Repello AI

• Model providers such as OpenAI and Anthropic could ship native red teaming and guardrails for the agents built on their platforms, removing the third-party budget line Repello depends on.
• No paying customer is named publicly, so buyers who require current named references could stall enterprise deals for a roughly dozen-person company.
• Repello has disclosed only a $1.2M seed while building five-plus product lines, so a capital-heavy enterprise push could force a raise on weak terms or a narrowing to fewer products.
• A small team spread across discovery, red teaming, runtime guardrails, an MCP gateway, and coding-agent monitoring could lose each line to a focused specialist in automated red teaming or runtime guardrails.
• The Gartner recognition and enterprise-scale claims Repello promotes are self-asserted, so a buyer or analyst checking them could find less third-party validation than the marketing implies.
• A customer can cancel Repello's subscription without reabsorbing toil, because the red-team findings and guardrails sit alongside production rather than embedded in it, which keeps switching cost low.

Repello AI treats the AI systems a company builds as the asset under attack and sells testing and defense across them. The homepage frames the problem as agentic workflows, MCP connections, and chatbots that traditional security tools cannot inspect, and it names concrete failure modes including prompt injection, jailbreaks, data exfiltration, excessive agent autonomy, and tool abuse. The buyer is the enterprise security team standing up AI in a core process.

Independent reporting corroborates the pain beyond Repello's own pages. Entrepreneur India, covering the seed round, describes the company as addressing the growing vulnerability of GenAI applications to complex and evolving cyber threats, which places the problem in a third-party account rather than vendor marketing alone.

Repello positions agent compromise as the consequence that matters. The company describes a 3-phase framework in which discovery feeds testing, testing calibrates runtime defenses, and runtime insights improve future testing, the loop its products are meant to close before an attacker exploits an exposed agent. [s1, s6, s2]

Repello sells across the AI security lifecycle rather than a single layer. ARTEMIS runs autonomous red teaming that profiles a system, builds a threat model, and executes multi-stage attacks, with a browser mode that drives the application like a real user, multimodal coverage across text, image, and audio, and findings mapped to MITRE, OWASP, NIST, ISO 42001, and the EU AI Act. The Inventory product scans codebases, cloud, and third-party apps to map every agent, model, and dataset into a threat graph.

ARGUS extends the same offensive knowledge into runtime defense. Repello states that ARGUS draws on adversarial insights from its red teaming engine and enforces context-aware guardrails across modalities and more than 100 languages. The company frames detection and protection as informed by the attacks ARTEMIS runs, which is the integrated story behind the platform.

Open-source tools give the capability claims an outside check. Repello publishes Agent-Wiz, a CLI for threat modeling AI agents built on frameworks such as LangGraph and CrewAI, and Whistleblower, a tool for testing system-prompt leakage. Both carry real GitHub adoption, several hundred stars for Agent-Wiz, which demonstrates the team can ship working offensive-security tooling. [s2, s4, s7, s10]

Repello competes as a broad platform against rivals who each focus on one of its lines. Automated red-teaming specialists contest what Repello's ARTEMIS covers, and runtime-guardrail vendors contest ARGUS. Each of those competitors concentrates on a single slice of what Repello attempts.

Repello's visible differentiator is the connected loop across discovery, testing, and runtime. The company argues that findings from red teaming directly shape the guardrails, which a buyer assembling point products from several vendors would have to integrate themselves. The open-source tools also give Repello a developer-facing profile larger than its headcount would predict.

The structural risk is who owns the buyer. Model providers could test and guard the agents built on their own platforms, and platform vendors building adjacent AI-security suites can bundle red teaming and guardrails into deals an enterprise already signs. Repello's breadth is both its integration pitch and its exposure to being out-focused on any single front. [s2, s3, s7]

Repello's clearest verifiable traction is open source rather than paying customers. Agent-Wiz and Whistleblower carry real GitHub followings, several hundred stars for the former, which shows developer interest the company can convert. This is community adoption and demand generation, not evidence of enterprise revenue.

Commercial proof is partial rather than absent. Entrepreneur India reports companies like Groww and PhysicsWallah use the product, and the homepage shows a customer logo wall whose names, including Groww, appear as image files rather than page text, plus two titled testimonials, one from Sandeep Varma of PhysicsWallah AI and one from Pradeep Bhat, a head of security whose organization the page does not name. Repello also publishes a red-team assessment of the AI vendor Lyzr on its blog.

Depth behind those names stays undisclosed. The pages do not say whether the named users are paying customers, how deep the deployments run, or whether they will act as references, and the broader claim stays at the homepage's wording of leading organizations across industries and AI systems serving millions of users rather than named references.

The recognition Repello promotes is self-asserted. The company's blog announces inclusion in a Gartner report listing top-funded AI TRiSM startups, which Repello surfaces itself rather than an analyst endorsing the product. Named enterprise references and a disclosed larger round would be the signals that the developer attention and backing have converted into deployments. [s1, s8, s6, s10, s12, s13]

Repello's founders pair engineering credibility with limited public pedigree. Aryaman Behera, the CEO, and Naman Mishra are IIT Roorkee alumni who founded the company in 2024 and ship working open-source security tools, which establishes hands-on offensive-security craft. No prior exits or sustained standards-body roles surface publicly, which is the difference from the cluster peers that earn a higher mark.

