Arnica

Arnica secures the software development pipeline by watching how developers actually behave rather than only scanning the code they produce. Its platform builds a behavioral baseline for each developer — typical commit patterns, working hours, repositories touched, tooling used — and flags deviations that look like a compromised account, an impersonated developer, or an insider pushing unauthorized changes. That approach targets a gap left by traditional application security tooling: software composition analysis and secret scanning catch known-bad code and dependencies, but they don’t catch a legitimate-looking commit from a hijacked developer identity, which is how several notable supply-chain incidents actually started.

Founded in 2021 and based in Atlanta, Arnica emerged from stealth with a $7 million seed round in October 2022 led by Joule Ventures and First Rays Venture Partners, with angel backing from recognizable names in the security industry including the co-founders of Orca Security and Aqua Security. The company has since extended its scope from pure anomaly detection into least-privilege enablement — automatically right-sizing developer and CI/CD permissions based on observed real-world usage rather than static role assignments, reducing the blast radius if an account is compromised.

Arnica competes in a crowded and fast-evolving software supply-chain security category alongside SBOM, CI/CD posture, and secrets-management vendors, but its specific focus on developer-identity behavior is a narrower and less commoditized angle than most competitors take. It remains an early-stage company with a small team and no publicly disclosed funding since its 2022 seed, so real-world scale and independent validation of its detection efficacy are still limited.