Startup Deep Dive : Appknox — from near-shutdown to $4 million in revenue, self-funded since 2016

In 2018, Appknox had about $30,000 left in the bank and roughly $220,000 in annual revenue — thin enough that its founders quietly discussed what winding the company down would look like. As of 2024, the same company says it is running at close to $4 million in annual recurring revenue, still privately held, and still without a single institutional funding round since 2016.

Appknox is a Bengaluru-born, Singapore-headquartered mobile application security testing company: it scans banking, fintech and e-commerce apps for vulnerabilities before and after they ship. Its story is less about a headline funding round and more about a startup that almost died from chasing the wrong customers, then rebuilt itself around a narrower, harder-to-win one — enterprise security teams at banks and large consumer platforms.

Quick facts

What they do

Appknox sells a platform that finds security flaws in mobile applications before criminals do. Enterprise security and engineering teams — mostly at banks, insurers, fintechs and large consumer apps — feed it a compiled Android or iOS binary, and it runs static analysis on the code, dynamic analysis on real physical devices, and testing of the APIs the app talks to, then hands back a report mapped to frameworks such as OWASP MASVS, PCI-DSS and HIPAA that a compliance officer can actually use. Automated scans are backed by a manual penetration-testing team for the findings that need a human. The company says it works with 300-plus enterprises today, including more than 60 banking, financial-services and insurance clients and more than ten Fortune 500 names, according to its own website.

The origin

Harshit Agarwal and Subho Halder had been friends since 2008, in the same engineering college. By late 2013 they were having a familiar founder conversation: mobile was about to become how most people used the internet, and almost nobody serious was testing whether the apps riding that wave were secure. Subho had spent time at Tata Consultancy Services and moonlighted as a bug-bounty hunter and mobile-security trainer; Harshit had cut his teeth at another startup. Neither had run a company before. In 2014 the pair, joined by Prateek Panda, got into JFDI (The Joyful Frog Digital Incubator) in Singapore, picked up an early $25,000 from the programme, and started building full time. Jungle Ventures and, notably, Google India’s then-head Rajan Anandan came in as early backers later that year, for an undisclosed sum against roughly a fifth of the company. The product itself did not ship commercially until 2016 — two years of building before the company had real revenue to show for it.

The struggle years

The mistake Appknox made was an ordinary one, dressed up as ambition: it raised money early, then let that money tell it a story about traction it did not have. Flush with its 2014 seed and a further pre-Series A round in 2016, the founders chased whatever mobile-first company would take a meeting — mostly small and mid-sized internet startups. Those customers needed a security audit once, ahead of a launch or a funding round, and then largely disappeared. Acquisition cost was high, lifetime value was low, and the flywheel never spun. By 2018, Appknox was down to around $220,000 in annual revenue and roughly $30,000 in the bank — a runway measured in weeks, not months, according to accounts the founders later gave through the Upekkha SaaS growth programme. There was no dramatic villain in the story: no fraud, no lawsuit, no stolen code. Just a company that had built a good product for the wrong customer, and had spent two funding rounds finding that out the hard way.

The turning point

The fix was not a new product. It was a narrower one. Appknox tore up its ideal-customer profile and rebuilt around banks, insurers and large regulated enterprises — organisations that need continuous, repeat security testing across dozens or hundreds of apps, not a one-time check before a launch. That single change in who they sold to reset the unit economics: contracts got bigger, renewals got automatic, and churn, which had quietly killed the SMB-first version of the business, largely disappeared. The company says it grew annual recurring revenue roughly tenfold off that 2018 low, reaching about $1.7 million by April 2022 — a compound growth rate the company has put at around 67% a year over that stretch — and has continued compounding since, all funded from its own cash flow rather than fresh outside capital. The before-and-after is stark: a business with $220,000 in revenue and weeks of runway in 2018 was, by its own account, generating a monthly operating profit of roughly $10,000 four years later.

