Lema AI

Lema AI, founded in 2023 by Eddie Dovzhik, Omer Yehudai, and Tomer Roizman, is trying to fix a specific and well-known failure in third-party risk management: the annual security questionnaire that gets filled out once, reflects a moment in time, and tells a buyer almost nothing about what a vendor’s access actually looks like six months later. Lema’s platform is built as an autonomous agent that behaves like a vulnerability researcher examining a vendor relationship on an ongoing basis, tracking what systems and data a third party actually touches, how permissions change over time, and where data actually flows, rather than relying on a vendor’s self-attestation.

The company emerged from stealth in early 2026 with a combined $24 million in seed and Series A funding, led by Team8 and F2 Venture Capital with participation from Salesforce Ventures, and has already landed customers in financial services and healthcare. That combination, credible enterprise security investors plus early Fortune 500-scale customers, is a meaningful validation signal for a company barely two years old.

For CISOs, the pitch is replacing point-in-time compliance theater with continuous, evidence-based vendor risk monitoring, an approach that fits a broader shift in GRC toward continuous controls monitoring. The tradeoff is that Lema is early: the agentic-analysis approach is technically ambitious, and how well it performs against evasive or poorly-instrumented vendor environments at scale is not yet proven by long-running, independently documented deployments.