Maze

• The scanner vendors whose findings Maze ingests, Wiz among them, can add exploitability reasoning to the tools buyers already own.
• The figure that most flagged vulnerabilities are not exploitable comes from Maze's own announcement material, and no source in the reviewed record measures how often the agents call a finding wrong, so a buyer would have to establish that in a pilot.
• The traction count in the reviewed record, more than ten organizations including two Fortune 200 companies, dates to the June 2025 Series A announcement, so a buyer weighing how widely Maze is deployed today has a vendor figure that is over a year old.
• Maze states it passed ISO 27001 and is in its SOC 2 Type 2 observation window, and its trust center requires an access request, so procurement teams must request access rather than read the attestation themselves.

Maze sells to security and engineering teams that receive more vulnerability findings than they can work through. The company frames the pain as wasted investigation rather than missing detection. The company reports that roughly 90% of the vulnerabilities its agents analyze turn out not to be exploitable once investigated.

That number is Maze's own measurement from its own deployments, which is the limit of the problem evidence in the reviewed record. Press coverage of the Series A carried the same framing, that vulnerability exploitation rose sharply in 2024 while most enterprises fix a fraction of their open vulnerabilities, and it names no study behind those figures. [s17, s10]

Maze runs two product lines on one engine. Maze Cloud triages and remediates CVEs in containers and virtual machines, and Maze Code investigates dependencies and first-party code, building call graphs to trace whether a vulnerable function is reachable and reading code structure to surface the business-logic flaws the vendor says pattern-matching scanners miss. Deployment needs a read-only role in the cloud account or repository, with no sensors to install, and Maze Cloud also connects to a scanner the customer already runs.

Maze points to the engineering it says makes its agents dependable. Maze describes agents trained on domain-specific tasks, several layers of validation that catch errors as the agents work, and routing that picks an expensive model only when a cheaper technique will not do. One of the agents' findings appears outside the vendor's pages. Maze reports that Maze Code found a login-enforcement bug in the open-source Langfuse project, and the Langfuse v3.174.0 release notes carry a matching fix. Maze is the source for the claim that its agents found the bug. No public documentation portal, open-source code, or third-party evaluation of the agents appears in the reviewed record, so a buyer judging how well the agents work has the vendor's description and that one matching fix. [s2, s20, s11, s14, s15]

Maze layers investigation on top of the scanners a customer already runs. Its distinguishing claim is coverage across cloud and code on one engine, so a dependency flaw and the container running it resolve as a single investigation instead of arriving as two tickets from separate tools.

Maze depends on the scanner vendors that could also build what it sells. It reads findings from the scanners a customer already runs, and Wiz, one of those vendors, publishes the integration on its own site. Wiz's customers can find Maze on that page. The page also sets out publicly what ingesting those findings involves. How long that investigation step stays Maze's own is open, so a buyer should read the coverage claim as a head start of unknown length. [s12, s2, s14]

Three customers vouch for Maze by name, with titles and employers attached. Nathan Cooke is an engineering manager for product security at Alloy, Jonathan Mattey is the chief information security officer at Forge, and Ted Kieffer leads information security and risk management at PartsSource. Those quotes describe use rather than intent, and a prospective buyer can approach the people who gave them.

The wider figures are older and vendor-stated, so a buyer weighing Maze's scale today has to discount them. SecurityWeek reported in June 2025 that Maze said early pilots were running inside more than ten organizations including two Fortune 200 companies, and the reviewed record carries no independent confirmation since. The sales channels are easier to verify, because Maze sells through AWS Marketplace with a published list price and Wiz documents the integration from its side. [s1, s18, s9, s13, s12]

Companies House lists four directors of Maze AI Limited. Harry Wetherald and Adrian Jozwik have served since incorporation, Santiago Castiñeira Fernández since May 2024, and Andrew Triedman since June 2025, the Theory Ventures partner whose board seat the Series A announcement described. The founders led product, design, and engineering teams at Tessian, Elastic, and Amazon before starting the company.

What the record does not show is a prior exit or a sustained publication history, the signals that separate a credible operating team from a proven one. The same registry shows the entity was incorporated in October 2023 as Canvas Software Limited and renamed in July 2025. Press coverage dates the founding to 2024, a year after the entity itself began. [s7, s8, s10, s22]

Maze states on both product pages that it has passed its ISO 27001 accreditation and is in its SOC 2 Type 2 observation window. A trust center runs at trust.mazehq.com, and it asks a visitor to request access, so whatever that trust center documents is not open to inspection as of 2026-07-27.

