NebuSec GTM brain

NebuSec offers AI-assisted code security and researcher-led audits and incident response to enterprise engineering and security teams.

category

AI application security and security audits

market profile

  • text: Enterprise security teams need to review rapidly changing code and dependencies, including code produced with AI assistance.
  • text: NebuSec combines continuous code security with human-led audits and incident response; standalone supply chain and cloud security offerings are marked coming soon.
  • text: Security research and disclosures serve as evidence of the team's technical focus and visibility in the market.

personas

  • title: Head of application security
    pains:
    • Large queues of findings consume limited triage capacity
    • Developers need validated risk and actionable remediation before prioritizing fixes
  • title: VP of engineering
    pains:
    • Rapid development and AI-generated code increase review volume
    • Security findings must fit development workflows without stalling releases
  • title: CISO
    pains:
    • Periodic reviews may miss exposures as systems change
    • Incidents require credible specialist investigation and response capacity

icp

  • text: Enterprise software organizations with proprietary code and engineering or security teams; employee thresholds are not disclosed.
  • text: Teams with rapidly changing code, AI-assisted development and high expectations for vulnerability verification and remediation.

message pillars

  • text: Supply verified code security findings and actionable fixes.
  • text: Provide security audits led by specialist researchers.
  • text: Help customers during active security incidents.

objections

  • objection: We already have static analysis and security testing tools.
    response: Pilot on a defined repository and compare verified findings, false-positive triage and remediation effort against existing tools.
  • objection: Does NebuSec cover all of our cloud and supply chain risk today?
    response: Scope the evaluation carefully: standalone cloud and supply chain security offerings are labeled coming soon on the site.
  • objection: Can the team handle our systems and data securely?
    response: Ask for an audit scope, relevant references, data handling details and a security questionnaire before sharing code.

competitors

  • name: Aikido Security
    why: Offers application security testing and penetration testing, competing for code-security and audit budgets.
  • name: Cobalt
    why: Provides penetration testing services, an alternative to researcher-led security audits.
  • name: Synack
    why: Provides penetration testing services that overlap with security assessment engagements.

influencers

  • name: Eten Zou
    url: https://nebusec.ai/about
    why: CEO and co-founder focused on automated vulnerability research.
  • name: Yuan Tan
    url: https://nebusec.ai/about
    why: CTO and co-founder with systems security and program analysis background.

keywords

  • AI code security
  • application security testing
  • verified vulnerability findings
  • security code audit
  • penetration testing services
  • AI vulnerability detection
  • incident response services

voice

  • technical
  • confident
  • research led

signals

  • text: An enterprise is expanding AI-assisted development and struggling to review code at its release cadence.
  • text: A software company is seeking an independent security audit or specialist incident response.

pricing

model: unknown

motion

sales_led

channels

  • security research
  • events
  • LinkedIn
  • X

confidence

medium

Founders

  • name: Eten Zou
    title: Founder/CEO
    role: CEO
    bio: CEO & Founder @ Nebula Security (YC S26). PhD in Cybersecurity. Focus on automated vulnerability research.
  • name: Yuan Tan
    title: Founder/CTO
    role: CTO
    bio: Founder at Nebula Security (YC S26). Black Hat USA speaker. PhD dropout in System Security with experience in DARPA-funded fundamental research on program analysis.
  • name: Frank Wu
    title: Founder/COO
    role: COO
    bio: Founder of Nebula Security (YC S26). Black Hat USA speaker and DEF CON finalist with r3kapig, the world's No. 1 hacking team in 2025. He led the DARPA AIxCC automated program repair team and shipped end-to-end RCE/LPE exploit chains on Chrome, Firefox, Linux, and Android. He pwned Google's kernelCTF multiple times with zero-days, and has published research at top academic venues such as USENIX Security and NDSS. Ph.D. dropout.
  • name: Xiaochuan Yu
    title: Founder/VP of Vulnerability Research
    role: Founder
    bio: Founder at Nebula Security (YC S26). Hacked into iPhone, Chrome, Firefox, Safari, QEMU, and various things in your daily life. DEFCON finalist for 3 consecutive years. $200k+ Bug Bounty in Chrome. Core member of r3kapig, the #1 hacking team in the world in 2025, on CTFTime. M.S. from UC San Diego. Research published at USENIX Security, BlackHat USA. Ph.D. droped out.

Back to YC companies