The list. Corma made the 2026–2027 Fortune Cyber 60 in the early-stage group. Fortune’s profile lists it in Tel Aviv with 25 employees, CEO Alon Pluda, founded in 2025. Fortune reports $60 million in funding and names Sequoia Capital and Khosla Ventures as investors. That is the seed round Corma announced on August 10, 2026, led by Sequoia, with Khosla Ventures and Coatue joining. Pluda also thanked Netz Capital. Calcalist reports the seed closed in early 2026. Valuation and revenue are Undisclosed. Lightspeed, which helps run the Cyber 60, is not listed as an investor.
One housekeeping note. There is a different, Paris-based company also called Corma that sells SaaS license management. It raised a €3.5 million seed in 2025. It is not the Cyber 60 pick. Do not mix up the two.
What Corma actually builds. Corma calls itself a frontier AI lab that only works on defense. It trains its own foundation model, the base AI model everything else runs on, for blue-team tasks. Then it deploys that model as what it calls a Security Workforce: agents that sit inside a customer’s existing tools and work across security operations, identity, cloud and network jobs. Pluda told Fortune most of that work has little to do with writing code. It is “looking at logs, audits, [and] finding the needle in a haystack,” and staying consistent across thousands of actions.
The one technical thing. Sequoia’s partner note spells it out. Defense looks like chess or Go to a machine-learning team: two players, a clean score (were you breached or not?), and an endless supply of games. Corma runs reinforcement learning, where the model learns by trial and reward, at scale inside simulated environments that copy real enterprise networks, including their tools, telemetry and noise. That is the bet. You don’t teach a model defense by feeding it more text. You make it play defense, millions of times, against realistic mess.
Sequoia says the result outperforms general-purpose models on defensive tasks at much lower cost per token. Corma also says the model can run fully on-prem and be post-trained on a customer’s own security data. For banks, hospitals and critical infrastructure, that last point matters as much as the benchmark.
Why it is winning now. Timing. Everyone in security watched general AI get much better at offense this year. Pluda’s whole pitch is that defense has not kept pace, and that the gap is structural. Corma’s claims are big. It says its first model went live at Fortune 100 and Fortune 500 companies across healthcare, finance, energy, critical infrastructure and retail. It says early deployments cut threat-response times by more than 94% and widened coverage 15 times. Those are company claims, not audits. No customer is named.
The CyberMerge view. Here is the provocative part. Most AI SOC companies, Dropzone and dozens more, rent models from the big labs and compete on workflow, integrations and trust. Corma is going the other way. It wants to own the model and treat everything else as delivery.
That can be a real moat. If the big labs keep optimizing for coding and chat, a defense-only model trained on realistic network simulations could stay ahead on the tasks SOCs care about, and cost less to run per alert. It can also be a money pit. Training runs are expensive. Sixty million dollars buys a strong team and real compute, but not frontier-lab compute. And each new general model release resets the benchmark Corma has to beat.
So watch three things. First, named customers who will say on the record what the agents do on their own. Second, an independent benchmark on defensive tasks, not a vendor chart. Third, cost: if Corma can show a lower price per investigated alert than a wrapper on a general model, the model-ownership bet starts to look like math, not ideology.
Bottom line. Corma is the purest test of a question every CISO will face in 2027. Do you want a defense tool built on someone else’s model, or a model built only for defense? Sequoia picked a side. The market hasn’t yet.