Loading startup
Market data is refreshed once per day from public sources. Information may be incomplete or outdated — verify independently before making decisions. This is not investment advice.
Evidence-bound summary — expand sections for movement, risks, and signals.
Memo snapshot · Jul 2, 2026, 5:26 PM
DealFlow OS uses public web data and automated enrichment. Research may be incomplete, outdated, or incorrect. Verify important information before making investment or outreach decisions.
TL;DR
Seed (YC)Casco - Autonomous Security Testing Official autonomous security testing platform.
Raised $500K across 1 funding round. Latest: $500K Pre-seed (Apr 2025). Investors: Y Combinator. (High).
11-50
Headcount band (inferred from open roles)
Inferred from 5 open roles on careers page; not verified FTE count.
jobs_boardFunding
Raised $500K across 1 funding round. Latest: $500K Pre-seed (Apr 2025). Investors: Y Combinator. (High).
Hiring
7 hiring‑related row(s); role‑spam risk if mostly generic boards (High).
Product / news
20 product/news‑styled row(s); headline risk without filings (High).
Traffic / social
2 social/traffic‑styled row(s) (Low).
Verified facts
Inferred (corpus-only)
+5 more in Recent movement below
Casco (YC Spring 2025) provides agentic red teaming for web, API, cloud, and AI systems.
Weak funding evidence: mention does not include a parsed raise amount/round and may refer to non-funding context.
No open roles indexed yet.
The index price and activity score are algorithmic estimates based on observed public company-level signals. They may be incomplete, stale, or inaccurate and are not investment, legal, tax, or business advice.
Casco:reddit_credentials_not_configured
Source types found
Strongest / recent news-style rows
Wed, May 20, 05:42 PM · confidence 88%high quality
Wed, May 20, 05:42 PM · confidence 85%high quality
wikipedia · Mon, Jun 29, 02:37 AM · confidence 50%medium quality
Newest first · 40 event(s)
Source: Blog
Expert insights on security testing, autonomous security testing, and agentic AI security. Learn from our security engineers about the latest in cybersecurity.
Source: Careers page
Join Casco and help build the future of security. We are looking for talented individuals passionate about keeping systems safe and secure.
Source: hackernews
Source: hackernews
Source: jobs_board
Source: jobs_board
Source: jobs_board
Source: jobs_board
Source: jobs_board
Source: official_site
Careers - Join Our Mission | Casco Penetration Testing Events Blog Partners Careers Support Book a demo Penetration Testing Events Blog Partners Careers Support Join Our Mission Our mission is to make all software effortlessly secure. We're looking for t…
Source: official_site
Autonomous Security Testing for Modern Applications | Casco Penetration Testing Events Blog Partners Careers Support Book a demo Penetration Testing Events Blog Partners Careers Support Always-on Security Testing Casco performs autonomous security testing for…
Source: official_site
Security Blog - Insights on Autonomous Security Testing with Agentic AI | Casco Penetration Testing Events Blog Partners Careers Support Book a demo Penetration Testing Events Blog Partners Careers Support Blog Vulnerability Disclosure: Database Takeover in E…
Casco (YC Spring 2025) provides agentic red teaming for web, API, cloud, and AI systems.
Technical blog demonstrating AI agent security research.
Official autonomous security testing platform.
Source: Blog / news
Even though clients intuitively ask for a pentest report, they are often not getting the right one. You are actually supposed to share the remediation report instead. This blog post explains why and what to share instead.
Source: Blog / news
Most security professionals pack for RSA like they're heading to Vegas in February. Wrong coast, wrong weather, wrong strategy. Here's everything you need to know.
Source: Blog / news
High-quality penetration test don't just stop with an initial report, they should include retesting, remediation reports, and actively discourage the practice of ingenuine "clean" reports.
Source: Blog / news
Get 20% off your annual pentest and 5% off your insurance with Vouch Insurance and Casco.
Source: Blog / news
Why a "clean" pentest report is a red flag and how to spot the good penetration tests from the bad ones.
Source: Blog / news
The Importance of Rate Limiting.
