ShiftLeft, which offers security-as-a-service software that checks code before runtime for vulnerabilities, raises $20M Series B
Kyle Wiggers / VentureBeat :
Context & Ripple Effects
ShiftLeft's $20M Series B lands early in what the related coverage shows becoming a multi-year funding run for application-layer security tooling. Its pitch — scanning code for vulnerabilities before runtime — sits at the start of a pipeline that later includes Salt Security's $30M Series B for API vulnerability discovery and Legit Security's $40M Series B for finding vulnerabilities from source code.
The pattern across these rounds is consistent: investors keep backing companies whose product intervenes at different points before an app is exploited — static code analysis (ShiftLeft), API discovery (Salt), dynamic testing (Bright Security), and SaaS-tool monitoring (Wing Security) — rather than one winner taking the category.
First-order effects
- ShiftLeft gains $20M to scale its pre-runtime code-scanning service against rivals like Salt Security and Pathlock, which raised comparable rounds for overlapping app-security territory.
Second-order effects
- Enterprise buyers face a widening menu of point solutions across the pre-exploitation window — static scanning, API detection, dynamic testing — pushing vendors toward bundling or integration to avoid being a single checkbox in the stack.
Third-order effects
- If the cadence holds through Legit Security's larger 2023 round, application security consolidates from scattered point tools into platforms covering the full development lifecycle, with capital favoring vendors that span multiple stages rather than one scan type.
The trend: Venture capital is systematically funding shift-left application security, with each round since ShiftLeft's Series B targeting a different pre-runtime intervention point in the development pipeline.