Legit Security: who they are, what they sell and what CISOs should ask

What Legit Security sells

Legit Security sells an application security platform to enterprise security and development teams. Its September 2023 funding release described the product as "an enterprise Application Security Posture Management (ASPM) platform" and was datelined Palo Alto (PR Newswire). The company came out of stealth in February 2022 with a release datelined Tel Aviv, which said it would build its US go-to-market organization with offices in Austin and Palo Alto (GlobeNewswire). The sources given here do not state a founding year.

The company is privately held and venture-backed. The 2022 release announced a $30 million Series A from Bessemer Venture Partners and TCV, after seed funding from CyberStarts (GlobeNewswire). In 2023 it closed a $40 million round led by CRV, with Cyberstarts, Bessemer and TCV taking part (PR Newswire). Its three co-founders run it: Roni Fuchs as CEO, Liav Caspi as CTO and Lior Barak as COO.

The product lines, in plain terms, are these:

• Posture management. The company says the platform consolidates vulnerabilities from different sources, enforces security policies and prioritises risk (PR Newswire).
• Software supply chain. At launch, the company said the platform scanned development pipelines for gaps and leaks. It also scanned the infrastructure inside those pipelines and the security hygiene of the people working in them (GlobeNewswire).
• AI coding security. Its homepage says it feeds remediation insights into AI tools such as Cursor, Claude Code and GitHub Copilot, with feedback from integrated SAST and SCA (Legit Security).
• Agentic remediation. The same page says the company's autonomous agents resolve vulnerabilities and that every change is validated (Legit Security).

Secrets detection is also among the categories on our record for the company.

On delivery, the company described itself in 2022 as a SaaS product that supports both cloud and on-premises resources. It said the product did not interfere with existing development tools and workflows (GlobeNewswire). The 2023 release named Google, NYSE, Kraft Heinz and Takeda Pharmaceuticals as customers (PR Newswire).

The company has also said what it is not. At launch, Fuchs said: "Right now, enterprises don’t need another code scanner." He said they needed a security product for the wider software supply chain environment (GlobeNewswire). Our reading is that this places the platform alongside scanners rather than in place of them. A Netskope security executive quoted in the same release said it "nicely complements our existing investments in application security tools". Other companies on our record in these categories are listed under vendors.

Figure: Legit Security's home page, captured 2026-10-29. Source: About Us | Legit Security.

The founders

CISO Tribune's record lists three co-founders: Roni Fuchs, CEO; Liav Caspi, CTO; and Lior Barak, COO. All three were named as the company's leadership in the 2022 launch release. The same release said Legit Security had assembled a team of security experts from Israel's Unit 8200, Checkmarx, Ping Identity, Duo/Cisco and Microsoft. That list described the team as a whole. The release did not say which of those organisations, if any, the founders themselves came from, and none of the material we reviewed sets out earlier employers or roles for any of the three.

Most of what the founders have said on the record about why they started the company comes from Fuchs. In the launch release he described the starting point as a change in how enterprises build software: "Enterprises increasingly rely on software to do business, and they're adopting cloud, DevOps, CI/CD and agile techniques to move fast," he said, adding that this "has created a huge new, unprotected attack surface that cybercriminals have targeted, and their attacks are escalating" (GlobeNewswire).

By the Series B announcement in 2023, Fuchs, then described as co-founder and CEO, stated the mission in broader terms. "We founded Legit Security with the mission to secure the world's software with a platform that continuously manages application security from code to cloud," he said (PR Newswire). In our reading, the founding story moved in that year from a focus on the software supply chain to application security as a whole. Fuchs did not describe it as a change.

At that time, Cyberstarts founder Gili Raanan said his firm was "excited to continue backing the talented, hard-working team at Legit Security" (PR Newswire). That is an investor's description, and the investor had backed the company since its seed round.

The sources available for this profile include no statements from Liav Caspi or Lior Barak about why they co-founded the company, and none describe their careers before Legit Security. We have not filled that gap with inference. Entries for security leaders and founders on our record are collected under people.

What the product does

Legit sells an ASPM platform that, in the words of its 2023 funding release, "continuously reduces application risk through discovery, analysis, correlation, and remediation of application vulnerabilities from code development all the way to cloud deployment" (PR Newswire). The same release said the product's "automated SDLC discovery and analysis capabilities" sort issues "based on context and business criticality" (PR Newswire). The sources describe the work in four steps.

