Corma
Building foundation models and AI agents for defensive cybersecurity to protect the global economy.
Website: https://corma.ai/
Cover Block
Open sources
| Field | Value |
|---|---|
| Name | Corma |
| Tagline | Building foundation models and AI agents for defensive cybersecurity to protect the global economy [corma.ai] |
| Headquarters | Tel Aviv, Israel / San Francisco, USA [Fortune, Aug 2026] |
| Founded | 2025 [Fortune, Aug 2026] |
| Stage | Seed [Fortune, Aug 2026] |
| Business Model | SaaS |
| Industry | Security |
| Technology | AI / Machine Learning |
| Geography | Global / Remote-First |
| Growth Profile | Venture Scale |
| Founding Team | Alon Pluda, Dana Raveh Tiram, Yuval Zacharia, Nitzan Simchi [LinkedIn, Dana Raveh Tiram, retrieved 2026] [LinkedIn, Yuval Zacharia, retrieved 2026] [LinkedIn, Nitzan Simchi, retrieved 2026] |
| Funding Label | $50M+ |
| Total Disclosed | ~$60,000,000 [Fortune, Aug 2026] |
Links
Open sources
- Website: https://corma.ai/
- LinkedIn: https://www.linkedin.com/company/cormaai
What an Investor Needs First
PUBLIC Corma is building foundation models and AI agents for defensive cybersecurity, and it merits investor attention now because it emerged from stealth in August 2026 with an unusually large $60 million seed round led by Sequoia Capital at a moment when enterprise buyers are looking for ways to counter AI-enabled attack volume [Fortune, Aug 2026] [SecurityWeek, Aug 2026] [Sequoia Capital]. Founded in 2025 by CEO Alon Pluda, the company presents itself as focused on the "defense gap," the view that general-purpose and security-adjacent AI systems have advanced offensive work faster than enterprise defense operations [Fortune, Aug 2026] [The Register, Aug 2026] [govinfosecurity.com, Aug 2026].
The product thesis is straightforward, if still early: Corma says its models power a virtual security workforce that plugs into the customer’s existing tools and can be onboarded more like team members than point software, with the intended scope spanning detection, investigation, and response across defensive tasks [SiliconANGLE, Aug 2026] [The Register, Aug 2026] [corma.ai]. That positioning matters because the differentiation appears to rest less on a single workflow feature and more on whether Corma can deliver generalized defensive automation inside the incumbent security stack, a higher-value promise but also one that will require careful proof on accuracy, false positives, and operational trust before it can support large enterprise budgets [SiliconANGLE, Aug 2026] [The Register, Aug 2026].
On team quality, the public record is directionally strong even if not yet complete. Reporting describes a mix of AI researchers from Google and DeepMind backgrounds and cybersecurity operators from Israel’s Unit 8200 and major security vendors, while Pluda is described as a longtime member of Israeli Military Intelligence [Calcalistech] [Pondero, Aug 2026] [govinfosecurity.com, Aug 2026].
The financing profile is already institutional. Fortune reported a $60 million seed round in August 2026 led by Sequoia Capital with participation from Khosla Ventures and Coatue, and the disclosed business model is SaaS, which suggests the near-term question is not access to capital but whether early deployments convert into repeatable enterprise adoption [Fortune, Aug 2026] [SiliconANGLE, Aug 2026].
Over the next 12 to 18 months, the public milestones worth watching are narrower than the ambition: named customer references, evidence of production use beyond launch pilots, signs that the agents can work across multiple defensive workflows inside existing environments, and clearer proof that Corma can translate a research-heavy thesis into a governed enterprise product [Fortune, Aug 2026] [SiliconANGLE, Aug 2026] [corma.ai]. The company has entered the market with credible backers and a timely problem statement, but the public evidence still sits closer to thesis validation than operating proof.
Partially corroborated -- Core facts are supported by Fortune and additional launch coverage, but several product and team details remain company-described or only partially corroborated.
