# Gecko Security

Aiolum story: https://aiolum.com/story/gecko-security/ · added 2026-11-12 · updated 2026-11-12

**In short.** Gecko Security (AI code scanner for security flaws, United Kingdom): Paid Pro plan on sale, November 2026. Evidence grade E: no revenue figure was checked. Team: 2 founders; Y Combinator lists a team of 2; headcount today not published. Launched October 2024; still running.

AI code scanner for security flaws · United Kingdom · AI-native · team of 2 to 10 · still running · group: Developer tools and coding agents

- Outcome: Paid Pro plan on sale, November 2026 (evidence grade of the headline number: E; no revenue figure)
- Launch: October 2024; months from launch to the outcome: 25
- Team: 2 founders; Y Combinator lists a team of 2; headcount today not published
- Outside funding: Y Combinator Fall 2024 and five other named investors; amounts not stated
- Main factor: Domain expertise
- Meters, 1 to 4: evidence strength 1, copyable pattern 1, capital needed 2
- Tags: AI-native, Small team, Funded, Running, B2B, Cybersecurity

Links:

- Visit gecko.security: https://www.gecko.security/

**The product.** A code scanner that uses large language models to find security flaws in a company's own source code. It aims at business-logic flaws, such as a user who can read another user's data. A customer connects a repository, runs scans and receives findings and fixes as pull requests.

**Why it worked.** Two founders with intelligence and military cyber careers built a scanner for flaws that older tools miss. The founder wrote on Hacker News that older scanners match patterns and lose the context of code that spans many files.

Evidence grades: A = disclosed by a public company, a filing or a payment processor, or verified by one; B = two or more independent reports agree, or a journalist confirmed it; C = a founder claim that no one else verified; D = reported, not verified: one founder claim or a third-party estimate with no second source; E = no revenue figure found, so the headline is a non-money fact and the other facts carry their own grades; calc = computed on this page from graded facts.

## Summary

Gecko Security sells a scanner for business-logic vulnerabilities. These are flaws in what a program lets a user do, for example reading another user's data by changing an ID. The scanner is a form of static analysis (SAST), which reads source code without running it, and it uses large language models. The company's pages say each finding comes with a call chain from input to the flawed code and a working proof of concept.

Jeevan "JJ" Jutla is CEO and Artemiy Malyshau is CTO, as the company's about page lists them. The Y Combinator company page says the company was founded in 2024, in the Fall 2024 batch, with a team of 2 in London. In October 2024 the company's site offered AI testing together with human hackers at a fixed price. In November 2026 its pricing page lists a free trial, a Pro plan and a custom Enterprise plan.

No revenue figure was found, so this story has grade E. The best-supported facts are the self-serve paid plan on the pricing page and the founder's claim of 30+ CVEs found in open-source projects. No independent source states that a customer has paid.

## Why did Gecko Security work?

### The founders built the scanner from their security careers

The about page says one founder worked at GCHQ and on a Binance red team. It says the other served in the Austrian Cyber Forces and worked on security projects for Interpol. The founder wrote on Hacker News that they saw the limits of older scanners in these careers.

### It publishes write-ups of flaws found in open-source projects

The blog has 47 articles, including CVE write-ups. The two n8n posts describe the flaw, a proof of concept and a patched version, and link a GitHub advisory. The founder wrote on Hacker News that the company notifies maintainers and publishes after a fix. No source says how many customers these posts brought.

### The offer moved from fixed-price testing to a scanner with a trial

In October 2024 the site sold unlimited testing with human hackers at a fixed price. In 2025 the founder described a free tier of one scan per user. In November 2026 the pricing page lists 10 trial scans and a self-serve Pro plan.

## How it was built

These details come from the founder's Launch HN post and the company's pages. They are grade C.

