Intrinsic
AcquiredPalo Alto, US · 6 known investors
Application and serverless security startup, acquired by VMware in 2019, that restricted what code could do at runtime.
Also known as GitStar
Investors · 6
Also in the syndicate · 1
Company profile
researched Aug 2026Intrinsic was an application security company that applied the principle of least privilege to running applications, aiming to reduce an application's attack surface to the minimum required and to protect sensitive resources against code injection attacks, malicious third-party modules, zero-day exploits and bugs. Rather than analyzing or monitoring application behavior as many application-layer defenses do, its technology ensured that code executed only as expected and blocked privileged operations not whitelisted by an organization's security policies.
The company focused in particular on Node.js applications, where, by its account, most of a typical modern application consists of untrusted open-source code that interacts with sensitive resources. It also targeted serverless computing environments, letting organizations define fine-grained policies that AWS Lambda functions had to obey at runtime, with support for Microsoft Azure Functions and Google Cloud Functions. Intrinsic stated its approach was fully compatible with legacy code, so customers did not have to change how they wrote or deployed applications.
Founded in 2015 and formerly known as GitStar, Intrinsic was based in San Francisco and had roughly 10 employees at the time of its acquisition. VMware confirmed the purchase in August 2019, saying the deal brought expertise and technology for expanding the VMware AppDefense platform into the public cloud.
Founding story
Intrinsic was founded in 2015 and previously operated under the name GitStar before adopting the Intrinsic name.
Latest developments
VMware confirmed the acquisition of Intrinsic in August 2019, citing plans to expand its AppDefense platform into the public cloud.
▸Full profile — market position, technology, go-to-market, geography, history
Market position
Intrinsic was a small, early-stage entrant in application and serverless runtime security; it was the second serverless security company acquired in 2019, three months after Palo Alto Networks purchased Israeli startup PureSec for $47 million. Following the acquisition, its technology was positioned to extend VMware's AppDefense platform into the public cloud.
Unlike security tools that defend against application-level attacks by analyzing or monitoring behavior, Intrinsic constrained execution itself, permitting only expected code paths and whitelisted privileged operations, while remaining compatible with existing code bases.
Technology
Intrinsic's software enforced least-privilege policies on applications at runtime, blocking privileged operations that were not whitelisted by an organization's security policies. It targeted Node.js applications, where untrusted open-source dependencies interact with sensitive resources, and extended to serverless platforms, allowing fine-grained runtime policies for AWS Lambda functions as well as Microsoft Azure Functions and Google Cloud Functions. The company said the approach was compatible with legacy code, requiring no changes to how customers wrote or deployed applications.
Go-to-market
Organizations and software development teams running Node.js applications and serverless workloads on public cloud platforms including AWS Lambda, Microsoft Azure Functions and Google Cloud Functions.
Geography
Headquartered in San Francisco, California; acquirer VMware is based in Palo Alto, California.
History
The company was founded in 2015 as GitStar and raised seed funding in August 2016 from Andreessen Horowitz, First Round Capital, NEA and the Stanford Start-X Fund. On August 20, 2019, VMware confirmed it had acquired Intrinsic for undisclosed terms, making it one of a series of VMware acquisitions that year alongside AetherPal, Bitnami, Avi Networks, Bitfusion.io, Uhana and Veriflow.
Compiled by commissioned research from 8 cited public sources — announcements, filings, and press listed under research sources below.
Key figures
latest reportedCompany-reported or press-reported figures, each dated to when it was claimed — not independently audited.
Timeline · 2
launches, deals, and filingsVMware confirmed it had acquired San Francisco-based serverless and application security startup Intrinsic; terms were not disclosed. VMware said the deal added expertise and technology for expanding its AppDefense platform into the public cloud.
Intrinsic raised seed funding in August 2016; amount not disclosed.
Dated company events from announcements, filings, and press; legal rows summarize public dockets and regulator releases.
▸Research sources · 8
primary sources listed
8 public sources were cited for this profile; the first-party ones are listed here.
Frequently asked questions
- What does Intrinsic do?
- Application and serverless security startup, acquired by VMware in 2019, that restricted what code could do at runtime.
- Who are Intrinsic's investors?
- Intrinsic's investors include 83North, August Capital, Mango Capital, New Enterprise Associates (NEA), Streamlined Ventures.
- Where is Intrinsic headquartered?
- Intrinsic is headquartered in Palo Alto, US.