The list. Astelia made the 2026–2027 Fortune Cyber 60, the unranked list of venture-backed security startups Fortune puts together with Lightspeed Venture Partners and AWS. Fortune’s profile lists it as early stage, founded in 2024, based in New York City, with 52 employees and CEO Alon Noy. Noy spent more than eight years leading Israel’s National Red Team, the unit that attacks the country’s critical infrastructure so defenders can find the holes first. His co-founders, Nadav Ostrovsky and Roy Rajwan, ran red teams too. That background is the product.
The problem, in plain words. Vulnerability management means scanning everything for known software flaws and ranking them. The ranking is where it breaks. A big company can carry millions of open findings. Severity scores tell you how bad a flaw could be in theory. Probability scores tell you which flaws attackers like in general. Neither tells you whether an attacker can get to that flaw on your network. So teams patch by score, fight IT over downtime, and the backlog never shrinks.
The unique part: reachability from the network up. Astelia builds a model of the customer’s network through read-only connections to infrastructure and network tools, down to the individual port on each machine. Separately, AI agents read each vulnerability and work out what an exploit needs: the way in, the privileges, the conditions that have to line up. Astelia then lays the two on top of each other. A flaw is reachable or it isn’t, and if it is, you get the attack path as a graph. Think of it as the difference between “this door has a weak lock” and “this door faces the street, and here is the hallway to it.” The fix list changes too. Astelia suggests segmentation, a config change or a compensating control when a patch can’t ship this week. That matters, because patching production is where most vulnerability programs go to die.
The numbers, and their limits. Astelia says that in one enterprise deployment it cut about 40 million identified vulnerabilities to fewer than 2,000 that were actually reachable. In its February funding release it cited a case where, out of nearly 3 million vulnerabilities, only about 30 were genuinely exploitable. Its headline claim is that less than 1% of findings are real exposure. These are Astelia’s figures, not independent audits. The risk is obvious once you say it out loud. Reachability is only as good as the map. A stale firewall export, an unconnected cloud account or a segment nobody integrated turns “not reachable” into a false negative with a very convincing diagram.
Why it’s winning now. Astelia frames April 2026, when frontier models like Claude Mythos showed exploitation at machine speed, as the turning point. It joined Anthropic’s Cyber Verification Program in June. In July it launched Astelia Agents, workflows that carry a flaw from triage to fix to validation across more than 100 tool integrations, with a human approving key steps and every action logged. Buyers are ready for it. In Lightspeed’s survey of 200 CISOs, 42% already use AI in vulnerability management. Astelia’s own line is the sharpest one in the category: putting agents on top of a bad priority list just automates the waste. The moat is the map, not the agent.
The financial view. Fortune reports $35 million in funding from Index Ventures, Team8 and Holly Ventures. Ctech breaks that into a $10 million seed led by Team8, which incubated the company, and a $25 million Series A led by Index. Valuation and revenue are Undisclosed. Fortune does not list Lightspeed as an investor. Headcount went from about 30 in February, per Business Insider, to the 52 Fortune lists now. The tell is in the roadmap. Noy told BankInfoSecurity that Astelia plans to add its own scanning. That means it wants to own the finding, not just filter someone else’s. That puts it on a collision course with Tenable, Rapid7 and Qualys, which reports earnings tonight. Speculative, but the logic is clean: a scanner incumbent that wants a credible “we tell you what’s reachable” story could build it slowly or buy it.
For practitioners. Don’t argue with the 1% claim. Test it. Take ten findings Astelia marks unreachable and hand them to your red team for a week. Then ask how often the network model refreshes, and what the product says when an integration goes quiet.
If a tool told you 99% of your backlog could wait, what proof would you need before you let it?