Discovery and inventory. The first job is mapping what a development organisation runs. At launch, Takeda's head of DevSecOps, Bob Durfee, said: "We’re now able to inventory all our SDLC systems and security tools, view developer activity, and detect and remediate vulnerabilities across them fast" (GlobeNewswire).

Correlation and context. Findings from other scanners are pulled together and weighed. The company's homepage states that the platform "understands each application’s business criticality, data sensitivity, and exposure, using that context to remediate" (Legit Security). A customer quoted on the same page credited it with "correlating the findings from different tools that we use in the organization" (Legit Security).

Policy and governance. The 2022 launch release said the product shipped with "hundreds of security policies developed by industry experts with real-world SDLC security experience". It also said the product included continuous assurance and governance features to "monitor adherence to regulatory requirements and compliance frameworks in real-time" (GlobeNewswire).

Remediation. The company now calls the product its "Agentic AppSec platform" and says it acts "before any code hits commit" (Legit Security). Beyond the agent fixes and developer-tool feedback noted earlier, the homepage claims that each fix "trains your AI coding agents to introduce fewer vulnerabilities over time" (Legit Security).

The outputs a security team works from are posture measures. Durfee said Legit's security scoring let him "measure the security posture of different teams and show progress improving it" (GlobeNewswire). Erik Bataller, VP of Security at ACV Auctions, described the product "tracking the security posture of our different teams and workspaces, addressing SDLC configuration drifts" (GlobeNewswire).

On the controls a person keeps, the sources mention policies, scores and compliance monitoring. In our reading, they say little about how a team approves or rejects an agent's fix, beyond the company's statement that changes are validated. Our record also files Legit under secrets detection.

Figure: Legit Security's product page, captured 2026-10-29. Source: AI-Native ASPM | Legit Security.

How it works and what it connects to

The sections above covered what the platform does. This one covers what it reads, where it runs and what the sources leave out.

The 2022 launch release described the platform's scope. It said the platform scanned software development pipelines for gaps and leaks, the infrastructure and systems inside those pipelines, and the people working within them.

Two customers quoted on the company homepage described the same reach in their own terms:

• One, at a financial services organisation, said it had needed a single platform to unify visibility across repos, build systems and deployment environments.
• Another said the product gave visibility across its pipelines and repositories.

By the Series B in September 2023, the company described the architecture as a unified application security control plane that consolidated vulnerabilities from different sources, enforced security policies and prioritised risk. The same release said it provided real-time visibility and security control across changing development environments.

The launch release described the product as a SaaS service that supported both cloud and on-premises resources. Amit Karp of Bessemer Venture Partners, an investor, said in that release that the product was "easy to deploy and delivers value in a couple hours." That is his claim. No customer figure for setup time appears in the sources.

The homepage places part of the product inside the developer's coding tools. It says Legit feeds remediation insights into AI tools like Cursor, Claude Code and GitHub Copilot. It also says developers get real-time feedback from integrated SAST and SCA as they write.

The homepage names agents rather than models:

• It says Legit uses intelligent agents to understand risk, remediate vulnerabilities and improve with every cycle.
• It says its autonomous agents take action, resolving vulnerabilities with fixes that, in the company's words, "understand your standards, your workflows, and what matters most to your business." It adds: "Every change is validated."
• It says the platform combines application context, business impact and AI-driven insight to separate real risk from noise.

The pages do not say which models the agents run on, what that validation involves, or whether a person approves a fix before it is merged.

The sources do not say where customer code and findings are stored, which regions data resides in, or what limits the company itself places on the product.

Where it sits in the market

CISO Tribune's record files Legit Security under three categories. Application security posture management covers the aggregation, correlation and prioritisation of findings from many application security tools across the software lifecycle. Secrets detection covers the scanning of code, repositories and collaboration tools for exposed credentials, keys and tokens. Software supply chain security covers the protection of build pipelines, artifacts, container images and package ecosystems against tampering and malicious components. The company's own descriptions have spanned the first and third of these. Its September 2023 Series B release described an enterprise ASPM platform that "protects an organization's software supply chain from attack".

The chart shows how many vendors CISO Tribune's record files under each of the three categories Legit Security sits in.

Other vendors on the record in those categories are listed here alphabetically and in no order of merit: Aikido Security, Anchore, Apiiro, Aqua Security, Archipelo, Arnica, Chainguard, Cycode, Endor Labs, Finite State, GitGuardian, GitHub Advanced Security, GitLab, HashiCorp, JFrog, Mend.io, OX Security, Phoenix Security, Pluto Security, RapidFort, Raven.io, Red Hat, Semgrep, Snyk, Socket, Sonatype, Trail of Bits, Truffle Security, Upwind and Veracode. Their profiles are in vendors, and the category terms are in the glossary.

