Kodem Security

Kodem Security addresses one of application security’s most persistent problems: static software composition analysis (SCA) tools flag every known-vulnerable open-source package in a codebase, regardless of whether that vulnerable code path is ever actually executed, burying security teams in low-priority findings. Kodem’s approach, which it calls dynamic SCA, deploys lightweight sensors (branded Kortex) that observe running applications via memory forensics down to the function level, then combines that runtime execution data with static call-graph mapping to determine reachability — whether an attacker could actually trigger the vulnerable code — before a finding gets prioritized.

Founded in 2021 and based in Tel Aviv, Kodem has raised more than $40 million from investors including Greylock, Highland Capital Partners, and TPY Capital, and has grown to roughly 51 employees. The company has published named case studies with Whistic and Rapyd describing measurable reductions in vulnerability alert volume after adopting runtime reachability analysis, which is a more concrete efficacy signal than most vendors in this space provide. It has also extended the underlying runtime-sensor approach into Application Detection and Response (ADR), aiming to catch and stop exploitation attempts against known vulnerable functions at runtime, rather than only reporting on them after the fact.

For AppSec teams drowning in SCA alert volume, Kodem’s reachability-based prioritization is a genuine, well-evidenced improvement over signature-only scanning, and it fits into a broader industry trend (also pursued by competitors) of layering runtime context onto static SCA results rather than replacing SCA outright.