Taxonomy Snapshot
| Axis | Value |
|---|---|
| Stage | Seed |
| Business Model | SaaS |
| Industry / Vertical | Security |
| Technology Type | AI / Machine Learning |
| Geography | Global / Remote-First |
| Growth Profile | Venture Scale |
| Funding | $50M+ total disclosed, including a $60M seed in August 2026 [Fortune, Aug 2026] |
Inside the Company
PUBLIC
What is knowable at this stage is narrow but still useful: Corma appears to be a newly formed cybersecurity company operating across Tel Aviv and San Francisco, with a public narrative centered on defensive AI rather than broad enterprise software claims [corma.ai] [Crunchbase, retrieved 2026]. Crunchbase lists Alon Pluda in Herzliya, Tel Aviv, as co-founder and CEO, and the company profile aligns with a 2025 founding date and dual Israel and U.S. footprint [Crunchbase, retrieved 2026]. On its website, Corma says it is "building foundation models toward superintelligence for defensive cybersecurity" and frames its mission as protecting the global economy from cyber risk as AI capabilities advance [corma.ai].
The chronology is short. The company was founded in 2025 according to Crunchbase, then surfaced publicly through its website and company profile with a product thesis built around AI agents that work alongside security teams inside existing tools and security stacks [Crunchbase, retrieved 2026] [corma.ai]. The legal entity is not established in the cited public records used for this section, and the public materials do not add much operational detail beyond the headquarters footprint, category, and product direction [corma.ai] [Crunchbase, retrieved 2026].
Partially corroborated -- Confirmed in part by Crunchbase and the company website; legal entity detail is not established in the cited public records used here.
Under the Hood
MIXED
Corma is positioning the product around a narrow but ambitious claim: a foundation model built for defensive cybersecurity, then packaged as AI agents that operate inside the tools security teams already use [corma.ai] [SecurityWeek, Aug 2026]. Public descriptions are reasonably consistent on the core workflow even if they remain high level. Company materials say the system is deployed as an AI workforce that works alongside human teams across defensive tasks, while third-party coverage describes a "virtual security workforce" integrated with existing customer environments and security stacks [corma.ai] [SiliconANGLE, Aug 2026] [CISO Network Newsroom].
The evidence is stronger on intended use case than on technical implementation. Reporting in The Register says the system is trained to detect, investigate, and respond to cyberattacks, with the company explicitly framing its bet as defensive rather than offensive security automation [The Register, Aug 2026]. SiliconANGLE adds one practical detail that helps translate the concept into enterprise workflow: customers reportedly onboard the agents in roughly the same way they would onboard a new hire, which implies role-scoped access, tool connectivity, and task delegation inside existing SOC processes rather than a standalone greenfield console [SiliconANGLE, Aug 2026].
What remains unverified in public is the underlying model architecture, data provenance, deployment model, and measurable performance. The company website uses expansive language around "foundation models toward superintelligence" and around generalizing across defensive tasks, but those claims are still company-originated and are not matched in the available sources by benchmark data, named integrations, or a verified public demo with technical depth [corma.ai] [govinfosecurity.com, Aug 2026]. For investors, the product story is coherent at the category level: purpose-built defensive agents, embedded in incumbent security workflows. The diligence gap is whether Corma has a repeatable technical advantage beyond positioning and interface design.
Claim stands unchecked -- Material product claims rely heavily on company statements, with partial corroboration from SecurityWeek, SiliconANGLE, The Register, and GovInfoSecurity.
Market Research
PUBLIC
Defensive cybersecurity is drawing fresh attention because enterprises now face a simple imbalance: AI appears to be lowering the cost and speed of attack activity, while most security teams still operate through fragmented tools and limited analyst capacity [The Register, Aug 2026] [Fortune, Aug 2026].
