Corma raises $60M seed from Sequoia for defensive cyber AI

A $60 million seed round is unusual on its own. A $60 million seed for a company only six weeks into shipping product, led by Sequoia with Khosla Ventures and Coatue alongside, is the kind of number that says investors think they are backing a category, not a company. Fortune reported that Tel Aviv and San Francisco startup Corma has taken the round to build what it calls the first frontier AI lab for defensive cybersecurity, with CEO Alon Pluda pitching a foundation model trained on the parts of security work that generative AI usually skips.

Pluda's framing is that the interesting job is not writing more secure code but 'looking at logs, audits, [and] finding the needle in a haystack.' Corma says its model has been deployed at Fortune 100 and Fortune 500 organizations across healthcare, financial services, energy, critical infrastructure and retail, and that early deployments cut threat response times by more than 94% while expanding security coverage 15 times across different security functions. Sequoia partner Shaun Maguire, quoted in the piece, argues that 'agentic AI gives attackers a structural speed advantage' and casts Corma's research as the counterweight.

The timing tracks with the rest of our security coverage this week. It sits within 324 cybersecurity stories we've tracked in the last 90 days. In the last two days alone we published on the Israeli research lab Irregular being tied to red-team work for OpenAI, Anthropic and Meta, and on OpenAI flagging its Astra model at the 'critical' cyber capability level. If the offensive side of frontier AI is being treated as critical, a defensive counterpart at seed scale was overdue.

There is real cause to hedge. Every performance number in this story comes from Corma itself, six weeks into deployment, with no third-party benchmark or named reference customer to check against. The reporting names only Pluda; any technical co-founders and the specifics of the underlying model architecture are not disclosed. For regulated buyers, sending live logs and audit trails into a young lab's foundation model is a decision no press release settles.

Even so, the shape of the bet is legible. If SOC teams start pricing agentic attack as a live operational threat rather than a research demo, a well-funded defensive lab with named Fortune 100 pilots is well positioned to be the vendor those teams call first.