Staris is an application security company that tests running software the way an attacker would and tells engineering teams which vulnerabilities are real. It is for application security leads and development teams buried in unconfirmed scanner findings, and for companies that need pentest evidence for customers but find a once-a-year test out of date by the next release.
The gap it fills is between volume and proof. Scanners report far more than any team can check, and a point-in-time test cannot keep pace with weekly releases.
At A Glance
| Vendor | Staris (Staris AI, Inc.) |
|---|---|
| Category | Application security validation |
| Deployment | Hosted service, private VPC or fully self-hosted |
| Customers | OpsHelm, AMI Tracks |
| Founded | 2023 |
| Market classification | Agentic AI Identity |
What Staris Does
Scanners are good at producing candidates and poor at saying which ones matter, so security teams spend their days triaging. Staris sits after them and turns their output into a short list of proven issues. Existing SAST, DAST and SCA tools keep surfacing candidate vulnerabilities and nothing is ripped out. Staris takes those candidates, proves which are exploitable in the running application, and returns a fix. Because validation runs each time a team ships, the evidence matches the version actually in production rather than the one tested months ago.
Products
Continuous Validation Platform
The core platform studies an application’s code and behaviour, then attacks it in a controlled way to confirm what can be exploited. What comes back to a developer is evidence and a fix, not a ticket to investigate:
- Each finding includes a working exploit and an execution trace
- Each exploitable vulnerability gets a PR-ready patch, with a confidence label
- Coverage includes broken access controls, authentication bypasses, injection flaws and business logic errors
- Customers set the scope and the actions Staris is allowed to take
Receipt
Sales and compliance teams are often asked for pentest reports during customer reviews. The Receipt answers that: a signed record, produced each cycle, of what was tested, what was proven exploitable and what was patched.
Expert Validation
For organisations that want a human sign-off, a named Staris expert reviews and signs every cycle, with a monthly signed Receipt and a quarterly readout call to walk through results.
How It Works
Teams point Staris at an application and it runs alongside the scanners they already use. The service is hosted by default, and larger customers can deploy it in a private VPC or fully self-hosted.
| Component | What it does |
|---|---|
| Release-aligned testing | Validation is triggered when a team ships, through CI/CD, so each result maps to a specific release. |
| Data handling | Staris does not train its models on customer application code or sensitive data, and customer data stays isolated within the deployment environment. |
| Access control | Single sign-on and role-based access control govern who can see findings and approve actions, and an operator dashboard shows validation status across cycles. |
Company Background
| Founded | 2023. |
|---|---|
| Headquarters | Seattle, United States. |
| Leadership | Adam Cecchetti (CEO and Co-founder) and Austin Fath (CTO and Co-founder). |
| Funding | A reported $5.7 million seed round led by Freestyle VC. |
Note: This overview is compiled from Staris’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.