Corma, an AI security startup, recently announced $60 million in seed funding led by Sequoia Capital, with participation from Khosla Ventures and Coatue. The company, founded approximately a year ago by CEO Alon Pluda, aims to address what it terms the "defense gap" in cybersecurity, where AI models currently exhibit greater proficiency in offensive security tasks compared to defensive ones.
Pluda highlighted an instance where a customer, a security executive, received a notification on his smartwatch from a Corma agent while walking his dog. The agent reported a live attack and requested permission to block it. Upon approval, the agent successfully blocked malware and prevented the attacker from moving across the company's network, mitigating the intrusion in under 10 minutes. This event was described by the customer as a "magical moment," underscoring Corma's goal of empowering defenders with AI capabilities.
The company's name, Corma, is derived from the Elven word for "ring," reflecting Pluda's ambition to create a comprehensive defensive AI solution. He noted that current frontier models from entities like OpenAI, Anthropic, and Google excel at coding, language tasks, and orchestrating multi-step workflows, making them effective for vulnerability research and end-to-end attacks. This offensive capability was evident in incidents such as the OpenAI and Hugging Face event.
However, Pluda contends that these same models are less adept at defensive security tasks that do not involve scanning code for vulnerabilities or misconfigurations. Corma's research indicates that the majority of defensive security tasks involve analyzing structured machine data like logs, events, configurations, and audit trails, which constitute a small portion of the data these models are typically trained on. Consequently, these models appear to interpret such data less reliably, and defensive reasoning is often more open-ended compared to the straightforward goals of offensive actions.
To illustrate this disparity, Corma conducted tests involving four frontier models—Claude Opus 4.8, GPT-5.5, Grok 4.3, and DeepSeek V4—pitting them against each other as both attackers and defenders within a simulated multi-business enterprise network. The objective for attackers was to implant a backdoor, while defenders aimed to detect and stop the attack. Across 241 scored engagements, the models successfully implanted persistent backdoors in 85 percent of their runs, but only detected 19 percent of attacks. This stark imbalance highlights the "defense gap" Corma seeks to close.
Corma's AI agents are designed to function as "team members" that organizations can deploy to handle various defensive security tasks. The company claims that Fortune 100 and 500 organizations across sectors including healthcare, financial services, energy, critical infrastructure, and retail have deployed its AI workforce. These early deployments have reportedly reduced threat response times by over 94 percent, expanded security coverage by 15 times across different security functions, and uncovered multi-stage attack campaigns.
Pluda emphasized that sufficiently intelligent and trustworthy AI, capable of responding to real-time attacks, can significantly improve security metrics and cover more ground than human intelligence alone.
