Dune Security

Dune Security develops a User Adaptive Risk Management platform aimed at the "user layer" of enterprise security. The system simulates social engineering attacks across email, SMS, voice, video and encrypted messaging applications such as WhatsApp, Viber, Signal and Telegram; ingests behavioral and contextual signals from an organization's existing security stack (IAM, secure email gateway, EDR, DLP, HRIS and others); and combines these with role-based business impact to produce a dynamic risk score for each individual user [0][2].

Based on those scores, the platform automatically adapts remediation: just-in-time and role-based microtraining for most users, and escalated measures for the highest-risk cohort, including access-restriction workflows, risk-based enforcement recommendations routed to control systems, and performance-management visibility for leadership. Executive reporting and exposure prioritization surface aggregate user risk, threat exposure and security posture [0]. Dune positions this as a replacement for legacy security awareness training (SAT), which it characterizes as treating all employees identically regardless of access level, behavior or real-time risk [0][2].

A content arm, Dune Studio, produces the training library, which covers security awareness topics (phishing, smishing, synthetic identities, SaaS and SSO phishing, collaboration-tool attacks, AI basics), compliance modules (NIS2, NIST standards, CCPA access rights, PII regulations) and role-based training for finance, HR, help desk and executives, with multi-lingual content and custom material including deepfakes used for red teaming [3].

Founding story

Co-founders David DellaPelle and Michael Waite met as strangers at JFK Airport during a four-hour flight delay caused by a cybersecurity incident; both were traveling to Portugal, and the flight was rerouted to the Azores, where DellaPelle pitched the idea. DellaPelle had previously worked at AI and cybersecurity startups from pre-seed through post-Series D and had attempted several earlier ventures. The pair began building in April 2023 and joined the Antler accelerator in New York after initially being rejected. DellaPelle attended Cornell and NYU; Waite attended BYU [6][7].

Business model

Dune Security sells an enterprise software platform to organizations, with demo-led sales ("Book a Demo") and a gated content library offering previews and "Get Full Access" tiers. The platform bundles attack simulation, training content and risk-based automation, and integrates with customers' existing security tooling [0][3].

Traction

Dune Security states it is trusted by Fortune 1,000 companies and has published customer case studies with Hugo Boss, OSF HealthCare, Culligan, Hitachi Digital and Stevens Institute of Technology. The company reports customer outcomes including a 25% decrease in average organizational risk scores within three months, an 80% decrease in time spent managing training logistics, and a 75% reduction in time spent on PCI DSS compliance training completion (to 15 minutes per person per year) [2][4][7].

Latest developments

Dune Security announced a partnership with Abstract Security in December 2025 to combine real-time detection with automated risk remediation, and a partnership with OmegaBlack in January 2026 connecting dark web exposure intelligence with user-level risk scoring and remediation. It published customer case studies with Hitachi Digital and Stevens Institute of Technology in April 2026, alongside research on multi-channel phishing, AI agent attack surface and sector-specific user risk [4].