ShiftLeft
Santa Clara, US Β· Founded 2016 Β· Delaware corporation Β· 4 known investors
Application security company, now branded Qwiet AI by Harness, offering code analysis that prioritizes reachable, exploitable vulnerabilities.
Also known as Qwiet AI Β· Qwiet AI by Harness Β· Shiftleft Inc Β· ShiftLeft Inc.
Founders & leadership
ShiftLeft was founded in 2016 by Chetan Conikee Sathyanarayana and Manish Gupta.
Board
Investors Β· 4
Also in the syndicate Β· 2
Reported raises Β· per SEC filings
Form D private placements$15.2M disclosed across 1 of 4 rounds Β· 2017β2021
βΆ$15.2MraisedNov 2018 Β· 5 investors Β· Other TechnologyRule 506(b)
- Chetan Conikee SathyanarayanaExecutive Officer, Director
- Urshit ParikhDirector
- Manish GuptaExecutive Officer, Director
- Umesh PadvalDirector
- Enrique SalemDirector
- Offering amount
- $20M
- Amount sold
- $15.2M
- First sale
- Oct 2018
- Incorporated
- Corporation, Delaware, 2016
- Federal exemptions
- 06b
Source: SEC EDGAR Form D. Amounts as filed; amended filings shown once at their latest values.
Company profile
researched Aug 2026ShiftLeft, Inc. is a Santa Clara, California-based application security company founded in 2016 and publicly launched in October 2017. Its platform combines static code analysis with application instrumentation to identify vulnerabilities and protect running applications, an approach the company described as "code-informed runtime protection" and "runtime-informed code analysis." The core technology is a Code Property Graph that maps abstract syntax trees, control flow graphs, call graphs, program dependency graphs and directory structures to build a model of an application, which is then used to detect vulnerabilities in context and to configure lightweight "microagents" that block or alert on activity targeting the specific weaknesses present in each application version. The company also shipped Ocular, a product built around a CPG Query Language (CPGQL).
The product is now marketed as Qwiet AI by Harness and is presented on shiftleft.io as part of the Harness platform. It consolidates SAST, software composition analysis, infrastructure-as-code, container and secrets scanning into a single scan, uses reachability and exploitability filters to prioritize findings, and adds AI agents that generate unit-tested code fixes ("AI Autofix"). Documented platform capabilities include support for Java, Scala, Python 3.10+, Go 1.21, C#/ASP.NET Core and PHP (beta); SBOM generation and export in CycloneDX and SPDX formats with OSS licensing data and exploitable-CVE counts; CWE reports exportable as PDF or HTML; build rules including license checks; trend and comparison reporting; personal access tokens; and integrations with Jira, GitHub pull requests, Azure DevOps Pipelines, AWS CodeBuild and CI/CD pipelines generally.
Founding story
The company was founded in 2016; Manish Gupta served as CEO and co-founder and Chetan Conikee as CTO. Gupta described the founding vision as making application security a seamless part of the development process rather than an afterthought, arguing that existing tools were inaccurate and heavily manual.
Business model
Software platform sold to enterprises, with a free tier, a 15-day premium trial permitting scanning of up to 10 applications concurrently, and team/enterprise subscriptions that unlock reporting, API access and enterprise-level support.
Tiered subscription software (free tier, premium trial, team/enterprise subscriptions with enterprise support).
Traction
Customers cited in 2019 coverage include Nutanix (Nutanix Epoch), Raytheon and Tavant. The company raised roughly $58 million in total across rounds through 2021 and reported plans to hire aggressively across departments. Product documentation shows a continuous release cadence from 2020 through at least December 2023.
Latest developments
The shiftleft.io site (Β© 2025) presents the product as Qwiet AI by Harness, part of the Harness platform, centered on a single consolidated scan, reachability/exploitability prioritization and AI agents that produce production-ready, unit-tested fixes in about five minutes. Documentation for 2023 records general availability of Python 3.10+ support, a new Qwiet AI by Harness dashboard with a sankey findings chart, PHP exclusions, Go 1.21 support, auto-language detection, SBOM exports with exploitable CVE counts, an ARM64 Docker image, and migration of all users to the new UI.
βΈFull profile β market position, technology, go-to-market, geography, history
Market position
Positioned as an application security testing vendor differentiating on accuracy and speed against traditional SAST/DAST tooling. In September 2018 the company reported a 100% true positive rate with 25% false positives on the OWASP Benchmark for Security Automation v1.2, which it said beat the commercial average by 45%. It was named a winner of the 2020 SINET 16 Innovator Award.
Emphasizes low false-positive rates and prioritization by reachability and exploitability rather than raw vulnerability counts, consolidation of SAST, SCA, IaC, container and secrets scanning into a single scan, and AI-generated, unit-tested fixes rather than findings alone. Marketing claims include a 97% true positive rate, 90% fewer false positives, 10x faster scans and a 95% reduction in remediation time.
