Startup Deep Dive : ArmorCode — it unifies hundreds of scanners and sells none of its own

ArmorCode has raised $81 million (about ₹778 crore) across four rounds, integrates more than 285 different security tools, and has processed billions of security findings for Fortune 500 buyers — yet it has never shipped a scanner of its own. That is the contradiction the company was built on. Before writing a line of product, founder Nikhil Gupta says he interviewed more than 200 security leaders, and the message came back almost unanimously: the industry did not need one more scanner. It needed something to make sense of the ones it already had.

So ArmorCode sells the opposite of a scanner. It is a vendor-neutral platform that ingests the output of everyone else’s tools — code scanners, cloud scanners, infrastructure scanners — correlates the noise, and surfaces the handful of issues worth fixing first. The bet has attracted backers from HighlandX to Ballistic Ventures, a board seat for a former Google Cloud and Goldman Sachs security chief, and an India engineering base registered in Bengaluru. What it has not produced, notably, is a single disclosed valuation or a line of audited group revenue. This piece walks through what ArmorCode actually is, where the money came from, how it earns, and where the risks sit — using only figures traceable to sources opened for this article.

Quick facts

What ArmorCode does

ArmorCode sells software to the people responsible for keeping an organisation’s applications and infrastructure secure. The problem it addresses is fragmentation: a large enterprise typically runs dozens of separate security scanners, each producing its own list of alerts, with no shared view of what actually matters. ArmorCode’s platform sits above all of them.

• Category: Application Security Posture Management (ASPM), which the company has since broadened to “unified exposure management” and, in its March 2026 messaging, “AI Exposure Management” (AIEM).
• Core function: ingests findings from more than 285 different security tools (per The Brand Hopper’s profile), de-duplicates and correlates them, and prioritises the small set of issues that carry real risk.
• Scale of data: the company said it had processed “4 billion and counting” findings as of its December 2023 Series B announcement (NGP Capital), and described handling “billions and billions of findings” across 240-plus integrated scanners by its July 2024 fourth-anniversary blog.
• Buyers: Fortune 500, Fortune 1000 and Global 2000 security and engineering teams. Named customers cited in company and press materials include athenahealth, whose engineering director is quoted in the Series B release.
• What it is not: ArmorCode does not sell a scanner. Its pitch is deliberately vendor-neutral — it makes other vendors’ tools more useful rather than competing with them at the scan layer.

The origin: 200 interviews and one answer

ArmorCode was founded in July 2020, at the height of the pandemic, by Nikhil Gupta and Anant Misra. Gupta was not a first-time founder. He had previously been co-founder and CEO of Avid Secure, a cloud security company acquired by Sophos in 2019, and describes more than 25 years in technology across several security ventures. Misra, his co-founder and chief technology officer, is a long-time software engineering leader. The pairing matters: one had sold a security company, the other could build the platform.

The founding insight came from listening rather than coding. Gupta has recounted interviewing more than 200 security leaders before settling on the product. Two facts kept surfacing. First, organisations were shipping software constantly — sometimes many times a day — and leaning heavily on open-source components, so the attack surface was expanding faster than any team could track. Second, the tools meant to secure all of this were multiplying and fragmenting; every scanner added more alerts but no more clarity. The leaders Gupta spoke to did not ask for a better scanner. They asked for something that could sit on top of every scanner they already owned and tell them what to fix first. That answer became ArmorCode’s entire reason to exist, and it is why the company’s identity is defined as much by what it refuses to build as by what it ships.

The struggle years: an over-tooled market

ArmorCode has no public near-death, founder ouster or fire-sale in its record — it has been a steadily funded company since 2022. Its genuine difficulty was different and, in a crowded market, no less real: it had to convince buyers that a company selling no scanner of its own deserved a line in an already bloated security budget.

