Kyvvu: Product, team and how it was built
Kyvvu (Security layer that checks each action of an AI agent before it runs, Netherlands): Engine 1.0 released after pilots in regulated firms, November 2026. Evidence grade E: no revenue figure was checked. Team: 2 co-founders, Jeroen Ghijsen (CEO) and Maurits Kaptein (CTO), and what the company calls a small team of senior engineers, expanded after the August 2026 round; headcount not published. Launched January 2026; still running.Added 6 November 2026
- Outcome
- Engine 1.0 released after pilots in regulated firms, November 2026
- Evidence
- E no revenue figure was checked
- Launch
- January 2026
- Status
- Still running
- Team
- 2 co-founders, Jeroen Ghijsen (CEO) and Maurits Kaptein (CTO), and what the company calls a small team of senior engineers, expanded after the August 2026 round; headcount not published
- Outside funding
- €1M pre-seed from Volta Ventures and BOM, August 2026 (company and IO+)
- Main channel
- Affiliates and partners
What is not verified
No revenue figure was found. The home page, about page, jobs page, blog posts, documentation, two IO+ articles and the arXiv page give dates, funding and claims of production use but no revenue, customer count or customer name. PyPI's page could not be read because it answered with a script check. A reader could look for named customer cases, a partner's public case study or a later funding announcement with figures. This story is grade E: the business is real and its product, price and customers are described from public pages, but no revenue figure was checked. Aiolum shows it as an idea worth studying, not as proof that it makes money.
Kyvvu sells what it calls an Agent Security Kernel: a small, trusted component that every action of an AI agent must pass before it runs. The idea comes from the reference monitor of operating systems, a component that checks every access by a process against a policy. Kyvvu's rules are policies on paths: they look at the ordered history of a task, so the same outbound email can be allowed after a product lookup and blocked after a read of personal data. The decision itself uses no AI model; a separate Policy Generator agent turns plain-language rules into the YAML rule files.
The company says it was founded in late 2025 by Jeroen Ghijsen, earlier CEO of the software company Metrological, and Maurits Kaptein, a professor at Eindhoven University of Technology. Its first blog post is dated 30 January 2026, a research paper followed in March, and IO+ reported in August 2026 that it raised €1 million from Volta Ventures and the Brabant Development Agency. Version 1.0 of the engine came out on 30 October 2026, and on 12 November 2026 Kyvvu pitches as one of nine finalists at the AI Summit Brainport.
No revenue figure was found. The company says the engine runs in production at financial-services, insurance and healthcare organisations in the Netherlands, through partner consultancies, but it names no customer. This page is grade E: the product and the funding are real, its income is not known.
How much revenue does Kyvvu make?
Each row shows the evidence grade and the source numbers from the list at the end of this page. The grades are explained in How Aiolum verifies.
| Fact | Value | Grade | How we know | Sources |
|---|---|---|---|---|
| Status | Live: pip install kyvvu, a hosted dashboard and documentation | C | Home page and documentation downloaded 6 November 2026. | [1, 6] |
| Engine 1.0 | released 30 October 2026, announced 3 November 2026 | C | The changelog dates version 1.0.0 to 30 October 2026; the CTO's blog post of 3 November 2026 says the 25 built-in rules are frozen for the 1.x series and that the engine passed a penetration test. | [5, 6] |
| Founded | late 2025, Kyvvu BV, Chamber of Commerce number 99594234 | C | About page. The about page gives Nijmegen as the address; IO+ calls the company "based in Den Bosch". The register itself was not read. | [2, 3] |
| Founders | Jeroen Ghijsen (CEO) and Maurits Kaptein (CTO) | C | About page. IO+ quotes the lead investor: "We are backing Jeroen, Maurits and the team". IO+ says the company grew out of research at the Jheronimus Academy of Data Science in Den Bosch. | [2, 3] |
| Team | "a small team of senior engineers"; headcount not published | C | About page: "We're intentionally keeping headcount lean". The funding post says engineering was expanded after the round. The jobs page says all roles start as freelance or contract work. | [2, 4, 11] |
| Outside funding | €1 million pre-seed, Volta Ventures and the Brabant Development Agency (BOM) | C | IO+ article dated 18 August 2026 and the company's post of 1 September 2026, which says the announcement went out on 21 August. | [3, 4] |
| Customers | "deployed in enterprise environments across regulated industries in the Netherlands"; none named | C | Home page and about page. The engine 1.0 post adds government. IO+ repeats the claim and quotes BOM on "live customers". | [1, 3, 5] |
| Free tier | first 1,000 active instance-hours a month | C | Home page. Paid prices are not published. | [1] |
| AI feature | Policy Generator agent: plain-language rules in, YAML policy out | C | CTO's blog post, 10 April 2026. The engine's verdicts themselves use no model: "No model is involved in the decision." | [8, 5] |
| Research paper | "Runtime Governance for AI Agents: Policies on Paths", arXiv, 17 March 2026 | C | Maurits Kaptein and two co-authors. | [10] |
| Pitch competition | one of nine finalists, AI Pitch Competition, AI Summit Brainport, 12 November 2026 | C | IO+ article by Bart Brouwers, 2 November 2026. | [7] |
| Time from the first blog post to engine 1.0 | 10 months | calc | Calculated: January 2026 to November 2026. | [12, 5] |
How to read this table: grade C values come from the company's own pages or from press articles that report what the company said. A "calc" value was computed on this page. No revenue figure exists, so no value is grade A or B.
