Oligo Raises $60M as AI Shrinks the Time Between Bug and Exploit

Axios’s August 4 deals roundup listed a $60 million raise by Israeli runtime-security company Oligo Security. The participating firms were Ballistic Ventures, Canon Capital, Greenfield Partners, Lightspeed Venture Partners, Red Dot Capital Partners and TLV Partners.

In its August 4 financing release, Oligo put total funding at $140 million and said the capital would support product development and global go-to-market expansion; it also claimed 300% year-over-year revenue growth and described a platform that observes production code execution, prioritizes potentially exploitable vulnerabilities and blocks exploit attempts at the application layer. The growth and product-performance statements are company claims, not independently benchmarked results.

AI is compressing the patch gap

The financing rests on a specific security argument: exploit development can now move faster than an enterprise’s normal remediation process. Even after a patch becomes available, organizations may need time for compatibility testing, change approval, staged deployment and rollback preparation.

Anthropic’s N-day exploit study found that its Mythos Preview model produced a first working exploit in under an hour and ultimately created eight exploits from recent Firefox patches in roughly 12 hours under controlled evaluation conditions. The work does not establish that every disclosed vulnerability will be exploited that quickly, and turning an exploit into a real campaign still requires target discovery, delivery and evasion.

It does support the narrower premise behind Oligo’s pitch: AI can reduce the specialist time needed to convert knowledge of a bug or patch into working exploit components. When that interval contracts, a monthly scanner or standard maintenance window may identify risk without providing protection during the period before a permanent fix reaches every workload.

Four controls answer four different questions

Static inventory, runtime evidence, virtual patching and application-layer blocking are related, but they do not perform the same job. A plain-language decision sequence begins with what software is present, then asks what is executing, whether a temporary restriction is possible and whether malicious behavior can be interrupted.

• Static vulnerability inventory: Is potentially affected software installed? Composition analysis, container scanning and version matching can identify packages associated with known vulnerabilities. That establishes possible exposure, not proof that the vulnerable function is reachable or running in a particular production workload.
• Runtime proof of exploitability: Is the relevant vulnerable code actually executing? Observed execution can help security teams prioritize a smaller set of findings. An unobserved path is not permanently safe, however, because traffic, configuration, feature flags and new releases can change which functions run.
• Virtual patching: Can a compensating control restrict the known exploit path while engineers prepare the code fix? The vulnerable component remains installed, so this control buys remediation time rather than removing the defect.
• Application-layer blocking: Can the security layer interrupt suspicious execution after an exploit attempt reaches the workload? This is an enforcement function, unlike inventory or prioritization, and its operational value depends on coverage, precision and the consequences of blocking legitimate behavior.

The sequence explains why runtime protection complements scanners instead of making them obsolete. Inventory provides breadth across assets; runtime observation adds production context; temporary controls reduce immediate exposure; and patching ultimately removes or updates the vulnerable code.

What investors are backing

The investor thesis is not simply that enterprises need another list of vulnerabilities. It is that the shrinking interval between disclosure and exploitation creates demand for controls that operate inside live applications, where defenders can observe execution and potentially stop a dangerous action before every system has been patched.

That positioning may be particularly relevant for large organizations with heterogeneous environments and formal change-management requirements. A critical update can be technically available while deployment remains incomplete across applications, containers, hosts or cloud workloads. Runtime controls are intended to cover part of that interval, but their effectiveness depends on whether they observe the relevant execution path.

Enforcement also introduces a different risk calculation from passive scanning. Security teams must weigh missed detections against false positives, application compatibility and rollback options. Blocking an operation without interrupting legitimate production traffic is central to the product’s value proposition, but the financing materials provide no independent comparative measurements of latency, precision or availability.

Funding does not settle the product case

The transaction is labeled additional funding rather than a conventional Series C. Publicly available details do not include the security type, investor allocations, governance terms or a post-money valuation. Oligo’s revenue-growth percentage also lacks the underlying revenue figures needed to assess the company’s current scale.

The distinction between runtime protection and permanent remediation remains important. A blocked attempt can reduce immediate risk, but it does not remove the vulnerable dependency, protect an unmonitored environment or guarantee that a different execution path will be covered. Patching therefore remains the durable corrective action.

The financing verifies substantial investor support for Oligo’s runtime-security thesis. What remains unresolved is how the platform performs across varied production environments and whether the company’s claimed growth translates into durable enterprise adoption; independent benchmarks, retention data and fuller transaction terms were not included in the disclosed materials.

Also read:

• Hush Security Raises $30M to Give Every Enterprise AI Agent an Identity
• Cyber Security – It’s Time You Protect You...
• What’s the Difference between Cyber Security and Information Security?