Feroot Security

Feroot Security builds client-side web application security software that monitors and controls the JavaScript running in a user’s browser, the part of the software supply chain that traditional application security tools (SAST, DAST, server-side WAFs) generally cannot see. Modern web pages load dozens of first- and third-party scripts, and a compromise anywhere in that chain, a hijacked analytics tag, a poisoned npm package, a malicious ad script, can let attackers skim payment card data or credentials directly out of the browser (a technique known as Magecart or web skimming) without ever touching the backend.

Founded in 2017 and headquartered in Toronto, Canada, Feroot went through Y Combinator and has raised roughly $25 million total, including an $8.4 million seed round in 2022 and a $14 million Series A led by True Ventures. Its flagship Inspector product continuously scans and monitors client-side JavaScript behavior in real time to flag unauthorized data access, script injection, and supply chain risk, and the company has built a subscription business it says serves thousands of customers across healthcare, retail, and payment services.

Feroot’s relevance got a concrete regulatory boost with PCI DSS 4.0’s requirements 6.4.3 and 11.6.1, which mandate that organizations handling payment card data inventory and monitor client-side scripts and detect unauthorized changes to payment pages, requirements that took effect in 2025 and map directly onto what Feroot’s product already does, giving the company a clear, independently defined compliance driver rather than a purely discretionary purchase.