# Veruilt

*/Startups/Veruilt*

## Startup Overview

This platform secures the software supply chain by automatically mapping and signing build artifact provenance. It embeds into continuous integration pipelines to generate immutable records of the exact components entering every software release. Rather than relying on after-the-fact scanning, the system captures build metadata at the moment of compilation.

Engineering and DevSecOps teams require verifiable integrity for their deployed applications to block supply chain attacks. Manual provenance tracking and bolted-on security checks create compliance gaps and introduce friction that halts release cycles. Without deterministic proof of origin, identifying a compromised build step requires extensive forensic reconstruction.

While traditional container security tools like Snyk or Aqua Security focus on vulnerability scanning and perimeter defense, this system delivers cryptographically attested proof of origin for every artifact. The entire mapping and signing mechanism remains completely invisible to the core development loop, granting security teams mathematical certainty without altering developer workflows.

## Startup Founding Hypothesis

**Approach**: that automatically maps and signs build artifact provenance
**Competitors**:
- [Snyk](/Competitors/Snyk)
- [Aqua Security](/Competitors/Aqua_Security)
- [manual provenance tracking](/Competitors/manual_provenance_tracking)
**Differentiator2x2**: cryptographically attested and completely invisible to the core development loop

## Startup Solution Coordinate

**Solution**: [Build Attestation Engine](/Software/Build_Attestation_Engine)

## Startup Position2x2

```mermaid
quadrantChart
    title Artifact Provenance Tools
    x-axis "Unverified / Trust-Based" --> "Cryptographically Attested"
    y-axis "High Developer Friction" --> "Invisible to Dev Loop"
    quadrant-1 "Defensible Automation"
    quadrant-2 "Transparent but Unverified"
    quadrant-3 "Manual Effort"
    quadrant-4 "Heavyweight Security"
    Snyk: [0.60, 0.45]
    Aqua Security: [0.75, 0.35]
    Manual Provenance Tracking: [0.15, 0.15]
    Veruilt: [0.95, 0.90]
```

## Startup Offer

**Proof**:
- Fintech engineering teams aiming to achieve SLSA Level 3 compliance without altering developer workflows
- Healthcare software vendors targeting zero failed compliance audits for software bill of materials (SBOM) provenance
- Cloud-native enterprises looking to replace manual artifact tracking with invisible automated attestation
**Tiers**:
- Name: Team Provenance · Price: ~$150–$300/mo · Inclusions: Up to 30 active contributors, 10,000 signed artifacts per month, and intended integrations for standard CI/CD environments like GitHub Actions and GitLab CI
- Name: Organization Attestation · Price: ~$1,000–$2,000/mo · Inclusions: Up to 200 active contributors, 100,000 signed artifacts, intended integration with external Key Management Services (KMS), and automated SLSA compliance reporting
- Name: Enterprise Supply Chain · Price: ~$30k–$50k/yr · Inclusions: Unlimited contributors, custom HSM (Hardware Security Module) targets, deployment policy enforcement engine, and dedicated onboarding support
**Guarantee**: Veruilt guarantees every successfully built artifact is cryptographically signed and mapped to its source commit without halting the build. If the system fails to generate a valid provenance record or blocks a healthy pipeline for more than 0.1% of builds in a billing period, the subsequent month of service is refunded in full.
**Business Function**: ProvideService
**Objection Handlers**:
- Objection: This will slow down our CI/CD pipeline. Rebuttal: Veruilt is designed to operate asynchronously, generating and attaching signatures without blocking the core build process.
- Objection: We already use Snyk or Aqua Security. Rebuttal: Snyk and Aqua scan for known vulnerabilities, whereas Veruilt strictly guarantees the deployed artifact is exactly what was built from your source code, preventing pipeline tampering.
- Objection: Developers will complain about adopting another security tool. Rebuttal: The system runs entirely at the infrastructure layer, requiring zero local installations, CLI tools, or changes to developer commit habits.
- Objection: We cannot hand over our private signing keys. Rebuttal: Keys are never held in the core application; the architecture is built to invoke signing operations directly within your existing KMS or HSM infrastructure.
**Pricing Architecture**: Tiered
**Agent Checkout Support**:
- agentic-commerce-protocol

