Remedio

• Microsoft could fold autonomous configuration remediation into Intune and Defender baselines, turning Remedio's core loop into a no-cost platform feature for the buyers it targets.
• Tanium, Qualys, or Tenable could extend their assessment and patch products into remediation with rollback, collapsing Remedio's foothold into an incumbent line item.
• A remediation-caused outage at a marquee customer would directly falsify the safety promise that differentiates the platform.
• Device posture management may never become a budgeted category, forcing Remedio to win every deal from configuration-compliance, patching, or vulnerability budgets that incumbent vendors already own.
• Spending $65 million on a hired United States sales motion could erode the capital efficiency that defined the company if sales productivity lags the bootstrapped baseline.
• A compromise of Remedio's update or remediation pipeline would hand an attacker fleet-wide configuration-change privileges across hundreds of enterprises.

Remedio sells the fix for a problem most security tools only report. Enterprises already know many of their devices run risky settings, but they leave them unrepaired because changing configurations on production machines can break the business. The company's origin story names this directly, saying misconfigurations were known but rarely fixed due to risk and complexity, and the pitch is making that repair safe enough to automate.

Customers and the lead investor corroborate the pain. Bessemer partner Adam Fisher credits Remedio with uncovering and remediating critical endpoint vulnerabilities that EDR and CSPM platforms missed, and Colgate-Palmolive's information-security head says the product improved security without added personnel, naming the staffing cost that unfixed findings impose. The buyer this framing addresses is the security or IT operations leader who owns the remediation backlog rather than the detection console.

The target market spans regulated and operational environments. The site carries solution pages for manufacturing, finance, healthcare, education, and government, covers OT and IoT devices alongside IT endpoints, and supports isolated, air-gapped deployments. Calcalist reports that deployment flexibility makes the platform suitable for sensitive industries such as healthcare and security. [s2, s9, s12, s10]

The Remedio platform packages one mechanic, discovering a risky device state and fixing it autonomously, into five modules. Remedio Baseline handles configuration security, Remedio Fortify covers vulnerability patching, Remedio Assure validates compliance, Remedio Gate controls which applications run, and Remedio AI Govern extends the loop to AI tooling. The homepage presents them as one platform to control device posture.

Remediation safety is the documented core of the engineering. The platform page describes impact preview and simulation before execution, dependency mapping to predict downstream consequences, and instant rollback for any action. The sensor stays under seven megabytes, runs through the task scheduler on Windows, Linux, and macOS, and works agentlessly for network devices, specific cloud assets, and AI tooling, with support reaching back to Windows 7 and Server 2008.

Remedio AI Govern applies the same loop to AI sprawl on devices. The module discovers AI applications, autonomous agents, browser extensions, coding assistants, and MCP connectors, flags risky permissions and policy drift, removes cached AI credentials and session tokens, and remediates on-device with human oversight and rollback. Remedio markets the module with a category-creation claim that no fetched third party repeats.

A buyer probing technical depth will notice a gap. No public documentation portal appears in the reviewed source set, and the vendor's public scale messaging stays high level, with the about page and the legacy product page both describing roughly three million devices protected for trusted brands. [s1, s3, s4, s5, s6, s2]

Remedio competes on completing the loop that adjacent tools leave open. Detection products report misconfigurations, vulnerability scanners rank them, and the enterprise still has to schedule the fix. Remedio performs the fix itself, and CEO Tal Kollender's stated position is that detection is nice and correction is what makes you secure.

The crowd of adjacent incumbents is the real competitive field. Microsoft ships Group Policy, Intune, and Defender baselines on the same devices at no extra cost, Tanium sells endpoint management and remediation to the same fleet operators, and Qualys and Tenable own the assessment budgets that Remedio's findings overlap. Remedio's visible foothold is the safety tooling around the change itself, meaning impact simulation, dependency mapping, and rollback, plus coverage that reaches OT and legacy systems incumbents deprioritize.

