Snyk Public-Source Startup Diligence Report
Snyk is a scaled developer-security platform in a strategically important category: AI-assisted secure software development, open-source supply-chain risk, container/IaC security, and application risk management. The upside case depends on durable enterprise retention, platform attach, AI remediation efficacy, and ability to defend pricing against bundled platform-native tools and cloud-security suites.
Snyk Public-Source Startup Diligence Report
Track with high-priority financial, customer, competitive, and legal diligence before any investment decision. Public evidence supports Snyk as an active, late-stage private developer-security unicorn with broad product and enterprise traction, but the most material underwriting inputs remain private.
Snyk competes against platform-native tooling, legacy AppSec suites, CNAPP/ASPM vendors, secrets scanners, and AI security entrants.
Diligence request: Review win/loss, competitor displacement, pricing and discounts, analyst reports, and churn reasons by competitor.
AI-assisted development and attacker automation can both increase demand and accelerate product-obsolescence risk if Snyk remediation accuracy or coverage lags.
Diligence request: Evaluate AI roadmap, model/data rights, accuracy benchmarks, security research cadence, and competitive AI-native alternatives.
CB Insights shows a $7.40B current valuation and $1.247B total raised, while secondary evidence reports a prior $8.5B valuation. Without round documents, preference stack, secondary-sale detail, and runway data, investor-return and employee-equity implications cannot be assessed.
Diligence request: Review full cap table, round documents, liquidation preferences, debt/warrants, secondaries, cash runway, and board financing plan.
Secondary public revenue/loss figures are not enough to validate ARR quality, margin profile, retention, CAC, payback, or cash conversion.
Diligence request: Obtain audited statements, ARR bridge, cohort retention, gross-margin waterfall, CAC/payback, billings/collections, and cash-flow model.
Named customers and case studies support enterprise traction, but account-level ARR, renewal dates, churn, NRR, and logo-rights status are not public.
Diligence request: Request top-customer ARR, renewal schedule, churn logs, NRR/GRR cohorts, and direct references.
Public pages cite compliance and security posture, but audit reports, DPAs, subprocessors, incident history, and customer-specific exceptions are private.
Diligence request: Review SOC2/ISO/FedRAMP evidence, DPAs, subprocessors, incident/breach logs, export-control analysis, and regulated-customer contracts.
Public product claims establish product modules and AI positioning, but not false-positive rates, model governance, fix acceptance, or customer outcome repeatability.
Diligence request: Review product telemetry, scan/fix benchmarks, AI model governance, incident history, and reference calls.
Snyk currently lists an interim CEO/CFO, while headcount public anchors differ between a 2022 secondary count and current careers language.
Diligence request: Review CEO succession, executive retention, headcount bridge, attrition, restructuring, and employee morale data.
Snyk is a late-stage private security-software unicorn with public valuation and funding signals but no public audited financial package, ARR bridge, gross-margin detail, cohort retention, cap table, debt schedule, or runway disclosure.
partially verified confidence: medium
Secondary sources report revenue and loss, but audited financials, ARR, margin, burn, and cash conversion are not public.
| metric | public signal | verification status | diligence request |
|---|---|---|---|
| Revenue | Secondary source reports US$220M revenue for 2023. | partially_verified | Audited revenue by month, SKU, region, customer segment, and contract type. |
| Net income / loss | Secondary source reports US$176M net loss for 2023. | partially_verified | Audited income statement, cash-flow statement, EBITDA bridge, non-cash adjustments, and one-time items. |
| ARR / NRR / gross retention | Not disclosed publicly. | not_publicly_verifiable | ARR bridge, NRR/GRR by cohort, logo churn, expansion, contraction, and downgrade reasons. |
| Gross margin and unit economics | Pricing ladder indicates SaaS plans but not economics. | not_publicly_verifiable | COGS by product, cloud spend, support cost, CAC, payback, LTV/CAC, and services mix. |
Public financial signals are insufficient for valuation underwriting.
partially verified confidence: medium
Public sources support unicorn status and funding scale, but round documents and capitalization economics are private.
| date | event | amount or valuation | diligence caveat |
|---|---|---|---|
| 2020-01-21 | CB Insights unicorn tracker date joined. | $7.40B valuation in current tracker. | Verify valuation methodology, last priced round, and current preference stack. |
| Current profile | CB Insights company profile funding signal. | $1.247B total raised per profile. | Does not disclose preferences, debt, secondaries, warrants, or runway. |
| 2021 | Secondary source peak valuation signal. | $8.5B valuation signal reported by Wikipedia for a $300M round. | Obtain original round documents and board materials; treat as secondary until verified. |
Public financing records are incomplete; do not infer full capitalization.
