Mallory

Mallory is an Austin, Texas company founded in 2024 that develops what it calls an AI-native threat and exposure management platform. The system continuously ingests thousands of open, commercial, and underground sources — vendor advisories, dark web forums, research blogs, GitHub disclosures, government feeds, and vulnerability/CVE data — and resolves them into a single structured threat graph of actors, campaigns, vulnerabilities, and observables, with each claim linked to its supporting evidence.

The platform then connects to tools a customer already runs, including code repositories, cloud, EDR, identity, SaaS, ticketing, and asset inventory systems, and reads each incoming threat against the customer's actual assets to determine whether the organization is in scope. Exposures are ranked by observed adversary behavior rather than by static severity scores, and the resulting work is routed into tickets, detections, and remediation workflows under customer-defined policy guardrails, with human review and override at each step and verification that an exposure has been closed. Scheduled agents run recurring exposure checks across repositories, supply chain, and CI/CD.

Mallory positions itself as an upstream reasoning layer that feeds downstream systems such as CTEM and exposure management, SOAR and ticketing, AI SOC, vulnerability management, SIEM, and EDR. Connectivity options include native support for Claude Code, the Model Context Protocol, an open REST API, and webhooks, alongside more than 40 other integrations. The company also publishes open-source tooling on GitHub, including an MCP server (archived), a Python API client, and a Go CLI exporter for the Mallory API.

Founding story

Founder and CEO Jonathan Cran spent roughly two decades in security, beginning as a network administrator and working as a penetration tester at Rapid7, then founding Intrigue, an open-source attack surface project that was integrated into Mandiant and became part of Google Threat Intelligence. He describes repeatedly encountering security teams working across narrow tools and assembling context manually, and left Google in 2024 to start Mallory.

Business model

Mallory sells a SaaS platform to enterprise security teams, offered with a free trial (14 days per the company site; a 30-day trial was cited at launch) that provides full platform access without a credit card, with usage described as opt-in.

Subscription software delivered as a SaaS platform with integrations across existing security tooling.

Traction

The company cites early adopters including Texas Mutual Insurance and a Fortune 500 healthcare threat intelligence team, plus an endorsement from HD Moore, creator of Metasploit and CEO of runZero. Its public GitHub organization hosts four repositories updated through mid-2026.

Latest developments

In April 2026 Mallory launched its platform for general availability as SaaS and announced a seed round led by Decibel Partners with participation from Live Oak Venture Partners and angel investors from Google, Robinhood, Cisco, Fastly, and GreyNoise. The company states that adversary-weighted prioritization ships today, while routing into ticketing and detections is live where supported and expanding, and pre-computed exposure on ingest remains on the roadmap.