Consider the environment it entered. By its own account the platform would eventually plug into more than 285 tools; that number is also a measure of how saturated the market already was when ArmorCode launched. A security buyer in 2020 and 2021 had reason to be sceptical of yet another dashboard promising to unify the chaos. The company also had to define a category as it went. It first described itself around “AppSecOps,” then rode the rise of the “ASPM” label as analysts formalised it, and by early 2026 was repositioning again toward “exposure management” and “AI Exposure Management.” Each shift is a bet that the market will follow the new framing — and a risk if it does not. The struggle, in other words, was not survival but standing out: earning trust as the neutral referee in a room full of vendors, and repeatedly re-explaining what problem it solved as the language of the industry moved underneath it.

The turning point: the Series B

The clearest inflection was the $40 million Series B, announced on 4 December 2023 and led by HighlandX, with NGP Capital, Ballistic Ventures, Sierra Ventures and Cervin Ventures joining. It roughly doubled the company’s lifetime capital and put a marquee growth investor behind the thesis.

The numbers on either side of that round tell the story. Before it, ArmorCode had raised about $25 million and was still, in venture terms, an early-stage company proving a category. With the Series B, total capital reached $65 million; the company reported annual recurring revenue growth of more than 400% year-over-year, said roughly a quarter of its customer base was Fortune 500, and pointed to over 4 billion findings processed across 200-plus integrated tools. It also signalled expansion — more than 20% headcount growth and a push into Europe. In one round the company moved from proving it could sell a novel idea to scaling a business that large enterprises were already paying for. The strategic $16 million round in March 2026, alongside a board seat for former Google Cloud and Goldman Sachs security chief Phil Venables, was the confirmation; the Series B was the pivot.

The money behind it

ArmorCode has raised $81 million (about ₹778 crore at $1 ≈ ₹96.0) across four disclosed rounds, without ever publicly stating a valuation. The rounds, in order:

• Seed — about $11 million, closed January 2022: led by Cervin Ventures, with Sierra Ventures, Tau Ventures and several cybersecurity angels (DarkReading, PRNewswire).
• Series A — $14 million, 16 November 2022: led by Ballistic Ventures, with Sierra Ventures, Cervin Ventures and angels including John Donovan (former AT&T Communications CEO), Oliver Friedrichs (Phantom Cyber founder), John M. Jack and Tom Reilly (former Cloudera and ArcSight CEO). This took total funding to about $25 million (SecurityWeek, Cervin Ventures, PRNewswire).
• Series B — $40 million (about ₹384 crore), 4 December 2023: led by HighlandX, with NGP Capital, Ballistic Ventures, Sierra Ventures and Cervin Ventures; lifetime funding reached $65 million (Businesswire, NGP Capital, Channel Futures).
• Strategic round — $16 million (about ₹154 crore), announced 3 March 2026: led by Cheyenne Ventures, with Ballistic Ventures, Highland Capital, Sierra Ventures, NGP Capital, Harmonic Growth Partners, Tau Ventures and Cervin Ventures; total funding reached $81 million (SecurityWeek, Yahoo Finance, VCA Online).

What each backer changed, in brief:

• Cervin Ventures seeded the company and stayed in through every subsequent round.
• Ballistic Ventures led the Series A and later placed Phil Venables — a Ballistic venture partner — on ArmorCode’s board in March 2026.
• HighlandX / Highland Capital led the growth-stage Series B, the round that scaled the business.
• Cheyenne Ventures led the 2026 strategic round aimed at the company’s agentic-AI expansion.

No valuation figure appears in any source opened for this article. Aggregators such as PitchBook and Tracxn maintain profile pages, but their valuation and revenue estimates sit behind paywalls and were not accessible here, so no valuation is asserted.

How it makes money

ArmorCode is a subscription software business. The revenue mechanics, drawn from The Brand Hopper’s profile and the company’s own descriptions:

• Primary revenue: recurring subscription fees for the platform, billed annually and scaled by usage or seat count — the classic enterprise SaaS model.
• Delivery: cloud-hosted or on-premises, aimed at large regulated enterprises that need continuous visibility across applications, infrastructure, cloud and, increasingly, AI systems.
• Go-to-market: a “channel-first” approach — partnering with value-added resellers, global system integrators and managed security providers rather than relying on direct sales alone. ArmorCode was named a CRN 2025 Stellar Startup, a channel-focused recognition.
• Supplementary revenue: professional services plus training and certification fees layered on top of subscriptions.
• Retention economics: The Brand Hopper cites a net revenue retention rate of about 130%, meaning existing customers on average spend more each year — the metric investors care most about in SaaS.

