Konvu

Konvu targets a specific, widely felt AppSec pain point: SCA and SAST tools generate huge volumes of vulnerability findings, and most of them turn out not to be exploitable in the actual application context. Konvu’s platform deploys AI agents that trace real code and runtime data flow — going beyond simple static call-graph reachability — to verify whether an exploit path genuinely exists, attaching evidence to each verdict so developers can check the reasoning instead of arguing with a CVSS score.

Founded in 2024 by Lucas Masson, Benoit Larroque, and Paul Bleicher, and based in Brooklyn, New York, Konvu raised a $5 million seed round in July 2024 from Picus Capital, Emblem, Kima Ventures, and BoxGroup. The company has published several quantified customer case studies: a Fortune 500 retailer cut its SCA triage queue by 93% in weeks, a fintech SaaS company found 81% of its Snyk findings were false positives, and an enterprise software customer confirmed only 75 findings were genuinely exploitable out of a much larger reviewed set.

The differentiator is depth of reachability analysis — tracing actual data flow and runtime conditions rather than relying on call-graph proximity alone — paired with an evidence trail meant to make automated dismissals defensible in audits. The published results are strong, but they are Konvu’s own case studies rather than independently audited figures, so they should be read as directionally credible rather than third-party verified.