Financing documents are required for final underwriting.
Treat the line as a sparse anchor chart, not a continuous valuation series.
Snyk offers a broad developer-security platform covering code, open-source dependencies, containers, IaC, and application risk management. Product breadth is well evidenced by company pages; product-level ARR, usage, remediation efficacy, and AI governance remain private.
verified confidence: high
Public product pages evidence a multi-module platform across SAST/code scanning, SCA/license risk, containers, IaC, and AppRisk.
| module | public capability | diligence test |
|---|---|---|
| Snyk Code | Code scanning/SAST and AI-assisted fixes. | Measure false positives, fix acceptance, language coverage, scan latency, and secure-code AI governance. |
| Snyk Open Source | Dependency vulnerability and license-compliance management. | Verify vulnerability database quality, license coverage, SBOM output, and remediation accuracy. |
| Snyk Container | Container image and Kubernetes security. | Benchmark image scanning, base image recommendation value, registry coverage, and runtime relevance. |
| Snyk IaC | Infrastructure-as-code misconfiguration detection. | Verify policy coverage, developer workflow adoption, and cloud misconfiguration outcomes. |
| Snyk AppRisk | Application risk management, asset discovery, and prioritization. | Verify asset coverage, prioritization accuracy, executive dashboard adoption, and CNAPP/ASPM overlap. |
Product existence is public; adoption and economics are private.
Architecture is inferred from public product pages.
verified confidence: high
Snyk discloses a Free, Team, Ignite, and Enterprise ladder, but discounting, utilization, and plan-level economics are not public.
| plan | target customer | public features | diligence gap |
|---|---|---|---|
| Free | Individual developers and small teams. | Entry-level scanning and developer adoption. | Conversion rate, support burden, abuse controls, and paid-upgrade paths. |
| Team | Development teams. | Team-level Snyk security coverage. | Paid-seat utilization, churn, ARPU, and discounting. |
| Ignite | Organizations with under 50 developers. | Broader governance and reporting for smaller organizations. | Upgrade rate to Enterprise, margin, and discounting by account size. |
| Enterprise | Large organizations. | SSO, SBOMs, compliance, reporting, data residency, and FedRAMP options. | ACV, renewal uplift, security addenda, DPAs, and procurement exceptions. |
Public plan labels do not reveal realized economics.
Public customer evidence supports a broad enterprise security customer base with named examples and vendor-published outcomes. Customer concentration, retention, NPS, contract terms, renewal calendar, and reference quality remain private.
partially verified confidence: medium
Snyk publicly cites hundreds of organizations and named customers, but ARR concentration and active status need direct validation.
| customer | public use case or outcome | diligence request |
|---|---|---|
| Skyscanner | Vendor-published case study says nearly 500 projects were monitored and security shifted left. | Obtain direct customer reference and contract metrics. |
| Okta | Customer quote tied to Snyk Code / AI static analysis appears on Snyk customer page. | Confirm usage, ARR, renewal status, and procurement terms. |
| ICE / NYSE | Customer page cites TEI benefits and remediation-speed claims. | Review underlying study, implementation scope, and contract value. |
| Google, AB InBev, Spotify, Snowflake, Komatsu, TechnologyOne, Labelbox | Named examples appear on Snyk customer/about pages. | Confirm active status, ARR, renewal, scope, and logo rights. |
Vendor-published customer evidence is not a substitute for reference calls.