At launch, the company set itself apart from scanning tools. In the February 2022 Series A release, Roni Fuchs said: "Right now, enterprises don’t need another code scanner. By 2023, Fuchs described the mission as being "to secure the world's software with a platform that continuously manages application security from code to cloud", according to the Series B release.

Customers quoted at launch described the product in similar terms. James Robinson, Netskope's deputy chief information security officer at the time, said "Legit’s platform nicely complements our existing investments in application security tools" (GlobeNewswire). Or Cohen, principal engineer at Melio, tied it to compliance work and said the platform helped "ensure security compliance with regulatory frameworks" (GlobeNewswire).

Our reading of these pages is that they present Legit as a layer that sits over other application security tools and correlates their output, not as a replacement for them. No single passage makes that claim. The current site adds AI coding assistants to the same picture, as described in the earlier sections.

Funding, investors and growth

The sources we hold record two announced rounds for Legit Security. The Series A arrived with the company's exit from stealth: a $30 million round, with Bessemer Venture Partners and TCV as leads. Before that, the launch release said, seed funding came from CyberStarts, with no amount given. The Series B was a $40 million round led by CRV, and Cyberstarts, Bessemer Venture Partners and TCV joined it as existing investors. Neither release gave that total.

The chart shows Legit Security's two disclosed rounds, in millions of US dollars.

Chart data: GlobeNewswire News Room; prnewswire.com.

The company said the Series A money would expand its engineering team and build a US go-to-market organisation, with offices in Austin and Palo Alto. The same release said the company had hired staff from Unit 8200, Checkmarx, Ping Identity, Duo/Cisco and Microsoft. It framed the raise with a Gartner forecast that 45% of organisations would have faced software supply chain attacks by 2025.

The Series B release listed different uses. It said the money would expand Sales, Marketing and R&D and address threats from AI and large language models in new applications. Fuchs said the investment would bring "new capabilities to extend visibility, security and governance to AI-generated code and embedded Large Language Models (LLMs) in applications". On our reading, the stated priorities moved from building the engineering base to selling and AI work.

The Series B release also made growth claims. It named Google, NYSE, Kraft Heinz and Takeda Pharmaceuticals as customers. It said platform deployments had nearly doubled in size within the first year of implementation. Takeda had already appeared in the launch release, through a quote from Bob Durfee, its Head of DevSecOps. James Green, a general partner at CRV, said he was "amazed by the breadth and depth of their Fortune 500 customers in such a short time". The release also cited a Gartner prediction that more than 40% of organisations building custom applications would adopt ASPM by 2026.

Neither release stated a valuation or a headcount. Funding for other companies in these categories appears on their own vendor pages.

Customers, partners and public evidence

The customers named in Legit Security's record come from the launch and Series B releases covered above: Google, NYSE, Kraft Heinz and Takeda, along with quoted practitioners at Takeda, Netskope and Melio. It said they include "some of the largest enterprises in the world" in insurance, banking, consumer products and cybersecurity. That is the company's own description, and the release identifies none of those customers.

The 2022 launch release carried one customer voice not covered earlier. Erik Bataller, VP of Security at ACV Auctions, said the product helped his team secure CI/CD pipelines, track the security posture of different teams and workspaces, and address SDLC configuration drift. He added that it let developers keep pace with "minimal security friction". The same release quoted Amit Karp, a partner at Bessemer Venture Partners, who said the product was "easy to deploy and delivers value in a couple hours". Bessemer was an investor, so this is a backer's statement and not a measured deployment benchmark.

The company's homepage carries further customer quotes. In the text we reviewed, those quotes do not have names attached. One came from a financial services organisation that said it needed "a single platform that could unify visibility across repos, build systems, and deployment environments". Another customer said the platform "did an outstanding job of correlating the findings from different tools" and that the company had included it "as early adopters of certain features". Because these are unattributed testimonials chosen by the vendor, they show what the company wants to stress, not what any particular named buyer reported.

For outside views, the homepage links to a product page on Gartner's peer reviews site, where buyers can read reviews directly. In a release on PR Newswire, the company said it had been named to the Fortune Cyber 60 for the third consecutive year. That list is presented by Lightspeed. The list reflects editorial and investor selection, not a product test.