- A custom indexer reads code like an IDE, inspired by GitHub's stack graphs. The founder wrote that it stores symbols and references in a compact Protocol Buffers format.
- A language model builds a threat model from the developer's intent, the trust boundaries and the exposed endpoints. It then proposes attack paths.
- For each path the system asks the indexer for the code it needs and rebuilds the call chain from source to sink. A Monte Carlo Tree Self-refine algorithm scores the path.
- The founder wrote that the system does not feed whole codebases to the model. The terms of service name OpenAI and Anthropic as third-party model providers.
- The company's site is a Next.js application with content on Sanity, as its page source shows. The about page says scans run in short-lived sandboxes and that code is not stored.

Sources: [7, 12, 1, 2]

## Who tried this before Gecko Security, and why did they fail?

Two companies in our database of failed startups sold code analysis or code understanding to engineering teams. The values below are from that database and are not independently verified.

The failed startups come from our database of dead startups, retold here in our own words; Its entries are AI-assisted summaries of public sources, so they carry no evidence grade.

### Sider (2012 to 2024; funding US$7.0M burned; cause: Competition)

- Promise: Automated code review and static analysis for software teams, to catch bugs and security flaws before production.
- Why it died: The record says free open-source tools and larger platforms that bundle code analysis left little room for a separate product.
- Record: 

### CodeSee (2020 to 2024; funding US$10.0M burned; cause: Monetization)

- Promise: Automatic visual maps of code architecture and dependencies for developers.
- Why it died: The record says the company struggled to turn free users into paying customers and compares its product to a vitamin, not a painkiller.
- Record: 

## What changed

Both companies sold understanding of code to developers who could get something similar for free. Sider faced free open-source analyzers and larger platforms. CodeSee, the record says, could not convert free users.

Gecko Security sells a narrower result: exploitable flaws with a proof of concept. Its pricing page lists a flat US$100 per month for the Pro plan. Whether customers pay for that result is not shown by any independent source. The founder's own claim is several enterprise customers.

## Can one person copy Gecko Security now?

**Verdict: The structure, yes. The founders' background, no.**

A narrow scan that returns proof, not a long list, can be sold with a trial and a flat monthly price. The founders' intelligence and cyber careers are the part that is hard to copy.

1. Pick one class of flaw that older tools miss, and show it on public code.
2. Let a buyer scan a real repository before paying.
3. Publish each finding with the advisory and the fixed version.
4. Add a self-serve plan for small teams and a custom plan for large ones.

**What is still open.** Other checks that need reasoning over a whole codebase, such as license risks, data-flow privacy checks and access-control reviews.

## How much revenue does Gecko Security make? The numbers, graded

No revenue figure is public. The facts below show a paid plan, a small funded team and published security findings. The company or its founders state all of them

| Fact | Value | Grade | Note | Sources |
|---|---|---|---|---|
| Company start | 2024 | C | The Y Combinator company page reads Founded: 2024, Batch: Fall 2024. The company's site footer carries no year of founding. | [4, 1] |
| Earliest site copies | 31 March 2024 and 8 October 2024 | C | The Internet Archive's first copy of the home page, of 31 March 2024, shows the name Gecko Security and the words Coming Soon. The copy of 8 October 2024 offers an AI security engineer plus expert human hackers at a fixed price. Neither copy names an earlier company name. | [15, 13] |
| Founders | Jeevan "JJ" Jutla (CEO), Artemiy Malyshau (CTO) | C | The company's about page. The page says one joined GCHQ as a teenager and the other served in the Austrian Cyber Forces. | [2] |
| Team size | 2 on the Y Combinator page; headcount today not published | C | The about page shows the two founders and says the company is growing. It gives no headcount. | [4, 2] |
| Backers named by the company | Y Combinator, Z Fellows, Ritual Capital, Rebel Fund, Liquid 2, Garage Capital | C | The about page. It states no amounts and no dates. It also names advisors from four large companies. | [2] |
| Paid plan on sale | Pro, US$100 per month | C | The pricing page, November 2026. The terms of service describe a recurring payment feature that automatically charges the card on file. | [3, 12] |
| Free trial | 10 scans in total, November 2026 | C | The pricing page. In July 2025 the founder wrote on Hacker News that the free tier was limited to one scan per user. | [3, 7] |
| Vulnerabilities found in open-source projects | 30+ CVEs | C | The founder's Launch HN post of 31 July 2025 names Ollama, Gradio and Ragflow. A CVE is a public identifier for a disclosed flaw. | [7, 5] |
| Customers, as stated by the founder | several enterprise customers; 50% fewer false positives on the same codebases | C | Launch HN post, 31 July 2025. The post names no customer. | [7] |
| Customer story on the company's blog | Cal.com, 27 August 2026 | C | Published by the company. It quotes the Head of Engineering and the CEO of Cal.com. No payment is stated. | [10] |
| Third-party models named in the terms | OpenAI and Anthropic | C | The terms of service say the services rely on third-party large language models and list those two providers. | [12] |
| Time from the launch post to the November 2026 plan | 25 months | calc | Calculated: October 2024 to November 2026. | [6, 3] |

How to read this table. Grade C is a statement by the company or its founders. A grade E story has no dated money figure, so no row here is a revenue number. A "calc" value was computed on this page.

## Pricing

Gecko Security prices in November 2026, from the company's pricing page (grade C)

| Plan | Per month, billed yearly (US$) | Per month, billed monthly (US$) | Limit |
|---|---|---|---|
| Free Trial | 0 | 0 | 10 scans in total, deep scans or pull request checks |
| Pro |  | 100 | 100 scans per month; team management for up to 5 people |
| Enterprise | custom, annual billing |  | unlimited scans; single sign-on, audit logs and on-premise deployment |

The page lists Pro at US$100 per month and Enterprise as custom annual billing set by the size of the engineering organization. The trial is described as a trial, not a permanent free tier. The Pro button leads to the company's web app, which was not opened.

## When did Gecko Security launch, and how did it grow? Timeline

From a Y Combinator batch in 2024 to a self-serve scanner with a paid plan in 2026. Each entry carries its grade.

- **2024** (grade C [4]): Founded, as the Y Combinator company page states, in the Fall 2024 batch.
- **8 October 2024** (grade C [13]): The company's home page offers continuous vulnerability detection by an AI security engineer and expert human hackers, at a fixed price by organization size.
- **16 October 2024** (grade C [6]): The first Y Combinator launch post, dated by its page data, says all testing runs in parallel with certified human pentesters.
- **31 July 2025** (grade C [7, 5]): Launch HN post by the CEO: a static analysis tool with large language models, 30+ CVEs claimed and several enterprise customers.
- **22 April and 13 May 2026** (grade C [8, 9]): The CTO publishes two write-ups of flaws in n8n, each linking a GitHub advisory with patched versions.
- **27 August 2026** (grade C [10]): A customer story about Cal.com appears on the company's blog.

## What could go wrong for Gecko Security?

- **What is not verified.** No revenue figure was found. The pages read were the company's site, its blog, the Y Combinator pages and a Hacker News thread. No payment-processor profile, filing or interview with revenue was found. The pricing page shows a self-serve Pro price with a button to the web app, and the terms describe automatic card charges. No independent source states that a customer has paid. The customers are the company's own statement.
- **Logo wall, quotations and counters.** The home page shows six customer names, one unnamed "Fortune 500 Financial Institution" and three quotations. One is from a named CISO of Chevron. One is from an unnamed "MD of Security" at a financial institution. The about page lists Chevron among the companies of its advisors. No source here confirms that these names pay. The quotations were not searched for copies elsewhere.
- **Security research on other projects.** Most blog posts read describe flaws in open-source code, such as n8n, and link advisories with patched versions. The founder wrote that the company scans public repositories, notifies maintainers first and publishes after a fix. A post of 26 January 2026 says the scanner found flaws "in Cal.com Cloud", the hosted service of a codebase that was open source at that time. The post shows the source code, thanks the security team of Cal.com and says the fixes shipped within a few days of the report. It does not say whether the flaws were tried on the hosted service, or with what permission. Cal.com later appears on the blog as a customer.
- **Claims and changes.** The 30+ CVE count, the false-positive figure and SOC 2 compliance are the company's statements and were not checked. The founder's July 2025 post said the free tier was one scan per user. The November 2026 page says 10 scans. The 2024 offer included human pentesters.

