Sequoia Capital Leads Seed Round in Corma to Close the AI Cybersecurity Defense Gap

Sequoia Capital Leads Seed Round in Corma to Close the AI Cybersecurity Defense Gap Sequoia Capital has led the seed round for Corma, a cybersecurity startup building a specialized foundation model and agentic security workforce designed to counter increasingly autonomous and scalable AI-driven offensive attacks. Frontier AI models favor attackers, who exploit technical vulnerabilities and social engineering, while defenders struggle with out-of-distribution log, event, trace, and telemetry data. Corma's red/blue testing revealed that an identical model acting as a defender failed to identify a hidden backdoor planted by the attacker 78% of the time. Led by founder and CEO Alon Pluda, Corma uses large-scale reinforcement learning and self-play across simulated enterprise network environments to train defense-focused agents. Corma's deployed Security Workforce is currently used in Fortune 500 companies across healthcare, finance, critical infrastructure, and retail, executing end-to-end incident response. The Defensive Gap in Frontier AI The emergence of agentic AI and advanced models like Anthropic's Mythos has tipped the cybersecurity balance toward offense, reducing social engineering costs to near zero and enabling rapid zero-day discovery. Conversely, defense relies on open-ended anomaly detection across unstructured logs, traces, and telemetry—data modalities largely absent in general LLM pretraining. In Corma's simulations, defenders failed to detect planted backdoors 78% of the time, even when using an identical model to the attacker. Corma's Reinforcement Learning Approach Treating cybersecurity as a zero-sum, two-player game similar to chess or Go, Corma applies reinforcement learning and self-play within simulated enterprise environments that mirror real-world network noise, tools, and telemetry. This vertical integration allows Corma to achieve superior defensive capabilities over general frontier models at lower per-token inference costs, while owning its model weights to avoid third-party usage restrictions. Deployment and Enterprise Impact Corma productizes its foundation model as an agentic Security Workforce operating across enterprise tools in operations, identity, cloud, and network security. In one deployment, an agent alerted a CISO via a Garmin watch and contained a pending attack after a single confirmation. In another, Corma identified, contained, and remediated an active campaign within its first hour of deployment after the customer's internal security team had missed it for 52 days.

红杉资本领投 Corma 种子轮：以专用防御模型应对AI安全失衡 红杉资本宣布领投网络安全初创公司 Corma 的种子轮融资。随着前沿AI模型显著降低攻击门槛并扩大安全缺口，Corma 正在通过强化学习与自对弈训练专用的网络防御基座模型，构建自主智能安全团队。 前沿大模型加剧攻防失衡，Corma 测试显示即使使用完全相同的模型，蓝队防御者仍有78%的概率未能发现红队植入的后门 针对防御端数据分布差异，Corma 在复刻真实企业环境的复杂网络中运用强化学习与自对弈训练专用基座模型 Corma 已将模型产品化为智能安全劳动力，进入医疗、金融等行业的多家财富500强企业并实现端到端威胁处置 红杉资本领投 Corma 种子轮，押注其垂直整合、自主模型权重及低推理成本优势 前沿模型加剧网络攻防失衡 Agentic AI 与前沿模型的爆发极大增强了攻击侧能力，能够以极低成本发现零日漏洞并大规模发起社会工程学攻击。相比攻击的目标导向推理，网络防御依赖日志、事件与遥测数据，需要对大量看似正常的活动进行开放式异常检测，而这类数据在通用大模型的预训练中极少出现。Corma 的红蓝对抗测试表明，即使使用完全相同的模型副本进行攻防，防御端仍有78%的概率无法发现植入的后门，攻击侧占据明显优势。 自对弈与强化学习构建防御基座 针对防御能力的扩展难题，Corma 创始人兼首席执行官 Alon Pluda 及其团队将网络安全视为可量化胜负的双人零和博弈。团队在高度复刻真实企业网络、工具与遥测噪音的环境中，通过大规模强化学习和自对弈训练专属基座模型。该路径旨在打造超越通用模型的前沿防御能力，同时具备更低的每 Token 推理成本，并通过自主掌握模型权重规避闭源实验室的使用限制。 智能安全劳动力落地与商业进展 Corma 的防御基座模型已被产品化为跨安全运营、身份管理、云和网络安全的智能安全劳动力，服务于医疗、金融、关键基础设施与零售等领域的财富500强企业。在实际案例中，该智能体曾在一小时内发现并修复某客户网络中潜伏52天未被察觉的攻击，并支持安全主管通过智能手表实现端到端确认与阻断。红杉资本据此宣布领投其种子轮融资。

