Patchstack

Patchstack is a security company focused on vulnerability intelligence and mitigation for websites built on open-source software, primarily WordPress and its plugin and theme ecosystem, with recently announced coverage for Node.js applications used by web hosts. Its core product, RapidMitigate, runs inside the website itself rather than at the server layer and deploys targeted mitigation rules that block exploitation of known vulnerabilities without requiring code changes or immediate updates. The company states this approach prevents up to 74% more vulnerabilities from being exploited than leading web application firewalls, and that it maintains over 12,000 (elsewhere cited as 16,720 in its public database) unique mitigation rules. Capabilities include software composition analysis, contextual prioritization based on known exploited vulnerabilities, remote software management, custom protection rules, an IP blocklist module, WordPress-specific hardening, a threat intelligence API, reporting features and support for PCI-DSS 4.0 requirements.

Patchstack operates a public open-source vulnerability database that lists tens of thousands of vulnerabilities in WordPress plugins and themes as well as npm packages, along with triage status and mitigation availability. The company reports it disclosed more than 4,100 vulnerabilities in 2024, published 76% of all known WordPress-related security vulnerabilities in 2023 and became the largest CVE Naming Authority by volume that year. It runs a Zero-Day Bug Bounty Program, which awarded a $14,400 bounty for a critical LiteSpeed Cache plugin vulnerability, and a managed vulnerability disclosure program (VDP) platform developed with the European Union that is free to plugin and theme developers and is positioned to help projects comply with the European Cyber Resilience Act. Around 900-944 plugins installed on millions of sites list Patchstack as a security point of contact.

The team is fully remote and international, led by co-founder and CEO Oliver Sild, with Dave Jong as CTO, Siobhan McKeown as COO, Darius Sveikauskas leading bounty and data, and staff across security research, engineering, marketing, sales, customer success and finance.

Founding story

Co-founded by Oliver Sild, who serves as CEO, together with CTO Dave Jong, whose bio describes starting a software company via Reddit.

Business model

Patchstack sells subscription security software directly and through channel partners. A Developer plan is priced at $69 per month billed annually ($828/year) covering website licenses and three seats, with additional seats at $24 per seat per month and additional bundles of five sites at $12.50 per month. Enterprise and Web host plans use custom billing and add extended API endpoints, SLAs, data processing agreements and dedicated rollout support. Web hosting partners resell or bundle Patchstack as an add-on, which the company positions to them as a new security revenue stream.

Recurring subscription fees per website/seat for individual developers and agencies, custom enterprise contracts, and infrastructure-wide licensing for hosting providers; personal plans are distributed via partners and resellers.

Traction

Public database totals of 51,314 entries with 16,720 mitigation rules; 12,000+ mitigation rules cited on the site; 4,100+ vulnerabilities disclosed in 2024 (13% highly exploitable); exclusive vulnerability intelligence for 944 WordPress plugins and roughly 900 plugins naming Patchstack as security contact. Partner testimonials cite 631,500+ threats blocked in the first month across WP Umbrella sites, prevention of more than 56,000 vulnerabilities in one managed WordPress environment, and protection against 1.3 million vulnerabilities over six months for another partner's users. Product rating cited as 4.9 stars.

Latest developments

Announced expansion of its protection to Node.js applications for web hosts, added remote software management and extended API endpoints to its plans, and closed a $5M Series A in 2024 intended to accelerate product development and build sales and marketing functions.