Oligo Security Raises $60M as AI Speeds Exploit Development

The interesting thing in Oligo Security's $60 million raise is not the number, it is the pitch underneath it. According to SiliconANGLE, the Israeli runtime security startup has now pulled in $140 million total, on a valuation the company says has more than doubled since its $50 million Series B in January 2025. Ballistic Ventures, Canon Capital, Greenfield Partners, Lightspeed, Red Dot Capital Partners, TLV Partners and Eyal Waldman all wrote checks. The company is claiming 300% year-over-year ARR growth alongside the round.

What the company sells matters more than the cap table. Oligo's software sits alongside applications in production, and a sensor built on eBPF, the Linux kernel feature, tracks which library functions a workload actually calls. Most of the vulnerabilities a scanner flags are never called at all, and those are the ones Oligo tells customers they can leave alone. The ones that do get called can be blocked mid-exploit at the application layer, without killing the container or the process behind it. In April the company added Runtime Exploit Blocking, which defends against classes of attack technique rather than individual CVEs, plus a virtual patching capability meant to bridge slow patch cycles.

Why this is a moment for that pitch specifically: CEO and co-founder Nadav Czerninski frames the fundraise around AI-generated exploits. "AI has fundamentally changed the economics of exploitation," he said, arguing that "when attackers can find vulnerabilities and build exploits at machine speed, runtime becomes the only place you can definitively understand true risk and stop real attacks without breaking production." That is the sales argument to any AppSec team currently drowning in scanner output they cannot triage fast enough. The commercial validation of it is that AWS named Oligo its exclusive AI runtime security partner for Security Hub's extended plan in February, and Palantir added the company to its FedStart program in June, aimed at FedRAMP High and DoD Impact Level 5 authorization.

The honest caveat is that the reporting does not disclose the actual valuation number, a customer count, or the terms of the AWS exclusivity, so take the growth and "exclusive" framing as reported, not settled. Rival runtime players will make the same "only exploitable vulns matter" argument, and this category compresses fast once the hyperscalers pick favorites.

Still, for security leaders staring at a wall of red in a scanner dashboard, the case for buying based on what actually runs, rather than what theoretically ships in a library, gets stronger every quarter AI keeps shortening the exploit-development cycle.