# Phylum

*/Startups/Phylum*

## Startup Overview

Modern software engineering relies heavily on open-source dependencies, exposing organizations to supply chain attacks and intentional code poisoning. To neutralize this threat, the platform analyzes package behaviors inside a secure sandbox. It intercepts and evaluates code at the point of ingestion, preventing malicious modules from infiltrating development environments or production pipelines.

Traditional security scanners like Snyk, Sonatype Nexus, and GitHub Dependabot operate by matching static code against databases of known vulnerability signatures. This system discards the signature-based approach in favor of an execution-based, malware-focused detection engine. By actively running unknown dependencies in an isolated environment, it identifies hidden payloads, unauthorized network requests, and evasive malware that static scanners miss.

## Startup Founding Hypothesis

**Approach**: that analyzes open-source dependency behaviors inside a secure sandbox
**Competitors**:
- [Snyk](/Competitors/Snyk)
- [Sonatype Nexus](/Competitors/Sonatype_Nexus)
- [GitHub Dependabot](/Competitors/GitHub_Dependabot)
**Differentiator2x2**: execution-based and malware-focused rather than checking static vulnerability signatures

## Startup Solution Coordinate

**Solution**: [Phylum Risk Engine](/Software/Phylum_Risk_Engine)

## Startup Position2x2

```mermaid
quadrantChart
    title Open-Source Dependency Security
    x-axis Static Signatures --> Execution-Based Analysis
    y-axis Known Vulnerabilities --> Malware Focus
    Snyk: [0.25, 0.35]
    Sonatype Nexus: [0.30, 0.45]
    GitHub Dependabot: [0.15, 0.20]
    Phylum: [0.85, 0.85]
```

## Startup Offer

**Proof**:
- Targeting a 100% block rate for zero-day typosquatting malware attempting data exfiltration
- Aim to reduce CI/CD false-positive security blocks by 80% compared to static CVE signature tools
- Goal of intercepting obfuscated install-script backdoors before they reach enterprise build servers
**Tiers**:
- Name: Team Analysis · Price: ~$30–$50/developer/mo · Inclusions: Automated dependency sandboxing for up to 25 developers, covering npm and PyPI registries, with standard CI/CD pipeline integration and daily behavior reports.
- Name: Enterprise Pipeline · Price: ~$90–$150/developer/mo · Inclusions: Unlimited developer seats, continuous registry monitoring across all major language ecosystems, custom execution policies, and designed to integrate with SIEM platforms.
**Guarantee**: If a malicious package bypasses our sandbox and executes a payload in your protected build environment, we refund your subscription for that quarter and assist with the forensic trace.
**Business Function**: ProvideService
**Objection Handlers**:
- Objection: Won't dynamic sandboxing slow down our build times? Rebuttal: We cache execution profiles for known-good package versions globally; only net-new or updated dependencies trigger a full sandbox detonation.
- Objection: We already have Snyk and Dependabot. Rebuttal: Those tools map known vulnerabilities (CVEs) in static code; Phylum executes packages to catch unknown, active malware like hijacked maintainer credentials or typosquatting.
- Objection: Do we have to send you our proprietary source code? Rebuttal: No, Phylum only pulls and analyzes the open-source dependencies your manifest requests from public registries.
**Pricing Architecture**: Tiered
**Agent Checkout Support**:
- agentic-commerce-protocol

## Startup Brand

**Voice**: Forensic and authoritative, prioritizing technical precision over alarmist security rhetoric.
**Tagline**: Block malicious open-source packages before they compromise your build.
**Icon Concept**: microscope
**Palette Intent**: electric-signal
**Visual Identity**: The identity pairs deep obsidian backgrounds with sharp neon green accents, anchoring monospace typography and structured telemetry visualizations of executing code.
**Archetype Reference**: the-hero

