Most security tools try to catch threats before software ships. Oligo Security is betting the more dangerous fight happens after deployment — and investors just put $60 million behind that thesis. The Israeli cybersecurity startup has closed a $60 million Series B round, a significant vote of confidence for an approach that monitors applications while they are actively executing, catching exploits that static scanners and pre-production audits routinely miss. For more on why runtime defense is becoming a venture priority, see our earlier coverage of Oligo Security and the broader shift toward detecting vulnerabilities at the moment attackers actually trigger them.
According to a Globes report, the round was led by prominent venture investors and brings Oligo’s total funding to roughly $80 million. The company was founded in 2022 and is headquartered in Tel Aviv, with a commercial presence in the United States. Its core product uses eBPF — a Linux kernel technology that lets software observe system behavior without modifying underlying code — to instrument running applications and flag malicious activity in real time, including attempts to abuse open-source libraries and supply-chain dependencies mid-execution.
Why Runtime Is the New Perimeter
The case for runtime security has sharpened considerably as attackers have learned to embed malicious payloads inside legitimate open-source packages and wait for production environments to activate them. Traditional software composition analysis tools scan dependency trees and flag known-bad versions, but they are essentially blind once an application is live. Oligo’s pitch is that eBPF-based instrumentation can watch exactly which library functions a running process actually calls — and block the ones that look like exploitation attempts without requiring agents, code changes, or restarts.
That capability is increasingly relevant as AI-generated code accelerates the pace at which unreviewed open-source dependencies land in production. Developers pulling packages from npm, PyPI, or Maven to scaffold AI-assisted features may not fully audit what they’re importing — and the window between a malicious package being published and being pulled can be measured in hours, not days. Oligo’s runtime lens means even a zero-day embedded in a popular library can be interrupted the moment it tries to do something the application would never legitimately do, like open an outbound shell or exfiltrate environment variables.
What $60 Million Buys in a Crowded Market
The funding arrives as the application security market fragments into overlapping categories — SAST, DAST, SCA, CNAPP, ASPM — with enterprise buyers increasingly fatigued by tool sprawl. Oligo is positioning itself not as another scanner added to the CI/CD pipeline but as a production-time enforcement layer that complements rather than duplicates existing pre-deployment tools. That framing matters commercially: it lets the company sell into security teams that already have crowded toolchains by arguing it covers a gap nobody else closes.
The $60 million will reportedly fund go-to-market expansion in North America and accelerate product development, particularly around support for additional language runtimes and cloud-native environments. The company faces competition from established players extending into runtime detection, including Aqua Security and Sysdig, as well as newer entrants working the eBPF angle. But the Series B signals that at least one set of investors believes Oligo’s focus on open-source library abuse — a specific and growing attack surface — gives it a defensible niche. For context on how other Israeli cybersecurity startups are approaching automated defense, our piece on Ultra Red’s platform covers a complementary approach to turning threat intelligence into active countermeasures.
The broader trend is unmistakable: security investment is shifting toward tools that operate closer to where code actually runs, not just where it’s written or stored. Oligo’s fresh capital positions it to push that argument into the enterprise mainstream — assuming it can out-execute a field that is filling up fast.