Category language remains unsettled. Remedio and Bessemer call the space device posture management, SecurityWeek files the company under endpoint security, and Calcalist describes an autonomous cybersecurity platform. Buyers can map the product to existing configuration-compliance, patching, and vulnerability budgets, but no analyst-defined category with the vendor's name for it appears in fetched sources, so each deal likely requires teaching the buyer which slot it fills. [s2, s3, s13, s11, s10]

Customer proof is unusually strong for a company that never ran a funded sales motion. Amazon's VP of security engineering, Carl Moses, says the technology already runs inside Amazon's cybersecurity protection, and Colgate-Palmolive's VP of information security calls the product a core part of the company's security strategy. The homepage and legacy product page carry customer logos including Coca-Cola, Check Point, the NHS, Kraft, and Eaton, the company publishes a Carlsberg case study, and Ynet reports the customer roster began with Israel Aerospace Industries.

The traction arrived without outside capital. Press reports six profitable years, hundreds of customer organizations including large enterprises and Fortune 500 companies, and about 40 employees, of whom roughly 20 work in R&D. Kollender told Ynet the company's annual recurring revenue reaches the tens of millions of dollars, a company claim no third party verifies. She also said most of the new money goes to go-to-market rather than R&D, which is what the September 2025 round exists to change.

Distribution beyond direct sales is forming but thin in public view. A partners page advertises a channel program, and the site carries AWS partner and Google Cloud technology-tier badges plus Splunk and Forescout integration artwork. No marketplace listing, reseller list, or MSSP program detail appears in fetched pages, so channel depth is not publicly measurable. [s12, s11, s6, s8, s7, s10]

The founding trio pairs an operator with two repeat builders. CEO Tal Kollender is a former Unit 8200 cyber specialist and ex-Dell EMC engineer whom press describes as a former teenage hacker. Gilad Raz co-founded Digital Fuel, which VMware acquired, after earlier work on the BRM antivirus and Check Point's firewall, and Yakov Kogan co-founded Digital Fuel with him. Independent press verifies the Digital Fuel history.

The hired executive layer signals the scale-up plan. CTO Matt Rowe previously led global security initiatives at Amazon and AWS, CMO Cynthia Bellefeuille Stanton ran Rapid7's vulnerability-risk-management business and later served as its chief marketing officer, and Mor Bikovsky serves as chief business officer. The company hired this bench for the United States expansion the funding round pays for.

Investor validation came late and on the founders' terms. Bessemer led the $65 million round with TLV Partners and Picture Capital after the company had declined earlier offers, and Kollender told Ynet the founders still hold the majority. Bessemer partner Adam Fisher says the firm spoke with recognized customers, including Amazon, before investing. [s10, s12, s2, s13]

Procurement-facing trust artifacts are visible but light. The site displays a SOC 2 Type II badge alongside AWS partner, Google Cloud, Gartner Cool Vendor, and Best in KLAS 2026 marks, and the platform supports SaaS, on-premises, and air-gapped deployment for regulated industries. No public trust center, security documentation page, or vulnerability disclosure policy appears in fetched pages.

The product's privilege level is the trust question public pages leave unanswered. A platform that autonomously changes configurations across an enterprise fleet holds the kind of access an attacker who compromised the vendor could repurpose at scale. Reviewed pages document safety against accidental breakage, through simulation and rollback, but present no threat model for the remediation pipeline itself.

Analyst and award recognition is vendor-displayed rather than independently fetched. The Gartner Cool Vendor and Best in KLAS badges appear on Remedio's own pages, and no analyst report or review-platform data was retrievable this analysis, so the named customer executives quoted in press are the strongest third-party quality signal available. [s2, s3, s12, s10]

Add analyzed competitors to compare them side by side with Remedio.

Remedio sells to large enterprises with sprawling, heterogeneous device estates. SecurityWeek reports adoption by large enterprises and Fortune 500 companies, the legacy customer wall spans beverages and healthcare, and the site organizes solutions by industry for manufacturing, finance, healthcare, education, and government. OT and IoT coverage plus air-gapped deployment options aim the product at exactly the organizations whose devices are hardest to reconfigure safely.

The buying persona owns remediation rather than detection. The platform's reporting and ROI framing addresses security and IT operations leaders who must show measurable risk reduction, and the compliance module speaks to audit owners who need configurations validated against frameworks continuously. Calcalist reports the deployment flexibility makes the platform particularly suitable for sensitive industries such as healthcare and security.