The money behind it

Appknox has raised very little money by startup standards, and has raised nothing at all in almost a decade:

• 2014 — pre-seed/seed, undisclosed amount: from JFDI (about $25,000) and a separate round from Jungle Ventures with Google India’s Rajan Anandan participating as an angel, for roughly 20% of the company (Business Standard, December 2014).
• 2016 — pre-Series A, reported at Rs 4.35 crore (roughly $640,000-$671,000; sources vary): led by SeedPlus, the early-stage vehicle Jungle Ventures had just launched in Singapore; this was SeedPlus’s first public investment (Inc42, TechCrunch and YourStory, August 2016).
• Since 2016: no further institutional funding round has been reported. The company describes itself as having grown on its own cash flow since the 2018 near-shutdown.

The only valuation on record is the $4.3 million post-money figure from the 2014 seed. There has been no priced round since, so there is no current valuation to report — a contrast with venture-backed peers in cybersecurity that have raised far larger, more frequent rounds.

How it makes money

Appknox runs a straightforward B2B SaaS model, sold on subscription rather than one-off audits:

• Pricing unit: per application under test, with unlimited scans for the term of the plan; customers can also buy volume-based bundles. Appknox does not publish price lists — pricing is quote-based, confirmed across the company’s own pricing and FAQ pages.
• Delivery: primarily direct enterprise sales, supplemented by channel partners — mainly managed security service providers — across Latin America, the Gulf and Southeast Asia (StartupTalky).
• Deal size: the founder has cited an average contract value in the $7,000-$20,000 range per year, with customer acquisition cost of roughly $7,000 and a payback period of eight to nine months, as of an April 2022 interview — figures that are company-stated, not audited.
• Largest account: the founder named Unilever as its biggest customer, reportedly paying more than $250,000 a year to cover around 600 apps — again company-stated.
• The part people get wrong: the product is not sold as a one-time compliance checkbox. The margin sits in renewal — a bank or insurer that tests continuously across its app portfolio is a recurring account, whereas the SMB customers Appknox originally chased treated it as a single pre-launch expense, which is exactly why that version of the business nearly failed.

The numbers

Appknox does not publish audited financial statements, and its Indian subsidiary’s Ministry of Corporate Affairs filings are only available to the public in wide disclosure bands rather than exact figures. The clearest picture comes from annual recurring revenue (ARR) the founder has stated in interviews, which should be read as company-stated rather than audited:

On the regulatory side, XYSec Labs Private Limited — the Bengaluru entity through which Appknox operates in India — showed revenue within a Rs 10-50 crore band for the year ended 31 March 2025, per its MCA filing as compiled by Tofler. For the year ended 31 March 2021, the same filings show EBITDA up 35.7% and net profit up 34.6% year-on-year, with net worth up 44.1%. Tofler’s free disclosure does not release the underlying rupee amounts, so these are directional, filing-sourced data points rather than a precise profit-and-loss line.

Where the money comes from

Appknox does not publish a revenue split by geography or vertical, but its disclosed customer base points to a concentration in regulated, security-conscious sectors:

• Vertical mix: more than 60 of its 300-plus enterprise customers are in banking, financial services and insurance — roughly a fifth of its named customer base (company website).
• Marquee accounts: more than ten Fortune 500 companies are customers, and the founder has named consumer-goods giant Unilever as its single largest account by contract value (company website; founder interview).
• Geographic reach: direct sales out of Bengaluru and Singapore, with channel partners extending coverage into Latin America, the Gulf Cooperation Council states and Southeast Asia (StartupTalky).
• The surprise: a company built in Bengaluru now does a meaningful share of its go-to-market outside India entirely — its 2025 and 2026 product launches were unveiled at RSA Conference in San Francisco and GISEC in Dubai, not in India, and its most recent partnership (with blockchain-security firm CredShields, announced 24 September 2025) is explicitly framed around the US and Gulf fintech markets rather than the domestic one.