## Startup Buyer Chain

**Chain**: Phylum → DevSecOps Teams → Software Developers
**Gtm Motion**: Acquisition begins by offering platform engineers a targeted proof-of-concept integration for a single CI/CD pipeline to analyze active pull requests for malicious dependency behavior. Expansion scales organization-wide as the security team enforces these execution-based checks as a mandatory gateway across all active development repositories.
**Agent Channel**: Intended to list within the GitHub Copilot extensions catalog and agent framework registries so AI coding assistants can programmatically query the sandbox to verify the runtime safety of open-source packages before recommending them to human developers.
**Primary Channel**: Searches for advanced dependency security and supply chain risk tools on the GitHub Marketplace, alongside organic discovery in DevSecOps community discussions tracking zero-day npm and PyPI malware incidents.

## Startup Customer Journey

```mermaid
flowchart LR; A[GitHub Marketplace] --> B[Dependency Sandbox]; B --> C[Single CI/CD Pipeline]; C --> D[Development Repository]; D --> E[Enterprise Build Server]; E --> F[Agent Framework Registry];
```

## Startup Proof Points

_Illustrative — target and order-of-magnitude estimate figures, not an achieved track record (this Thing is concept-stage)._

**Pilot Goals**:
- 30-day sandbox integration pilot on a single development team CI/CD pipeline, aiming to identify at least one active malicious dependency or obfuscated script that bypassed existing static scanners.
- 14-day shadow-mode deployment on an enterprise npm registry proxy, targeting a demonstration of global cache efficiency resulting in near-zero latency impact on developer pull requests.
**Target Metrics**:
- Target: 100 percent block rate for zero-day typosquatting malware attempting data exfiltration.
- Aim: 80 percent reduction in CI/CD false-positive security blocks compared to legacy static CVE signature tools.
- Target: Under 2 percent latency impact on overall build times utilizing the global execution profile cache.
**Target Case Studies**:
- Mid-sized Fintech SaaS Engineering Team: Target a case study demonstrating how automated dependency sandboxing prevents a compromised npm package from exfiltrating environment variables during the build process.
- Large E-commerce Enterprise DevSecOps: Aim to document the integration of dynamic execution policies into a CI/CD pipeline to catch zero-day typosquatting attacks that existing static CVE scanners miss.
- Growth-stage Web3 Startup Lead Security Engineer: Target a proof point showing the successful interception of obfuscated install-script backdoors in PyPI dependencies before they reach internal build servers.
**Testimonial Targets**:
- VP of Engineering: Target a testimonial expressing relief that proprietary source code remains private while builds are protected from hijacked maintainer credentials.
- DevSecOps Lead: Aim for a quote validating the confidence to deploy open-source dependencies knowing that active malware is caught dynamically before execution.
- Lead CI/CD Architect: Target a testimonial highlighting how seamlessly custom execution policies integrate with existing SIEM platforms without slowing down developer velocity.

## Startup Top Risks

**Risks**:
- Severity: existential · Description: Sandboxing every dependency severely inflates CI/CD pipeline build times, leading developer teams to disable the tool entirely. · Mitigation Status: in-progress
- Severity: high · Description: Sophisticated supply chain malware detects the sandbox environment and remains dormant during analysis to evade detection. · Mitigation Status: unmitigated
- Severity: high · Description: Incumbents like Snyk or GitHub bundle dynamic analysis into their existing static scanning platforms. · Mitigation Status: in-progress
- Severity: moderate · Description: Benign install scripts performing telemetry or system checks trigger false positives, causing alert fatigue for security teams. · Mitigation Status: in-progress

## Startup Competitors

- [Snyk](/Competitors/Snyk) — Static Vulnerability Scanner
- [Sonatype Nexus](/Competitors/Sonatype_Nexus) — Status Quo SCA
- [GitHub Dependabot](/Competitors/GitHub_Dependabot) — Native Ecosystem Tooling
- [Socket Security](/Competitors/Socket_Security) — Direct Competitor
- [Endor Labs](/Competitors/Endor_Labs) — Modern SCA Competitor