Demand proof is current through late 2025. The September 2025 funding coverage carries on-record customer quotes, and named case studies such as Carlsberg sit alongside live product pages for the post-rename Remedio brand, so the public proof of demand is recent rather than launch-era. The company operates from Israel, the United States, and Europe, and the round explicitly funds a deeper United States presence.

Remedio's capability claim is autonomous remediation made safe. Five modules reuse one mechanic across configuration security, patching, compliance validation, application control, and AI governance, and the engineering the vendor documents most carefully is the part that prevents a fix from becoming an outage. Predictive impact preview and dependency-aware validation check changes before execution, dependency mapping predicts downstream consequences, and every action carries instant rollback.

Coverage breadth is itself a capability argument. Platform support extends back to Windows 7 and Windows Server 2008 and spans mainstream Linux distributions and macOS, and the platform handles network devices, specific cloud assets, and AI tooling agentlessly. OT and legacy support matters because those estates carry the misconfigurations nobody dares touch by hand.

AI cuts in both directions through the product. Press describes the platform using AI to resolve identified issues instantly, and SecurityWeek reports a roadmap toward an AI-powered platform unifying configuration, compliance, patching, and vulnerability management. In the other direction, Remedio AI Govern treats AI tools on devices as the thing to protect, discovering agents, browser extensions, coding assistants, and MCP connectors, then remediating risky permissions and exposed AI credentials.

The public evidence stops short of efficacy. No benchmark, documentation portal, or third-party technical evaluation appears in fetched pages, and the vendor's public scale messaging stays high level, with the about page and the legacy product page both describing roughly three million devices protected for trusted brands. Named customer testimony in press is strong adoption evidence, but capability depth beyond marketing copy is not publicly inspectable.

The same safety engine holds a latent, not-yet-evidenced data advantage. If the validation machinery records which configuration change broke which dependency on which device class, pooling those break and no-break outcomes across heterogeneous fleets could train a remediation-safety model that rivals cannot match without comparable deployment. Fetched pages document impact preview, dependency mapping, rollback, and audit trails, but show no cross-customer recording of those outcomes, so the advantage stays potential rather than realized.

Remedio's go-to-market history is the inverse of its venture-backed peers. The company sold for six years on revenue, reaching hundreds of large organizations with around 40 employees, and Ynet attributes the early growth to customers joining one after another from Israel Aerospace Industries onward. Until the 2025 round the public record offers no funded sales machine to evaluate, only the results of lean growth.

Founder-fronted storytelling dominates the public record at a stage where most vendors run hired sales teams. Tal Kollender personally fronts press, the funding story, and the company's public narrative, while the claimed annual recurring revenue in the tens of millions matches the stage where founder-led sales normally hands off to a hired team. The round's stated allocation, with most money going to go-to-market rather than R&D, plus an executive bench drawn from Rapid7 and Amazon, suggests that handoff is happening on schedule rather than prematurely.

Channel motion exists and is broader than a badge wall. The partners page describes a partner ecosystem of distributors, resellers, and system integrators, naming channel partners including GuidePoint Security and Comguard alongside AWS partner and Google Cloud technology-tier badges plus Splunk integration artwork. No cloud-marketplace listing appears in fetched pages, so the channel supplements the company's own selling and press rather than replacing it.

The expansion bet is concentrated and explicit. Kollender told Ynet the company began spending on United States growth before the round closed, and that Bessemer encouraged faster spending than the founders' bootstrap instincts allowed. Whether a team whose public record is bootstrap-era, founder-fronted selling converts $65 million into repeatable enterprise sales is the execution question the next year answers.

Remedio publishes no prices. Product pages route to demo requests and a free-trial call to action, no pricing page appears in the sitemap inventoried by the 2026-07-12 probe, and no fetched source names a charging unit. That pattern fits a vendor negotiating large enterprise contracts deal by deal, with the trial as an entry point rather than a transparent-pricing motion.

The natural unit would be the device, and the vendor's value story argues for pricing anchored to savings. A per-device sensor across fleets gives both sides an obvious meter, and the homepage's ROI engine converts each autonomous remediation into time saved, reduced man-hours, and quantified risk reduction, which is the arithmetic a vendor runs when it wants budget conversations anchored to operational savings rather than license comparisons.

The pricing pressure comes from platform bundling. Endpoint and device-management suites that enterprises already license include configuration and baseline features, so Remedio must price the gap between found and fixed, and the undisclosed unit leaves no public way to judge how much premium the safety engine commands.