Customer evidence is vendor-published and should be reference-checked.
verified confidence: high
Snyk has broad integration and partner evidence, which creates both distribution leverage and platform-dependency exposure.
| relationship category | examples publicly visible | business role | diligence gap |
|---|---|---|---|
| Source-code management | GitHub, GitLab, Bitbucket, Azure Repos. | Core developer workflow entry point. | API dependency, marketplace performance, change-of-policy risk, co-sell or partnership terms. |
| CI/CD and issue tracking | Jenkins, Jira and workflow tooling categories. | Remediation workflow and developer notification. | Integration usage by account, maintenance burden, and partner SLAs. |
| Cloud, registry, and container ecosystem | AWS, Azure, Google Cloud, Docker, Kubernetes categories. | Container, IaC, and cloud-risk coverage. | Cloud marketplace ARR, registry API limits, policy dependencies. |
| Reseller / solution partner ecosystem | Snyk partner directory categories. | Implementation and channel reach. | Partner-sourced bookings, margin, rev-share, partner concentration. |
Integration breadth creates both distribution and operational dependency.
Snyk operates in a crowded application-security and developer-security market spanning GitHub/GitLab-native tools, legacy AppSec vendors, cloud-security platforms, secrets scanners, and newer AI security entrants. Public evidence supports competitive breadth but not market share, win rates, or pricing pressure.
verified confidence: medium
CB Insights and Snyk comparison pages identify a broad competitive set across platform-native, legacy AppSec, and specialized developer-security tools.
| competitor or category | segment overlap | Snyk positioning | diligence question |
|---|---|---|---|
| GitHub Advanced Security / SCM-native security | Code scanning, dependency scanning, secret scanning, developer workflow. | Independent multi-platform developer security. | Win/loss versus bundled SCM security and attach/renewal impact. |
| GitLab security | DevSecOps platform-native security. | Cross-platform breadth and remediation. | Budget displacement versus bundled DevOps suites. |
| Veracode and legacy AppSec suites | SAST, SCA, enterprise AppSec governance. | Developer-first workflow and remediation. | Replacement versus coexistence, regulated-enterprise preferences, price pressure. |
| GitGuardian and specialized developer-security vendors | Secrets, code risk, and adjacent developer workflows. | Broader platform breadth. | Need specialized acquisitions or integrations for best-of-breed gaps. |
Vendor comparison pages are useful positioning evidence but not neutral win-rate data.
Requires win/loss and customer validation.
inconclusive confidence: medium
Competition likely centers on developer workflow depth, platform breadth, AI remediation quality, enterprise trust, and bundled-platform economics.
| axis | Snyk public position | competitor pressure | follow up |
|---|---|---|---|
| Developer workflow breadth | Strong public evidence across SCM/CI/CD/IDE/container/cloud integrations. | Bundled SCM/DevOps platforms. | Measure active usage and attach by integration. |
| Platform breadth | Code, SCA, Container, IaC, AppRisk. | CNAPP, ASPM, AppSec suites, point tools. | ARR and retention by module. |
| AI remediation | AI security and DeepCode-style positioning. | AI coding assistants and AI-native AppSec entrants. | Model evals, fix acceptance, liability terms. |
| Enterprise trust/compliance | SOC2/GDPR/ISO/FedRAMP/data-residency signals. | Established AppSec and cloud-security vendors. | Review audit reports and customer security exceptions. |
Scoring is analyst judgment from public evidence and requires customer validation.
Snyk appears to combine developer-led adoption, freemium/low-friction plans, enterprise sales, partner/integration channels, and customer proof. The public channel map is credible, but pipeline conversion, sales efficiency, partner contribution, and demand-generation ROI are not public.
partially verified confidence: medium
Public plans and integrations support product-led and developer-led entry with enterprise conversion paths.
| channel | public signal | likely role | diligence metric needed |
|---|---|---|---|
| Developer-led free/self-serve | Free plan and developer workflow integrations. | Usage seeding and product-led acquisition. | Free-to-paid conversion, active usage, abuse/support costs. |
| Team and Ignite paid plans | Public Team and Ignite packaging. | Paid expansion and land-and-expand bridge. | ARPU, churn, conversion to Enterprise, utilization. |
| Enterprise direct sales | Enterprise plan, compliance capabilities, and named customers. | Primary large-account monetization. | ACV, sales cycle, pipeline coverage, discounting, win/loss. |
| Partner/reseller/integration ecosystem | Partner directory and integrations. | Distribution leverage and platform stickiness. | Partner-sourced pipeline, reseller margin, marketplace revenue. |
Channel weights are not disclosed publicly.