Technology
The platform is built on a Code Property Graph that unifies abstract syntax trees, control flow graphs, call graphs, program dependency graphs and directory structures to reason about application context and detect complex, multi-component vulnerabilities. That analysis drives code-informed microagents deployed with each software release, which are described as having minimal latency, memory and CPU impact because they know precisely which parts of an application are vulnerable. Ocular exposes the graph through a CPG Query Language. The current Qwiet AI product adds reachability and exploitability filtering, EPSS scoring, secrets detection with field-level tracking, SBOM generation (CycloneDX, SPDX), CWE reporting, and AI agents that produce verified, unit-tested code fixes.
Go-to-market
Sold through direct enterprise sales and marketing; the 2019 Series B funded expansion of global sales and marketing, including the hire of a vice president of worldwide sales, and the company assembled an external advisory board of security and engineering leaders. Adoption is developer-led in practice via CI/CD pipeline and IDE integrations, a free tier and self-service trials, with demo requests on the website.
Enterprise application security, DevSecOps and development teams. Named customers include Nutanix, Raytheon and Tavant; website testimonials reference healthcare and biotech, retail, finance and services companies with revenues from $50M to over $10B, and the site references Fortune 500 AppSec programs.
Geography
Headquartered in Santa Clara, California, United States, with stated global sales and marketing expansion following the 2019 Series B.
History
Founded in 2016 in Santa Clara, California, ShiftLeft launched publicly in October 2017 after a first funding round of $9.3 million. A $20 million Series B led by Thomvest Ventures closed in February 2019, bringing total funding to nearly $30 million, alongside the hire of a VP of worldwide sales and the formation of an advisory board. In 2020 the company expanded dashboard reporting, GitHub and Jira integrations, and Ocular, and won the SINET 16 Innovator Award. It later raised $29 million in expansion capital led by Blackstone Innovations Investments and SYN Ventures, taking total funding above $58 million. The product was subsequently rebranded Qwiet AI and, per the current website and documentation, is offered as Qwiet AI by Harness.
Compiled by commissioned research from 8 cited public sources β announcements, filings, and press listed under research sources below.
Key figures
latest reportedCompany-reported or press-reported figures, each dated to when it was claimed β not independently audited.
Competitors Β· 10
by search overlap
Companies competing with ShiftLeft for the same Google search keywords, organic and paid, via search-intersection analysis.
Non-dilutive funding Β· 1 SBIR/STTR award
Federal grants β no equity taken| Agency | Phase | Year | Amount |
|---|---|---|---|
| U.S. Air ForceAir Force | Phase I | 2020 | $50K |
Source: SBIR.gov award data (U.S. Small Business Administration). SBIR/STTR awards are competitive federal R&D grants and contracts β non-dilutive capital alongside any venture rounds above.
Timeline Β· 11
launches, deals, and filingsSupport for applications written in Python 3.10 or later became generally available via the --pythonsrc flag; OSS findings on the applications list page gained a severity breakdown.
The updated UI became generally available and all users were migrated; the classic UI was retired. Also added Go 1.21 analysis, SBOM exports with exploitable CVE counts and an ARM64-compatible Docker image.
Beta support for PHP applications, detailed OSS licensing information in generated SBOMs, license-based build rules, and EPSS score and exploitability status filters.
Round led by Blackstone Innovations Investments and SYN Ventures with participation from previous investors, bringing total raised to over $58 million; proceeds earmarked for hiring, sales and marketing, and cloud-native product development.
$29M source β
Reporting added to the dashboard for premium trial and team/enterprise subscribers, plus a 15-day premium trial allowing scanning of up to 10 apps with API and reporting access.
Ocular release 0.4.1 introduced a major rearchitecture of the CPG Query Language (CPGQL), requiring a user migration.
Series B led by Thomvest Ventures with new investor SineWave Ventures and existing investors Bain Capital Ventures and Mayfield, bringing total funding to nearly $30 million. Funds earmarked for product portfolio breadth, application coverage and global sales and marketing.
$20M source β
Sortino, previously in executive roles at Trend Micro and Dome9 Security (acquired by Checkpoint), was named VP of worldwide sales.
Advisory board announced with Bob Flores (former CTO, CIA), Craig Rosen (CISO, AppDynamics), Shahar Ben Hador (CIO, Exabeam), Aaron McKeown (Xero), Manish Arya (Tavant) and Yonatan Ryabinski (Vanguard).
ShiftLeft launched in October 2017, a year before its OWASP Benchmark results were published.
Dated company events from announcements, filings, and press; legal rows summarize public dockets and regulator releases.
Legal entities Β· 1
corporate structureβΈResearch sources Β· 8
primary sources listed
- ShiftLeftshiftleft.io Β· web
8 public sources were cited for this profile; the first-party ones are listed here.
Frequently asked questions
- What does ShiftLeft do?
- Application security company, now branded Qwiet AI by Harness, offering code analysis that prioritizes reachable, exploitable vulnerabilities.
- Who founded ShiftLeft?
- ShiftLeft was founded by Chetan Conikee Sathyanarayana, Manish Gupta in 2016.
- Who are ShiftLeft's investors?
- ShiftLeft's investors include Bain Capital Ventures, Wipro Ventures.
- How much funding has ShiftLeft raised?
- ShiftLeft has disclosed $15.2M raised across 1 of its 4 known rounds.
- Where is ShiftLeft headquartered?
- ShiftLeft is headquartered in Santa Clara, US.