- Tel Aviv-based Corma secured $60 million in seed funding from Sequoia Capital on August 10, 2026, to develop a foundation model for defensive cybersecurity.
- Corma’s internal simulations show AI attackers breach systems in about nine of ten attempts, while existing AI defenders detect roughly one in ten threats, the gap its agents are built to close.
- The company reports its deployed agents cut threat-response times by more than 94% and expanded security coverage 15 times in customer deployments, though independent validation has not been cited.
Sequoia Capital led a $60 million seed round for Corma, a Tel Aviv and San Francisco startup building a foundation model for defensive cybersecurity, with Khosla Ventures and Coatue joining on August 10, 2026. That is a large seed for a company that has been shipping for only weeks, and the size of the bet reflects a specific, uncomfortable calculation about where AI-driven attacks are heading.
The Attacker’s Speed Advantage
The asymmetry is stark. Corma’s internal simulations show AI attackers breach target systems in about nine of ten attempts; existing AI-based defenders detect roughly one in ten threats. Human analysts triaging alerts cannot match the speed at which an autonomous attacker can pivot, escalate and exfiltrate. That gap is Corma’s stated rationale for building a defence-native model rather than bolting security capability onto a general-purpose LLM.
What Corma Built
Founded in 2025 by AI researchers and veterans of Israel’s Unit 8200, Corma trains its foundation model on security-specific data: logs, audit trails and pattern libraries, not general code corpora. The distinction matters for inference quality, a model trained on security telemetry produces different signal correlations than one fine-tuned from a general-purpose base.
The product deploys autonomous agents across an organisation’s existing security tooling. They ingest security data at volume, correlate signals across tools and respond to multi-stage attack campaigns continuously, without waiting for a human to triage each alert. Builders integrating agentic workflows into SOC environments will recognise the pattern: it sits closer to an autonomous agent layer over existing infrastructure than a point solution replacement, similar in architecture to the approaches covered in our agent interoperability work.
Early Numbers
Corma has already deployed to Fortune 100 and Fortune 500 customers across healthcare, financial services, energy and retail. The company reports threat-response times down by more than 94% and security coverage expanded 15 times across those deployments, and says its agents have surfaced multi-stage attack campaigns that would have gone undetected by existing tooling. These figures come from Corma’s own testing; independent validation has not been cited.
Why the Round Is This Size
The bet is that SOC teams will need a purpose-built agentic layer, and that adapting general-purpose AI or incrementally improving existing SIEM platforms will not close the detection gap fast enough. Sequoia’s framing ties the raise directly to the speed advantage AI gives attackers, with Corma’s model trained for the complexity of real-world intrusions rather than lab scenarios. Whether the market prices this as a standalone frontier or incumbents absorb the capability is still open, Corma is early enough that both outcomes remain plausible. The concentration of AI venture capital into a small number of foundation-model bets makes a $60 million seed less anomalous than it would have been two years ago.
Regulatory Exposure
Autonomous AI agents making real-time decisions in hospitals, banks and energy infrastructure will draw regulatory attention. Accountability frameworks for AI-driven security decisions do not yet exist at scale, and transparency requirements for automated response actions in critical sectors are still being worked out across jurisdictions. Corma’s deployments in regulated industries put it early in the path of whatever those frameworks become. The EU AI Act already shaping how AI developers document high-risk deployments, is the most immediate regulatory pressure on any company operating in this space.
What the Capital Funds
Corma plans to use the raise to expand training data and model scale, and to hire across defensive security, AI research and operations. The Unit 8200 founding team gives it a recruiting profile that skews toward practitioners with applied military-grade security experience, a talent pipeline that is genuinely difficult to replicate quickly.
