Florian Walter
Co-founder & CTO
Built by the people who found the flaws.
Application security was built around how engineers write code, not around how security is actually run inside enterprises. We spent our careers in that gap, and built the mechanism we could not buy.
35 years inside Tier 1 enterprises, on both sides.
We built their defences. Then we were paid to break them. LeoTrace judges code the way we did.
Patrick Rycroft
Co-founder & CEO
Boy Baukema
Head of Security Research
The hard question is no longer how do you fix it. It’s who do you trust to measure it.
01
We built the engines
A decade as Veracode’s most senior security researcher, deciding which vulnerability classes a commercial engine would and would not catch.
02
We hardened the banks
Years advising and hardening some of the largest enterprises on the planet, inside their controls and on their release schedules.
03
We tested them
Then years exploiting the same vulnerability classes, under contract, against institutions like them.
04
We sold to them
Into named Tier 1 financial institutions across the US and UK, watching findings accumulate faster than any team could act on them.
We wrote the criteria.
Detection is a judgement, not a pattern match. These are the rules that judgement runs on, and the control you have over them.
Written from production
Every rule comes from a vulnerability class we have watched break a production system, not from a category in a taxonomy.
Precision is stated, not implied
Every rule carries the conditions under which it does not apply, so a finding that does not apply is never raised.
Judged, not matched
The rules are the criteria. A frontier model applies them to the change in front of it, in the turn that wrote it.
Measured in production
Stated sample sizes and figures from production code rather than only purpose built test applications. Method shared under NDA.
Tuned to your appetite
Whether log output should be encoded is a real argument. Defaults sit at account level, and you decide whether individual repos may override them.
I’ve spent my career tracing how one flaw becomes a hundred. A human does that slowly, one file at a time. AI does it in seconds, across everything.
Florian Walter
Co-founder & CTO
Backed to build the index for agentic engineering.
The answers a risk function asks for before a pilot, stated up front rather than on request.
Founded
2025, London, United Kingdom
Funding
Pre-seed closed 2026, led by Twin Path with Outward and GEC Capital.
Team
Security research, product design, engineering and operations. Hiring across research and enterprise engineering.
Talk to the people who built it.
Forty-five minutes with your security and platform leads. No slides unless you want them.