The open-source output is the team's strongest public signal. Agent-Wiz and Whistleblower are real tools with measurable community uptake, and they demonstrate the team can build the kind of adversarial tooling the commercial platform automates. That is a working-product signal rather than a record of recognized in-domain authority.

The backing adds outside confidence in the people. The seed round drew Venture Highway, now part of General Catalyst, alongside pi Ventures, Entrepreneur First, and angels including Charles Songhurst, a Meta board member. Investor conviction is an indirect signal about the founders rather than a verifiable track record of prior builds. [s6, s7, s9]

Repello's trust posture combines product design with two self-displayed certification badges. ARGUS offers an interactive guardrails playground a buyer can test, and the Workstation Lens product claims a 15-minute setup through existing EDR, which lowers the evaluation barrier for a security team. These are hands-on proof points a prospect can try before committing.

The homepage footer displays an AICPA SOC seal and an ISO 27001 certified seal, so Repello signals SOC 2 and ISO 27001 attestation on its own site rather than showing nothing. What the public record still lacks is an inspectable trust portal or a downloadable report a buyer can verify, the trust subdomain does not resolve, and the SPA security and trust pages serve no certification artifacts. So a procurement team at a security-conscious enterprise buyer can see the claimed certifications but would still ask for the underlying reports through sales. For a young company whose products probe and sit inside proprietary AI systems, the readiness item that surfaces in a security review is the missing portal, not the absence of any attestation. [s3, s5, s11]

Add analyzed competitors to compare them side by side with Repello AI.

Repello sells to the enterprise security team standing up generative AI in production, the buyer that owns agentic workflows, MCP connections, and customer-facing chatbots and is accountable when one is breached. The homepage frames the target as the organization securing its entire AI stack across applications, agents, and MCPs, and the ARTEMIS page addresses AI, product, and security teams, so the pitch spans builders and defenders.

The segment is broad by design and that is both the pitch and the risk. Repello spans discovery, offensive testing, and runtime defense in one platform, so it can enter through whichever pain a buyer feels first and expand across the loop. Against that, each slice it sells is also a standalone product category elsewhere in the market, so the segment Repello claims is contested at every edge rather than a defensible niche it holds alone.

Named demand is real but narrow. The homepage's customer logo wall carries Groww and PhysicsWallah alongside two titled testimonials, one from PhysicsWallah AI and one from a head of security whose organization the page text does not name. The open segmentation question is whether Repello anchors a defensible enterprise foothold or stays a broad platform thin in any single account.

The product line is unusually complete for the company's stage. ARTEMIS runs autonomous red teaming that profiles, plans, and attacks like a human red-teamer, builds threat models, executes multi-stage attacks, and visualizes the attack paths that breach a system, with multilingual coverage across text, image, and audio and a sub-one-minute time to first vulnerability. ARGUS extends the same offensive knowledge into runtime guardrails, an Inventory product discovers AI assets, and an MCP gateway adds protocol visibility.

The durable advantage sits beneath the agents rather than in them. Repello states its red-teaming engine draws on a threat intelligence repository of 15 million-plus curated attack vectors and claims 15x more coverage than manual testing, and it positions ARGUS as born offensive and built defensive, reusing those attack insights to power real-time protection. That offense-to-defense reuse is the company's clearest technical story.

The verifiable footprint backs the claim that the team can build. Agent-Wiz ships working open-source tooling at roughly 380 GitHub stars as of July 2026, and Whistleblower, a system-prompt-leakage tool, carries roughly 160 stars, public engagement signals rather than installation counts. The unverified piece is the corpus itself: the 15 million figure is the company's own number, with no third-party audit or accuracy benchmark in the cited sources.

Repello runs a demo-led enterprise motion fronted by a free-tooling top of funnel. Paid conversion is demo-led, while the homepage and ARTEMIS page also promote a free red-teaming scan, a posture that fits a security-team buyer and a negotiated deal, and the open-source releases plus an interactive guardrails playground give a prospect hands-on proof before any sales conversation.

The developer surface is wider than the headcount. Agent-Wiz and Whistleblower carry real GitHub adoption, and the ARGUS page links out to a live playground at guard.repello.ai where a buyer can simulate prompt-injection and system-prompt-leak attacks and read the policy hits. In its June 2025 seed coverage, Entrepreneur India reported the company would use the capital to expand red-teaming capabilities and scale go-to-market, an early paid motion by that account.

Conversion proof is thin. The named references are the homepage logo wall carrying Groww and PhysicsWallah, whom the June 2025 press also reported as users, plus a titled PhysicsWallah AI testimonial, with paid status and deployment depth undisclosed, and the homepage's featured-in strip carries a Gartner logo, an appearance whose nature the cited pages do not detail. Named, referenceable enterprise deployments are the signal that has not yet appeared.