## Startup Solution Stack

- [Dependency Threat Service](/Services/Dependency_Threat_Service) — Service-as-Software
- [Sandbox Execution Agent](/Agents/Sandbox_Execution_Agent) — Agent
- [Package Behavior Worker](/Agents/Package_Behavior_Worker) — Agent
- [Phylum Risk Engine](/Software/Phylum_Risk_Engine) — Software
- [Dynamic Analysis API](/Software/Dynamic_Analysis_API) — Software

## Startup Story Brand

**Hero**:
- **Need**: to be the guardian of the build pipeline, not a reactive firefighter
- **Want**: to prevent malicious open-source packages from infiltrating the software supply chain
- **Identity**: the security engineer at a high-growth software company
**Plan**:
- Step: Select registries · Detail: Choose the npm, PyPI, or RubyGems ecosystems your team uses for automated monitoring.
- Step: Audit dependencies · Detail: Review behavior reports that reveal what your packages actually do when executed in our sandbox.
- Step: Enforce policies · Detail: Set rules to block any package that attempts unauthorized network calls or file system access.
**Guide**:
- **Empathy**: You shouldn't still be manually verifying PyPI package authors. Snyk wasn't built to catch malicious install-script backdoors in real-time.
**Problem**:
- **Villain**: obfuscated malware
- **External**: Snyk and Dependabot miss zero-day typosquatting because they only flag known CVEs in a manifest file
- **Internal**: you feel exposed knowing that a single hijacked npm maintainer could bypass your static scans
- **Philosophical**: Why should security teams accept reactive signature-matching when proactive behavioral execution is possible?
**Success**: Your build pipeline remains clean of malware while false positives from static scanners drop by eighty percent.
**One Liner**: What if your security tools actually executed code to find hidden threats? Phylum analyzes dependency behaviors in a secure sandbox, blocking malicious packages before they compromise your build.
**Positioning**:
- **So That**: intercept zero-day malware before it executes in your environment
- **Unlike**: static CVE signature tools
- **For Whom**: security engineers at high-growth software companies
- **Category**: Behavioral supply chain security
**Call To Action**:
- **Direct**: Secure your pipeline
- **Transitional**: View sandbox telemetry
**Failure Stakes**:
- data exfiltration through hijacked credentials
- compromised enterprise build servers
- loss of customer trust following a supply-chain breach
**Transformation**:
- **To**: the engineer who stops supply chain attacks
- **From**: a developer auditing CVE lists in GitHub
**Controlling Idea**: Security should stop malware through execution analysis, not just record-keeping.

## Startup Token Hero

**Genre**: founding-hypothesis
**Rendered**: What if your security tools actually executed code to find hidden threats? Phylum analyzes dependency behaviors in a secure sandbox, blocking malicious packages before they compromise your build.
**Mechanism**: spine-derived-v1
**Template Id**: spine-founding-hypothesis
**Vocab Fingerprint**: fb67edcefbe64ac2

## Startup Token Positioning

**Genre**: moore-positioning
**Rendered**: Behavioral supply chain security for security engineers at high-growth software companies. Unlike static CVE signature tools — intercept zero-day malware before it executes in your environment.
**Mechanism**: spine-derived-v1
**Template Id**: spine-moore-positioning
**Vocab Fingerprint**: 98ec421da057933b

## Startup Token Pitch Deck

**Genre**: pitch-deck
**Rendered**: Problem: Snyk and Dependabot miss zero-day typosquatting because they only flag known CVEs in a manifest file
Solution: What if your security tools actually executed code to find hidden threats? Phylum analyzes dependency behaviors in a secure sandbox, blocking malicious packages before they compromise your build.
Customer: security engineers at high-growth software companies
Unlike: static CVE signature tools
**Mechanism**: spine-derived-v1
**Template Id**: spine-pitch-deck
**Vocab Fingerprint**: 010783091fb2abd8