Source: Blog / news
Just in the last 7 days, we've seen LiteLLM and axios impacted by supply chain attacks. Recently, I was chatting with Bereket Engida, the creator of the popular JS auth library. He observed repeated attempts by a contributor to add malicious code directly via…
Source: Blog / news
The release of the OWASP Top 10 2025 marks a pivotal moment for application security. While some classic vulnerabilities remain, the list reflects a world where software is increasingly complex and interconnected. For security teams, this means the goalposts…
Source: Blog / news
Casco is proud to announce that we have become a Gold Sponsor of the OWASP AI Exchange to advance AI security practices globally.
Source: Blog / news
Effective April 12, 2026, Casco no longer issues "clean pentest reports". Here's what that means and how to verify report authenticity.
Source: Blog / news
Why unverified MCPs can be a major vulnerability
Source: Blog / news
How we hire at Casco. Our mission is to make all software effortlessly secure. We hire with a simple 3-step process.
Source: Blog / news
How we hacked Ford.com for $130,000. This is a story about a forgotten subdomain and a $130,000 domain purchase that could have led to a massive breach.
Source: Blog / news
A SQL injection vulnerability in ElectricSQL's ORDER BY parameter gave attackers full database access. The ElectricSQL team fixed and deployed it in 2 hours.
Source: Blog / news
Why many penetration test are not getting approved by clients and how to spot the good penetration tests from the bad ones.
Source: Blog / news
Announcing CrewAI as a customer of Casco.
Source: Blog / news
Casco is proud to announce that we have achieved CREST accreditation, meeting rigorous international standards for penetration testing excellence.
Source: Blog / news
How to build self-securing software with autonomous security testing.
Source: npm_registry
empty
4 row(s)
The company's own site — the authoritative description of what they sell and to whom. Marketing-controlled, so treat claims as positioning rather than verified traction.
Careers - Join Our Mission | Casco Penetration Testing Events Blog Partners Careers Support Book a demo Penetration Testing Events Blog Partners Careers Support Join Our Mission Our mission is to make all software effortlessly secure. We're looking for t…
Why it matters: Primary source — the company's own positioning; best read for what they sell and to whom, not for traction claims.
Open source ↗Autonomous Security Testing for Modern Applications | Casco Penetration Testing Events Blog Partners Careers Support Book a demo Penetration Testing Events Blog Partners Careers Support Always-on Security Testing Casco performs autonomous security testing for…
Why it matters: Primary source — the company's own positioning; best read for what they sell and to whom, not for traction claims.
Open source ↗Security Blog - Insights on Autonomous Security Testing with Agentic AI | Casco Penetration Testing Events Blog Partners Careers Support Book a demo Penetration Testing Events Blog Partners Careers Support Blog Vulnerability Disclosure: Database Takeover in E…
Why it matters: Primary source — the company's own positioning; best read for what they sell and to whom, not for traction claims.
Open source ↗Official autonomous security testing platform.
Why it matters: Primary source — the company's own positioning; best read for what they sell and to whom, not for traction claims.
Open source ↗3 row(s)
Third-party press coverage. Independent reporting corroborates company claims; repeated coverage across outlets is a momentum signal.
Technical blog demonstrating AI agent security research.
Why it matters: Independent coverage — third-party corroboration of company claims; recurring coverage indicates rising visibility.
Open source ↗Why it matters: Independent coverage — third-party corroboration of company claims; recurring coverage indicates rising visibility.
Open source ↗Why it matters: Independent coverage — third-party corroboration of company claims; recurring coverage indicates rising visibility.
Open source ↗1 row(s)
Funding announcements and investor-database records. The strongest public signal of capitalization: round, amount, and syndicate quality when disclosed.
Casco (YC Spring 2025) provides agentic red teaming for web, API, cloud, and AI systems.
Why it matters: Funding signal — Pre-Seed per this source; verify against the linked original before relying on it.
Open source ↗6 row(s)
Open roles and careers pages. Active hiring implies runway to spend and shows where the company is investing (engineering vs GTM vs ops).
Join Casco and help build the future of security. We are looking for talented individuals passionate about keeping systems safe and secure.
Why it matters: Hiring signal — open roles imply runway to spend and show where the company is investing.
