Ox Security Raises $60M Series B to Combat Code Risk from AI

An application security startup led by a longtime Check Point executive raised $60 million to address the proliferation of AI-generated code and adversarial use of AI.

See Also: Boost your cybersecurity team capabilities with GenAI

New York-based OX Security plans to use the Series B investment to automate remediation at scale and close the gap between problem identification and resolution, according to co-founder and CEO Neatsun Ziv. OX wants to help customers focus on the 5% of vulnerabilities that matter through smart prioritization and remediation rather than overwhelming developers with endless issue lists, Ziv said.

“It’s always good to do fundraising when all the stars are aligned,” Ziv told Information Security Media Group. “The market is receptive to the message, everything seemed to be going in place. We went into this fundraising when we had at least one more year till we had to do fundraising. So, it’s like everything fell into place.”

OX Security, founded in 2021, employs 165 people and emerged from stealth in September 2022 with $34 million in seed funding led by Evolution Equity Partners, Team8 and Microsoft’s venture fund. The company has been led since its inception by Ziv, who spent nearly 10 years at Check Point Software, culmination in a five-year stint leading the Israeli giant’s threat prevention and intelligence business (see: UK Software Security Code of Practice Earns Mixed Reviews).

How OX Security’s Approach Is Different From the Status Quo

DTCP was selected as the lead investor for OX’s Series B funding due to a longstanding relationship and a shared strategic vision, according to Ziv. He compared today’s AI-driven disruption to the early days of cloud adoption, except that innovation cycles are now six months long instead of years. This accelerated pace requires a different approach to product planning, infrastructure and responsiveness, Ziv said.

“We basically have increased our R&D drastically to make sure that we are able to cope with the new challenges coming in,” Ziv said. “So, that’s the biggest investment really, going back to the product and enhancing it so it will be fitted toward the new age that we are going towards.”

AI models trained on large open-source datasets often reuse code patterns that may have already been deprecated or known to include vulnerabilities, Ziv said. Because these models operate on statistical correlation rather than a holistic understanding of security risks, they can unknowingly introduce serious issues into codebases. Plus, cybercriminals are leveraging AI to speed up exploit development.

“They don’t know how to build defended code, and defended code means usually slower performance and they’re optimizing towards other things – from what they’ve learned in open source – which is usually performance over security,” Ziv said. “So, there are numerous things where a machine would make a different decision just because lack of context.”

Rather than overwhelming development teams with thousands of low-priority alerts, he said OX Security uses contextual intelligence to isolate only the most critical vulnerabilities. The system runs a layered contextual analysis, asking questions such as, “Is this vulnerability active?,” “Has the password been rotated?” and “Is it behind two-factor authentication?” to flag issues that are critical, provable and actionable.

“If I found a password in code, I can just say, ‘Hey, I found a password in code,’ but then you have hundreds of those,'” Ziv said. “So, then the developer will ignore you.”

Why OX Security Is Putting Remediation Center Stage

90% of OX’s efforts to date have been focused on detection and prioritization, but Ziv sees a future opportunity around resolving and remediating risk at scale with minimal developer intervention. New AI models can ingest not just the vulnerable snippet, but also surrounding context – variable names, logic flows and architectural patterns – and develop suggestions that are more usable and code-specific.

“If I’m giving you a generic solution, you still need to do a lot of work to retrofit it to your code,” Ziv said. “What AI is absolutely fabulous in is taking a suggestion and melding them together so you’ll have something that is great. Now, it’s a small mental gap, but it’s a huge hurdle that you need to go through. And AI simply is amazing. So, it’s really about closing the last mile.”

One of the most telling KPIs for OX is the volume of code changes scanned daily – which currently stands at around 100 million lines – reflecting not only client usage, but also the velocity of change in software environments. OX also tracks how quickly customers fix high-priority issues once they’re flagged, helping the company measure the credibility and usefulness of its prioritization system, according to Ziv.

The era of cloud infrastructure misconfigurations as the primary security risk is largely behind us, with issues like open S3 buckets mitigated through tighter controls and smarter defaults. As a result, cloud security providers are starting to pivot toward application security, but Ziv said they face challenges because of the different buyer personas and organizational focus. That gives specialized vendors like OX an edge.

“It’s going back to the code to look at the vulnerabilities themselves and whether they’re reachable,” Ziv said. “And I think the new generation that right now OX is part of is actually saying, ‘Hey, the only thing that is reliable is what’s happening in the code compared to production.'”