Truffle Security

Truffle Security is the company behind TruffleHog, one of the most widely deployed open-source secret-scanning tools in the industry. Founded in 2021 and based in San Francisco, the company built its credibility the way a handful of successful security vendors have: by open-sourcing a genuinely useful scanner, watching it get adopted across thousands of engineering organizations, and then building a paid enterprise platform on top of the trust that created. TruffleHog searches source code, chat systems, support tickets, and cloud environments for exposed API keys, credentials, and tokens, and importantly verifies whether a found secret is still live and exploitable rather than just flagging a pattern match, which is the step that determines whether a finding is worth an engineer’s time.

The company has recently expanded from pure secret detection into non-human identity (NHI) security, tracking the sprawling population of API keys, service accounts, and machine credentials that now vastly outnumber human identities in most enterprises and are a common path for supply-chain and cloud breaches. A November 2025 $25 million Series B, co-led by Intel Capital and Andreessen Horowitz and bringing total funding past $40 million, is funding that expansion, including a GCP-focused analyzer for leaked Google Cloud service accounts.

For CISOs, the appeal is a low-friction way to close one of the most common and embarrassing breach vectors: a credential sitting in a public repo or Slack channel. Truffle Security’s differentiation from generic secret scanners is verification (confirming exploitability, not just pattern-matching) and its large open-source install base, which gives the company visibility into how secrets actually leak in practice.