## Startup Token M E D D P I C C

**Pain**: Snyk and Dependabot miss zero-day typosquatting because they only flag known CVEs in a manifest file
**Metrics**: Target: Your build pipeline remains clean of malware while false positives from static scanners drop by eighty percent.
**Rendered**: Pain: Snyk and Dependabot miss zero-day typosquatting because they only flag known CVEs in a manifest file
Economic buyer: DevSecOps Teams
Metrics: Target: Your build pipeline remains clean of malware while false positives from static scanners drop by eighty percent.
Competition: static CVE signature tools
**Mechanism**: spine-derived-v1
**Competition**: static CVE signature tools
**Economic Buyer**: DevSecOps Teams
**Vocab Fingerprint**: 6137523fca31c33f

## Startup Token Cold Email

**Genre**: cold-email
**Rendered**: Subject: Behavioral supply chain security for security engineers at high-growth software companies

security engineers at high-growth software companies — Snyk and Dependabot miss zero-day typosquatting because they only flag known CVEs in a manifest file What if your security tools actually executed code to find hidden threats? Phylum analyzes dependency behaviors in a secure sandbox, blocking malicious packages before they compromise your build.
**Mechanism**: spine-derived-v1
**Template Id**: spine-cold-email
**Vocab Fingerprint**: fb486d7f1a1ec8a2

## Startup Token Agent Spec

**Genre**: ai-agent-spec
**Rendered**: Behavioral supply chain security. What if your security tools actually executed code to find hidden threats? Phylum analyzes dependency behaviors in a secure sandbox, blocking malicious packages before they compromise your build. Serves security engineers at high-growth software companies.
**Mechanism**: spine-derived-v1
**Template Id**: spine-ai-agent-spec
**Vocab Fingerprint**: 2557f17f6452a41d

## Neighborhood

### Candidate solutions

- [ABET Accreditation Data Collection](/Problems/ABET_Accreditation_Data_Collection) — candidate solution for · Problems
- [Reconcile Hobbs Meter Billing](/Problems/Reconcile_Hobbs_Meter_Billing) — candidate solution for · Problems

### Composed of

- [Criterion Vector Service](/Services/Criterion_Vector_Service) — composes · Services
- [LMS Integration API](/Software/LMS_Integration_API) — composes · Software
- [Multimodal Parsing Engine](/Software/Multimodal_Parsing_Engine) — composes · Software
- [Competency Alignment Worker](/Agents/Competency_Alignment_Worker) — composes · Agents
- [Artifact Extraction Agent](/Agents/Artifact_Extraction_Agent) — composes · Agents
- [Rubric Alignment Agent](/Agents/Rubric_Alignment_Agent) — composes · Agents
- [LMS Extraction API](/Software/LMS_Extraction_API) — composes · Software
- [Multimodal Vision Engine](/Software/Multimodal_Vision_Engine) — composes · Software
- [Artifact Evaluation Worker](/Agents/Artifact_Evaluation_Worker) — composes · Agents
- [Compliance Dossier Service](/Services/Compliance_Dossier_Service) — composes · Services
- [Sandbox Execution Agent](/Agents/Sandbox_Execution_Agent) — composes · Agents
- [Package Behavior Worker](/Agents/Package_Behavior_Worker) — composes · Agents
- [Dynamic Analysis API](/Software/Dynamic_Analysis_API) — composes · Software
- [Dependency Threat Service](/Services/Dependency_Threat_Service) — composes · Services

### Embodies

- [Service-as-Software](/Theses/Service-as-Software) — embodies · Theses
- [Software](/Theses/Software) — embodies · Theses

### What it offers

- [Criterion Vector](/Services/Criterion_Vector) — offers · Services
- [Criterion Vault](/Services/Criterion_Vault) — offers · Services
- [Phylum Risk Engine](/Software/Phylum_Risk_Engine) — offers · Software

