Salt Security, a cybersecurity startup which uses AI and machine learning to protect APIs, raises $20M Series A led by Tenaya Capital
Kyle Wiggers / VentureBeat :
Context & Ripple Effects
This $20M Series A is the opening move in what became one of the faster capital climbs in API security: within two years Salt Security followed it with a $30M Series B led by Sequoia, a round led by Advent International, and ultimately a $140M Series D at a $1.4B valuation that brought total funding to $271M.
The timing is not accidental — the same company's researchers had just disclosed now-patched critical flaws in social sign-in and OAuth implementations affecting Vidio, Grammarly, and Bukalapak, giving the startup both the research credibility and the market evidence for why APIs need dedicated protection rather than generic perimeter tools.
First-order effects
- Tenaya Capital's $20M funds Salt Security's push to turn its AI-based API discovery and vulnerability detection work into a commercial platform, directly off the back of its publicized OAuth and social sign-in findings.
- Enterprises running third-party sign-in flows — the kind exposed in Salt's own Grammarly and Bukalapak research — gain a funded vendor whose product roadmap targets exactly those attack surfaces.
Second-order effects
- Sequoia's subsequent Series B entry validates the category for other investors, and adjacent AI-security plays like Elisity's AI-powered monitoring and access control raise show capital broadening across the security stack, forcing incumbent tool vendors to decide whether to build or buy API-layer capabilities.
- ShiftLeft's earlier $20M Series B for pre-runtime code checking marks the neighboring approach — securing code before it ships versus protecting live APIs — meaning buyers now face competing security-as-a-service pitches at different points in the application lifecycle.
Third-order effects
- If the funding trajectory holds, API security consolidates from a feature inside broader platforms into a standalone budget category, with specialist vendors like Salt reaching unicorn valuations before incumbents respond.
- The pattern points toward security budgets following traffic: as more enterprise functionality moves behind APIs, capital keeps flowing to firms that can discover and defend them autonomously — a shift later echoed by agentic-security entrants such as Way Security's AI-driven IAM automation round.
The trend: Enterprise security spending is migrating to the API layer, where AI-driven detection startups are converting research disclosures into rapidly compounding venture rounds.