TestifySec

TestifySec builds software supply chain security tooling centered on cryptographic build attestation. Its open-source core — Witness (an attestation framework implementing the in-toto specification), Archivista (attestation storage), and the Judge policy engine — captures and signs evidence at each step of a CI/CD pipeline, then lets organizations enforce policy and generate SBOMs (software bills of materials) based on verifiable proof of how software was actually built, rather than a self-reported manifest.

Founded in 2021 and headquartered in Jasper, Alabama, TestifySec was selected by the Department of Homeland Security’s Science and Technology Directorate (S&T) as one of seven startups nationally for its Silicon Valley Innovation Program cohort focused on software supply chain visibility, receiving a $199,990 award to extend its SBOM generation and policy/admission-control capabilities for DevOps pipelines. The company separately won an AFWERX SBIR Phase 1 award from the Department of the Air Force for FLiCK, a forensic license-compliance tool. It raised a $6.4 million seed round led by Mucker Capital, with Dreamit Ventures and a Jefferies family office also participating.

In January 2024, TestifySec donated Witness and Archivista as official subprojects of in-toto, bringing them into the Cloud Native Computing Foundation ecosystem, and the company’s engineers hold maintainer and steering-committee roles across in-toto, TUF, Witness, Archivista, and the newer SBOMit project.

The company’s credibility currently rests heavily on government pilot work and open-source governance standing rather than a large public roster of commercial enterprise customers, which is typical for a young company building infrastructure-layer security tooling around an emerging, federally-driven compliance mandate (SBOMs and build provenance under Executive Order 14028).