Zafran Security Secures $60 Million Series C for AI Vulnerability Automation
Zafran Security has closed a $60 million Series C funding round to scale its AI-native platform for automating cyber exposure management. The New York-based startup, founded in 2022, deploys autonomous agents that scan networks for vulnerabilities, prioritize risks, and execute remediations without human intervention. Investors led by Menlo Ventures see the technology as a shift from reactive security to proactive defense in enterprise environments.
The round brings Zafran’s total funding to $130 million, with participation from CyberStarts, Knollwood Investment, PSP Growth, Sequoia Capital, and Vintage Investment Partners. Zafran’s core engine integrates with cloud providers like AWS and Azure, analyzing over 10,000 asset types per deployment. It uses reinforcement learning to simulate attack paths, reducing mean time to remediate from weeks to hours.
Enterprise adoption has accelerated, with clients including Fortune 500 financial firms and healthcare providers. The platform’s agentic architecture handles 95 percent of low-to-medium severity fixes autonomously, escalating only high-impact threats for review. Zafran processes 500 terabytes of telemetry data daily across customer bases, achieving a 40 percent reduction in exposure scores within the first quarter of use.
Proceeds will fund expansions into endpoint detection and supply chain risk mapping. Zafran’s roadmap includes integrating post-quantum cryptography modules to counter emerging quantum threats. The company targets a 30 percent market share in automated vulnerability management by 2027, competing with tools from Tenable and Qualys.
Cybersecurity funding in 2025 has topped $15 billion for U.S. startups, driven by rising ransomware incidents numbering 2,200 per week globally. Zafran’s focus on agentic AI aligns with industry shifts, where 62 percent of CISOs prioritize automation per Gartner surveys. Menlo Ventures partner Matt Murphy stated, “Zafran’s agents represent the future of scalable security operations.”
The startup’s valuation has climbed to $450 million post-money, reflecting a 3.5x multiple on annual recurring revenue exceeding $30 million. Zafran employs 120 engineers, with 70 percent dedicated to model training on anonymized breach datasets. Its platform supports hybrid environments, scanning legacy on-premises systems alongside Kubernetes clusters.
Regulatory pressures amplify demand. The U.S. SEC’s cybersecurity disclosure rules mandate faster vulnerability reporting, penalizing delays over 72 hours. Zafran’s compliance toolkit automates audit trails, generating NIST-aligned reports in under 10 minutes. European GDPR enforcement has similarly boosted adoption, with 25 percent of new customers from the EU.
Competitors like SentinelOne emphasize endpoint protection, but Zafran’s exposure-wide scope differentiates it. The platform’s false positive rate sits at 2 percent, outperforming legacy scanners at 15 percent. Zafran plans to launch a managed service tier in Q2 2026, bundling agent deployment with 24/7 monitoring for mid-market firms.
Broader implications touch U.S. critical infrastructure. The CISA reports 1,600 vulnerabilities exploited monthly, with automation gaps costing $10 billion annually in breaches. Zafran’s tech could mitigate 70 percent of these through predictive patching. Partnerships with Microsoft and Google Cloud enable seamless API integrations, covering 80 percent of enterprise workloads.
Zafran’s growth mirrors a wave of AI-driven security firms raising over $500 million collectively this year. Its agents evolve via federated learning, aggregating insights across clients without data sharing. The funding positions Zafran to hire 50 specialists in adversarial AI testing, fortifying against model poisoning attacks.
As cyber threats proliferate, with phishing up 61 percent year-over-year, Zafran’s automation addresses talent shortages affecting 3.5 million U.S. roles. The platform’s dashboard visualizes risk heatmaps, correlating exposures to business impact scores. Future updates will incorporate zero-trust principles, enforcing least-privilege access in real-time.
This infusion underscores investor confidence in AI’s role in closing security gaps. Zafran’s trajectory highlights how startups are redefining defense strategies for a post-breach era.