The risks

• No fresh institutional capital since 2016: the company has grown on its own cash flow for close to a decade. That discipline is also a constraint — well-funded rivals in adjacent categories, such as runtime mobile-threat-defence player Zimperium, have raised far larger rounds, giving them more room to spend on sales, marketing and acquisitions than a self-funded competitor can match.
• Customer concentration at the top: the founder’s own figures imply a single account, Unilever, could account for a high single-digit percentage of total ARR at the $4 million 2024 level ($250,000-plus out of roughly $4 million). Losing or renegotiating one large enterprise contract would be felt disproportionately.
• A crowded, overlapping category: mobile application security testing now includes NowSecure, Zimperium, Data Theorem, Oversecured, Guardsquare and the open-source MobSF, several of which compete directly on pre-release binary scanning depth — the same ground Appknox occupies. Differentiation increasingly rests on newer layers such as AI-assisted vulnerability triage (its own KnoxIQ, launched April 2026) and post-launch app-store monitoring (Storeknox, launched April 2025), both of which are new enough that their commercial traction is not yet independently verifiable.

The takeaway

The lesson in Appknox’s story is not about the product — mobile security testing is a real and growing need, and that was true in 2014 as much as it is now. It is about who you sell a good product to. Two funding rounds and four years of building could not save a company that kept signing customers who only needed it once. What did save it was choosing a smaller, harder-to-close, but far stickier customer: the enterprise security team that has to test continuously, forever, because the apps and the regulations around them never stop changing. A founder who finds that the fundraising and the hiring feel easier than the renewals should probably worry more about the renewals.

Frequently asked questions

What does Appknox actually sell?

A subscription platform that scans mobile apps (Android and iOS) for security vulnerabilities using static analysis, dynamic analysis on real devices, and API testing, backed by manual penetration testing, mapped to compliance frameworks such as OWASP MASVS, PCI-DSS and HIPAA.

Who founded Appknox and when?

Harshit Agarwal, Subho Halder and Prateek Panda founded it in 2014 in Bengaluru, developing the product through Singapore’s JFDI accelerator before commercially launching in 2016.

How much funding has Appknox raised?

Very little: an undisclosed 2014 seed round from Jungle Ventures and angel investor Rajan Anandan, plus roughly $25,000 from JFDI, followed by a 2016 pre-Series A reported at Rs 4.35 crore (about $640,000-$671,000, reports vary). No institutional round has been reported since 2016.

Is Appknox profitable?

The company describes itself as profitable and self-funded since a near-shutdown in 2018, citing a monthly operating profit of roughly $10,000 as of April 2022; it has not published audited profit figures for more recent years.

Is Appknox listed on any stock exchange?

No. Appknox is privately held, with no IPO and no public listing, and its only disclosed valuation — $4.3 million — dates back to its 2014 seed round.

Sources

Figures are as of September 2026. Currency converted at $1 ≈ ₹96.0 as of 18 September 2026 (Trading Economics).

• Business Standard, “Jungle Ventures, Google’s Anandan in talks to invest in startup firm Appknox,” December 2014
• Business Standard, “Mobile security startup Appknox raises Rs 4.35 cr,” August 2016
• Inc42, “Mobile Security Startup Appknox Raises $671K In Pre Series A To Expand In Southeast Asia Market,” August 2016
• YourStory, “Appknox raises funding,” August 2016
• TechCrunch, “Mobile security startup Appknox lands funding to focus on Southeast Asia,” August 2016
• Getlatka, “Appknox Revenue: $4M Est. ARR, $4.3M Valuation” (founder interview with revenue, employee and customer figures), accessed September 2026
• StartupTalky, “Appknox – Mobile App Security | Founders | Business Model,” accessed September 2026
• Appknox, “About Appknox” (company website), accessed September 2026
• Tofler, “Xysec Labs Private Limited” MCA-sourced company financials, accessed September 2026
• PR Newswire, “Appknox Launches Storeknox, Revolutionizes Mobile App Security with Continuous Store Monitoring,” April 2025
• SiliconANGLE, “Appknox launches KnoxIQ to prioritize real-world exploitability in AI-driven application security,” April 2026
• PR Newswire / Morningstar, “Appknox and CredShields Partner to Deliver Unified Security Across Mobile and Web3 Ecosystems,” September 2025

Found an error? Write to us and we’ll correct it in the open, dated, on the piece.