Young "bug bounty hunter" bags $6M pre-seed round for security startup

2026-03-17 · Source: Tech.eu - Tech.eu · Field: Technology & Digital — Cybersecurity & Data Privacy, Emerging Technologies & Innovation · Depth: Fundamental Awareness, quick

Summary

French cybersecurity startup Lupin & Holmes, founded by 23-year-old "bug bounty hunter" Roni Carta, has secured a \$5.9 million pre-seed round led by Harry Stebbings' 20VC and Seedcamp. Carta, who earned nearly \$800,000 from companies like Google and Amazon by identifying vulnerabilities, developed an upstream security platform called Depi. This platform maps real attack paths in a company's code, addressing his insight that hackers exploit these upstream layers rather than front doors. With existing traction among Fortune 500 clients, including Ledger, the funds will be used for hiring, research, and further product investment, grounded in a strong "hacker culture."

Key takeaway

Bug bounty veteran Roni Carta's Lupin & Holmes secured a \$5.9M pre-seed for Depi, an upstream security platform that proactively maps real attack paths in early code layers. Leveraging Carta's \$800k earnings from FAANG bug bounties, this "hacker culture" approach targets vulnerabilities where breaches typically originate, preventing attacks before they happen. This highlights a critical shift towards deep, proactive defense strategies, offering valuable insights for securing complex AI/ML infrastructure and data.

Topics

• Cybersecurity Startup
• Bug Bounty Hunting
• Pre-seed Funding
• Upstream Security Platform
• Enterprise Security

Best for: CTO, VP of Engineering/Data, Security Engineer, Entrepreneur, Investor

Related on AIssential

• From Arsène Lupin To Upstream Security: How Roni Carta Turned A Teenage Hacking Obsession Into Depi — A teenage hacking obsession can evolve into a venture-backed cybersecurity startup focused on supply chain attack prevention.
• Bug bounty businesses bombarded with AI slop — AI tools are overwhelming bug bounty programs with low-quality reports, necessitating program adaptation and AI-driven triage.
• Exaforce raises $125M Series B to build AI for catching and stopping cyberattacks as they happen - The Tech Buzz — Predictive AI cybersecurity is gaining significant investment as enterprises seek real-time threat neutralization.
• White Circle raises $11M to help companies secure and monitor AI model behavior — White Circle raised $11M to secure AI models against jailbreaks and prompt injections using real-time input/output monitoring.
• Introducing the OpenAI Safety Bug Bounty program — OpenAI's new bug bounty targets AI-specific abuse and safety risks beyond traditional security vulnerabilities.
• AI‑enhanced DDoS‑for‑hire operations increased rapidly in 2025—report — The NETSCOUT DDoS Threat Intelligence report for H2 2025 reveals a significant surge in "AI-enhanced DDoS-for-hire operations," contributing to increased global attack volume and sophistication.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Tech.eu - Tech.eu.