WillItSurvive

Israeli startup selling application security posture management (ASPM) across the software pipeline.

Losing its protection
Assessed 21 July 2026 · Evidence as of 21 July 2026
The structural protection is eroding.
On the recordSince 21 July 2026 · Checkable from early 2027 · Every call on the record Checkpoint: Whether Cycode announces a Series C round validating its growth claims
The call

Cycode claims triple-digit growth but hasn't raised money in nearly five years and is shrinking staff, while Microsoft, GitLab, Wiz and Apiiro all close in on the same ground.

Cycode helps companies find security problems in their code before bad actors do. It is getting harder to protect because Microsoft's GitHub, coding assistants like Copilot, and new AI tools are starting to do the same scanning work built-in, without a separate tool. The real test will be whether Cycode can raise new money in the next six months, it has not raised funding since 2021, and the company's headcount is shrinking even though it claims huge revenue growth, which does not add up.

Why
01
AI pressure: GitHub Copilot, Cursor, Claude Code and other coding agents. Coding assistants are absorbing basic scanning and secrets detection directly into the IDE, shrinking the market for standalone tools that just flag known bugs. Could AI do the core job? Only partly.
02
Bigger players: GitHub Advanced Security (Microsoft), GitLab, Wiz. Microsoft and GitLab bundle security scanning into the platforms developers already pay for, and Wiz could bundle ASPM into its cloud security suite. Could a giant copy it? Yes, easily.
03
What protects it. Deep correlation across 100+ tools plus Fortune 100 compliance relationships that are costly to rip out once wired in.
What would change this call
Cycode announces a Series C round by early 2027. Would confirm investor confidence in its revenue growth claims.
Headcount trend over next two quarterly updates from Crustdata or similar trackers. Continued shrinkage would signal strain despite claimed revenue growth.
2026 or 2027 analyst reports (e.g. Gartner, Forrester) on ASPM category rankings. Would show whether Apiiro's lead over Cycode widens or narrows.
Key numbers
  • $81M total funding, last round Nov 2021 (2026-07)
  • Revenue estimated $21M to $38M by third parties (2026-07)
  • Headcount ~150, down 7% year over year (2026-06)
Named risks
  • No new funding round since Series B in November 2021 despite claimed 200-400% YoY revenue growth. Severity: high
  • Independent analysts rank Apiiro ahead of Cycode in core enterprise ASPM breadth as of May 2026. Severity: medium
  • GitHub Advanced Security and GitLab bundling native scanning could commoditize baseline ASPM features. Severity: high
  • AI coding assistants (Copilot, Cursor, Claude Code) increasingly embed native security linting, narrowing standalone tool need. Severity: medium
Rivals, as read in July 2026
RivalDirectionEvidence
Apiirolosing toRanked 'Best Overall' for enterprise AppSec governance ahead of Cycode, May 2026 analysis
GitHub Advanced Security (Microsoft)gaining onNative platform bundling threatens to absorb pure-play ASPM scanning layer
WizcontestingAdjacent CNAPP incumbent capable of bundling ASPM-grade correlation into its platform
ArmorCode, Snyk AppRiskcontestingPositioned as mid-market alternatives to Cycode per May 2026 analyst comparison
Questions people ask
Has Cycode raised a Series C funding round?
No. As of July 2026, Cycode's most recent equity round remains its $56M Series B from November 2021, bringing total disclosed funding to about $81M across seed, Series A ($20M, May 2021) and Series B rounds, per company and Pitchbook data.
Is Cycode profitable?
Cycode has not disclosed profitability. It claims (vendor-claimed) over 400% YoY revenue growth as of February 2025 and doubled ARR for two consecutive years by November 2024, but has not raised new equity since November 2021, an unusual gap for a claimed high-growth startup.
Who is Cycode's biggest competitor?
Apiiro is Cycode's closest ASPM rival; an independent May 2026 analysis called Apiiro 'Best Overall' for risk-based AppSec governance at large enterprises, positioning Cycode's strength as narrower, focused on pipeline and supply-chain security rather than broad correlation.
Could AI coding assistants replace Cycode's product?
Baseline scanning features are being absorbed into IDEs like Copilot and Cursor, but Cycode responded by shipping an MCP Server in October 2025 and 'ADLC Security' in May 2026 to govern AI-generated code, positioning itself as a layer atop, not replaced by, these tools.
Who owns Cycode?
Cycode is privately held and VC-backed, founded in 2019 by CEO Lior Levy, CTO Ronen Slavin, and Chief Product/Engineering Officer Dor Atias. Insight Partners led its $20M Series A (May 2021) and $56M Series B (November 2021), with YL Ventures also participating.
Is it safe to take a job at Cycode right now?
Cycode has not announced new funding since its November 2021 Series B despite claiming triple-digit revenue growth through 2025, a mismatch that could indicate strong capital efficiency or funding difficulty; no layoffs have been publicly reported as of July 2026.
Timeline
  • 2026-07-14Hosted virtual Agentic Development Security Summit with Anthropic, Cisco, Abbott speakers
  • 2026-05-12General availability of ADLC Security; declared 'Shift Left is Dead'
  • 2025-10-08Released Cycode MCP Server for Cursor, Windsurf, GitHub Copilot integration
  • 2025-06Launched AI Exploitability Agent, AI Teammates, and CI/MON runtime protection
  • 2025-02-04Launched Change Impact Analysis; secured multiple Fortune 100 customers
  • 2024-11-13Announced ARR doubled year over year for two consecutive years
  • 2024-07Unveiled 'Cycode AI' embedding AI features across ASPM platform
  • 2024-05-16Launched ASPM connector marketplace with 100+ integrations
  • 2024-03-05Acquired Bearer, an AI-powered SAST and API discovery startup
  • 2021-11Raised $56M Series B led by Insight Partners
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources