Aiolum Browse stories
All stories
AI code scanner for security flaws · United Kingdom

Gecko Security: Product, team and how it was built

Small teamFundedB2BCybersecurity

Gecko Security (AI code scanner for security flaws, United Kingdom): Paid Pro plan on sale, November 2026. Evidence grade E: no revenue figure was checked. Team: 2 founders; Y Combinator lists a team of 2; headcount today not published. Launched October 2024; still running.Added

Outcome
Paid Pro plan on sale, November 2026
Evidence
E no revenue figure was checked
Launch
October 2024
Status
Still running
Team
2 founders; Y Combinator lists a team of 2; headcount today not published
Outside funding
Y Combinator Fall 2024 and five other named investors; amounts not stated
Main channel
Not stated
No revenue figure

What is not verified

No revenue figure was found. The pages read were the company's site, its blog, the Y Combinator pages and a Hacker News thread. No payment-processor profile, filing or interview with revenue was found. The pricing page shows a self-serve Pro price with a button to the web app, and the terms describe automatic card charges. No independent source states that a customer has paid. The customers are the company's own statement. This story is grade E: the business is real and its product, price and customers are described from public pages, but no revenue figure was checked. Aiolum shows it as an idea worth studying, not as proof that it makes money.

Gecko Security sells a scanner for business-logic vulnerabilities. These are flaws in what a program lets a user do, for example reading another user's data by changing an ID. The scanner is a form of static analysis (SAST), which reads source code without running it, and it uses large language models. The company's pages say each finding comes with a call chain from input to the flawed code and a working proof of concept.

Jeevan "JJ" Jutla is CEO and Artemiy Malyshau is CTO, as the company's about page lists them. The Y Combinator company page says the company was founded in 2024, in the Fall 2024 batch, with a team of 2 in London. In October 2024 the company's site offered AI testing together with human hackers at a fixed price. In November 2026 its pricing page lists a free trial, a Pro plan and a custom Enterprise plan.

No revenue figure was found, so this story has grade E. The best-supported facts are the self-serve paid plan on the pricing page and the founder's claim of 30+ CVEs found in open-source projects. No independent source states that a customer has paid.

Gecko Security: Paid Pro plan on sale, November 2026. AI code scanner for security flaws, United Kingdom, team of 2 to 10, evidence grade E.
The story in one card. Share it with the address of this page.
01

Why did Gecko Security work?

Four causes, in the order they mattered. Each one is a reusable lesson.

01

The founders built the scanner from their security careers

The about page says one founder worked at GCHQ and on a Binance red team. It says the other served in the Austrian Cyber Forces and worked on security projects for Interpol. The founder wrote on Hacker News that they saw the limits of older scanners in these careers.

02

It publishes write-ups of flaws found in open-source projects

The blog has 47 articles, including CVE write-ups. The two n8n posts describe the flaw, a proof of concept and a patched version, and link a GitHub advisory. The founder wrote on Hacker News that the company notifies maintainers and publishes after a fix. No source says how many customers these posts brought.

03

The offer moved from fixed-price testing to a scanner with a trial

In October 2024 the site sold unlimited testing with human hackers at a fixed price. In 2025 the founder described a free tier of one scan per user. In November 2026 the pricing page lists 10 trial scans and a self-serve Pro plan.

How it was built

These details come from the founder's Launch HN post and the company's pages. They are grade C. [7, 12, 1, 2]

  • A custom indexer reads code like an IDE, inspired by GitHub's stack graphs. The founder wrote that it stores symbols and references in a compact Protocol Buffers format.
  • A language model builds a threat model from the developer's intent, the trust boundaries and the exposed endpoints. It then proposes attack paths.
  • For each path the system asks the indexer for the code it needs and rebuilds the call chain from source to sink. A Monte Carlo Tree Self-refine algorithm scores the path.
  • The founder wrote that the system does not feed whole codebases to the model. The terms of service name OpenAI and Anthropic as third-party model providers.
  • The company's site is a Next.js application with content on Sanity, as its page source shows. The about page says scans run in short-lived sandboxes and that code is not stored.

Tools named in the sources

Each one opens its page in the Tools tab, with every story that uses it.

02

Who tried this before Gecko Security, and why did they fail?

Two companies in our database of failed startups sold code analysis or code understanding to engineering teams. The values below are from that database and are not independently verified.

Died 2012 to 2024Burned US$7.0M burned

Sider

The promise

Automated code review and static analysis for software teams, to catch bugs and security flaws before production.

Why it died

The record says free open-source tools and larger platforms that bundle code analysis left little room for a separate product.

Competition
Died 2020 to 2024Burned US$10.0M burned

CodeSee

The promise

Automatic visual maps of code architecture and dependencies for developers.

Why it died

The record says the company struggled to turn free users into paying customers and compares its product to a vitamin, not a painkiller.

Monetization

The failed startups come from our database of 1,749 dead startups, retold here in our own words. Its entries are AI-assisted summaries of public sources, so these cards carry no evidence grade.

What changed

Both companies sold understanding of code to developers who could get something similar for free. Sider faced free open-source analyzers and larger platforms. CodeSee, the record says, could not convert free users.

Gecko Security sells a narrower result: exploitable flaws with a proof of concept. Its pricing page lists a flat US$100 per month for the Pro plan. Whether customers pay for that result is not shown by any independent source. The founder's own claim is several enterprise customers.

03

Can one person copy Gecko Security now?

The structure, yes. The founders' background, no.

A narrow scan that returns proof, not a long list, can be sold with a trial and a flat monthly price. The founders' intelligence and cyber careers are the part that is hard to copy.

Where it is still open: Other checks that need reasoning over a whole codebase, such as license risks, data-flow privacy checks and access-control reviews.

  1. 1Pick one class of flaw that older tools miss, and show it on public code.
  2. 2Let a buyer scan a real repository before paying.
  3. 3Publish each finding with the advisory and the fixed version.
  4. 4Add a self-serve plan for small teams and a custom plan for large ones.
04

How much revenue does Gecko Security make?

Each row shows the evidence grade and the source numbers from the list at the end of this page. The grades are explained in How Aiolum verifies.

No revenue figure is public. The facts below show a paid plan, a small funded team and published security findings. The company or its founders state all of them
FactValueGradeHow we knowSources
Company start2024CThe Y Combinator company page reads Founded: 2024, Batch: Fall 2024. The company's site footer carries no year of founding.[4, 1]
Earliest site copies31 March 2024 and 8 October 2024CThe Internet Archive's first copy of the home page, of 31 March 2024, shows the name Gecko Security and the words Coming Soon. The copy of 8 October 2024 offers an AI security engineer plus expert human hackers at a fixed price. Neither copy names an earlier company name.[15, 13]
FoundersJeevan "JJ" Jutla (CEO), Artemiy Malyshau (CTO)CThe company's about page. The page says one joined GCHQ as a teenager and the other served in the Austrian Cyber Forces.[2]
Team size2 on the Y Combinator page; headcount today not publishedCThe about page shows the two founders and says the company is growing. It gives no headcount.[4, 2]
Backers named by the companyY Combinator, Z Fellows, Ritual Capital, Rebel Fund, Liquid 2, Garage CapitalCThe about page. It states no amounts and no dates. It also names advisors from four large companies.[2]
Paid plan on salePro, US$100 per monthCThe pricing page, November 2026. The terms of service describe a recurring payment feature that automatically charges the card on file.[3, 12]
Free trial10 scans in total, November 2026CThe pricing page. In July 2025 the founder wrote on Hacker News that the free tier was limited to one scan per user.[3, 7]
Vulnerabilities found in open-source projects30+ CVEsCThe founder's Launch HN post of 31 July 2025 names Ollama, Gradio and Ragflow. A CVE is a public identifier for a disclosed flaw.[7, 5]
Customers, as stated by the founderseveral enterprise customers; 50% fewer false positives on the same codebasesCLaunch HN post, 31 July 2025. The post names no customer.[7]
Customer story on the company's blogCal.com, 27 August 2026CPublished by the company. It quotes the Head of Engineering and the CEO of Cal.com. No payment is stated.[10]
Third-party models named in the termsOpenAI and AnthropicCThe terms of service say the services rely on third-party large language models and list those two providers.[12]
Time from the launch post to the November 2026 plan25 monthscalcCalculated: October 2024 to November 2026.[6, 3]

How to read this table. Grade C is a statement by the company or its founders. A grade E story has no dated money figure, so no row here is a revenue number. A "calc" value was computed on this page.

Gecko Security prices in November 2026, from the company's pricing page (grade C)
PlanPer month, billed yearly (US$)Per month, billed monthly (US$)Limit
Free Trial0010 scans in total, deep scans or pull request checks
Pro100100 scans per month; team management for up to 5 people
Enterprisecustom, annual billingunlimited scans; single sign-on, audit logs and on-premise deployment

The page lists Pro at US$100 per month and Enterprise as custom annual billing set by the size of the engineering organization. The trial is described as a trial, not a permanent free tier. The Pro button leads to the company's web app, which was not opened.

05

When did Gecko Security launch, and how did it grow?

From a Y Combinator batch in 2024 to a self-serve scanner with a paid plan in 2026. Each entry carries its grade.

  1. 2024CFounded, as the Y Combinator company page states, in the Fall 2024 batch. [4]
  2. 8 October 2024CThe company's home page offers continuous vulnerability detection by an AI security engineer and expert human hackers, at a fixed price by organization size. [13]
  3. 16 October 2024CThe first Y Combinator launch post, dated by its page data, says all testing runs in parallel with certified human pentesters. [6]
  4. 31 July 2025CLaunch HN post by the CEO: a static analysis tool with large language models, 30+ CVEs claimed and several enterprise customers. [7, 5]
  5. 22 April and 13 May 2026CThe CTO publishes two write-ups of flaws in n8n, each linking a GitHub advisory with patched versions. [8, 9]
  6. 27 August 2026CA customer story about Cal.com appears on the company's blog. [10]

What could go wrong for Gecko Security?

