Tolmo

Tolmo is a security platform that deploys fleets of autonomous AI agents across a customer's production stack. The system first builds a live "Production Knowledge Graph" that ingests context and metadata from cloud providers, code repositories, CI/CD pipelines, containers, databases, identity systems, observability tools and third-party security vendors, then links code to its deployments and surrounding services. Specialized agents reason over this graph on every pull request, deployment and alert so that findings arrive with full environmental context rather than as isolated signals.

The product includes a Pentesting Agent that performs continuous adversarial testing of live environments and aims to prove real exploitability, an Internal Discovery Agent that inventories assets and infers cross-service dependencies from configuration while classifying what datastores hold and who accesses them, and a Remediation Agent that ships verified fixes, reviews changes at the pull-request level against the graph and computes blast radius. Tolmo also markets a 24/7 incident response team for customers under attack. Its stated coverage extends across code, CI, cloud applications and specification documents, with agents triaging, verifying impact and remediating autonomously and escalating to humans only when necessary.

A command-line interface is available (installable via Homebrew, an install script or a Debian package) that lets teams run SQL and Cypher queries against the infrastructure graph, manage and triage security findings with an audit trail, proxy authenticated requests to connected services such as GitHub, AWS, Linear, Sentry and Datadog without credentials leaving the backend, download threat-model pipeline artifacts, manage Datadog monitors, query historical graph state via temporal attributes, and install a Tolmo skill into Claude Code and other AI agents.

Founding story

The four co-founders — Pierre Betouin, JB Aviat, Vlad de Turckheim and Arnaud Breton — previously built Sqreen, an early runtime application security company that reached 800 customers in production and was acquired by Datadog in 2021. They then spent years building Datadog's security business and working with engineering and security teams across thousands of companies. According to the founders, observing how runtime observability transformed engineering work, and the widening gap between development velocity and security tooling as AI generates code, led them to start Tolmo as the tool they wanted but could not find.

Business model

Tolmo sells a SaaS security platform to organizations, offering self-serve sign-up and sales-led demos, with a waitlist at launch and design-partner engagements preceding general availability. A 24/7 response team is offered alongside the automated agents.

Traction

At the time of its June 2026 launch, Tolmo reported more than 40 design partners with the product deployed in production, hundreds of critical security findings surfaced in real production environments, and the first fleet of Pentesting Agents live with customers. Team size was about 12.

Latest developments

Accel published its investment note on June 18, 2026, describing Tolmo's Production Knowledge Graph approach. The company's blog features agent-authored security research, including analyses of AI-generated kernel code and malicious package techniques in npm, PyPI and Crates ecosystems, and Tolmo stated additional agents beyond pentesting were rolling out.