Open source ↗Why it matters: Hiring signal — 5 open role(s) indexed; hiring implies runway and shows growth priorities.
Open source ↗Why it matters: Hiring signal — 5 open role(s) indexed; hiring implies runway and shows growth priorities.
Open source ↗Why it matters: Hiring signal — 5 open role(s) indexed; hiring implies runway and shows growth priorities.
Open source ↗Why it matters: Hiring signal — 5 open role(s) indexed; hiring implies runway and shows growth priorities.
Open source ↗Why it matters: Hiring signal — 5 open role(s) indexed; hiring implies runway and shows growth priorities.
Open source ↗5 row(s)
Public engineering activity. Sustained commits, releases, and stars indicate real product development and, for dev tools, developer adoption.
A hacky solution to a problem that shouldn't exist: adding classes to the body tag
Why it matters: Engineering signal — public repo activity evidences active development and possible developer adoption.
Open source ↗Why it matters: Engineering signal — public repo activity evidences active development and possible developer adoption.
Open source ↗Casco Universal Middleware Router
Why it matters: Engineering signal — public repo activity evidences active development and possible developer adoption.
Open source ↗empty
Why it matters: Engineering signal — public repo activity evidences active development and possible developer adoption.
Open source ↗Why it matters: Engineering signal — public repo activity evidences active development and possible developer adoption.
Open source ↗2 row(s)
Social presence and mentions. A soft signal — useful for gauging attention and launch reception, not a substitute for verified traction.
Why it matters: Attention signal — social mention or presence; soft signal of market interest.
Open source ↗Why it matters: Attention signal — social mention or presence; soft signal of market interest.
Open source ↗19 row(s)
Company blog and newsletters. Shipping cadence and technical depth of posts hint at product velocity and team quality.
Expert insights on security testing, autonomous security testing, and agentic AI security. Learn from our security engineers about the latest in cybersecurity.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗Even though clients intuitively ask for a pentest report, they are often not getting the right one. You are actually supposed to share the remediation report instead. This blog post explains why and what to share instead.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗Most security professionals pack for RSA like they're heading to Vegas in February. Wrong coast, wrong weather, wrong strategy. Here's everything you need to know.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗High-quality penetration test don't just stop with an initial report, they should include retesting, remediation reports, and actively discourage the practice of ingenuine "clean" reports.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗Get 20% off your annual pentest and 5% off your insurance with Vouch Insurance and Casco.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗Why a "clean" pentest report is a red flag and how to spot the good penetration tests from the bad ones.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗The Importance of Rate Limiting.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗Just in the last 7 days, we've seen LiteLLM and axios impacted by supply chain attacks. Recently, I was chatting with Bereket Engida, the creator of the popular JS auth library. He observed repeated attempts by a contributor to add malicious code directly via…
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗The release of the OWASP Top 10 2025 marks a pivotal moment for application security. While some classic vulnerabilities remain, the list reflects a world where software is increasingly complex and interconnected. For security teams, this means the goalposts…
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗Casco is proud to announce that we have become a Gold Sponsor of the OWASP AI Exchange to advance AI security practices globally.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗Effective April 12, 2026, Casco no longer issues "clean pentest reports". Here's what that means and how to verify report authenticity.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗Why unverified MCPs can be a major vulnerability
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗How we hire at Casco. Our mission is to make all software effortlessly secure. We hire with a simple 3-step process.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗How we hacked Ford.com for $130,000. This is a story about a forgotten subdomain and a $130,000 domain purchase that could have led to a massive breach.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗A SQL injection vulnerability in ElectricSQL's ORDER BY parameter gave attackers full database access. The ElectricSQL team fixed and deployed it in 2 hours.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗Why many penetration test are not getting approved by clients and how to spot the good penetration tests from the bad ones.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗Announcing CrewAI as a customer of Casco.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗Casco is proud to announce that we have achieved CREST accreditation, meeting rigorous international standards for penetration testing excellence.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗How to build self-securing software with autonomous security testing.
Why it matters: Company publishing — post cadence and depth hint at product velocity.
Open source ↗Sign in as an active team member to view private notes, watchlist controls, transcript evidence, and interaction history.