The public record here is thinner than it should be for a clean market-sizing exercise. No named third-party TAM, SAM, or SOM figures were provided in the sourced materials for Corma or its immediate category, so the safer approach is to treat this as an emerging segment inside the larger enterprise cybersecurity and security operations budget stack, rather than force precision that the evidence does not support. What is documented is the company's stated wedge: a foundation model and agent layer aimed at defensive cybersecurity, deployed as a "virtual security workforce" inside existing customer tools, with early deployment claims tied to Fortune 100 and Fortune 500 organizations across healthcare, financial services, energy, critical infrastructure, and retail [Fortune, Aug 2026] [SiliconANGLE, Aug 2026].
Those verticals matter because they are already among the most regulated and operationally sensitive parts of the economy, which tends to support sustained security spend even when broader software budgets tighten. The company and the media coverage around its launch repeatedly frame the problem as a "defense gap," meaning general-purpose AI and offensive tooling are improving faster than enterprise defensive workflows, especially for detection, investigation, and response [The Register, Aug 2026] [govinfosecurity.com, Aug 2026] [Sequoia Capital]. That framing is directionally plausible, but readers should note that it remains closer to category thesis than to third-party measured market segmentation in the materials provided.
A useful way to think about demand is through the budgets Corma is trying to sit beside, not above. If the product behaves as described, it is adjacent to security operations center staffing, managed detection and response, SIEM and SOAR workflows, incident response automation, and broader cyber defense platforms that already aggregate alerts and orchestrate remediation [SiliconANGLE, Aug 2026] [The Register, Aug 2026]. The substitute market is not only other AI-native security vendors. It is also internal analyst labor, outsourced SOC services, and incumbent platform modules that promise some level of automated triage and response.
| Market lens | Public evidence | Implication for Corma |
|---|---|---|
| Core category | Defensive cybersecurity agents and foundation models integrated into existing security tools [SiliconANGLE, Aug 2026] [SecurityWeek, Aug 2026] | Positions the company inside active security operations budgets rather than greenfield experimentation |
| Target buyer environment | Fortune 100 and Fortune 500 organizations across healthcare, financial services, energy, critical infrastructure, and retail [Fortune, Aug 2026] | Suggests an enterprise motion where budget exists, but procurement and validation cycles are likely to be demanding |
| Adjacent spend pools | SOC staffing, detection and response workflows, incident investigation, and security tool orchestration inferred from product descriptions [The Register, Aug 2026] [SiliconANGLE, Aug 2026] | Expansion may depend on proving labor substitution or measurable response improvement, not just model quality |
| Substitute solutions | Human analysts, MDR providers, and incumbent security platforms with automation features [The Register, Aug 2026] | Competitive pressure likely comes from workflow ownership and trust, not only model performance |
The table points to a market that is likely large in budget terms but still early in product definition. For that reason, the commercial question is less "how big is cyber" and more whether buyers will fund an agentic workforce as a new control plane inside existing defensive stacks.
Macro and regulatory forces cut both ways. On the supportive side, sectors like healthcare, finance, energy, and critical infrastructure face high breach costs and formal oversight, which can make investments in faster detection and response easier to justify [Fortune, Aug 2026]. On the constraining side, the same environments typically require auditability, access controls, and confidence that automated actions inside security tooling will not create new operational risk, especially when products are positioned as generalized agents rather than narrow co-pilots [SiliconANGLE, Aug 2026] [The Register, Aug 2026]. That does not weaken the market, but it does suggest adoption may track proof, governance, and integration quality more than headline interest in AI security.
Partially corroborated -- Market characterization relies on public launch coverage and company-adjacent claims from Fortune, SiliconANGLE, The Register, SecurityWeek, govinfosecurity.com, and Sequoia Capital. No independent third-party TAM, SAM, or SOM figures were available in the provided sources.
Competition and Substitutes
Positioning
MIXED Corma is positioning itself less as another point security tool and more as an AI-native defensive labor layer, which places it in competition with incumbent security platforms, managed detection and response providers, and the growing set of AI security copilots, even though the available source set does not name direct startup peers [Fortune, Aug 2026] [SiliconANGLE, Aug 2026] [The Register, Aug 2026].
