Socket secures $40M to combat next-generation software supply chain attacks led by industry titans Abstract Ventures, Elad Gil, and a16z
Socket safeguards companies from software supply chain attacks by detecting and preventing threats in open source code and empowering developers to secure their applications and critical services against malware and other security risks.
Feross Aboukhadijeh
October 22, 2024
San Francisco, CA — October 22, 2024. With over 90% of modern applications built on open source, security has become more critical than ever. Traditional Software Composition Analysis (SCA) tools are struggling to keep up with the rising tide of supply chain attacks. Helping to tackle the problem, the #1 platform protecting software from supply chain attacks Socket, which is today announcing a $40M funding round, is laser-focused on proactively monitoring open source packages for malicious behaviors like backdoors, typo-squatting, and obfuscated code.
The Socket Series B $40M funding round was led by Abstract Ventures, with participation from Elad Gil, Andreessen Horowitz (a16z), and a stellar group of angel investors including Bret Taylor (OpenAI), Phil Venables (Google), Scott Johnston (Docker), Christina Cacioppo (Vanta), Ann Mather (Pixar, Alphabet, Netflix, Airbnb), and Tobias Lütke (Shopify), among others. This latest round brings Socket’s total funding to $65M, fueling its mission to modernize security for open source software and build out its team across engineering, product, and design.
“We’ve seen incredible momentum over the past year,” said Feross Aboukhadijeh, founder and CEO of Socket. “Our technology has made it possible for leading AI, B2B, and finance companies to switch from legacy SCA solutions like Snyk to Socket. We’re not just catching vulnerabilities — we’re detecting and blocking malicious threats in real time.”
Socket Dashboard: Showing alerts detected within your organization's repositories
A New Standard for Software Supply Chain Security#
Socket’s platform now supports six programming languages, including newly added Java and Ruby, and handles critical use cases like license enforcement and reachability analysis — making it a comprehensive replacement for legacy tools.
“Attackers are evolving their supply chain attacks and legacy tools aren’t catching them,” said Jason Clinton, CISO at Anthropic. “Socket’s real-time threat detection helps strengthen our security posture, even from zero-day supply chain attacks.”
Socket package details and scores
“As generative AI drives unprecedented speed in software development, the risk of malicious or vulnerable packages slipping through is higher than ever,” said Amjad Masad, Founder and CEO at Replit. “Socket provides preventative protection, catching threats before they can compromise organizations and enabling developers to innovate without sacrificing security.”
“If you haven't explored Socket yet, now's the time,” said Dev Akhawe, Head of Security at Figma.
In the last 12 months, Socket has shipped groundbreaking features, including AI-powered threat detection for software dependencies in six programming language ecosystems which have enabled it to detect and block over 100 software supply chain attacks every week. This pace of innovation has been key to Socket’s rapid growth, with the company now protecting over 7,500 organizations and 300,000 GitHub repositories.
“Socket is revolutionizing how companies secure their software,” said Ramtin Naimi, Founder and Managing Partner at Abstract Ventures. “As organizations face increasing software supply chain threats, Socket’s preventative and developer-friendly approach is exactly what’s needed. Socket’s ability to rip-and-replace legacy SCA tools has already made Socket the go-to solution for leading companies that want to massively up-level their application security. We’re proud to lead their Series B and support them in their mission to make open source software safer for everyone.”
“Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry,” said Elad Gil, investor and co-founder at Color Health. “It’s rare to see a team ship this fast and deliver such a meaningful impact.”
With fresh capital, Socket plans to accelerate its product development and expand its team. The company is actively hiring for roles in engineering, product, and sales as it scales to meet the growing demand for Socket’s next-gen application security platform. “We’re building a world-class team to tackle one of the most urgent challenges in software today,” said Feross.
As supply chain attacks grow more frequent and sophisticated, companies need to move beyond reactive security measures. Socket’s mission is clear: to stop supply chain threats before they’re inside your organization, providing the peace of mind that developers and security teams need to focus on what they do best — building great products.
For more information, visit https://socket.dev and join the team that’s reshaping the future of software security.
Ramtin Naimi, Founder and Managing Partner at Abstract Ventures: “Enterprises that adopt Socket are realizing an immediate ROI by cutting the massive burden of managing endless security alerts and proactively preventing costly software supply chain compromise. Socket has emerged as the enterprise developer standard and the central hub for companies to secure their open source dependencies.”