| Plan | Per month, billed yearly (US$) | Per month, billed monthly (US$) | Limit |
|---|---|---|---|
| Free tier | 0 | first 1,000 active instance-hours a month | |
| Above the free tier | not published | sold through authorized partners | |
| Proof-of-value for end customers | 0 | scoped pilot in the customer's environment |
The home page offers the SDK and engine with the first 1,000 active instance-hours free every month. It does not say what use above that costs. Kyvvu says it sells through a small set of authorized partners, tier-1 consultancies and AI governance specialists, and offers end customers in regulated industries a scoped, no-cost proof-of-value. The SDK is under the Apache 2.0 licence and the engine under the source-available BSL 1.1 licence.
When did Kyvvu launch, and how did it grow?
From a university research group to a 1.0 release and a pitch final, in about one year. Each entry carries its grade.
- Late 2025CJeroen Ghijsen and Maurits Kaptein found Kyvvu, out of research at the Jheronimus Academy of Data Science. [2, 3]
- 30 January 2026CFirst post on the company blog. [12]
- 17 March 2026CKaptein and two co-authors publish "Runtime Governance for AI Agents: Policies on Paths" on arXiv. [10]
- 10 April 2026CThe Policy Generator agent turns plain-language compliance text into rule files. [8]
- August 2026C€1 million pre-seed from Volta Ventures and BOM, as IO+ and the company report it. [3, 4]
- 7 September 2026Ckyvvu-claude brings the rules to Claude Code through its PreToolUse hook, in beta. [9]
- 30 October to 3 November 2026CEngine 1.0 released; Kyvvu is named a finalist for the AI Summit Brainport pitch on 12 November. [6, 5, 7]
Why did Kyvvu work?
Four causes, in the order they mattered. Each one is a reusable lesson.
One narrow technical claim
The company sells one idea: a breach can be a sequence of permitted steps, so the check must see the whole task. It says no other runtime check offers rules over the whole path, and it published the model as a research paper.
Rules, not a second model
The engine is deterministic: the same inputs give the same verdict, and it fails closed when no policy can be loaded. That is what a compliance officer can inspect and what an auditor can replay. AI appears in the Policy Generator, which writes the rules, not in the decision.
Sold through consultancies
Regulated buyers reach Kyvvu through partner consultancies that build their agents, plus a free proof-of-value. The pre-seed post names widening the partner network as one of three uses of the money.
How it was built
These details come from the company's own pages. They are grade C. [2, 1, 5]
- Three packages: the kyvvu SDK (Apache 2.0), the kyvvu-engine (BSL 1.1, source-available) and a control plane, hosted or self-hosted, for policies, incidents, traces and reports.
- The engine runs inside the agent's process with no network call per step, or beside it as kyvvu serve for agents not written in Python.
- Every action is written as a kind and a verb in the company's open Agent Action Grammar, for example step.exec or step.resource GET.
- Policies are YAML files in the customer's own git, with an OWASP baseline and EU AI Act and GDPR templates.
- Logs are hash-chained, so a changed entry can be detected, and they go to the customer's existing SIEM, the security monitoring system.
Tools named in the sources
Each one opens its page in the Tools tab, with every story that uses it.
Who tried this before Kyvvu, and why did they fail?
Three companies in our database of failed startups sold an extra security layer to enterprises and lost to larger platforms that bundled the same function. The values below are from that database and are not independently verified.
Toopher
The promiseTwo-factor authentication for enterprises that checks where the user is.
Why it diedAcquired by Salesforce in 2015 and later discontinued; broader security suites won the market.
ThinAir
The promiseReal-time data loss prevention and insider threat detection.
Why it diedCould not stand out against larger security vendors with more resources and reach.
Sider
The promiseAutomated code review and static analysis for development teams.
Why it diedSqueezed between free open-source tools and enterprise platforms that bundled code analysis.
The failed startups come from our database of 1,749 dead startups, retold here in our own words. Its entries are AI-assisted summaries of public sources, so these cards carry no evidence grade.
What changed
Toopher, ThinAir and Sider each sold one more checkpoint to enterprises that already bought security from large vendors, and each lost when a platform bundled the function. Kyvvu's checkpoint is for a new kind of workload, the AI agent that chooses its own sequence of actions, and the CTO writes that over the last year the agent harnesses (Claude Code, Copilot Studio, LangChain, CrewAI) have converged on hooks that ask before an action.