The practical competitive map splits three ways. First are incumbent platform vendors in security operations, endpoint, cloud, and SIEM, which already sit inside the workflows Corma says it plugs into, and therefore control the system of record even if they do not provide the same agentic labor model [SiliconANGLE, Aug 2026] [corma.ai]. Second are services-led substitutes such as internal SOC teams and MDR providers, because Corma is explicitly selling a "virtual security workforce" rather than a narrow model feature [SiliconANGLE, Aug 2026] [The Register, Aug 2026]. Third are adjacent AI assistants for security, where the contest is likely to center on whether customers want recommendation software or operational agents that detect, investigate, and respond across tools on their behalf [The Register, Aug 2026] [govinfosecurity.com, Aug 2026].
That framing matters because Corma is not trying to displace a single software seat. Its stated wedge is that general-purpose models are not optimized for defensive security, and that a dedicated foundation model can generalize across defensive tasks while working inside the customer stack already in place [govinfosecurity.com, Aug 2026] [corma.ai]. If that claim holds in production, the nearest substitute may be human analyst capacity rather than another dashboard.
Corma's clearest edge today appears to be a combination of capital, narrative clarity, and team composition. The company emerged from stealth with a $60 million seed round led by Sequoia, with Khosla Ventures and Coatue participating, which gives it unusual balance-sheet room for a company founded in 2025 and likely supports a longer model-building runway than most seed-stage security startups can afford [Fortune, Aug 2026]. The team is described in multiple reports as blending Google and DeepMind AI alumni with veterans of Israel's Unit 8200 and major cybersecurity companies, a mix that is well matched to the problem the company says it is solving [Calcalistech] [Pondero, Aug 2026] [BigGo Finance].
That edge is real, but some of it is perishable. Capital and recruiting strength help at launch, yet neither guarantees durable product separation if larger vendors embed similar agent workflows into platforms customers already own. The more durable edge, if it develops, would come from proprietary defensive telemetry, customer feedback loops, and trust earned through operating inside live enterprise security environments, but the public record does not yet establish the depth of those data advantages or the breadth of customer usage beyond reported deployments into Fortune 100 and Fortune 500 organizations [Fortune, Aug 2026].
Corma is most exposed where incumbent distribution is strongest. Security buyers already spend through established platform budgets, and vendors that own SIEM, endpoint, identity, email, or cloud-security control points can bundle automation into broader contracts in ways a new standalone company cannot easily match. Corma is also exposed to buyers who prefer accountable service delivery over software autonomy, since an MDR can sell outcomes, human escalation, and procurement familiarity to the same enterprise security leader Corma is trying to persuade [SiliconANGLE, Aug 2026] [The Register, Aug 2026].
There is also a category boundary worth watching. Corma's positioning is tightly defensive, and reporting says it is training AI to detect, investigate, and respond to attacks rather than focus on offensive security work [The Register, Aug 2026]. That focus may sharpen product execution, but it also leaves adjacent budgets in offensive security, red teaming, and broader developer-security workflows to other vendors with different datasets and buyer relationships.
The most plausible 18-month scenario is a market where platform owners remain the default winners if enterprises decide that agentic security should be purchased as a feature inside existing controls rather than as a new operating layer. In that case, the likely winner if distribution is the deciding variable is Microsoft, because it already owns broad enterprise workflow and security surface area. The likely loser if customers reject standalone agents as a separate control plane is the cohort of seed-stage AI security companies built around copilot or workforce narratives, with Corma included in that risk set by definition. The reverse scenario is also credible: if buyers conclude that incumbent platforms remain too fragmented and that a dedicated defensive model materially improves analyst throughput, then Corma becomes one of the more credible independent beneficiaries because it has already paired a large seed balance sheet with a specific thesis about the "defense gap" [Fortune, Aug 2026] [The Register, Aug 2026] [Sequoia Capital].