## Startup Brand

**Voice**: Technical and authoritative, defined by absolute precision.
**Tagline**: Cryptographically signed build artifacts with zero developer friction.
**Icon Concept**: stamp
**Palette Intent**: electric-signal
**Visual Identity**: Dark terminal-inspired backgrounds contrast with stark neon green cryptographic hashes and severe monospaced typography, projecting verifiable security.
**Archetype Reference**: the-sage

## Startup Buyer Chain

**Chain**: B2B → Platform Engineering → Security and Compliance Teams
**Gtm Motion**: Acquires users through bottom-up adoption by Platform Engineering teams installing the tool in individual CI/CD pipelines for zero-friction artifact signing. Expands enterprise-wide when Security and Compliance teams mandate centralized cryptographic attestation and provenance reporting across all corporate repositories.
**Agent Channel**: Designed to list in autonomous DevOps agent tool registries and the OpenAI schema directory, where AI security agents would discover and invoke the API to verify the cryptographic provenance of a build artifact before authorizing a deployment.
**Primary Channel**: GitHub Marketplace and GitLab Integration Directory, where platform engineers search for 'SLSA compliance', 'artifact provenance', or 'container signing' while configuring CI/CD pipelines.

## Startup Customer Journey

```mermaid
flowchart LR
  A[GitHub Marketplace] --> B[Platform Engineering]
  B --> C[CI/CD Pipeline]
  C --> D[Signed Artifact]
  D --> E[Production Workloads]
  E --> F[Security Team]
  F --> G[Enterprise KMS]
  G --> H[Provenance Record]
```

## Startup Proof Points

_Illustrative — target and order-of-magnitude estimate figures, not an achieved track record (this Thing is concept-stage)._

**Pilot Goals**:
- 30-day single-repository pilot to prove asynchronous signature generation attaches provenance records without blocking the core GitHub Actions build process.
- 60-day multi-team rollout to validate external KMS integration and achieve automated SLSA compliance reporting for up to 10000 artifacts.
**Target Metrics**:
- Target: 0 added seconds to developer pipeline latency.
- Target: 100 percent of deployed artifacts cryptographically mapped to source commits.
- Aim: 0 manual audit interventions required for SBOM provenance.
- Aim: less than 0.1 percent failed provenance record generations per billing cycle.
**Target Case Studies**:
- Mid-sized fintech engineering team targeting SLSA Level 3 compliance across 50 repositories without increasing average CI/CD build times.
- Large healthcare software vendor seeking to automate SBOM provenance generation for all releases to eliminate manual compliance audit failures.
- Cloud-native enterprise infrastructure team aiming to replace fragmented artifact tracking with automated attestation linked directly to their existing Key Management Service.
**Testimonial Targets**:
- VP of Engineering expressing relief that developers achieved supply chain security without altering commit habits or installing new local CLI tools.
- DevSecOps Lead confirming confidence in audit readiness because artifact signatures map automatically to source commits without exposing private signing keys.
- Chief Information Security Officer highlighting the elimination of pipeline tampering risks through invisible infrastructure-layer attestation.

## Startup Top Risks

**Risks**:
- Severity: existential · Description: Incumbents like GitHub or Snyk natively integrate automated artifact signing into their core CI/CD pipelines, eliminating the need for a standalone provenance tool. · Mitigation Status: unmitigated
- Severity: high · Description: Maintaining 'invisible' integrations requires constant updates to hook into rapidly changing build tools, language compilers, and container engines without breaking customer builds. · Mitigation Status: in-progress
- Severity: moderate · Description: Security teams mandate the tool, but developers bypass it locally because cryptographic key management introduces latency into their compilation loop. · Mitigation Status: in-progress
- Severity: moderate · Description: Enterprise adoption stalls because chief information security officers require SOC2 and FedRAMP certifications before allowing third-party code access. · Mitigation Status: unmitigated

## Startup Competitors

- [Snyk](/Competitors/Snyk) — Incumbent
- [Aqua Security](/Competitors/Aqua_Security) — Incumbent
- [Manual Provenance Tracking](/Competitors/Manual_Provenance_Tracking) — Status Quo
- [Chainguard](/Competitors/Chainguard) — Startup Competitor
- [Sigstore Tooling](/Competitors/Sigstore_Tooling) — DIY Ecosystem
- [Legit Security](/Competitors/Legit_Security) — ASPM Platform

