12/757 → 20/654; +1.47 percentage points of formation share.
The defining split in this batch is between companies securing AI systems and companies built as AI systems that attack or defend on their own, and the second group is growing faster and stranger than the first: MindFort, Veria Labs, and Parameter all pitch autonomous agents that hack or pentest continuously rather than once a year, while Golf, Alter, ContextFort, and Multifactor exist specifically because those same autonomous agents are now something enterprises need to fence in, monitor, and authenticate. That loop, tools built to secure agents while other tools are agents doing the attacking, is why "Security" at 1.93x growth looks sluggish next to "AI Agents" at 11.38x; the agent wave is outrunning the security tooling meant to contain it, and "Security Infrastructure Tools" growing at 2.63x suggests the plumbing layer is absorbing more of that gap than point-solution startups are. Real-world consequences are already showing up outside pure infosec, in the shift toward social manipulation as attack surface: GhostEye emulates vishing and deepfaked executives, and BeeSafe AI is building defenses specifically for conversation-based, trust-exploiting attacks rather than code exploits. The compliance side, represented by Probo, points to a parallel and less flashy problem, the difficulty of turning shifting rules and audits into a living, machine-checkable map rather than a one-time document, which is exactly what the obligations-mapping investigation tied to this formation is chasing. None of this cluster of urgency existed in its current form before agentic AI systems became cheap and reliable enough to run unsupervised, roughly the window opened by GPT-4-class and later models in 2023 and 2024, which is also what made autonomous red-teaming and autonomous defense economically viable at the same moment.
As autonomous systems proliferate, operators may need to distinguish malfunction, spoofing, adversarial control, and intentional behavior quickly enough to respond safely.
Research operational demand for sensor-fusion provenance, behavioral attribution, countermeasure verification, and post-event evidence across autonomous domains.
Organizations repeatedly translate changing rules, contracts, and policies into controls, owners, evidence requests, and remediation without a durable executable map.
Follow one regulatory or contractual change from source text through interpretation, control updates, operational evidence, review, and remediation across teams.
Better Auth is building developer auth infra while ContextFort, Alter, and GhostEye focus on securing AI/agentic systems; as more of these companies wire AI agents into workflows, existing human-centric auth models won't cover agent-to-agent permissions, creating demand for agent-native identity layers.
Check back around June 2027 for new YC batches, to see whether independent evidence for "Identity and authorization infrastructure for AI agents" has appeared.
With BitPatrol, MindFort, Golf, GhostEye, and Veria Labs all pitching AI-driven detection or pentesting, buyers will need a neutral way to measure false-positive rates and efficacy across overlapping AI security vendors before enterprise adoption scales.
Check back around May 2027 for new YC batches, to see whether independent evidence for "AI-security tool validation/benchmarking layer" has appeared.
Tinfoil's focus on AI privacy alongside many AI-driven security scanners (BitPatrol, MindFort, GhostEye) suggests these tools will need to process sensitive codebases/logs without exposing them to third-party model providers, pushing demand for confidential-compute or on-prem inference layers built specifically for security workloads.
Check back around August 2027 for new YC batches, to see whether independent evidence for "Privacy-preserving inference infrastructure for security AI" has appeared.
Included in YC's Security membership during the measured recent window.
Included in YC's Security membership during the measured recent window.
Included in YC's Security membership during the measured recent window.
Included in YC's Security membership during the measured recent window.
Included in YC's Security membership during the measured recent window.
Included in YC's Security membership during the measured recent window.
Included in YC's Security membership during the measured recent window.
Included in YC's Security membership during the measured recent window.
Included in YC's Security membership during the measured recent window.
Included in YC's Security membership during the measured recent window.
Measured-window members of Security that could not be assigned to a narrower shared YC tag or industry without forcing a classification.
A primary internal company segment within Security, derived deterministically from the shared yc tag “Cybersecurity”. This is a classification of current window members, not a causal layer or a separate time trend.
A primary internal company segment within Security, derived deterministically from the shared yc tag “Developer Tools”. This is a classification of current window members, not a causal layer or a separate time trend.
No comparable outside activity is connected yet.
These share a word with “Security” but are tracked as separate categories. The real overlap below is the actual share of Security’s companies also found in that category — not a guess.
Cambrian Signal, “Security,” publication yc-2026-10-02-semantic-v8, snapshot October 2, 2026.
cambrian.jafar.com/formation/security