Partially corroborated -- This section relies on public reporting from Fortune, SiliconANGLE, The Register, and team background references, but the source set does not name direct startup competitors or independently verify product performance against incumbents.
Opportunity
PUBLIC
The prize here is unusually large if Corma executes, because defensive cybersecurity is one of the few enterprise categories where buyers already spend at board-level priority and where AI can plausibly move from workflow assist to labor substitution inside the security operations stack [Fortune, Aug 2026] [The Register, Aug 2026].
The headline opportunity is straightforward: Corma could become a default AI labor layer for enterprise cyber defense, not just another detection product. That outcome is still early and company claims remain only partially verified, but the public evidence points to a credible starting position. The company emerged from stealth with a $60 million seed led by Sequoia Capital, with Khosla Ventures and Coatue also participating, and it is positioning the product as a defensive AI workforce that operates inside the tools security teams already use [Fortune, Aug 2026]. Reporting also says its first model had been deployed to Fortune 100 and Fortune 500 organizations across healthcare, financial services, energy, critical infrastructure, and retail, which matters because those are sectors with large security budgets and high cost of failure [Fortune, Aug 2026].
That is the key distinction in the upside case. If enterprises are willing to onboard agents "like a new hire" and let them detect, investigate, and respond across existing environments, Corma is not competing only for software budget, it is competing for operating budget tied to analyst time, response coverage, and round-the-clock defense capacity [SiliconANGLE, Aug 2026] [The Register, Aug 2026]. A vendor that meaningfully shifts that budget line can grow into a much larger platform than a point tool usually can.
| Scenario | What happens | Catalyst | Why it's plausible |
|---|---|---|---|
| Fortune 500 SOC co-pilot becomes workforce layer | Corma starts as an AI teammate inside security operations, then expands from alert triage and investigation into broader defensive workflows across large enterprises | Early deployments inside Fortune 100 and Fortune 500 environments turn into referenceable production use cases [Fortune, Aug 2026] | The product is already described as a virtual security workforce integrated with existing customer tools, which lowers adoption friction relative to asking buyers to rip and replace their stack [SiliconANGLE, Aug 2026] |
| Defensive foundation model becomes a control plane | Corma's model layer becomes the orchestration and reasoning layer across multiple security products, making it harder to displace over time | Enterprises decide that general-purpose models are not sufficient for defensive security, validating a specialized model approach [govinfosecurity.com, Aug 2026] [Sequoia Capital] | The company is explicitly training a foundation model for defensive cybersecurity and framing the gap as one where offensive AI has advanced faster than defense, a problem large buyers are already motivated to solve [The Register, Aug 2026] [SecurityWeek, Aug 2026] |
| Vertical trust wedge in regulated sectors | Corma concentrates in sectors where incident-response speed and auditability matter most, then compounds within those budgets | One category-tipping enterprise account in healthcare, finance, or critical infrastructure proves that buyers will trust AI agents in sensitive environments [Fortune, Aug 2026] | Public reporting already places early deployments in exactly those sectors, which suggests the company is testing the product where pain is acute and budgets are durable [Fortune, Aug 2026] |
The compounding logic rests on workflow breadth and data feedback, though the public record does not yet prove the loop quantitatively. If agents are embedded where security teams already work, each successful deployment should widen product surface area: more alerts seen, more investigations run, more response patterns observed, and more context on how enterprises actually handle defensive tasks inside incumbent tools [SiliconANGLE, Aug 2026] [corma.ai]. In security, that matters because a product that begins with one narrow automation can expand into adjacent decisions if it earns trust on real incidents.
There is also a distribution advantage in the company's current framing. Corma is not asking customers to adopt a net-new security console first; the public description is that it operates alongside human teams inside the existing stack [corma.ai] [CISO Network Newsroom]. If that holds in practice, expansion can come from deeper permissions, broader task coverage, and more teams using the same agent layer, rather than from repeated system replacement cycles. That is a cleaner path to compounding than a standalone dashboard strategy, especially in large enterprises where tool consolidation tends to move slowly [SiliconANGLE, Aug 2026].
