Problem

Modern software teams are often protected by one-time or annual penetration tests even though their code changes continuously. Veria’s research describes traditional pentests as slow, expensive, narrowly scoped, and quickly outdated: results can take two to three weeks, engagements commonly cost $15,000–$30,000 or more, and auditors may examine only five to ten application features while background jobs, admin panels, and internal APIs remain untouched. This creates a damaging mismatch between the economics of testing and the speed of development, particularly for companies subject to PCI DSS, HIPAA, or pre-launch crypto audits.

The killer use case is a team shipping code daily that needs to know whether new features introduce exploitable vulnerabilities before attackers find them, without hiring a full internal red team. Veria’s Stoffel case study illustrates the economic pain: the customer previously paid roughly six figures for an audit, waited weeks for results, and still had unreviewed code shipped between audits.

Product / Service

Veria AI is an autonomous application pentester delivered as a continuous security-testing service. Its agents map the attack surface, test code paths and edge cases, and attempt real exploits—typically against a staging environment—so findings are validated rather than merely inferred from static patterns. The product is designed to plug into the CI/CD workflow and provide a live, ranked view of exploitable issues across repositories.

The workflow extends from discovery through remediation. Findings can be posted to Slack and filed in Linear with status synchronization; each issue includes evidence of exploitability, impact, and remediation guidance, while Veria can draft a code fix or open a patch for engineer review and merge. The intended benefit is broader coverage, faster feedback, fewer false positives, and a security review that can run as code changes rather than months after they are introduced.

Market

Veria competes in AI-native offensive security, specifically autonomous or continuous application penetration testing. Its differentiation from conventional SAST products such as Semgrep and Snyk is the attempt to demonstrate real business-logic vulnerabilities through working exploits, rather than primarily flagging code patterns. Comparable autonomous offensive-security platforms include XBOW and Horizon3.ai’s NodeZero, both of which also emphasize continuous attack simulation, exploit validation, and prioritized remediation.

The company has early but concrete traction rather than appearing to be merely pre-product. It is backed by Y Combinator and was founded in 2025 by members of the top U.S. competitive hacking team; the company says it has found critical vulnerabilities across AI tools, operating systems, fintech applications, and major crypto exchanges. Veria also publishes a Stoffel customer case study reporting findings in two to three hours instead of two to three weeks, comparable or better vulnerability coverage than a leading audit firm, and a comparison in which Veria found 34 bugs with a 5% false-positive rate versus six bugs and 100% false positives for GitHub Advanced Security. Public materials reviewed here do not disclose a standard price or revenue figure, but they do report use by customers including a multi-billion-dollar fintech company.