Israeli runtime security startup Oligo Security has raised $60 million in new funding, bringing its total capital raised to $140 million at a valuation that more than doubled since its $50 million Series B round closed in January 2025. According to reporting by SiliconANGLE, the company secured backing from Ballistic Ventures, Canon Capital, Greenfield Partners, Lightspeed, Red Dot Capital Partners, TLV Partners, and Eyal Waldman. The funding arrives as the company claims 300% year-over-year growth in annual recurring revenue and positions itself around a pitch that AI-generated exploits are changing the economics of cybersecurity.
Oligo's platform uses a runtime sensor built on eBPF, the Linux kernel feature, to monitor which library functions a workload actually invokes during production. Most vulnerabilities flagged by scanners are never called at all, and the system tells customers they can disregard those uncalled flaws. For vulnerabilities that do get invoked, the platform can halt them mid-exploit at the application layer without terminating the container or the process running it. In April, the company rolled out Runtime Exploit Blocking, which guards against categories of attack methods rather than specific CVEs, plus a virtual patching feature designed to cover slow patch cycles. AWS named Oligo its exclusive AI runtime security partner for Security Hub's extended plan in February, and Palantir added the company to its FedStart program in June, targeting FedRAMP High and DoD Impact Level 5 authorization.
CEO and co-founder Nadav Czerninski framed the fundraise around the threat of AI-generated exploits. "AI has fundamentally changed the economics of exploitation," he said, arguing that "when attackers can find vulnerabilities and build exploits at machine speed, runtime becomes the only place you can definitively understand true risk and stop real attacks without breaking production." The reporting notes that the actual valuation figure, customer count, and terms of the AWS exclusivity arrangement were not disclosed, meaning the growth metrics and "exclusive" designation should be taken as reported rather than independently verified. OpenAI itself identified Astra as its first model at a 'Critical' cyber level two days before the announcement, which Czerninski uses as supporting evidence from the model vendor side.
The case for Oligo's approach rests on the argument that application security teams are overwhelmed by scanner output they can't triage quickly enough, and that AI tools are shortening the time it takes attackers to develop working exploits. The company's pitch is that buying based on what actually runs in production, rather than what theoretically exists in a library, becomes more compelling each quarter that AI continues to compress the exploit-development cycle. Rival runtime players will make the same "only exploitable vulnerabilities matter" argument, and the category is expected to consolidate rapidly once hyperscalers choose their preferred partners. For security leaders staring at a wall of red alerts in a scanner dashboard, the distinction between shipped code and called code offers a filtering mechanism that could cut noise without increasing exposure. If the defensive cycle can't keep pace with the offensive one, runtime visibility becomes less optional and more foundational. Organizations that delay adoption risk being caught in the gap between vulnerability disclosure and patch deployment, especially as adversaries gain access to tools that automate the search for weaknesses and the creation of exploits.