The size of the win is easiest to frame by category economics rather than current company metrics, because no confirmed revenue figures are public. A specialized defensive AI platform that becomes embedded across Fortune 500 security operations could plausibly grow into a multibillion-dollar company value (scenario, not a forecast), simply because enterprise cybersecurity vendors with strategic workflow ownership have historically supported very large outcomes, and Corma is aiming at a broader operating layer than a single alerting or detection feature [Fortune, Aug 2026] [The Register, Aug 2026]. The conservative read is that the outcome depends on proving trust, efficacy, and expansion in production. The optimistic read is that if a defensive model layer becomes a standard part of enterprise security operations, the company could sit in one of the more valuable control points created by AI in security over the next cycle [Sequoia Capital] [SecurityWeek, Aug 2026].
Partially corroborated -- Built primarily from Fortune, SiliconANGLE, The Register, SecurityWeek, and company materials; the central upside case is plausible but still early, with several product and deployment claims resting partly on company or launch-reporting sources.
Sources
Open sources
[corma.ai] Corma | https://corma.ai/
[Fortune, Aug 2026] Exclusive: Corma raises $60M from Sequoia, Khosla Ventures for AI trained to defend against cyberattacks | https://fortune.com/2026/08/10/exclusive-corma-raises-60-million-from-sequoia-for-ai-trained-to-defend-against-cyberattacks/
[LinkedIn, retrieved 2026] Dana Raveh Tiram, PhD - Israel | Professional Profile | LinkedIn | https://www.linkedin.com/in/dana-raveh/
[SecurityWeek, Aug 2026] Corma Emerges From Stealth With $60M for Defensive Cybersecurity Foundation Model | https://www.securityweek.com/corma-emerges-from-stealth-with-60m-for-defensive-cybersecurity-foundation-model/
[Sequoia Capital] Defending the future: why we led Corma’s seed round | https://www.sequoiacap.com/article/corma-seed/
[The Register, Aug 2026] Stopping a cyberattack while walking your dog? Defensive AI security CEO says it's not ruff to do | https://www.theregister.com/security/2026/08/16/stopping-a_cyberattack-while-walking-your-dog-defensive-ai-security-ceo-says-its-not-ruff-to-do/
[govinfosecurity.com, Aug 2026] AI Defenders to Counter AI Attackers: Corma Raises $60 Million | https://www.govinfosecurity.com/ai-defenders-to-counter-ai-attackers-corma-raises-60-million-a-29172
[SiliconANGLE, Aug 2026] Corma launches with $60M funding for defensive cybersecurity AI | https://siliconangle.com/2026/08/10/corma-launches-60m-funding-defensive-cybersecurity-ai/
[Calcalistech] Corma, an Israeli-American cybersecurity startup, raises $60 million in seed funding | https://www.calcalistech.com/ctechnews/article/h1cwzhvigg
[Pondero, Aug 2026] Corma lands $60M seed for defensive cybersecurity AI | https://pondero.co/news/corma-lands-60m-seed-for-defensive-cybersecurity-ai/
[Crunchbase, retrieved 2026] Alon Pluda | https://www.crunchbase.com/person/alon-pluda
[CISO Network Newsroom] Corma launches with $60M to build AI workforce for cyber defense | https://cisonetwork.com/newsroom/corma-launches-with-60m-to-build-ai-workforce-for-cyber-defense/
[BigGo Finance] Corma launches with $60M to build an AI workforce for defensive cybersecurity | https://biggo.com/news/202608101634_Corma_launches_with_60M_to_build_an_AI_workforce_for_defensive_cybersecurity
Articles about Corma
- A Foundation Model for Defense Emerges With a $60 Million Seed — The Tel Aviv and San Francisco startup is training foundation models to detect and respond to attacks, betting that specialized AI can close the 'defense gap'.