Repello publishes no pricing in fetched sources. The paid motion converts to a demo request, supplemented by a free red-teaming scan and open-source tools, the posture of a vendor selling negotiated enterprise contracts to security teams rather than a self-serve or seat-priced tool, and it withholds the budget-anchoring signal some peers publish.

The charged unit is not stated. A platform spanning discovery, testing, and runtime could meter on assets scanned, attack runs, protected traffic, or a flat platform subscription, and none of these is disclosed publicly. The open-source tools and the playground are free top-of-funnel rather than a priced tier, so they do not reveal the commercial meter.

The inferable belief is that buyers pay for coverage of an AI attack surface rather than for a feature count, given the 15x-coverage framing that anchors the value story. Confirming the unit and whether testing and runtime are bundled or sold separately would require the sales conversation the demo-only posture signals is the intended path.

Fetched sources present Repello primarily as software the customer operates rather than a managed service. ARTEMIS, ARGUS, Inventory, the MCP gateway, and Workstation Lens are products a security team runs against its own AI systems, the ARGUS page describes a layer that integrates into the customer's existing AI stack, and nothing in fetched sources describes Repello analysts running the testing or owning the safety outcome on the customer's behalf.

The architecture is built to lower the operational lift. ARGUS enforces context-aware guardrails informed by the red-teaming engine, the playground lets a team validate behavior before deployment, and the integrated 3-phase loop is pitched so that discovery feeds testing and testing calibrates the runtime defenses without the customer stitching point products together. That integration is the operational selling point.

Operational assurance collateral is absent. No published uptime or support SLA for the inline ARGUS guardrails surfaces in fetched pages, and the sub-100-millisecond blocking figure the site advertises is the vendor's own claim, which matters because a runtime defense sits in the live request flow. A buyer would have to establish those operating terms in a sales and security review rather than read them publicly.

Repello asks a buyer to let its software probe and sit inside proprietary AI systems, so trust is load-bearing, and the strongest proof point in this record is hands-on rather than documentary. The ARGUS interactive playground at guard.repello.ai lets a prospect simulate prompt-injection and system-prompt-leak attacks and watch the defenses respond, which is a verifiable trial a security team can run before committing.

The formal attestation posture comes from self-displayed seals. The served homepage carries AICPA SOC and ISO 27001 badge images in its footer markup, and a probe of the trust and security subdomains and the /trust, /security, /compliance, and /soc2 paths on 2026-07-16 found no trust portal, every path returning not-found, so a buyer can see the seals without pulling the underlying reports. A procurement team at a security-conscious enterprise buyer would still request those reports through sales rather than verify them on the site.

The open-source output doubles as a trust signal. Agent-Wiz at roughly 380 stars and Whistleblower at roughly 160 stars as of July 2026 are public, inspectable code with visible community engagement, which lets a technical buyer judge the team's craft directly. What is missing is the inspectable compliance evidence a regulated buyer's security review demands, which is the readiness gap a young vendor inside customer AI systems must close.

Repello positions itself as the platform that closes the loop across the AI security lifecycle rather than a point tool. It describes a proprietary 3-phase framework in which discovery feeds continuous testing, testing calibrates runtime defenses, and runtime insights improve future testing, so the platform claim rests on owning the connection between offense and defense that a buyer would otherwise integrate across several vendors.

The integration is the real differentiator. A customer assembling a red-teaming tool, a guardrail product, and an asset-discovery scanner from three vendors carries the integration burden itself, while Repello argues its attack findings directly shape its guardrails. Agent-Wiz extends the ecosystem outward, mapping the agent frameworks developers already use.

The exposure is who owns the platform layer beneath Repello. Model and cloud providers could ship native testing and guardrails for the agents built on their own platforms, removing the third-party budget line, a structural exposure this review infers rather than one the cited pages document. Repello's ecosystem claim is a bet that an independent, offense-informed layer beats the incumbents' bundled one.

Repello's credibility comes from demonstrated offensive-security craft rather than on prior exits. Co-founders Aryaman Behera and Naman Mishra are IIT Roorkee alumni who founded the company in 2024, and the team ships working open-source adversarial tooling, which establishes hands-on capability. No prior company exits or sustained standards-body roles surface in fetched sources, which is the gap relative to the pedigreed founding teams in the cluster.

The open-source record is the team's strongest public signal. Agent-Wiz, a CLI for threat-modeling AI agents, carries roughly 380 stars and 57 forks as of July 2026, and Whistleblower, which probes system-prompt leakage, carries roughly 160 stars and 26 forks, both real tools that demonstrate the team can build the adversarial capability the commercial platform automates.

The backing supplies outside conviction in the people. Entrepreneur India reports a small seed round with Venture Highway, now part of General Catalyst, alongside pi Ventures, Entrepreneur First, and angels including Charles Songhurst, a Meta board member. Investor confidence is an indirect signal about the founders rather than a verifiable record of prior builds, and the modest round sets the resource gap against better-funded rivals.