NebuSec

NebuSec is a coding tool. NebuSec's Nebu platform uses AI to monitor code continuously, verify vulnerabilities and prepare patches, backed by researchers who found zero-days in Chrome and Linux. Cloud, supply chain and pentesting layers are still coming soon.

NebuSec builds Nebu, an AI security platform aimed at continuous protection of source code and cloud environments. The company was founded by researchers who have discovered zero-days in Chrome, Firefox and the Linux kernel, and it pairs that offensive research background with automated analysis. Its pitch is that an AI system watches the codebase around the clock, and a human research team steps in when a finding is serious. The only product currently live is Code Security. It scans every code change using full repository context, verifies findings so teams are not buried in noise, and prepares patches that are ready to merge. Four further layers are listed as coming soon: supply chain security (dependency origins, build pipelines and registry scanning), cloud security (attack-path mapping and automated remediation), continuous AI pentesting (automated red teaming on a chosen cadence) and AI agent security, which learns from a team's vulnerability history to steer AI coding agents away from repeated mistakes. The target buyer is an enterprise engineering or security team that wants ongoing coverage rather than periodic audits. Access runs through a booked demo, not a self-serve signup, and the site gives no pricing. Credibility rests on a public track record: a buglist of CVEs, detailed technical write-ups on Chrome, Firefox, nginx, curl and kernel vulnerabilities, and headline counts of vulnerabilities found, CVEs assigned and Google VRP bounties earned. The company is backed by Y Combinator. Among alternatives, NebuSec sits between conventional code scanners and consultancy-style penetration testing. Static analysis and dependency tools are broader and cheaper but lack the exploit-level expertise the company emphasises, while boutique research firms offer depth without continuous automation. Buyers should note that much of the announced platform is not yet shipped, so evaluation today centres on code security and on the strength of the research team behind it.