The risk is the same as before. The harness makers and the large security vendors can build path rules into their own products. Kyvvu's answers are to stay neutral across harnesses with an open action grammar, to keep data inside the customer's systems, and to sell through the consultancies that regulated firms already use.
Can one person copy Kyvvu now?
Not by one person: this is research-led enterprise security.
Kyvvu started from a professor's research group, a paper and a founder with two decades in enterprise software, and it sells to banks and insurers through consultancies. A solo founder can copy the small part: a hook-based rule checker for one coding agent, sold to developers. The enterprise part needs audits such as ISO 27001 and SOC 2, which the company says are underway, and long pilots.
Where it is still open: Rule checkers for single agent harnesses, audit logs for agents in other regulated sectors, and tools that turn written regulations into machine-checkable rules.
- 1Find a risk that a new kind of software creates and that existing tools check only one step at a time.
- 2Publish the idea in a form that buyers' security teams can read: a paper, a white paper, open rule files.
- 3Plug into the hooks that the platforms already ship instead of building a proxy.
- 4Give away a free tier for developers and sell pilots to regulated firms through partners.
What could go wrong for Kyvvu?
The risks are the mirror image of the causes above.
What is not verified
No revenue figure was found. The home page, about page, jobs page, blog posts, documentation, two IO+ articles and the arXiv page give dates, funding and claims of production use but no revenue, customer count or customer name. PyPI's page could not be read because it answered with a script check. A reader could look for named customer cases, a partner's public case study or a later funding announcement with figures.
AI is in the rule writing, not in the verdict
The engine that allows or blocks actions uses no AI model; the CTO writes: "No model is involved in the decision." The AI part is the Policy Generator agent described in April 2026, and the product's market is AI agents. The site files it with other infrastructure for AI agents.
Depends on agent harnesses and model providers
Kyvvu does not depend on one model provider: the home page says it works the same whichever models the agent uses. It does depend on the hooks of the harnesses it plugs into: Claude Code's PreToolUse hook, Copilot Studio's security webhook, LangChain and CrewAI callbacks. Claude Desktop, which uses MCP instead of hooks, is not covered (September 2026 post). The home page says the approach is aligned with Anthropic's Zero Trust for AI agents framework of May 2026; that is the company's own reading.
Competition
On this site, Pushary also checks coding-agent actions before they run, but by asking a person on a phone; Kyvvu decides by rules over the whole task and sells to regulated enterprises rather than to individual developers.
Claims without names
The home page says the white paper was written "with feedback from senior security, risk and AI leaders" at the Belastingdienst, ING, Rabobank, Arcadis, Datashift and Valcon; no source shows these organisations as customers. Production customers are described only by sector. The about page gives Nijmegen as the address, while IO+ says Den Bosch.
Sources
The grade next to each source is the best grade that the source can support. "Read in full" means that the text of the page was downloaded and the numbers were checked in it.
- C Kyvvu home page, read 6 November 2026Read in full. Source for what the product does, the free tier, the integrations, the partner model and the claims of production use.
- C About Kyvvu, read 6 November 2026Read in full. Source for the founders, the founding date, the team description, the packages and the company registration.
- C IO+, 18 August 2026: Keeping AI agents in check: Kyvvu raises €1 millionRead in full. Press report of the round with quotes from the CEO, Volta Ventures and BOM.
- C Kyvvu blog, 1 September 2026: Kyvvu raises a €1M pre-seed from Volta Ventures and BOMRead in full. Source for the investors, the announcement date and the use of funds.
- C Kyvvu blog, 3 November 2026: Kyvvu engine 1.0, a reference monitor for AI agentsRead the first half. Source for the 1.0 release, the deterministic design and the harness hooks.
- C Kyvvu documentation: kyvvu changelog, read 6 November 2026Read the version list and the 1.0.0 entry. Source for the release dates.
- C IO+, 2 November 2026: Nine AI startups, one final: from smart promises to real valueRead in full. Source for the pitch final and an outside description of the product.
- C Kyvvu blog, 10 April 2026: From Plain English to Enforceable Policy, meet the Kyvvu Policy GeneratorRead in full. Source for the AI feature that writes the rules.
- C Kyvvu blog, 7 September 2026: kyvvu-claude, policy enforcement for Claude CodeRead the first sections. Source for the Claude Code integration and its limits.
- C arXiv 2603.16586: Runtime Governance for AI Agents: Policies on PathsRead the abstract page metadata. Source for the title, authors and date.
- C Join Kyvvu, read 6 November 2026Read in full. Source for the remote, freelance-first way of hiring.
- C Kyvvu sitemap, read 6 November 2026Read in full. Source for the dates of all blog posts, the first on 30 January 2026.
- C Database of failed startups, local exportLocal export. AI-written summaries, not independently verified. Source for the failed predecessors.
Run this company? Send corrections or a verified figure to aiolum@livyden.com