The Mandos platform tracks 388 companies whose main business is application security, and together they have raised $11.4B. The category grew up checking code after a developer wrote it, in the repository, the pipeline or the running app, and selling that check to the security team. Corridor was built to check code at the moment it is written, and its new owner is not an AppSec platform but a coding agent company.
Here is why I think the agent maker wants it. When an agent writes most of the code, the cheapest place to stop a flaw is inside the agent's own loop, before the pull request even exists, and only the agent's vendor owns that loop. Upwind is moving toward the same spot from the other side, with sensors on the endpoints where coding agents run, while Infisical and Mintive make sure the agent never holds a real key for longer than the task. So the check, the key and the sensor are all moving closer to the agent, which also means closer to whoever ships it.
If you're a founder in AppSec, your list of natural buyers now includes the coding agent makers, and they buy differently from security vendors because they want a capability their agent can ship and a team that knows how to build it. If you sell to security teams instead, expect the question of what you see that the agent's own checks cannot, and "we scan the repository" is a weaker answer than it was a year ago.
If you're an investor, Corridor is a useful marker. It raised at a $200M valuation in March and was bought seven months later by the kind of company it was built to serve, which is good for speed, but there are only a handful of agent makers who can buy, and a short buyer list rarely helps the price.
Through the eyes of a CISO buyer, this is mostly good news, because a flaw stopped before the pull request is the cheapest flaw you will ever fix. The catch is that the tool writing the code is now also grading it, so I'd put two things in the contract: the findings flow into my own systems, and my own policy, not only the vendor's, decides what blocks a merge.
Where I could be wrong: this is one deal, and Cognition may have bought a team it already knew well more than it bought a strategy, since Stamos had worked with Corridor's founders. The large AppSec platforms can also plug into every coding agent at once, which one agent maker's in-house check cannot do.
Still, when the company that writes the code buys the company that checks it, I'd take that as a sign of where the check is going to live.
- Cloudsmith changed its headline from "Artifact management and security for the AI software supply chain" to "Artifact management and supply chain security for AI-driven development" between 26 and 29 October, and a new line on the page reads "Agents pull whatever format the task needs."
- Netcraft's website assistant used to promise "rapid detection and disruption" of phishing and fraud, and between 26 and 30 October it started giving a number instead: "phishing sites often taken down within 33 minutes".
- ORION Security took the number out of its research line between 26 and 30 October, so "asking 159 CISOs in 5 cities" now reads "asking CISOs in 5 cities", and the product is now called "ORION Security" instead of "ORION" across the homepage.
- Slide changed "Every backup, by default" to "Every backup verified, by default" between 28 and 31 October.
- AIR Security changed its headline from "Secure Your AI Agents" to "We Secure AI Agents" between 28 October and 1 November.
- A Security replaced its Ⓐ symbol with its name between 29 October and 1 November, so "Ⓐ fortifies you against weaponized AI" now reads "A Security fortifies you against weaponized AI", and "when Ⓐ applies pressure to your system" became "when A Security applies continuous pressure to your system."
One question
If you're building or backing an AppSec company: if a coding agent maker called you tomorrow, what would it want most, your team, your product or your customers? Reply and tell me. The best replies get quoted, anonymously, next week.
Thank you for reading.
If you want more than the newsletter: get the full market picture on the Mandos platform, and if you are building or investing in this space, let's talk.
Talk to you next Monday.
Nikoloz