Channel mix cannot be estimated responsibly from public evidence.
partially verified confidence: medium
Category positioning, comparison pages, customer proof, and compliance claims support enterprise demand generation but not conversion economics.
| signal | evidence | interpretation | diligence gap |
|---|---|---|---|
| Category positioning | AI security company and developer-security platform language. | Snyk is refreshing AppSec positioning around AI and developer workflows. | Message testing, pipeline influence, brand-search conversion. |
| Customer proof | Named customers and case-study outcomes. | Supports enterprise credibility but is vendor-curated. | Reference calls, logo-rights agreements, active-customer status. |
| Competitive landing pages | Comparison pages against GitHub Advanced Security, Veracode, GitLab. | High-intent acquisition and differentiation tactic. | Traffic, conversion rate, influenced pipeline, competitor-specific win rates. |
| Enterprise trust | Public security/compliance posture and data-residency features. | Security posture likely supports enterprise procurement. | Audit packages, security exceptions, DPAs, and procurement redlines. |
Marketing efficiency cannot be inferred from public evidence alone.
Snyk product pages and IP signals indicate ongoing R&D investment in AI-assisted developer security, AppRisk, SCA, containers, and IaC. Public sources do not disclose engineering headcount allocation, model governance, vulnerability-research process, roadmap commitments, or R&D accounting.
partially verified confidence: medium
Public product pages show a multi-module R&D surface, but technical execution and roadmap evidence remain private.
| initiative | public status | RnD question |
|---|---|---|
| AI-assisted code remediation | Marketed via Snyk Code and AI positioning. | Fix acceptance, model accuracy, secure-code outcomes, liability boundaries. |
| Application risk management | Snyk AppRisk product page. | Asset discovery accuracy, prioritization quality, integration maintenance. |
| SCA/SBOM/license governance | Snyk Open Source and plan features. | License data accuracy, vulnerability feed quality, SBOM adoption. |
| Container and IaC expansion | Container and IaC product pages. | Cloud-provider coverage, Kubernetes relevance, drift/runtime signal, CNAPP overlap. |
Roadmap and delivery metrics are private.
Technical diligence should inspect telemetry and architecture, not just product pages.
partially verified confidence: medium
Public IP signals exist, but patents, trademarks, assignments, OSS obligations, and AI/data rights require legal/technical review.
| signal | public evidence | risk or opportunity | diligence request |
|---|---|---|---|
| Patents | CB Insights reports 9 patents filed. | Some visible IP footprint, but claim scope unknown. | Patent family list, assignments, prosecution status, claim chart, FTO review. |
| Trademarks | Justia search results show SNYK and related marks. | Brand and acquisition-history assets need chain-of-title review. | Official trademark files, renewals, assignments, oppositions, and mark-use evidence. |
| AI/security data assets | Snyk positions AI-assisted code security and vulnerability management. | Potential differentiation and liability/data-rights exposure. | Model cards, data provenance, evaluation metrics, vulnerability database licenses. |
| Open-source compliance | Snyk Open Source and license-compliance product positioning. | Product credibility depends on license-data accuracy and internal OSS compliance. | Internal OSS audit, third-party code provenance, and customer deliverable review. |
IP and OSS claims require counsel and technical audit.
Snyk has public evidence of scale, global offices, a 1,000+ employee base, and a current leadership roster. A notable diligence item is leadership transition because current Snyk pages list Ken MacAskill as interim CEO/CFO while some secondary sources may still show prior CEO information.
verified confidence: high
Current Snyk leadership pages list an interim CEO/CFO and a senior leadership roster; board pages list founder and investor/operator directors.
