Crash Override

Crash Override sells what it calls an Engineering Relationship Management (ERM) platform: build-inspection technology that automatically catalogs workloads and artifacts as they’re built, then maintains a live change ledger connecting code, infrastructure, tools, and the teams touching them. The pitch is that most software supply-chain security today relies on periodic, passive scanning and manually declared SBOMs, while Crash Override tries to derive an always-current inventory directly from what’s actually being built and deployed.

The company was founded in 2022 by John Viega and Mark Curphey, two of application security’s more established names — Viega wrote one of the field’s first books on secure software and previously founded Capsule8 (acquired by Sophos); Curphey founded OWASP in 2002 and was founding CEO of SourceClear (acquired by Veracode). Crash Override raised a $28 million seed round in July 2025 led by GV and SYN Ventures, bringing total funding to roughly $42 million, and was named a Top 10 finalist in the RSAC 2026 Innovation Sandbox competition, which comes with a $5 million investment from RSA Conference LLC.

The differentiator is traceability derived from actual build artifacts rather than declared metadata, which in principle stays accurate as environments drift. That’s a genuinely different foundation for supply-chain security tooling, though the company is still early: there’s no public evidence yet of named enterprise deployments or measured outcomes beyond the RSAC judging process itself.