Devin Finzer

CRV Security: Request for Startups I never know if this actually works for our friends over at YC but figured we'd try. Here's what we want to fund in 2026! 1. Golden Artifacts: Think Chainguard but more broad. Artifact attestation exists for open source. Almost nothing exists for internal software — especially the vibe-coded tooling now running in production. We want the company building cryptographic proof of secure software delivered from secure artifacts: who built it, how, and whether it was reviewed. If more things are being yeeted into the world via Claude Code (myself included), this feels like an issue. 2. MCP & Agentic Security: Agents are getting real credentials and taking real actions. The security posture of most orgs around this is basically zero. That changes fast. You'd never give an employee hardcoded API keys or write access to your email without supervision/trust. Why give it to agents? 3. AI Governance: Boards are asking CISOs to account for AI risk. CISOs have no good answer other than "Palo has a module" 4. Next-Gen Endpoint: CrowdStrike was built for a world of static binaries and human operators. AI workloads, cloud-native infra, and AI-assisted attackers need a new architecture. The category is ready to be reinvented. 5. Networking in the AI Era: Zero trust was designed for humans. What does network security look like when the entity requesting access is an agent? Nobody's really solved this. 6. Email Security + Next-Gen Phishing: LLMs have made spear phishing infinitely scalable. I've never truly understood why Abnormal and KnowBe4 aren't one company. Maybe this time it's different. 7. Frontier Security Lab: We'd back a credible, well-staffed lab focused entirely on red-teaming models and setting the evidentiary standard the industry needs as LLM built apps become the norm. 8. Dependency Security: That Actually Remediates Malicious and vulnerable dependencies are a top attack vector. The tooling is mostly noise — scanners that don't close the loop. The winner here ships fixes, not just alerts. 9. Critical Infrastructure Cyber: Data centers, satellites, power grids, undersea cables. The physical backbone of the internet is increasingly exposed and wildly under-defended. We have data centers in space, for God's sake. Surely we need better cyber for critical infrastructure? 10. PAM for the Modern Era Legacy: PAM was built for static roles, human users, on-prem directories. Cyberark was founded in 1999.....Agents, ephemeral workloads, and cloud-native infra have broken all of those assumptions. Is anyone rebuilding this from scratch? If you're building in any of these areas — or something we haven't thought of — reach out. james@crv.com

452

49 Comments

Three things: 1. You can't document patient encounters with language. That makes AI useless. Language to document patient encounter is exactly like putting paper behind the screen of the monitor. The only viable solution is to use discrete values, like you might find in a database and pick out of a list box. Discrete values allow the user to relate symptoms to lab results to diagnoses to treatments to outcomes. Further, it allows you to search for symptoms and read cases with successful outcomes related to those symptoms. Can't do that with language. Before you say you can, just don't. You can't. 2. You can't have specialties There are 130+ specialties. Epic, et al., writes a new program for each one. That is one reason why an installation costs $1.2 BILLION. Find a nomenclature that contains all the terms you need and use that. We at Sentia use the UMLS. Look it up. that means we have ONE page to document care, and it is universal for all specialties. Don't argue, Judy, you're wrong. Criminally wrong. 3. Your EMR is NOT a billing system. your EMR is an ELECTRONIC MEDICAL RECORDS system. Nowhere in there is billing even mentioned. If you have discrete values, you can also relate procedures to coverage and automate the entire health insurance industry. This is what Sentia has done. Automating insurance cuts over half the costs. This gives the lie to the entire AI movement: people who don't understand the problem doing dumb things that muddy the waters, so the real solutions get drowned out. http://sentiahealth.com

3