| name | public role | source | diligence focus |
|---|---|---|---|
| Ken MacAskill | Chief Executive Officer & CFO; described as interim CEO. | Snyk leadership page. | Succession plan, CFO bandwidth, CEO transition, retention plan. |
| Lindsey Bennett | Chief Accounting Officer. | Snyk leadership page. | Accounting controls, close process, audit readiness. |
| Diana Brunelle | Chief People Officer. | Snyk leadership page. | Attrition, hiring plan, compensation, culture. |
| Manoj Nair | Chief Innovation Officer. | Snyk leadership page. | R&D roadmap and AI/product governance. |
| Tom Nielsen | Chief Revenue Officer. | Snyk leadership page. | GTM productivity, pipeline, renewals, customer concentration. |
| Guy Podjarny | Chairman & Founder. | Snyk board page. | Founder continuity, governance, IP assignment, strategic oversight. |
Public role list should be validated against management org chart and board materials.
Verify current reporting structure and succession plan with company records.
Requires HRIS/payroll validation.
partially verified confidence: medium
Snyk states it has a global team over 1,000 employees and global offices; a secondary 2022 employee count should be reconciled to current headcount.
| signal | public value | source | diligence caveat |
|---|---|---|---|
| Employee count 2022 | 1,400 employees in secondary source. | Wikipedia. | Definition and date require company confirmation. |
| Current public headcount language | Global team of over 1,000 employees. | Snyk careers. | May indicate contraction or definitional difference versus 2022 secondary figure. |
| Headquarters and offices | Boston headquarters; offices include Boston, Bucharest, Cluj, Lisbon, London, Ottawa, Singapore, Sydney, Tel Aviv, Tokyo, Zurich. | Snyk about. | Lease commitments and employment-law exposure require review. |
Headcount trend requires company payroll and HRIS records.
Snyk is an active private company with public privacy, terms, security, compliance, and trademark evidence. No legal clearance should be inferred: litigation, customer obligations, employment matters, IP chain of title, DPAs, subprocessors, insurance, sanctions/export controls, and regulatory correspondence require private review.
partially verified confidence: high
Companies House confirms SNYK LIMITED is active, but global entity structure, litigation, claims, insurance, and change-of-control consents are not public.
| matter | public status | verification status | diligence request |
|---|---|---|---|
| SNYK LIMITED corporate status | Active private limited company incorporated 2015-07-09. | verified | Full legal entity chart and all material subsidiaries/branches. |
| Pending lawsuits against Snyk | No comprehensive docket search available in this run. | not_publicly_verifiable | Counsel-run docket searches in US, UK, EU, Israel, and material operating jurisdictions. |
| Threatened claims, settlements, indemnities, insurance | Not public. | not_publicly_verifiable | Claims register, demand letters, settlement agreements, indemnity notices, cyber/E&O/D&O policies, and loss runs. |
Absence of public docket review is not legal clearance.
Legal timeline is not a docket or clearance opinion.
partially verified confidence: medium
Public sources show trademarks/patent signals and compliance/security posture claims, but detailed IP, OSS, DPA, audit, incident, and regulatory materials require private review.
| topic | public signal | risk | diligence request |
|---|---|---|---|
| Trademarks and patents | Justia lists Snyk-related marks; CB Insights reports 9 filed patents. | Ownership, scope, renewals, assignments, and freedom-to-operate remain unverified. | Official patent/trademark files, assignment chain, claim charts, FTO review, and acquisition IP schedules. |
| Privacy and data protection | Privacy policy publicly available. | Cross-border transfer, processor/controller obligations, code telemetry, and sensitive security data. | DPAs, subprocessor list, DPIAs, transfer assessments, incident logs, and privacy counsel memo. |
| Enterprise security commitments | Security and plan pages reference encryption, SOC 2 Type II, GDPR, ISO 27001/27017, FedRAMP options, and data residency. | Customer-specific exceptions and audit obligations may exceed public terms. | SOC 2 report, ISO certificates, FedRAMP package, security questionnaire exceptions, and customer audit rights. |
| Terms, indemnities, export controls, and regulated customers | Public terms are available; enterprise MSAs are private. | Enterprise liability caps, IP/security indemnities, sanctions/export controls, and regulated-customer requirements. | Top customer MSAs, liability caps, indemnities, export-control assessment, sanctions screening, and regulated-customer obligations. |
Public compliance language must be reconciled to audit reports and contracts.
