RAVEN is a runtime application security company. It watches how application code actually executes in production, then uses that view to block exploits, cut vulnerability backlogs down to the issues that matter and bring AI agents running inside applications under control. It is built for security and engineering teams running cloud native applications across containers, microservices and several cloud providers.
The problem it addresses is that security tooling built around published vulnerabilities reacts after the fact, while the code that actually runs in production goes unwatched.
At A Glance
| Vendor | RAVEN (RAVEN.IO, legal name Raven Cloud Inc) |
|---|---|
| Category | Runtime application security |
| Identities covered | AI agents running in production, traced to owning services and code authors |
| Deployment | eBPF based sensor inside the customer environment, no code changes |
| Agentic AI | Runtime AI-Agents module for agent discovery, monitoring and policy control |
| Customers | Favor Delivery, SageSure, gopuff, Windward, Zesty |
| Funding | Seed and post-seed rounds led by Norwest and Elron Ventures (2026) |
| Market classification | Cloud Security |
What RAVEN Does
When AI shortens the time it takes to build an exploit, organisations “can no longer rely solely on signatures or on CVEs published after the fact.” RAVEN’s approach is to learn what normal looks like for each application. The platform maps the internal paths code takes into execution chains, builds a behavioural fingerprint of expected behaviour and flags live execution that departs from it. That lets it stop an exploit at runtime, before there is a CVE for it, and tells teams which parts of their code really execute.
Products
Runtime Prevention
Runtime Prevention stops exploits inside running applications, including attacks against flaws that have no published CVE yet. Malicious execution is blocked at the moment it happens, using policies set at library level, and protection is added without code changes or injection.
Runtime ADR
Runtime ADR is application detection and response for live workloads. It picks up exploit attempts in real time, gives incident responders forensics at application level and ties an attack to the specific code change or deployment that introduced the weakness.
Runtime SCA
Runtime SCA helps teams facing thousands of open dependency findings decide which ones are worth fixing. It checks whether a vulnerable function is actually reached at runtime, which the company claims can “De-prioritize 99% of vulnerabilities”. It also:
- Uses cluster metadata to work out which workloads are exposed to the internet
- Maps every executed library and function to the commit, author and build behind it
- Shows remediation paths that include deep transitive dependencies
- Builds dependency relationships without needing source code or build pipelines
Runtime Gatekeeper
Runtime Gatekeeper sits before production and blocks risky applications from being promoted, so problems seen during testing do not reach live environments.
Runtime AI-Agents
Runtime AI-Agents is aimed at teams that have AI agents inside their applications but no inventory of them. It finds those agents, watches what they do and applies policy to their actions.
How It Works
| Component | What it does |
|---|---|
| Runtime sensor | One eBPF based sensor, instrumenting at library and function level, feeds every module, so a single deployment covers the whole platform. |
| No code changes | RAVEN does not inject code, modify prompts or need language-specific SDKs, so it can be added to existing services without touching their source. |
| Local processing | Detection and enforcement run inside the customer environment. Application data, prompts and payloads are not sent out for external analysis. |
| Alerting | Findings and alerts go to Slack, Microsoft Teams, email, Jira or a webhook. |
Identities And Systems Covered
| AI agents | Embedded agents, framework based agents and tool driven workflows found at runtime, with no registration or tagging. |
|---|---|
| Ownership | Each agent action traced to its owning service, deployment, code change and author. |
| Workloads | Applications in containers and microservices across multiple cloud providers, with cluster metadata used to judge network exposure. |
| Languages | Java, Node.js, Python and Go, among others. |
Agentic AI Capabilities
Runtime AI Agent Discovery
Agents running in production are found from runtime behaviour alone, with no registration, tagging or manual inventory.
Behaviour Monitoring
For each agent the module records the data it touches, the APIs and tools it calls and the code paths it runs.
Policy Based Runtime Control
Security teams define what agents are allowed to do, not only who they are. Unsafe actions can raise an alert or be blocked in real time.
Developer Attribution
Every agent action is linked to the service, deployment, code change and author that own it. This places control at the application layer, where guardrails and prompt monitoring at the model or request layer cannot see.
Company Background
| Founded | 2023, by Israeli cyber intelligence veterans. |
|---|---|
| Headquarters | Palo Alto, California, United States. |
| Leadership | Roi Abitboul (co-founder and CEO), Guy Franco (co-founder and CTO) and Omer Yair (co-founder and CRO). |
| Funding | Came out of stealth on 18 March 2026 with a reported $20 million. Investors alongside the two lead firms included CyberFuture, Dnipro VC, Jibe Ventures, RedSeed, SentinelOne, Unusual Ventures, UpWest. |
Note: This overview is compiled from RAVEN’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.