Runtime Ventures

AiStrike has been named a Leader in the IDC MarketScape: Worldwide Standalone AI SOC Platforms 2026 Vendor Assessment. Attackers are using AI to move faster than security teams can respond. More analysts and more tools won’t close that gap. We built AiStrike on a simple belief: AI threats need AI defense. The SOC shouldn’t just react faster. It should get ahead of attacks and get stronger with every investigation. We believe this recognition reflects that vision: security operations that are proactive instead of reactive, that adapt instead of standing still, and that keep people in control. Thank you to the customers and partners who pushed us, tested us, and built this with us. 👉 Download the IDC MarketScape excerpt: https://lnkd.in/ef32gmDE SOURCE: “"IDC MarketScape: Worldwide Standalone AI SOC Platforms 2026 Vendor Assessment”, [September 2026], IDC #US54127026 #AISOC #Cybersecurity #SecurityOperations #AgenticAI #AiStrike

We had an incredible time hosting our annual Founders and Friends party this year at Hacker Summer Camp in Vegas. Bringing together so many founders, security leaders, and investors always reminds us just how special this community is. Thanks to everyone who joined us and made the evening such a memorable one. Until next year!

Today we’re excited to announce our seed investment in Bloom Security! The enterprise endpoint is changing. AI agents, MCP servers, browser extensions, IDE plugins, and third-party code are becoming central to how employees work while creating entirely new categories of risk that traditional endpoint tools weren’t built to address. Bloom is rebuilding endpoint security for the AI era. Its platform gives security teams deep visibility into everything running on the endpoint, assesses risk in context, and provides granular enforcement and one click remediation across AI tools, agents, applications, plugins, code libraries, and local data. Welcome to the Runtime Ventures family, Bloom Security!

📈 StepSecurity grew ARR more than 5x in 2024, more than 5x again in 2025, and the first half of 2026 just outpaced both. We closed roughly 7x more new customers in H1 2026 than in H1 2025, including the largest contracts in our history. Many customers expanded before their first renewal because they saw value within weeks. 🏢 Multiple Fortune 500 companies now run StepSecurity. Mercor, Dexcom, Miro, Circle, Mercari, Cresta, Kong, Utility Warehouse, Paddle, and many others are customers we can name publicly. And here is the proof point I am most proud of. Security companies chose StepSecurity to protect their own development infrastructure, including Chainguard, Checkmarx, Contrast Security, and XBOW. 🚨 Why is this happening now? A supply chain attack used to require a nation state team. Today one person with an AI coding agent can pull it off. Attackers no longer go after hardened production systems. They go after developer machines, code repositories, package registries, and CI/CD pipelines. Our threat intelligence team discovered several supply chain compromises such as the Axios npm compromise, the Shai-Hulud attack on TanStack, and the Nx Console breach. That research drove more than 100 media stories and citations in official CISA alerts. 🧩 Point solutions keep losing this fight. Malicious code moves through five stages: from a public registry, to a developer laptop, to a code repository, to a CI/CD pipeline, to your release. StepSecurity is end to end supply chain security with a control at every hop. Secure Registry screens packages before they reach dev machines or CI/CD. Dev Machine Guard protects laptops. Repo controls block use of compromised packages. Harden-Runner secures CI/CD at runtime on Linux, macOS, and Windows. If one layer misses, the next one catches. 🙏 Thank you to our customers, to the community, and to a small but mighty StepSecurity team. For the full mid-year update, refer to our blog post (link in comments).

Every time a new CVE drops or a threat report gets published, detection teams go through the same motion. Read the intel Find logs Pull out IOCs Map TTPs Figure out what the heck matters Write the detections Tune them for their environment Most of that work happens in silos 😢 Today, we’re launching Intel Exchange for the detections.ai community. Community members can now create and share reports that connect the dots between threat research, CVE analysis, MITRE, logs, IOCs, detection context, and working detections across formats like Sigma, Suricata, CQL, KQL, SPL, YARA, YARA-L, S1QL, and more. We started with a simple goal - how can we help defenders move faster from “what happened?” to “what can we detect?” That’s the piece I’m most excited about. Intel Exchange is not just about sharing intel. It’s about sharing the work behind the detections too. The context, evidence, logs, decisions, mapping, logic, AI prompts, etc. The things that help another team understand, adapt, and improve the work for their own environment. Oh, and you might notice detections.ai looks a little different 😎 We’ve rolled out a new look and feel that better reflects where we’re headed as a community and platform. Same mission and team with the same belief - detection engineering gets better when we build together. Intel Exchange is live now for everyone! And we’re just getting started. Read more about the launch here - https://lnkd.in/gFjvvhjw