depthfirst Raises $80M Series B to Secure the Code Agents Write
When AI agents write most of your code, who checks for vulnerabilities? depthfirst just closed an $80 million Series B led by Meritech Capital, bringing total funding to $120 million. That is less than 90 days after they emerged from stealth with a $40 million Series A. The speed says everything about how urgent this problem has become.
depthfirst is not another SAST tool bolted onto a CI pipeline. They built their own security model called dfs-mini1 that specializes in finding vulnerabilities in code, including smart contracts, and they claim it outperforms frontier models at 10 to 30x lower cost. The platform covers code scanning, supply chain analysis, secrets detection, and dynamic testing. The number that matters: 80 percent of their fix recommendations get accepted and merged by developers. That is unheard of in security tooling where most alerts get ignored.
The customer list tells the story. ClickUp, Lovable, Supabase, incident.io, Moveworks, Persona, AngelList. Notice how many of those are companies building with or for AI agents. Lovable alone generates enormous volumes of AI-written code that needs security review. depthfirst is positioned exactly where the bottleneck is forming: the gap between how fast agents produce code and how fast humans can verify it is safe.
Forerunner Ventures and The House Fund joined the round, with existing investors Accel, Box Group, Liquid 2 Ventures, Alt Capital, and Mantis VC participating. The company was co-founded by CEO Qasim Mithani and CTO Andrea Michi.
https://depthfirst.com/
The agent-generated code security market barely existed a year ago. Now depthfirst has raised $120 million in under three months. That is the market telling you something: the more code agents write, the more we need AI to audit what AI writes. The recursive loop is the business model.
← Back to all articles
depthfirst is not another SAST tool bolted onto a CI pipeline. They built their own security model called dfs-mini1 that specializes in finding vulnerabilities in code, including smart contracts, and they claim it outperforms frontier models at 10 to 30x lower cost. The platform covers code scanning, supply chain analysis, secrets detection, and dynamic testing. The number that matters: 80 percent of their fix recommendations get accepted and merged by developers. That is unheard of in security tooling where most alerts get ignored.
The customer list tells the story. ClickUp, Lovable, Supabase, incident.io, Moveworks, Persona, AngelList. Notice how many of those are companies building with or for AI agents. Lovable alone generates enormous volumes of AI-written code that needs security review. depthfirst is positioned exactly where the bottleneck is forming: the gap between how fast agents produce code and how fast humans can verify it is safe.
Forerunner Ventures and The House Fund joined the round, with existing investors Accel, Box Group, Liquid 2 Ventures, Alt Capital, and Mantis VC participating. The company was co-founded by CEO Qasim Mithani and CTO Andrea Michi.
https://depthfirst.com/
The agent-generated code security market barely existed a year ago. Now depthfirst has raised $120 million in under three months. That is the market telling you something: the more code agents write, the more we need AI to audit what AI writes. The recursive loop is the business model.
Comments