Lineaje is a software supply chain security company that helps organisations trust the software they build, buy and deploy. It serves engineering, security and compliance teams that need to remove vulnerabilities from open-source components and containers, prove what is inside their software to customers and regulators, and govern the AI agents now being built into applications.
The problem is inherited risk. Most of the code in a modern application was written by someone else, and every unreviewed dependency or base image brings vulnerabilities the team did not choose.
At A Glance
| Vendor | Lineaje |
|---|---|
| Category | Software supply chain security |
| Identities covered | Users, services and AI agents accessing LLMs, agents and MCP servers |
| Agentic AI | UnifAI policy orchestration and runtime guardrails, Lineaje AI |
| Customers | Cisco, VMware, KPMG, Pure Storage, US Air Force |
| Founded | 2022 |
| Market classification | DevSecOps |
What Lineaje Does
Most applications are assembled from open-source packages and base images whose transitive dependencies nobody on the team has reviewed. Lineaje treats securing that supply chain as a continuous factory: software is scanned, fixed, verified and delivered as trusted software, rather than checked once and left to drift. Provenance records are part of the output, which matters to software vendors selling to the US government under EO14028. The same approach now extends to agentic AI applications, whose models, agents and MCP servers form a new kind of supply chain.
Products
Gold Open Source (GOS)
GOS gives developers open-source packages and container images free of critical, high and exploitable vulnerabilities, so that vulnerable components are replaced at the source. Each package and its transitive dependencies are vetted across more than 100 attributes, and the catalogue holds more than 3 million packages and more than 3,000 images. Custom images can be created on demand from an existing public container image, and a premium tier adds custom, verified fixed packages and images. The custom images are built by Lineaje AI.
CVEF (Continuous Vulnerability Elimination Factory)
CVEF is for teams buried in vulnerability backlogs. It runs a repeated cycle of scanning, patching, verification and delivery across source code, open source, containers and AI-generated code, with the goal of “Zero Exploitable Vulnerabilities in 90 Days”.
Frontier Defense
Frontier Defense uses frontier AI models to discover novel vulnerabilities, validate whether they can be exploited and generate verified patches, with each candidate patch evaluated independently against the vulnerability and its exploits. Lineaje reports an average of 5.67 novel vulnerabilities found per project.
XBOM Manager And SBOM360
These products handle software bills of materials for teams that must share them. xBOM Manager covers SBOMs, AIBOMs, CBOMs and software provenance and generates FBOMs. SBOM360 Hub manages the SBOM lifecycle from creation to decommissioning, lets teams share compliant SBOMs with their customers and checks automatically whether SBOMs meet NTIA requirements. Its Fast Scan analyses large numbers of components quickly.
SCA360 And Third Party Risk Manager
SCA360 provides software composition analysis of the components inside an application. Third Party Risk Manager assesses the risk in software that comes from suppliers.
UnifAI
UnifAI is an autonomous AI policy orchestrator for security, engineering management and GRC teams responsible for agentic AI applications. It inventories AI assets, derives policies and enforces them from build time through runtime. Guardrails control which LLMs are approved and block malicious, hidden or embedded content and instructions, and at runtime they sit on each connection an agent makes, whether to another agent, an MCP server, an LLM or a person. The product is aligned with the EU AI Act and the OWASP AI Top Ten and is offered through an early access programme.
How It Works
| Component | What it does |
|---|---|
| Build time | UnifAI checks agentic AI applications before code is committed. |
| Package and image sourcing | GOS packages and images are vetted before customers pull them from the catalogue. |
| Continuous remediation | CVEF scans code and components, generates guardrailed patches and pull requests, validates each fix with evidence and regression checks before merge, and delivers fixes through automation and SBOM lifecycle management. |
| Runtime | UnifAI guardrails are deployed alongside running applications. |
Fixes reach developers as pull requests in the repositories they already use, so remediation fits the normal code review process.
Identities And Systems Covered
| Users, services and agents | UnifAI defines which users, services and agents may access specific LLMs, agents and MCP servers |
|---|---|
| Connection types | Agent to agent (A2A), agent to MCP (A2MCP), agent to LLM (A2LLM) and agent to human (A2H) |
| AI assets | Agents, models, MCP servers and skills, discovered continuously |
| Software artefacts | Open-source packages, container images and their transitive dependencies, described in SBOMs, AIBOMs and CBOMs |
Integrations
| Area | Integrations |
|---|---|
| AI coding tools | Cursor, Claude, Google Antigravity, GitHub Copilot, Augment Code |
| AI platforms | Copilot Studio |
| Model providers | Amazon Bedrock, Anthropic, Google AI, Meta, Microsoft, OpenAI, OpenRouter |
Company Background
| Founded | 2022 |
|---|---|
| Headquarters | Saratoga, California, United States, with offices in Silicon Valley, Washington D.C. and the Middle East |
| Leadership | Javed Hasan (CEO and co-founder), Anand Revashetti (CTO and co-founder), Intekhab Nazeer (CFO), Mohamed Kortam (Chief AI and Engineering Officer) |
| Funding | A reported $20 million Series A led by Prosperity7 Ventures, Neotribe, Hitachi Ventures and Tenable Ventures, bringing total investment to $27 million |
| Recognition | Included in the 2026 Gartner Magic Quadrant for Software Supply Chain Security and the GigaOm Radar for Software Supply Chain Security |
Note: This overview is compiled from Lineaje’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.