entry point at $999 per audit, a recurring Cloud subscription for in-house security teams, and custom-priced On-prem deployments for regulated buyers. ISEC provides the research backbone including curated detection methods and two decades of offensive security work yielding Hall of Fame recognition from Apple, Microsoft, Cisco, Oracle, Red Hat, and the US DoD. Striga is a Polish private limited company (STRIGA SP. Z O. O.), incorporated in Warsaw, with a small team currently recruiting.

Name

Striga

Legal name

STRIGA SP. Z O. O.

Website

https://striga.ai

Company type

Private

Founded year

2025

Operating status

Operating

Headcount range

1–10 employees

Short description

Striga is an AI-powered source code auditing platform that detects complex vulnerabilities in software across 30+ languages. Founded in Warsaw in 2025 and backed by ISEC's two decades of offensive research, it serves enterprise security teams, security consultancies and MSSPs, and regulated organizations across Europe and Asia.

Ownership category

akta.pro rank

Product category

Application Security Testing

NAICS

Computer Systems Design and Related Services (54151)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Vulnerability Management & Penetration Testing Services (BPAEADAD)

akta.pro secondary industry

Vulnerability Assessment & Scanning (HDADAHAA)

Keywords

• Source code auditing
• Vulnerability detection
• Application security testing
• AI security platform
• Static code analysis

Headquarters

HQ city

Warszawa

HQ country

Poland

HQ region

Europe

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations

Revenue model

1. Code Audit: One-off security assessment of customer codebase. A dedicated specialist verifies, chains, and reports Striga's findings into an actionable report with every vulnerability, exploitation path, and remediation guidance. Priced per lines of code, starting from $999 — a fraction of traditional human-led review costing $20k–$50k+.
2. Cloud Platform Subscription: Subscription-based access to managed Striga instance. In-house security teams run audits on demand without managing infrastructure. Zero-data-retention option available. Subscription pricing not publicly disclosed.
3. On-Premises Deployment: Custom on-premises deployment for regulated and sovereign workloads. Source code never leaves customer infrastructure. Detection methods curated by ISEC's research team. Sized to customer environment and workloads; pricing custom.

Pricing tiers

Go-to-market motion2 records

Distribution channels3 records

Marketing channels5 records

Core offering

Striga is an AI-powered source code auditing platform that finds complex, multi-step vulnerabilities in full codebases that SAST tools and fuzzers miss. It is delivered via three modes: a one-off Code Audit service (from $999), a managed Cloud subscription with zero-data-retention option, and an On-prem deployment for regulated and sovereign workloads. Every finding is delivered with a working proof-of-concept exploit, severity assessment, and remediation guidance.

Product overview

Striga is an AI-powered source code auditing platform developed by ISEC, offering three deployment modes: Code Audit (one-off service starting at $999), Cloud (managed subscription), and On-prem (on-premises deployment). The platform analyzes full codebases to detect complex multi-step vulnerabilities that SAST tools and fuzzers miss, delivering actionable reports with working exploits behind every finding. Supports 30+ programming languages.

Differentiator

Problem solved

Functional benefit

Products and services

• Code Audit

Quantifiable outcome

• Up to 95% lower cost than manual audit ($999 vs $20k–$50k+)
• +4 more outcomes

Named customers3 records

Segments4 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability5 records

Feature9 records

Partnerships

Two partnerships are on record, tiered core and flagship.

• NVIDIAcoreTechnology or Integration · 1 June 2026Striga joined the NVIDIA Inception program, NVIDIA's global startup ecosystem for AI/ML companies. The program provides access to NVIDIA's developer tools, preferred pricing on hardware and software, and a global ecosystem of investors and partners. For Striga, this means compute, tooling, and ecosystem access to scale the vulnerability research pipeline that finds and proves vulnerabilities in real software.
• ISECflagshipStrategic or Co-development PartnerStriga is developed and backed by ISEC, a security firm with two decades of offensive research and Hall of Fame recognition from Apple, Microsoft, Cisco, Oracle, Red Hat, and the US DoD. ISEC provides the research foundation and curated detection methods for on-premises deployments. Founders Franciszek Kalinowski and Bartłomiej Dmitruk started Striga in early 2025 drawing on ISEC's offensive research expertise. Works with clients across Europe and Asia.

Scale indicators8 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Sonar (SonarQube): Sonar provides static code analysis and code-quality/security scanning across many languages, including a self-hosted edition similar to Striga's on-prem option. Both target engineering teams that want deep code-level inspection integrated into CI.
• Veracode: Veracode provides application security testing including static analysis and code audits for enterprise customers. It overlaps with Striga's code audit and on-prem deployment model for regulated workloads, and competes for the same regulated buyer personas.
• Checkmarx: Checkmarx is an enterprise SAST platform with on-premises and cloud deployments, similar to Striga's three-tier model. It serves the same financial services and regulated buyers that Striga targets with its on-prem offering.
• Snyk: Snyk is a developer security platform offering SAST, SCA, and code scanning for software teams — directly comparable to Striga's code-audit and cloud offerings. Both target engineering and security teams trying to find vulnerabilities before production, though Snyk's scale and breadth are substantially larger.
• Semgrep: Semgrep offers code analysis with static rules and AI-assisted detection for engineering teams. It competes directly with Striga's platform on detection of complex vulnerabilities in production codebases, especially in the mid-market and developer-led buying motion.
• Mend (formerly WhiteSource): Mend offers application security including SAST and software composition analysis for enterprise developers. It overlaps with Striga's audit-and-platform model and competes for the same enterprise security buyer.

Emerging players

• Aikido Security: Aikido Security offers an all-in-one code and cloud security platform for SMEs and mid-market developers. It competes with Striga's cloud product on price-sensitive, developer-led buyers who want fast, automated vulnerability detection.
• HackerOne: HackerOne runs a vulnerability disclosure and bug bounty platform that connects organizations with offensive security researchers — closely aligned with Striga's offensive-research heritage and CVE-driven output, though delivered via a different business model.
• Endor Labs: Endor Labs applies AI to software dependency and code risk analysis, targeting enterprise engineering teams. It is an emerging competitor in AI-augmented application security with partial overlap on code vulnerability detection.

Broad incumbents

• GitHub Advanced Security: GitHub Advanced Security bundles code scanning, secret detection, and dependency review into the GitHub platform. It is a broad incumbent whose free or low-cost entry point inside the GitHub ecosystem competes aggressively with Striga's per-audit pricing.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks7 records

Key highlights7 records

Customer concentration

• Xx.com/striga_ai
• LinkedInlinkedin.com/company/striga-ai

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds1 record

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Striga