Elad Gil, investor and co-founder at Color Health: “Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry. It’s rare to see a team ship this fast and deliver such a meaningful impact. I’m thrilled to have a chance to work with them on their incredible growth trajectory.”
Zane Lackey, General Partner at Andreessen Horowitz and Co-founder at Signal Sciences: “This team knows how to build products that developers love, they understand security, and they’re tackling an urgent problem for a community they’ve been part of for more than two decades.”
Martin Casado, General Partner at Andreessen Horowitz: “Socket shows all the signs of becoming an iconic security company.”
Scott Johnston, CEO at Docker: “At Docker, we’re all about helping developers build securely and productively. Socket is a perfect complement to that mission, catching vulnerabilities and malicious code early in the process. It’s a critical tool for anyone working with open source, and developers are adopting it quickly.”
Christina Cacioppo, Co-founder and CEO at Vanta: “Scaling securely means building trust—and compliance is a big part of that. Socket’s new approach to vulnerability management adds meaningful depth to application security, providing the visibility needed to build confidence and meet compliance goals by staying ahead of emerging risks.”
Dylan Field, Co-founder and CEO at Figma: “As a long time open source maintainer, Feross knows the challenges of supply chain attacks better than anyone. Socket’s vision for securing the software supply chain tackles a complex problem with a developer-first approach, and I believe they have an opportunity to build a generational security platform.”
Dane Stuckey, Chief Information Security Officer: “Modern software is built on open-source, and our adversaries have learned that software supply chain attacks are one of the most successful ways to penetrate organizations. Nation-state actors in particular have invested substantial time, energy, and resources to target critical infrastructure via these methods. Socket is a critical partner in preventing these attacks by identifying malicious third party code in supply chain components. High-security organizations, including governments and defense, need to adopt a zero-trust approach not only for their networks, but for all the software components which they build their enterprises on. Socket gives organizations the tools needed to vet, interrogate, and secure their systems early, rather than reacting after a threat is discovered. I’m excited about what they’re building, and the impact it can have in institutions where security is non-negotiable.”
Ryan Dahl, Node.js inventor & Deno co-founder & CEO: "As the inventor of Node.js and Deno, I know the critical need for better safeguards in the open-source ecosystem. Socket addresses a key gap by proactively stopping harmful dependencies before they can cause issues. Socket lets developers build with confidence without compromising engineering velocity.”
Jason Clinton, CISO at Anthropic: “Attackers are evolving their supply chain attacks and legacy tools aren’t catching them. Socket’s real-time threat detection helps strengthen our security posture, even from zero-day supply chain attacks.”
Guillermo Rauch, Founder and CEO at Vercel: “At Vercel, we care about giving developers tools to build, scale, and secure a faster web. Socket is one of the rare companies that enables security without compromising developer experience. Customers can adopt the latest open-source tools without second-guessing every dependency. That’s a game-changer.”
Devdatta Akhawe, Chief Information Security Officer at Figma: “Socket is a natural fit for us because it's frictionless and doesn't get in the way of developers.”
Amjad Masad, Founder and CEO at Replit: “As generative AI drives unprecedented speed in software development, securing the software supply chain has become mission-critical. With AI-powered tools generating the majority of new code and even importing third-party dependencies, the risk of malicious or vulnerable packages slipping through is higher than ever. Socket provides preventative protection, catching threats before they can compromise organizations and enabling developers to innovate without sacrificing security.”
Aaron Davis, MetaMask founder: "Managing a large dependency graph when security is mission critical can be an overwhelming task. With Socket, we get actionable insights right in the pull request. This helps keep MetaMask safe without slowing down development velocity. We're excited to see them grow with this new investment."
Yan Zhu, Chief Information Security Officer at Brave: “For many years, organizations have been installing open source dependencies without insight into potential vulnerabilities and issues. Socket is like an X-ray into open source dependencies, going above and beyond to detect issues that aren’t yet known vulnerabilities within the security community. It’s so easy-to-use, it’s a no-brainer.”
Aaron Brown, Head of Security at Vercel: "Socket goes beyond relying solely on CVEs or third-party sources for threat intelligence. They conduct first-hand analysis to identify unknown issues in open-source dependencies before they can impact our code. Early detection, coupled with supporting documentation, means Socket not only strengthens our security but also saves valuable time and resources that would otherwise be spent on remediation efforts."
Want to be part of this journey? We're recruiting for various roles – from engineering, security, operations, and sales. Explore roles at socket.dev/careers.
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.
