VERIA LABS builds an autonomous pentester for software teams that want security testing to keep pace with how often their code changes. Its AI agents prove that a vulnerability is real before reporting it and then draft the fix, so engineers get confirmed issues with patches rather than a long list of possible problems.
The company’s stated goal is “to make getting hacked a thing of the past.”
At A Glance
| Vendor | VERIA LABS (Veria Labs, Inc.) |
|---|---|
| Category | AI-driven penetration testing |
| Deployment | SaaS (sign-in at veria.dev) |
| Customers | Ramp, PostHog, Infisical, Pydantic, Ripple |
| Founded | 2025 |
| Market classification | Agentic AI Identity |
What VERIA LABS Does
Traditional penetration tests happen once or twice a year, while code ships every day. Veria replaces that rhythm with agents that run all the time and send a weekly round of actionable results every Monday morning. Each cycle follows the same path: find what is exposed, prove which weaknesses can actually be exploited, and propose the change that closes them. Because a finding is only reported once it has been exploited, teams spend their time on issues that matter. New code gets the same treatment, as each pull request is checked before it is merged.
Products
Veria Autonomous Pentester
Veria is a single product with several parts that together take a vulnerability from discovery to fix.
| Findings feed | Vulnerabilities ranked by severity, each linked to the vulnerable code with a suggested fix |
|---|---|
| Dependency analysis | Checks dependencies against known security advisories and whether the code actually calls the vulnerable part, which cuts out alerts for libraries that are present but unused |
| Automatic fixes | Writes patches and opens pull requests for engineers to review |
| PR security review | Reviews each pull request as it opens and comments on the lines that introduce vulnerabilities |
| Workflow integration | Posts findings to Slack and creates Linear issues, keeping their status in sync |
How It Works
Customers sign in to the service at veria.dev and connect their code. From then on the agents test the codebase continuously and attempt to exploit what they find, so every reported issue comes with evidence. Output stays at code level: findings point to the exact lines involved, and remediation arrives as pull requests in the customer’s own repository, where it passes through normal code review before anything is merged. Slack messages and Linear issues carry the results to the engineers who own the affected code.
Agentic AI Capabilities
The team tests the security of AI agent tooling as well as conventional code. Its published research includes a one-click remote code execution flaw in Block’s Goose AI agent, a sandbox escape in Pydantic’s Monty sandbox for AI agents, and work showing how MCP authentication flaws can lead to remote code execution in Claude Code, Gemini CLI and other tools. The same agents have found proof forgery issues in zkVMs such as Jolt and Aleo, and an infinite mint issue in the XRP Ledger.
Company Background
| Founded | 2025, in San Francisco |
|---|---|
| Founders | Cayden Liao, Jayden Sarveshkumar and Stephen Xu |
| Funding | A $3.2 million seed round in February 2026, with Y Combinator, Paul Graham, Gokul Rajaram, Rock Yard Ventures and Schema Ventures among the backers |
Note: This overview is compiled from VERIA LABS’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.