Phylum provides an automated platform that ingests packages as they are published to registries and analyzes supply-chain risk across five domains: Malicious Code, Vulnerability, License, Author, and Engineering risk. The company’s tooling automates risk analysis and malware detection, convicting malicious packages in an average of 11 minutes. Phylum’s approach has enabled the classification and removal of hundreds of previously unidentified malicious packages and their authors per month. The company plans to use its new funding to grow its go-to-market team and to continue inventing new heuristics and machine-learning models to proactively identify risk in open-source packages. Phylum was founded in 2020 and is based in Evergreen, CO. Phylum helps companies defend their systems by identifying risk across the entire software supply chain to stay ahead of cybersecurity threats and emerging attack vectors. It applies machine learning, deep analytics, and static code analysis to provide a complete picture of open-source risk by analyzing source code and code history, author and package relationships, and open-source intelligence feeds. Phylum analyzes all five classes of risk for software packages and dependencies and offers a Phylum Package Score that enables automation so developers can be security-first while operating at modern development speed. The company emerged from stealth after incorporating early feedback from design partners at organizations in financial services, healthcare and medical devices, government, and technology. Phylum recently completed a $4.5M seed funding round. The company is led by co-founder and CEO Aaron Bray.

Total raised

$20M

Funding rounds

2

Latest round

Series A

Latest activity

May 2022