## Sources

1. Gecko Security home page — https://www.gecko.security/ (grade C). Read in full, 12 November 2026. Source for the product description, the logo wall and the three quotations. The page source shows Next.js and Sanity.
2. Gecko Security about page — https://www.gecko.security/about (grade C). Read in full, 12 November 2026. Source for the founders, the named backers and advisors, and the sandbox claim.
3. Gecko Security pricing page — https://www.gecko.security/pricing (grade C). Read in full, 12 November 2026. Source for the three plans, the Pro price and the 10 trial scans.
4. Y Combinator company page: Gecko Security — https://www.ycombinator.com/companies/gecko-security (grade C). Read in full, 12 November 2026. Source for the year founded, the batch, the team size of 2 and the location.
5. Y Combinator launch post, 2025: Gecko Security: AI SAST for finding Vulnerabilities in Code — https://www.ycombinator.com/launches/O7D-gecko-security-ai-sast-for-finding-vulnerabilities-in-code (grade C). Read in full, 12 November 2026. The post data is dated 4 August 2025. Source for the 30+ CVE claim and the customer claim.
6. Y Combinator launch post, 2024: Gecko Security: Your AI Security Engineer — https://www.ycombinator.com/launches/M40-gecko-security-your-ai-security-engineer (grade C). Read in full, 12 November 2026. The post data is dated 16 October 2024. Source for the early product with human pentesters.
7. Hacker News, 31 July 2025: Launch HN: Gecko Security (YC F24) - AI That Finds Vulnerabilities in Code — https://news.ycombinator.com/item?id=44747204 (grade C). Read in full, 12 November 2026. The CEO's post and his replies. Source for the method, the CVE claim, the free tier and the disclosure practice.
8. Gecko Security blog, 22 April 2026: CVE-2026-42227: n8n Public API Variables IDOR Allows Cross-Project Secret Disclosure — https://www.gecko.security/resources/cve-2026-42227 (grade C). Read in full, 12 November 2026. Source for the advisory link, the patched versions and the proof of concept on a test instance.
9. Gecko Security blog, 13 May 2026: n8n Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints — https://www.gecko.security/resources/n8n-dynamic-credential-oauth-bypass (grade C). Read in full, 12 November 2026. Source for the second advisory and its patched versions.
10. Gecko Security blog, 27 August 2026: How Cal.com Rebuilt AppSec After Going Closed Source — https://www.gecko.security/resources/how-cal-com-rebuilt-appsec-after-going-closed-source (grade C). Read the opening sections only. A customer story published by the company.
11. Gecko Security resources page — https://www.gecko.security/resources (grade C). Read in full, 12 November 2026. Source for the count of 47 articles and the list of recent posts.
12. Gecko Security terms of service — https://www.gecko.security/terms-of-service (grade C). Read the payment and third-party model passages. Source for the recurring charge and the model providers.
13. Internet Archive copy of the Gecko Security home page, 8 October 2024 — https://web.archive.org/web/20241008202516/https://gecko.security/ (grade C). Read in full, 12 November 2026. Source for the earlier offer with human hackers at a fixed price.
14. Database of failed startups, local export — /method/#dead (grade C). Record pages read on the website on 12 November 2026. AI-written summaries, not independently verified. Source for the failed predecessors.
15. Internet Archive copy of the Gecko Security home page, 31 March 2024 — https://web.archive.org/web/20240331144436/https://www.gecko.security/ (grade C). Read in full, 12 November 2026. The first copy the archive lists for the domain. It shows only the name and Coming Soon.
16. Gecko Security blog, 26 January 2026: How Broken Access Controls in Cal.com Leaked Millions of Bookings and Enabled Complete Account Takeover — https://www.gecko.security/resources/caldotcom-broken-access-controls (grade C). Read in full, 12 November 2026. Source for the Cal.com Cloud findings, the report to Cal.com and the fix in version 6.0.8.

Contact: aiolum@livyden.com. Run Gecko Security? Send corrections or a verified figure to aiolum@livyden.com (subject: Correction: Gecko Security).