## Startup Solution Stack

- [Build Provenance Service](/Services/Build_Provenance_Service) — Service-as-Software
- [Artifact Mapping Agent](/Agents/Artifact_Mapping_Agent) — Agent
- [Attestation Signing Worker](/Agents/Attestation_Signing_Worker) — Agent
- [Cryptographic Signature Engine](/Software/Cryptographic_Signature_Engine) — Software
- [Provenance Verification API](/Software/Provenance_Verification_API) — Software

## Startup Story Brand

**Hero**:
- **Need**: to be the enabler of rapid delivery, not the bottleneck in the pipeline
- **Want**: to secure the software supply chain without slowing down shipping cycles
- **Identity**: the security engineer at a cloud-native fintech enterprise
**Plan**:
- Step: Attach · Detail: Connect your CI/CD environment to our infrastructure layer to begin artifact mapping.
- Step: Review · Detail: Inspect the automatically generated SLSA compliance reports to verify source-to-binary integrity.
- Step: Enforce · Detail: Set deployment policies that only allow cryptographically attested artifacts into your production environment.
**Guide**:
- **Empathy**: Audit-ready records are won in the build logs — but developers often bypass security when tools feel like friction.
**Problem**:
- **Villain**: pipeline tampering
- **External**: Achieving SLSA Level 3 compliance today requires manual provenance tracking and intrusive CLI tools that break GitHub Actions workflows.
- **Internal**: You feel like the 'workflow police' every time a security check kills a developer's momentum.
- **Philosophical**: Every engineering lead deserves cryptographically certain software — not a choice between speed and security.
**Success**: You achieve absolute supply chain visibility with automated SLSA compliance and zero pipeline delays.
**One Liner**: Every build cycle, security engineers fight pipeline tampering. Veruilt built invisible artifact signing so teams ship verified code with zero friction.
**Positioning**:
- **So That**: achieve SLSA compliance without altering developer workflows
- **Unlike**: manual provenance tracking or Snyk scans
- **For Whom**: security engineers at cloud-native enterprises
- **Category**: Automated Software Supply Chain Attestation
**Call To Action**:
- **Direct**: Secure my artifacts
- **Transitional**: View sample provenance record
**Failure Stakes**:
- Failed compliance audits
- Unauthorized code in production
- Developer burnout from tool sprawl
**Transformation**:
- **To**: free to architect resilient systems, no longer stuck policing developer commit habits
- **From**: a security bottleneck managing manual attestations
**Controlling Idea**: Supply chain security must be cryptographically certain and developer-invisible.

## Startup Token Hero

**Genre**: founding-hypothesis
**Rendered**: Every build cycle, security engineers fight pipeline tampering. Veruilt built invisible artifact signing so teams ship verified code with zero friction.
**Mechanism**: spine-derived-v1
**Template Id**: spine-founding-hypothesis
**Vocab Fingerprint**: 966a59037064a90d

## Startup Token Positioning

**Genre**: moore-positioning
**Rendered**: Automated Software Supply Chain Attestation for security engineers at cloud-native enterprises. Unlike manual provenance tracking or Snyk scans — achieve SLSA compliance without altering developer workflows.
**Mechanism**: spine-derived-v1
**Template Id**: spine-moore-positioning
**Vocab Fingerprint**: 3a9f1f15e2d975c4

## Startup Token Pitch Deck

**Genre**: pitch-deck
**Rendered**: Problem: Achieving SLSA Level 3 compliance today requires manual provenance tracking and intrusive CLI tools that break GitHub Actions workflows.
Solution: Every build cycle, security engineers fight pipeline tampering. Veruilt built invisible artifact signing so teams ship verified code with zero friction.
Customer: security engineers at cloud-native enterprises
Unlike: manual provenance tracking or Snyk scans
**Mechanism**: spine-derived-v1
**Template Id**: spine-pitch-deck
**Vocab Fingerprint**: 716b10f237d669c2

## Startup Token M E D D P I C C

**Pain**: Achieving SLSA Level 3 compliance today requires manual provenance tracking and intrusive CLI tools that break GitHub Actions workflows.
**Metrics**: Target: You achieve absolute supply chain visibility with automated SLSA compliance and zero pipeline delays.
**Rendered**: Pain: Achieving SLSA Level 3 compliance today requires manual provenance tracking and intrusive CLI tools that break GitHub Actions workflows.
Economic buyer: Platform Engineering
Metrics: Target: You achieve absolute supply chain visibility with automated SLSA compliance and zero pipeline delays.
Competition: manual provenance tracking or Snyk scans
**Mechanism**: spine-derived-v1
**Competition**: manual provenance tracking or Snyk scans
**Economic Buyer**: Platform Engineering
**Vocab Fingerprint**: 72b6512197585e1f

## Startup Token Cold Email

**Genre**: cold-email
**Rendered**: Subject: Automated Software Supply Chain Attestation for security engineers at cloud-native enterprises

security engineers at cloud-native enterprises — Achieving SLSA Level 3 compliance today requires manual provenance tracking and intrusive CLI tools that break GitHub Actions workflows. Every build cycle, security engineers fight pipeline tampering. Veruilt built invisible artifact signing so teams ship verified code with zero friction.
**Mechanism**: spine-derived-v1
**Template Id**: spine-cold-email
**Vocab Fingerprint**: ff5540ca03723f17

## Startup Token Agent Spec

**Genre**: ai-agent-spec
**Rendered**: Automated Software Supply Chain Attestation. Every build cycle, security engineers fight pipeline tampering. Veruilt built invisible artifact signing so teams ship verified code with zero friction. Serves security engineers at cloud-native enterprises.
**Mechanism**: spine-derived-v1
**Template Id**: spine-ai-agent-spec
**Vocab Fingerprint**: 22c17c9ecf71ff54

## Neighborhood

### Candidate solutions

- [On-Site Code Verification](/Problems/On-Site_Code_Verification) — candidate solution for · Problems

### Composed of

- [Attestation Signing Worker](/Agents/Attestation_Signing_Worker) — composes · Agents
- [Cryptographic Signature Engine](/Software/Cryptographic_Signature_Engine) — composes · Software
- [Provenance Verification API](/Software/Provenance_Verification_API) — composes · Software
- [Build Provenance Service](/Services/Build_Provenance_Service) — composes · Services
- [Artifact Mapping Agent](/Agents/Artifact_Mapping_Agent) — composes · Agents

### Competitors

- [Sigstore Tooling](/Competitors/Sigstore_Tooling) — competes with · Competitors
- [Chainguard](/Competitors/Chainguard) — competes with · Competitors
- [Snyk](/Competitors/Snyk) — competes with · Competitors
- [Aqua Security](/Competitors/Aqua_Security) — competes with · Competitors
- [Legit Security](/Competitors/Legit_Security) — competes with · Competitors
- [Manual Provenance Tracking](/Competitors/Manual_Provenance_Tracking) — competes with · Competitors

### Embodies

- [Software](/Theses/Software) — embodies · Theses

### What it offers

- [Build Attestation Engine](/Software/Build_Attestation_Engine) — offers · Software

### Similar Startups

- [Anvilwood](/Startups/Anvilwood) — similar · Startups
- [Anvilhaven](/Startups/Anvilhaven) — similar · Startups
- [Attategic](/Startups/Attategic) — similar · Startups
- [Autaph](/Startups/Autaph) — similar · Startups
- [Pocogn](/Startups/Pocogn) — similar · Startups
- [Apexorigin](/Startups/Apexorigin) — similar · Startups
- [Registryard](/Startups/Registryard) — similar · Startups
- [Engoblem](/Startups/Engoblem) — similar · Startups
- [Wintrust](/Startups/Wintrust) — similar · Startups
- [Sourcewheel](/Startups/Sourcewheel) — similar · Startups
- [Harborimage](/Startups/Harborimage) — similar · Startups
- [Registrymuse](/Startups/Registrymuse) — similar · Startups
- [Continuousrope](/Startups/Continuousrope) — similar · Startups
- [Pureregistry](/Startups/Pureregistry) — similar · Startups
- [Nodehazard](/Startups/Nodehazard) — similar · Startups
- [Castossom](/Startups/Castossom) — similar · Startups
- [Houndaga](/Startups/Houndaga) — similar · Startups
- [Weavegrove](/Startups/Weavegrove) — similar · Startups
- [Fusyard](/Startups/Fusyard) — similar · Startups
- [Attestationfile](/Startups/Attestationfile) — similar · Startups