The part people get wrong: because ArmorCode is vendor-neutral, some assume it competes with the scanners it integrates. It does not. Its margin comes from being the layer that makes those tools collectively useful — the more scanners a customer runs, the more valuable a neutral aggregator becomes. Its moat is breadth of integration (285-plus tools) and the workflow lock-in that follows once a security team runs its remediation process through the platform.

The numbers

ArmorCode is a privately held US company and does not file public group financials, so there is no audited three-year revenue-and-profit series to reproduce. Rather than invent one, the table below sets out what is actually disclosed or independently estimated, with each figure’s source and period. Group revenue and profit/loss are marked “not disclosed” where no opened source provides them.

Two cautions on these figures. The revenue and headcount numbers for 2022–2023 are GetLatka estimates, which that site describes as estimates rather than filed accounts; GetLatka also carries an apparent error stating ArmorCode is “no longer independent,” which the March 2026 independent funding round contradicts, so that claim is disregarded. The growth rates — “400%+ YoY” (December 2023) and “doubled year over year” (March 2026) — are company-stated in funding announcements and are not audited. A reported ₹12.26 crore FY23 figure for the India subsidiary appeared only in a search snippet from a page that could not be opened, and would in any case reflect the India arm’s cost-plus service billing rather than group revenue, so it is excluded here.

Where the money comes from

ArmorCode does not publish a formal segment or geography split, but several structural splits are visible from disclosed facts:

• By customer tier: the enterprise top-end dominates. As of December 2023 roughly a quarter of the customer base was Fortune 500; by March 2026 the company said nearly 80% of its Fortune 500 and Fortune 1000 customers were driving its push into AI-security capabilities.
• By function sold: recurring platform subscriptions are the core, supplemented by professional services and training/certification fees.
• By geography of the business: the commercial base is US-led (Palo Alto headquarters), with stated expansion into Europe funded by the Series B.
• By geography of the build: engineering is anchored in India. ArmorCode India Private Limited is registered in Bengaluru (WeWork Embassy TechVillage, Bellandur), incorporated in late 2020, with Praneet Khare as VP of Engineering and Managing Director, India; a Gurgaon presence is also cited in company listings.

The surprise sits in that last point. ArmorCode is marketed as a Palo Alto security company, but its founder has publicly credited the India team with a large share of the company’s growth, and the India entity is a subsidiary of the US parent formed within months of founding. The engineering centre of gravity for a fast-scaling American security vendor is, in practice, substantially Indian — a pattern common to the sector but rarely front-and-centre in the marketing.

The risks

• A crowded, consolidating category. ASPM and exposure management are contested by well-funded players — Wiz, Snyk, Legit Security, Palo Alto Networks (Cortex), Tenable and GitLab among those cited in ArmorCode’s competitive set. Platform giants can bundle ASPM into broader suites and squeeze a standalone specialist on price.
• Integration dependence. ArmorCode’s value rests on ingesting 285-plus third-party tools. If those vendors change APIs, restrict data access, or build competing aggregation themselves, the neutral-layer advantage erodes. Being vendor-neutral is a strength only for as long as the vendors cooperate.
• Category-language churn and AI framing. The company has repositioned from “AppSecOps” to “ASPM” to “exposure management” to “AI Exposure Management” in under six years. Each pivot chases where the market is heading, but repeated re-labelling risks confusing buyers and invites the charge of “AI-washing” if the agentic-AI capabilities do not match the marketing.
• Opacity and the funding environment. With no disclosed valuation, no audited group revenue and a $16 million 2026 round that is modest relative to the $40 million Series B, outsiders cannot verify the growth story beyond the company’s own “doubling” claim. A tougher private-capital market would test a business that has not demonstrated a public path to profitability.