Maze answers the enterprise deployment questions directly. Maze hosts in AWS, offers single-tenant as well as multi-tenant hosting, and says it uses orchestrators such as AWS Bedrock and Google Vertex that keep customer data out of model-provider training. Maze connects through a read-only role rather than software installed in the workload. The fixes the agents produce still reach production through the customer's own pull-request and ticketing paths. [s3, s16, s19, s21]

Add analyzed competitors to compare them side by side with Maze.

Maze sells to security and engineering teams whose scanners produce more findings than the team can work through. Three reference customers speak on the company's site, an engineering manager for product security at Alloy, a chief information security officer at Forge, and a security and risk leader at PartsSource. Each names a title rather than a sector, so the record shows the role Maze sells to and not the industries it sells into.

A buyer cannot tell from the record how many customers Maze has now. In June 2025 the company said pilots were running inside more than ten organizations including two Fortune 200 companies, a floor rather than a count, and no independent source has confirmed either the count or the segment.

Maze Cloud triages and remediates CVEs in containers and virtual machines, and Maze Code investigates dependency and first-party code flaws. The dependency agents build call graphs to trace reachability through the dynamic calls the vendor says a parser gives up on, and the code agents read structure and data flow to reach business-logic flaws rather than matching known patterns.

Maze points to the engineering it says makes its agents reliable. Maze describes agents trained on domain-specific tasks, several validation layers that catch errors as agents work, and routing that reserves an expensive model for the cases that need one. One of the agents' findings appears outside the vendor's own pages. Maze reports that Maze Code found a login-enforcement bug in the open-source Langfuse project, and the Langfuse v3.174.0 release notes carry a matching fix on the email-OTP path. Maze is the source for the claim that its agents found the bug, and its account records that a person then validated the finding and coordinated disclosure.

Maze's product pages ask a visitor to book a demo rather than to start a trial. Maze also sells through AWS Marketplace as Maze Vulnerability Management, a procurement route cloud buyers already use. Wiz publishes the integration from its own side.

Maze publishes vulnerability research of its own, including the Langfuse bug its agents found and a person validated before disclosure. That gives a prospective buyer published work from the agents to read alongside the product description.

Maze publishes a list price on AWS Marketplace. A twelve-month contract to protect a cloud environment of 500 assets is listed at $120,000.00, with private offers available for custom terms.

The AWS listing sets a price for a fixed estate size and publishes no unit rate and no second tier. A buyer can therefore see what 500 assets cost and cannot work out from the listing what a larger or smaller estate would cost. Maze's own site points a buyer to a demo booking rather than to that published price, so the marketplace listing is where a buyer sees a number without contacting sales.

Deployment is light. Maze asks for a read-only role in the cloud account or repository, with no sensors or anything else to install, and the company says the setup takes minutes. Maze Cloud also connects to a scanner the customer already runs. Maze gathers runtime context without deploying anything into the workload.

Maze delivers findings and fixes where engineers already work. Maze Code runs in the CI/CD pipeline and surfaces findings at the pull request, and fixes can be pulled into an AI coding agent, with a full audit trail behind each decision so a deprioritized finding carries its reasoning. The customer's team still operates the product and owns the outcome.

Maze states on both product pages that it has passed its ISO 27001 accreditation and is in its SOC 2 Type 2 observation window. Its trust center runs at trust.mazehq.com, and a probe of that surface on 2026-07-27 returned an access-request form, so whatever that trust center documents sits behind that request. The 90% figure in the public record comes from Maze's own announcement of Maze Code, and it counts how many findings turn out unexploitable rather than how often the calls are right.

Maze answers the hosting and data-handling questions directly. Maze hosts in AWS and offers single-tenant hosting, and it says it uses orchestrators such as AWS Bedrock and Google Vertex that keep customer data out of model-provider training.

Maze layers investigation on top of the scanners a customer already runs. It reads findings from those tools, adds its own runtime and static context, and returns a verdict plus a fix. Wiz supplies those findings and ranks risk itself, so the vendor that feeds Maze could add the step Maze sells.

Maze returns its findings and fixes to the CI/CD pipeline, the pull request, and AI coding agents rather than to a separate console. Running both product lines on one engine lets a CVE that appears in code, image, and cloud resolve as a single investigation. Maze pitches that single investigation as the reason to buy both lines, and a customer reaches it by connecting the code side and the cloud side.

Companies House lists four directors of Maze AI Limited. Harry Wetherald and Adrian Jozwik have served since incorporation in October 2023, Santiago Castiñeira Fernández since May 2024, and Andrew Triedman since June 2025, the Theory Ventures partner whose board seat the Series A announcement described. The registry also records Canvas Software Limited as the entity's previous name, changed in July 2025.

The founders led product, design, and engineering teams at Tessian, Elastic, and Amazon before starting the company, which is directly relevant operating experience. The reviewed record shows no prior exit and no sustained publication history behind that experience, which is the part a buyer weighing an unproven product would want.