Deployment is engineered to be a non-event. The vendor claims rollout in minutes rather than months, with a sensor under seven megabytes scheduled through the operating system's own task scheduler rather than a resident agent, agentless operation for network devices, specific cloud assets, and AI tooling, and assessment that begins immediately without a tuning period. SaaS, on-premises, and air-gapped options serve buyers whose environments forbid cloud control planes.

Operational risk concentrates at the moment of change, and the product design answers it. Predictive impact preview and dependency-aware validation before execution, conflict-aware alerting when a hardening change would affect a dependent application, and instant rollback are the controls that let an operations team delegate changes to software. The stakes are structural, since one bad fleet-wide remediation would cost more trust than years of good ones earn.

Operational transparency to non-customers is limited. Fetched pages show no public product-documentation portal, SLA, status page, or support-tier description, so a buyer evaluates those through the sales process rather than the open web.

Remedio's compliance posture covers fewer procurement basics than its marketing wall suggests. Air-gapped and on-premises deployment options serve regulated buyers, and the fetched badge inventory carries AWS, Gartner, Google Cloud, and KLAS marks, including a Best in KLAS 2026 cybersecurity badge alongside the healthcare positioning. The homepage also displays a SOC 2 Type 2 badge, but only as an image with no text equivalent, so it names an attestation without making a report inspectable. No public trust center or vulnerability disclosure policy appeared in the reviewed source set, whose footer links resolve to the privacy policy and a framework-compliance solutions page.

The unanswered trust question is the platform's own blast radius. Remedio holds fleet-wide privileges to change configurations, block applications, and remove credentials across hundreds of enterprise estates, which makes the vendor's update and remediation pipeline a high-value supply-chain target. Public materials document protection against accidental breakage thoroughly and say nothing about protection against malicious use of the remediation channel.

Third-party validation remains thinner than customer validation. Gartner Cool Vendor, the Forbes Next Billion-Dollar Startups feature, and KLAS marks are vendor-displayed badges rather than fetched reports, the SOC 2 Type 2 mark is another such badge with no accompanying report in the reviewed pages, and the strongest external signal is named customer executives endorsing the product in independent press.

Remedio is structured as a suite, with one sensor and one remediation engine reused across five modules. Each module addition, from configuration to patching to compliance to application control to AI governance, raises the value of the same deployed footprint. That is consolidation economics inside existing accounts rather than a platform other vendors build on.

Ecosystem connections run inward and outward. The platform page describes an API-first design with named SIEM, ITSM, EDR, and AI/MLOps integrations, and the partners page carries a technology-alliance and channel roster from GuidePoint Security to Comguard alongside AWS partner and Google Cloud technology-tier badges. A public API documentation portal is still absent from fetched pages, and nothing in fetched materials shows third parties building on Remedio.

The suite design doubles as the expansion strategy. SecurityWeek reports the company building toward a unified platform combining configuration, compliance, patching, and vulnerability management, which moves onto ground the established vulnerability and endpoint management incumbents occupy, and AI Govern points the same machinery at a market crowded with funded AI-security startups.

The founding trio pairs an operator with the two Digital Fuel co-founders. CEO Tal Kollender is a former Unit 8200 cyber specialist and ex-Dell EMC engineer whom press describes as a former teenage hacker. Gilad Raz co-founded Digital Fuel, which VMware acquired, after earlier work on the BRM antivirus and Check Point's firewall, and Yakov Kogan co-founded Digital Fuel with him. Independent press verifies the Digital Fuel history.

The hired executive layer signals the scale-up plan. CTO Matt Rowe previously led global security initiatives at Amazon and AWS, CMO Cynthia Bellefeuille Stanton ran Rapid7's vulnerability-risk-management business and later served as its chief marketing officer, and Mor Bikovsky serves as chief business officer. This bench matches the United States expansion the funding round pays for.

The organization is small for its customer count and deliberately so. Forty people at the September 2025 round, roughly half in R&D, support hundreds of client organizations, a ratio Kollender presents as proof of product leverage. The round exists to grow the go-to-market side of that ratio, and the founders retaining majority control means the bootstrap-era decision style persists into the venture-funded phase.