The sources we reviewed did not set out security certifications, a partner or reseller programme, cloud marketplace listings or independent benchmark results. Buyers who need those should ask the company for current documentation. Other vendors in the same categories are listed in our vendor directory.

Research, open source and public work

This section is meant to record Legit Security's research, open-source tools, disclosures and reports, with dates and findings. The company's own pages for that work were in the material available to us. Each one returned only cookie-consent and tracking text, with no body copy. This profile therefore reports no research findings, tool descriptions, report figures or disclosure dates from those pages. Readers who want that detail should go to the company's site directly. Vulnerability write-ups we track appear on our disclosures page, and vendor studies are listed under reports.

What the sources do show is the subjects the company chose to write about in its own announcements.

In the Series B release of September 2023, mentioned above, the company described AI-generated code and embedded large language models as introducing "a rapidly expanding class of" new threats. It linked that phrase to a post on its own blog about securing AI-generated code (PR Newswire). The release did not summarise what the post found.

The February 2022 launch release described a body of written security knowledge built into the product. The company said its platform "combines automated discovery and analysis capabilities with hundreds of security policies developed by industry experts with real-world SDLC security experience" (GlobeNewswire). That is a product claim, not published research. The release did not say whether any of those policies were released openly.

Our reading of the two releases is that the company's public writing moved from pipeline and supply-chain policy in 2022 toward the security of AI-assisted development by 2023. We will add those when the company's pages can be read in full.

What a CISO should ask before buying

These questions are our reading of what a proof of concept should test. Each one is tied to something Legit Security has said about its own product, so a buyer can check the claim against their own estate.

1. Where does prioritisation context come from? The homepage says the platform understands each application's business criticality, data sensitivity and exposure. Ask who supplies and maintains that context, and what happens to a finding's priority when a tag is wrong or missing.

2. How are duplicate findings merged? The Series B release described a control plane that consolidates vulnerabilities from different sources. Feed in the same issue from two of your scanners and check how they are matched and which severity wins.

3. What does validation mean for agent fixes? The homepage says its autonomous agents resolve vulnerabilities and that "Every change is validated" (homepage). Ask whether that means tests, human review or both, and whether an agent can merge without approval.

4. How is the learning loop measured? The company claims each fix trains your AI coding agents to introduce fewer vulnerabilities. Ask for the metric behind that and where the training data is kept.

5. How do the built-in scanners compare? The company describes integrated SAST and SCA that give feedback as code is written. Run them on a repository with known flaws and compare the results with your current tools.

6. What is enforced before commit? The homepage says the platform acts "before any code hits commit" (homepage). Ask which checks run at that point, which run later, and what a developer sees when one fails.

7. What permissions does it need? The 2022 launch release said the solution did not interfere with existing development tools and workflows. Ask for the exact read and write scopes it requests in source control and CI.

8. Which self-hosted systems connect? The same release said it supported cloud and on-premises resources. Confirm coverage for your own on-premises build and repository servers.

9. What developer data is collected? The release said the platform scanned people and their security hygiene. Ask what activity data is stored, who can see it and for how long, before HR or a works council asks you.

10. Which frameworks map out of the box? The company said it monitored adherence to regulatory requirements and compliance frameworks. Ask which ones, and whether the evidence exports in a form your auditors accept.

11. Can the policy library be tuned? Given the large built-in policy set mentioned earlier, ask how policies are edited or switched off, and how the company measures false positives.

Timeline

Only two items in our sources carry firm dates: a February 2022 wire release and a September 2023 wire release. The list below keeps to what the sources date, oldest first, and puts undated items in a separate note.

• Before February 2022: seed round. The launch release said prior seed funding came from CyberStarts, without giving a date or amount.
• February 2022: US expansion plan. The same release said the money would go to engineering and to a US go-to-market organisation with offices in Austin and Palo Alto.
• September 2023: stated use of funds and growth claim. The release said the money would expand sales, marketing and R&D and address AI and large language model threats in new applications. The company also said platform deployments across customers had nearly doubled in size within the first year. That figure is the company's own and was not independently verified.

Undated items. A later Legit Security release, listed alongside the Series B on the newswire, announced VibeGuard, which the company called an industry first. The source does not give the release date.

The agentic remediation, AI coding and ASPM pages described in earlier sections carry no dates. Neither do the company's research and open source pages. A buyer who wants a dated product history, such as when remediation agents or AI coding integrations reached general availability, should ask the company for release notes. Comparable funding and launch histories for other companies in these categories are on our vendor pages.