Is Moresec profitable in 2026?

No profitability data is publicly available for Moresec (默安科技) as of 2026. No revenue figures, funding history, or financial statements have surfaced despite targeted searches, leaving profitability entirely unverified.

Could AI replace Moresec's product, MurphySec?

MurphySec's core functions, dependency scanning, vulnerability detection, and CVE-database matching, are exactly the kind of automatable workflow AI tooling already targets. No verified proprietary data moat has been confirmed to resist this as of 2026.

Who is Moresec's biggest competitor?

Domestically, Qi An Xin, NSFOCUS, and Sangfor (all active in China's cybersecurity market as of 2026-07-13) could bolt SCA features onto existing suites. Globally, Sonatype and Snyk lead the SCA category but are blocked from China by data-localization law.

Moresec's ownership structure and funding history are unverified as of 2026. Background reports suggest a Series C/D-stage startup founded around 2016 with Chinese VC backing, but this could not be confirmed with a citable current source.

What does Moresec actually make?

Moresec, based in Hangzhou, China, is linked to MurphySec (墨菲安全), a software supply-chain-security tool offering SCA, vulnerability detection, a vulnerability database, GitHub Actions integration, and a JetBrains IDE plugin, per its GitHub repository dated 2023-05-14.

Has Moresec raised recent funding?

No recent funding round, investor names, or valuation could be verified for Moresec as of 2026 despite roughly a dozen targeted Chinese and English searches; this remains an open, unconfirmed item.

Cybersecurity companies · China

Moresec

Chinese startup making MurphySec, a tool that scans code for vulnerable open-source components.

Little protection left

Assessed 26 July 2026 · Evidence as of 26 July 2026

Not much stands between this business and its pressures.

On the recordSince 26 July 2026 · Checkable from watch through 2026 · Every call on the record Checkpoint: Any announcement of SCA bundling by Aliyun, Tencent Cloud, or a major domestic suite vendor

The call

Moresec has a working open-source supply-chain scanner but no confirmed customers, funding, or data edge to show why bigger rivals or AI tools would not catch up.

Moresec's main product, MurphySec, scans code to find security problems and outdated software packages. Bigger Chinese security companies like Qi An Xin and Sangfor can add this feature to their existing products without much trouble, and new AI tools are starting to do the same job automatically and cheaply. The biggest risk would be if one of those bigger companies or major cloud providers like Aliyun suddenly launched their own version and bundled it with other services, which could eliminate Moresec's room to grow within a year or two.

Why

AI pressure: AI-native code-scanning tools (GitHub Advanced Security, model-assisted DevSecOps). AI tools that auto-match CVEs to code dependencies could replicate MurphySec's core function cheaply, but none has displaced it yet in China. Could AI do the core job? Yes, likely.

Bigger players: Qi An Xin, NSFOCUS, Sangfor. These bigger domestic security vendors could bolt SCA scanning onto existing suites, but no verified announcement shows them doing so yet. Could a giant copy it? Yes, easily.

What protects it. None confirmed: no named enterprise customers, no proprietary vulnerability database, no regulatory approval found.

What would change this call

Qi An Xin, NSFOCUS, or Sangfor announces native SCA or software supply chain security modules. Shows incumbents converting from slow to shipped threat against Moresec's core product.
Aliyun or Tencent Cloud bundles SCA/dependency scanning natively into their cloud platforms. Shows cloud platform bundling is eroding demand for standalone SCA vendors like Moresec.
Moresec announces named enterprise customers with multi-year renewals or a new funding round. Would be first verifiable evidence of market traction countering current lack of proof.

Key numbers

Open-source MurphySec repo public since at least 2023 (2023-05-14)
0 verified enterprise customer logos found (2026)
0 verified funding rounds or valuation confirmed (2026)

Named risks

No verified funding, revenue, headcount, or customer data found for Moresec as of 2026. Severity: high
Core SCA scanning and CVE-matching functions are highly automatable by AI tooling with no confirmed defensive moat. Severity: high
No structural barrier preventing larger domestic suite vendors from bolting on equivalent SCA features. Severity: medium
Sector-level reputational and regulatory scrutiny of Chinese cybersecurity vendors, exemplified by the KnownSec state-ties report of 2026-02-04. Severity: medium
MurphySec's corporate relationship to Moresec itself is unconfirmed by independent sourcing. Severity: low

Rivals, as read in July 2026

Rival	Direction	Evidence
Qi An Xin	gaining on	Large domestic suite vendor could bundle SCA feature; no confirmed Moresec countermove as of 2026
NSFOCUS	gaining on	Established Chinese suite vendor able to add SCA capability with existing distribution as of 2026
Sangfor	contesting	Actively marketing cloud and network security products in China as of 2026-07-13
Sonatype	losing to	Global SCA category leader with mature vulnerability timeline resource dated 2026-07-21, though blocked from China by data-localization law
GitHub Advanced Security / Snyk	gaining on	Native SCA bundling trend documented via GitLab migration guide, 2024-05-01

Questions people ask

Is Moresec profitable in 2026?: No profitability data is publicly available for Moresec (默安科技) as of 2026. No revenue figures, funding history, or financial statements have surfaced despite targeted searches, leaving profitability entirely unverified.
Could AI replace Moresec's product, MurphySec?: MurphySec's core functions, dependency scanning, vulnerability detection, and CVE-database matching, are exactly the kind of automatable workflow AI tooling already targets. No verified proprietary data moat has been confirmed to resist this as of 2026.
Who is Moresec's biggest competitor?: Domestically, Qi An Xin, NSFOCUS, and Sangfor (all active in China's cybersecurity market as of 2026-07-13) could bolt SCA features onto existing suites. Globally, Sonatype and Snyk lead the SCA category but are blocked from China by data-localization law.
Who owns Moresec?: Moresec's ownership structure and funding history are unverified as of 2026. Background reports suggest a Series C/D-stage startup founded around 2016 with Chinese VC backing, but this could not be confirmed with a citable current source.
What does Moresec actually make?: Moresec, based in Hangzhou, China, is linked to MurphySec (墨菲安全), a software supply-chain-security tool offering SCA, vulnerability detection, a vulnerability database, GitHub Actions integration, and a JetBrains IDE plugin, per its GitHub repository dated 2023-05-14.
Has Moresec raised recent funding?: No recent funding round, investor names, or valuation could be verified for Moresec as of 2026 despite roughly a dozen targeted Chinese and English searches; this remains an open, unconfirmed item.

Timeline

2026-07-26Search results confirm Moresec is distinct from unrelated Japanese firm Moresco Corp (TSE:5018)
2026-07-21Sonatype vulnerability timeline illustrates scale of global SCA threat category Moresec's MurphySec addresses
2026-07-13Sangfor (深信服) actively marketing cloud/network security products as large Chinese peer vendor
2026-05-07Murphy Security Research Institute web page live, claiming supply-chain research focus across five sectors
2026-02-04WireScreen report ties peer firm KnownSec to Chinese state cyber activity, raising sector scrutiny
2024-05-01GitLab publishes migration guide from GitHub Advanced Security, showing native SCA bundling trend
2023-05-14murphysecurity/murphysec open-source repo describes SCA, vulnerability detection, and vuln database tool

Revision history

26 July 2026

First assessed. Little protection left. The text above is fixed as of this date and is not edited afterwards.

In the same band

Rising (Beijing Rising Information Technology)CyFirma Alert Logic