The risks are the mirror image of the causes above.

What is not verified

No revenue figure was found. The pages read were the company's site, its blog, the Y Combinator pages and a Hacker News thread. No payment-processor profile, filing or interview with revenue was found. The pricing page shows a self-serve Pro price with a button to the web app, and the terms describe automatic card charges. No independent source states that a customer has paid. The customers are the company's own statement.

Logo wall, quotations and counters

The home page shows six customer names, one unnamed "Fortune 500 Financial Institution" and three quotations. One is from a named CISO of Chevron. One is from an unnamed "MD of Security" at a financial institution. The about page lists Chevron among the companies of its advisors. No source here confirms that these names pay. The quotations were not searched for copies elsewhere.

Security research on other projects

Most blog posts read describe flaws in open-source code, such as n8n, and link advisories with patched versions. The founder wrote that the company scans public repositories, notifies maintainers first and publishes after a fix. A post of 26 January 2026 says the scanner found flaws "in Cal.com Cloud", the hosted service of a codebase that was open source at that time. The post shows the source code, thanks the security team of Cal.com and says the fixes shipped within a few days of the report. It does not say whether the flaws were tried on the hosted service, or with what permission. Cal.com later appears on the blog as a customer.

Claims and changes

The 30+ CVE count, the false-positive figure and SOC 2 compliance are the company's statements and were not checked. The founder's July 2025 post said the free tier was one scan per user. The November 2026 page says 10 scans. The 2024 offer included human pentesters.

Sources

The grade next to each source is the best grade that the source can support. "Read in full" means that the text of the page was downloaded and the numbers were checked in it.

  1. C Gecko Security home page
    Read in full, 12 November 2026. Source for the product description, the logo wall and the three quotations. The page source shows Next.js and Sanity.
  2. C Gecko Security about page
    Read in full, 12 November 2026. Source for the founders, the named backers and advisors, and the sandbox claim.
  3. C Gecko Security pricing page
    Read in full, 12 November 2026. Source for the three plans, the Pro price and the 10 trial scans.
  4. C Y Combinator company page: Gecko Security
    Read in full, 12 November 2026. Source for the year founded, the batch, the team size of 2 and the location.
  5. C Y Combinator launch post, 2025: Gecko Security: AI SAST for finding Vulnerabilities in Code
    Read in full, 12 November 2026. The post data is dated 4 August 2025. Source for the 30+ CVE claim and the customer claim.
  6. C Y Combinator launch post, 2024: Gecko Security: Your AI Security Engineer
    Read in full, 12 November 2026. The post data is dated 16 October 2024. Source for the early product with human pentesters.
  7. C Hacker News, 31 July 2025: Launch HN: Gecko Security (YC F24) - AI That Finds Vulnerabilities in Code
    Read in full, 12 November 2026. The CEO's post and his replies. Source for the method, the CVE claim, the free tier and the disclosure practice.
  8. C Gecko Security blog, 22 April 2026: CVE-2026-42227: n8n Public API Variables IDOR Allows Cross-Project Secret Disclosure
    Read in full, 12 November 2026. Source for the advisory link, the patched versions and the proof of concept on a test instance.
  9. C Gecko Security blog, 13 May 2026: n8n Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
    Read in full, 12 November 2026. Source for the second advisory and its patched versions.
  10. C Gecko Security blog, 27 August 2026: How Cal.com Rebuilt AppSec After Going Closed Source
    Read the opening sections only. A customer story published by the company.
  11. C Gecko Security resources page
    Read in full, 12 November 2026. Source for the count of 47 articles and the list of recent posts.
  12. C Gecko Security terms of service
    Read the payment and third-party model passages. Source for the recurring charge and the model providers.
  13. C Internet Archive copy of the Gecko Security home page, 8 October 2024
    Read in full, 12 November 2026. Source for the earlier offer with human hackers at a fixed price.
  14. C Database of failed startups, local export
    Record pages read on the website on 12 November 2026. AI-written summaries, not independently verified. Source for the failed predecessors.
  15. C Internet Archive copy of the Gecko Security home page, 31 March 2024
    Read in full, 12 November 2026. The first copy the archive lists for the domain. It shows only the name and Coming Soon.
  16. C Gecko Security blog, 26 January 2026: How Broken Access Controls in Cal.com Leaked Millions of Bookings and Enabled Complete Account Takeover
    Read in full, 12 November 2026. Source for the Cal.com Cloud findings, the report to Cal.com and the fix in version 6.0.8.

Run this company? Send corrections or a verified figure to aiolum@livyden.com

Back to all stories