Cybersecurity is a perpetual fight between the good guys and the bad. The age of agentic AI and Mythos-class models has tipped the scales in favor of the bad guys, opening a Pandora’s box for offensive capabilities. An explosion in CVEs has since ensued . Cyberattacks are about technical exploitation, which requires coding and reasoning prowess. Anthropic’s Mythos can discover and exploit zero-day vulnerabilities. Any model paired with a harness brings the cost of social engineering attacks down to near zero, unleashing them at unprecedented scale. The danger is heightened with every new model release. Defensive security isn’t improving in parallel. The relevant data lives in logs, events, traces and telemetry, a fundamentally different modality than the bodies of text LLMs usually train on, which barely show up in pretraining. Unlike offensive cybersecurity, which involves goal-directed reasoning towards a defined objective, defense requires open-ended reasoning, continually finding anomalies across vast amounts of normal-looking activity, a distinct capability that typically demands extensive domain-specific training. In short, defense is out of distribution for general-purpose frontier models: neither the data nor the intuition it requires is well-represented in training. In the race toward AGI, we cannot expect the frontier labs to take the detour of overhauling their training pipelines for defensive cybersecurity. And we certainly can’t afford to bet our security on a hope that they do. Corma has illustrated this “defense gap” in testing . They ran red/blue team simulations where an attacker plants a hidden backdoor and a defender tries to find it. The defender failed to find the backdoor 78% of the time, even when the defender was an identical copy of the very same model that planted it. Holding model quality constant, attackers will always have an advantage. The only answer to scaling laws on offense is better scaling laws on defense. Recent events have shown that frontier AI for defensive cybersecurity is one of the crucial unsolved problems of the AI age. Solving it is the generational mission Corma was founded on. Corma founder and CEO Alon Pluda and his team are training a foundation model to power defensive cybersecurity agents. Cybersecurity, like Go or chess, is a two-player, zero-sum game with a clean reward (were you breached or not?) and an endless supply of games to play. Reinforcement learning and self-play have produced superhuman results before in this kind of paradigm. We are seeing history repeat itself. Corma pushes this further with large-scale reinforcement learning across cybersecurity environments that replicate real enterprise networks, with all their tools, telemetry and noise – as part of a training pipeline that produces frontier defensive capabilities, outperforming general-purpose foundation models, with much lower per-token inference costs. In the cat-and-mouse game of cybersecurity, we believe Corma’s vertical integration and “sovereign AI” approach will win. Cost matters (always-on inference costs can rack up quickly). Owning the model weights matters (they aren’t subject to restrictions on cybersecurity-related usage set by the closed model labs). And specialization and inference speed really matter (fastest to protect against a new threat wins). Corma’s foundation model is deployed and productized as an agentic Security Workforce. These workers operate across different security tools and take on roles spanning the entire security organization: from security operations and identity management to cloud and network security and beyond. They are on the job at Fortune 500 companies and large enterprises across healthcare, finance, critical infrastructure, retail and more. Corma’s foundation model powers agents that complete defensive work end to end. We spoke to one CISO whose Corma agent notified him of a pending attack through his Garmin watch while he was on a walk with his dog in the evening; with one confirmation, the agent was able to shut the attacker down, all while he was still walking. In another instance, within its first hour on the job, Corma uncovered, contained and remediated an active attacker campaign inside a customer’s network that their security team had missed for 52 days. Training frontier foundation models for defensive cybersecurity requires world-class hackers and world-class researchers – almost no company on earth has both. Alon is personally one of the most elite hackers in the world, and has assembled a cohesive and interdisciplinary team of hackers and researchers that is hill-climbing on technical challenges and building impressive commercial momentum. We are thrilled to lead Corma’s seed round and to be their partner as they chart new territory in what is sure to be one of the most dynamic races in AI.