The takeaway

ArmorCode’s most transferable lesson is that a durable product can be defined by what you refuse to build. In a market flooded with scanners, the founders resisted the obvious move — shipping a marginally better scanner — and instead sold the one thing 200 interviews said was missing: a neutral layer that made every existing tool worth more. That discipline is harder than it sounds, because the temptation in a hot category is to add features, not to stay narrow. The pattern for founders is to find the job the incumbents are all failing at collectively, rather than the job any one of them does slightly imperfectly. ArmorCode’s second lesson is quieter and unfinished: raising $81 million while disclosing no valuation and no group revenue can carry a company a long way on trust and traction, but the same opacity that protects a private company on the way up becomes the question every buyer and future investor eventually asks — what, exactly, are the numbers.

Frequently asked questions

Who founded ArmorCode and when?

ArmorCode was founded in July 2020 by Nikhil Gupta, who is co-founder and CEO, and Anant Misra, co-founder and CTO. Gupta had previously co-founded and led Avid Secure, acquired by Sophos in 2019. Mark Lambert, sometimes associated with the company, is its Chief Product Officer rather than a founder.

How much has ArmorCode raised, and from whom?

ArmorCode has raised $81 million (about ₹778 crore) across a roughly $11 million seed (January 2022, Cervin-led), a $14 million Series A (November 2022, Ballistic-led), a $40 million Series B (December 2023, HighlandX-led) and a $16 million strategic round (March 2026, Cheyenne Ventures-led). Backers include Cervin, Ballistic, HighlandX/Highland Capital, Sierra Ventures, NGP Capital and Tau Ventures.

What is ArmorCode’s valuation?

ArmorCode has not publicly disclosed a valuation in any funding announcement, and no valuation figure was available in the sources opened for this article. Estimates on paywalled aggregator sites were not accessible, so no valuation is asserted here.

Is ArmorCode’s team based in India?

Yes, substantially. Its engineering arm, ArmorCode India Private Limited, is registered in Bengaluru and was incorporated in late 2020; Praneet Khare leads engineering in India. Company listings also cite a Gurgaon presence. The US parent is headquartered in Palo Alto, California. Note that public reports place the India base in Bengaluru rather than Pune.

What does ArmorCode actually sell?

It sells a subscription platform for Application Security Posture Management and unified exposure management. Rather than scanning code or cloud itself, it ingests the output of more than 285 other security tools, correlates the findings, and prioritises the most critical risks so security teams can fix what matters first.

Sources

Figures are as of September 2026. Currency converted at $1 ≈ ₹96.0 as of 18 September 2026 (Trading Economics).

• Businesswire — ArmorCode Raises $40 Million in Series B Funding (December 2023)
• NGP Capital — ArmorCode raises $40 million in Series B funding (December 2023)
• Channel Futures — ArmorCode Closes $40 Million Series B Funding Round (December 2023)
• SecurityWeek — AppSec Startup ArmorCode Raises $14 Million (November 2022)
• SecurityWeek — ArmorCode Raises $16 Million for Exposure Management Platform (March 2026)
• Yahoo Finance / ArmorCode — ArmorCode Doubles Growth, Boosts AI Security Governance with New Funding and Board Appointment (March 2026)
• VCA Online — ArmorCode Doubles Growth, New Funding and Board Appointment (March 2026)
• Cervin Ventures — ArmorCode Raises $14M in Series A Funding (November 2022)
• DarkReading / PRNewswire — ArmorCode Closes $11 Million Seed Funding Round (January 2022)
• ArmorCode blog — ArmorCode Turns 4: A Message from CEO Nikhil Gupta (July 2024)
• The Brand Hopper — ArmorCode: Founders, Business Model, Funding & Competitors (2024)
• GetLatka — ArmorCode revenue and headcount estimates (2023, self-described estimates)
• Instafinancials / ZaubaCorp — ArmorCode India Private Limited, CIN U72900KA2020FTC141372 (RoC Bangalore records)
• ArmorCode — Recognized as a CRN 2025 Stellar Startup (2025)

Found an error? Write to us and we’ll correct it in the open, dated, on the piece.