Nebula Security
AI-native security lab selling automated code auditing built by elite exploit researchers.
On the record
Checkpoint: ZeroPath's speaking slot at Black Hat USA, which could widen its lead in mid-market mindshare
The call
Nebula has hacker credibility but no named customers yet, competing against a rival that already has hundreds and a shipped AI product from HackerOne.
Nebula Security uses artificial intelligence to find bugs in mobile apps and other software code. The company's founders have real credibility from breaking into Android phones, which is hard to fake. However, it is easy to copy: bigger companies like HackerOne already built similar AI tools, other startups like ZeroPath and Hex Security are doing the same thing, and free AI models from OpenAI and Google can analyze code too. The one thing that could save Nebula is if it stops trying to be a general scanning tool and instead becomes known for deep, high-stakes security reviews that big companies pay premium prices for, paired with some kind of official certification or seal that shows the work is trustworthy.
Why
01
AI pressure: HackerOne Code AI, ZeroPath, and frontier LLMs doing code analysis. Rivals already ship AI code-scanning products; frontier LLMs shrink the gap Nebula's CLI agent needs to stay ahead of generic analysis. Could AI do the core job? Yes, likely.
02
Bigger players: HackerOne. HackerOne has already launched its own AI code-security product, giving it a live competing offering plus an existing customer base Nebula lacks. Could a giant copy it? Yes, easily.
03
What protects it. Founders hold independently verified elite exploit credentials, including a full Android 17 exploit chain and $400,000+ in Google bounties.
What would change this call
Nebula names paid enterprise/mid-market customers or design partners within 6 months of its July 23, 2026 launch. Would show founder reputation converts into real paying demand, not just launch buzz.
ZeroPath speaks at Black Hat USA 2026 and announces new customer counts afterward. Would show the incumbent AI-AppSec rival consolidating mindshare while Nebula is still pre-traction.
Nebula publishes or is cited in a third-party benchmark comparing false-positive/recall rates against ZeroPath or HackerOne Code. Would show whether Nebula's product has measurable technical superiority beyond founder credentials.
ZeroPath speaks at Black Hat USA 2026 and announces new customer counts afterward. Would show the incumbent AI-AppSec rival consolidating mindshare while Nebula is still pre-traction.
Nebula publishes or is cited in a third-party benchmark comparing false-positive/recall rates against ZeroPath or HackerOne Code. Would show whether Nebula's product has measurable technical superiority beyond founder credentials.
Key numbers
- $400,000+ won in Google bug bounties
- 934 vulnerabilities in Nebula's catalog
- ZeroPath reports 750+ customers, 200k+ scans/mo
Named risks
- Zero named customers or disclosed revenue as of July 2026 launch.
- No proprietary dataset, workflow lock-in, or regulatory moat identified beyond founder reputation.
- Crowded, well-funded AI-SAST field (ZeroPath, Hex Security, HackerOne) already owns buyer attention.
- Self-claimed CVE credit for nginx bug not independently confirmed by third parties.
- Name collision with unrelated Vega and Zyxel Nebula products could cause market confusion.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| ZeroPath | losing to | 750+ customers and 200,000+ monthly scans by 2026-07-06 vs Nebula's zero named customers |
| HackerOne | losing to | HackerOne Code shipped and benchmarked against ZeroPath by 2026-07-06 |
| Hex Security | losing to | Claims $1M ARR in 8 weeks by 2026-06-03 vs Nebula's undisclosed revenue |
| Gecko Security | contesting | Publishes direct comparisons claiming fewer false positives than ZeroPath, 2026-04-09 |
| Snyk, Checkmarx, Semgrep | gaining on | Incumbent AppSec vendors racing to bolt on AI-SAST features as of 2026-07-06 |
Questions people ask
- Is Nebula Security profitable?
- No revenue or profitability figures have been disclosed. Nebula Security (YC S26) claims over $400,000 in Google bug bounties as of its July 23, 2026 launch, but that is bounty income, not product revenue, and no customer or ARR numbers exist in public sources.
- Does Nebula Security have any paying customers?
- As of its July 23, 2026 YC launch, Nebula Security has zero named customers disclosed. This contrasts with rival ZeroPath, which reports 750+ customers and 200,000+ monthly scans as of July 6, 2026.
- Who is Nebula Security's biggest competitor?
- ZeroPath is the closest and more mature rival, with 750+ customers and 200,000+ monthly scans as of July 6, 2026, plus a Black Hat USA 2026 speaking slot. HackerOne also shipped a competing AI code-security product, HackerOne Code, benchmarked against ZeroPath in July 2026.
- Could AI replace Nebula Security?
- Nebula Security's product is itself an AI agent (Vega) for code auditing, meaning its own value proposition already assumes AI substitution for manual pentesting. With no proprietary dataset or workflow lock-in identified as of July 2026, it faces thin-wrapper commoditization risk as frontier LLMs improve at generic codebase analysis.
- What has Nebula Security actually proven it can do?
- Independently verified by outside security press on June 24, 2026, Nebula Security demonstrated IonStack, a full browser-to-kernel exploit chain rooting a fully updated Android 17 device via a single malicious URL, using a Firefox JIT bug patched June 2, 2026.
- Who owns or funds Nebula Security?
- Nebula Security is a private, venture-track company in Y Combinator's Summer 2026 batch, listed Active as of July 25, 2026. No third-party source confirms a specific funding amount or lead investor for the company as of that date.
Timeline
- 2026-07-25YC directory lists Nebula Security Active with 4 employees in Vancouver, WA
- 2026-07-23Nebula Security publishes formal YC launch post and claims $400,000+ in bug bounties
- 2026-07-21Third-party API directory documents Vega CLI product and site shows 934-entry vuln catalog
- 2026-07-06HackerOne Code compared against ZeroPath; ZeroPath reports 750+ customers
- 2026-06-26Adjacent rival Nebulock raises $25M Series A for AI-native contextual security
- 2026-06-24Cyberkendra reports Nebula Security demoed IonStack, an Android 17 full exploit chain
- 2026-06-17CVE-2026-42530 NGINX advisory published; Nebula's claimed involvement not credited by name
- 2026-06-03Rival Hex Security (YC W2026) reportedly reaches $1M ARR in 8 weeks
- 2026-06-02Firefox 151.0.3 patches CVE-2026-10702, the bug used in Nebula's IonStack chain
Revision history
27 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Security Startups funded by Y Combinator (YC) 2026 (2026-07-25)
- Cybersecurity Startups funded by Y Combinator (YC) 2026 (2026-07-06)
- Launch YC: Nebula Security: Bringing beyond Mythos protection to your product (2026-07-23)
- Nebula Security · AI security research lab
- One Malicious Link, Full Root Access, Nebula Security Demos the World's First Android 17 Exploit Chain (2026-06-24)
- CVE-2026-42530: NGINX HTTP/3 Use-After-Free Vulnerability (2026-06-17)
- Nebula Security, API Provider, Schemas (2026-07-21)
- ZeroPath: RSAC 2026 Innovation Sandbox Profile
- Claude's Corner: Hex Security, AI Agents That Hack Before Attackers Do (2026-06-03)
- HackerOne Code vs ZeroPath AI-Native SAST (2026-07-06)
- Nebulock Raises $25 Million for AI-Native Contextual Security (2026-06-26)
- Nebula Security: A security engineer in your team