### Competitors

- [Gradescope By Turnitin](/Competitors/Gradescope_By_Turnitin) — competes with · Competitors
- [Watermark Assessment Suite](/Competitors/Watermark_Assessment_Suite) — competes with · Competitors
- [Manual Spreadsheet Mapping](/Competitors/Manual_Spreadsheet_Mapping) — competes with · Competitors
- [Watermark](/Competitors/Watermark) — competes with · Competitors
- [Gradescope](/Competitors/Gradescope) — competes with · Competitors
- [Canvas LMS](/Competitors/Canvas_LMS) — competes with · Competitors
- [Manual Spreadsheet Tracking](/Competitors/Manual_Spreadsheet_Tracking) — competes with · Competitors
- [HelioCampus](/Competitors/HelioCampus) — competes with · Competitors
- [manual folder curation](/Competitors/manual_folder_curation) — competes with · Competitors
- [Manual Spreadsheet Workarounds](/Competitors/Manual_Spreadsheet_Workarounds) — competes with · Competitors
- [manual spreadsheet curation](/Competitors/manual_spreadsheet_curation) — competes with · Competitors
- [Watermark Assessment](/Competitors/Watermark_Assessment) — competes with · Competitors
- [Manual Spreadsheet Audits](/Competitors/Manual_Spreadsheet_Audits) — competes with · Competitors
- [Spreadsheet Mapping](/Competitors/Spreadsheet_Mapping) — competes with · Competitors
- [manual SharePoint folders](/Competitors/manual_SharePoint_folders) — competes with · Competitors
- [manual spreadsheets](/Competitors/manual_spreadsheets) — competes with · Competitors
- [Microsoft SharePoint](/Competitors/Microsoft_SharePoint) — competes with · Competitors
- [SharePoint Folders](/Competitors/SharePoint_Folders) — competes with · Competitors
- [HelioCampus Platform](/Competitors/HelioCampus_Platform) — competes with · Competitors
- [Snyk](/Competitors/Snyk) — competes with · Competitors
- [GitHub Dependabot](/Competitors/GitHub_Dependabot) — competes with · Competitors
- [Socket Security](/Competitors/Socket_Security) — competes with · Competitors
- [Endor Labs](/Competitors/Endor_Labs) — competes with · Competitors
- [Sonatype Nexus](/Competitors/Sonatype_Nexus) — competes with · Competitors

### Similar Startups

- [Nodehazard](/Startups/Nodehazard) — similar · Startups
- [Weavegrove](/Startups/Weavegrove) — similar · Startups
- [Wintrust](/Startups/Wintrust) — similar · Startups
- [Houndaga](/Startups/Houndaga) — similar · Startups
- [Sourcewheel](/Startups/Sourcewheel) — similar · Startups
- [Veruilt](/Startups/Veruilt) — similar · Startups
- [Verench](/Startups/Verench) — similar · Startups
- [Visibilitygrain](/Startups/Visibilitygrain) — similar · Startups
- [Boundoreman](/Startups/Boundoreman) — similar · Startups
- [Autaph](/Startups/Autaph) — similar · Startups
- [Dependencyslate](/Startups/Dependencyslate) — similar · Startups
- [Abortedpoint](/Startups/Abortedpoint) — similar · Startups
- [Arborforge](/Startups/Arborforge) — similar · Startups
- [Sourcenith](/Startups/Sourcenith) — similar · Startups
- [Flawtorch](/Startups/Flawtorch) — similar · Startups
- [Anvilhaven](/Startups/Anvilhaven) — similar · Startups
- [Fenrir](/Startups/Fenrir) — similar · Startups
- [Codedepot](/Startups/Codedepot) — similar · Startups
- [Fusyard](/Startups/Fusyard) — similar · Startups
- [Engoblem](/Startups/Engoblem) — similar · Startups