Risk ratings are analyst judgments from public evidence.
| ID | Claim | Status | Sources |
|---|---|---|---|
| EC-001 | CB Insights listed Snyk as a current unicorn with a $7.40B valuation, 2020-01-21 date joined, United States/Boston geography, Enterprise Tech category, and selected investors BOLDstart Ventures, Google Ventures, and Accel. | verified high | S-001 |
| EC-002 | SNYK LIMITED is an active private limited company incorporated in the United Kingdom on 2015-07-09. | verified high | S-004 |
| EC-003 | Secondary public sources describe Snyk as a private computer-security company founded in 2015, headquartered in Boston, with founders Guy Podjarny, Danny Grander, and Assaf Hefetz; the same source reports 2023 revenue of $220M, 2023 net loss of $176M, and 1,400 employees in 2022. | partially verified medium | S-003 |
| EC-004 | Snyk publicly positions itself as an AI security company that helps organizations find and fix security issues across code, dependencies, containers, and cloud infrastructure, with Boston headquarters and global offices. | verified high | S-005 |
| EC-005 | Snyk publicly offers Free, Team, Ignite, and Enterprise plans with features spanning Code, Open Source, IaC, Container, AppRisk, reports, SSO, SBOMs, compliance, and data residency options. | verified high | S-007 |
| EC-006 | Public product pages describe modules for code scanning, open-source dependency and license risk, container security, infrastructure-as-code security, and application risk management. | verified high | S-008S-009S-010S-011S-012S-013 |
| EC-007 | Snyk customer pages cite hundreds of organizations and named customer examples, while the Skyscanner case study says nearly 500 projects were monitored. | partially verified medium | S-014S-015 |
| EC-008 | Snyk exposes a broad ecosystem surface through integrations and partner listings across code hosts, CI/CD, issue tracking, cloud providers, registries, IDEs, and security workflow tools. | verified high | S-016S-017 |
| EC-009 | Snyk faces competition from adjacent developer-security, application-security, cloud-security, secrets-detection, and vulnerability-management vendors; CB Insights names competitors and Snyk comparison pages target GitHub Advanced Security, Veracode, and GitLab. | verified medium | S-002S-024S-025S-026 |
| EC-010 | Snyk states on its careers site that it was founded in London and Tel Aviv in 2015 and has a global team of over 1,000 employees. | verified high | S-006 |
| EC-011 | Snyk current leadership page lists Ken MacAskill as Chief Executive Officer & CFO and describes him as interim CEO; the same page lists Lindsey Bennett, Diana Brunelle, Manoj Nair, Tom Nielsen, and Austin Martin in senior roles. | verified high | S-018 |
| EC-012 | Snyk board page lists Guy Podjarny as Chairman & Founder and lists Mike Scarpelli, Sanjay Poonen, Ken Fox, Ping Li, Philippe Botteri, and Peter McKay as board/advisor figures. | verified high | S-019 |
| EC-013 | Snyk public security, privacy, and plan pages disclose compliance/security posture such as encryption in transit/rest, SOC 2 Type II, GDPR, ISO 27001/27017, FedRAMP plan support, and US/EU/Australia data-residency options. | partially verified medium | S-007S-020S-021 |
| EC-014 | Justia trademark results show SNYK, DEVSECCON, FUGUE, and PROBELY marks associated with Snyk entities; CB Insights says Snyk has filed 9 patents. | partially verified medium | S-002S-023 |
| EC-015 | Public financing data is incomplete; CB Insights profile reports total funding raised of $1.247B and investor names, while the unicorn tracker reports $7.40B latest valuation; detailed cap table, liquidation preferences, debt, secondary sales, and runway are not public. | partially verified medium | S-001S-002 |
| EC-016 | No comprehensive public-source litigation docket review, customer-contract review, employment-agreement review, insurance review, or data-processing agreement review was available in this run; legal exposure remains a diligence gap rather than a cleared item. | not publicly verifiable high | S-004S-021S-022S-023 |
This report is a public-evidence diligence snapshot, not investment advice. Important financial, legal, technical, and contractual facts remain non-public and should be verified directly with management and primary documents before any investment decision.