Hacking Software Before the Hackers Do

Software teams have spent the last decade getting extraordinarily good at shipping code quickly. Security hasn’t kept pace.

For many companies, penetration testing still looks remarkably manual. Hire a team of security experts, give them access to your application, wait while they probe it for vulnerabilities, then receive a report documenting what they found. The exercise might happen once or twice a year, even as the underlying software changes every day.

AI is making that mismatch worse. Developers can now generate and deploy code faster than ever, which means more software, more changes, and more opportunities for something to go wrong.

Parameter is building for a world where security testing has to move just as fast.

The company is developing autonomous agents that continuously attack applications and infrastructure, looking for vulnerabilities the way a skilled penetration tester would. When Parameter finds one, it doesn’t simply flag suspicious code. Its agents attempt to verify the vulnerability, chain exploits together when necessary, and give security teams the reproduction steps they need to understand what actually happened.

The ambition is straightforward: give every company an attacker that works for them.

From Pen Test to Continuous Attack

Traditional penetration testing made sense when software changed more slowly. A skilled security researcher could spend days or weeks probing an application, finding weaknesses, combining them into possible attacks, and documenting what needed to be fixed.

The problem is that the report begins aging almost as soon as it arrives.

A vulnerability discovered during a penetration test can be fixed on Monday while an entirely new one is introduced on Tuesday. As development becomes continuous, security testing eventually has to become continuous too.

Parameter’s agents are designed to repeatedly explore applications and infrastructure, test potential weaknesses, build exploit chains, and return as the software changes. The company describes the goal as moving security from scheduled, point-in-time testing toward something continuous, autonomous, and always on.

The distinction between detecting and exploiting a vulnerability is important. Security teams already have plenty of tools that generate alerts. The harder question is whether an attacker can actually do something with them.

Parameter is designed to answer that question. If it reports a vulnerability, the goal is to verify that the vulnerability is real and show the security team how it can be reproduced.

That gives companies something far more useful than another theoretical warning: evidence of how someone could actually get in.

Three Founders, Three Sides of the Problem

Parameter’s founding team is unusually well matched to what they’re building, but not for the reasons we originally wrote.

Ahmad Khan studied mathematics at the University of Waterloo before working on robotics and world models, including systems designed to give robots a better understanding of their environments. He came to Parameter from the intelligence side of the problem: how do you build autonomous systems capable of understanding an unfamiliar environment and deciding what to do next?

Huzaifa Ahmad brings a different instinct. He previously built software at PlayAI, AWS, and Capital One, while also building consumer applications that reached millions of downloads. But the more relevant thread is his interest in taking systems apart. In college, he reverse-engineered major applicant-tracking platforms and built software that interacted with them at scale. As he puts it himself, he has always liked breaking things as much as building them.

Prama Yudhistira fills in another critical piece. At Codegen, he built asynchronous coding agents that could perform software-development work, and at AMD he built infrastructure for testing MI300 GPU firmware. He understands both the agents increasingly writing software and the infrastructure required to make complex technical systems reliable.

Put those backgrounds together and the shape of Parameter makes sense. Ahmad understands autonomous systems. Huzaifa has the adversarial instinct to look for ways software behaves differently than its designers intended. Prama has built both coding agents and testing infrastructure.

They aren’t trying to turn a traditional penetration-testing firm into an AI company. They’re approaching offensive security from the perspective of people who have spent their careers building autonomous systems, infrastructure, and software that interacts with other software.

Attackers Are Getting Faster Too

The timing matters because AI is changing both sides of security.

Coding agents are making developers dramatically more productive, increasing the amount of software companies can create and the speed at which they can change it. At the same time, attackers can use many of the same advances in models and automation to search for weaknesses more quickly.

Defenders can’t respond to machine-speed software development and machine-assisted attacks with security processes that happen a few times a year.

Parameter is building around that asymmetry.

The company’s early results give some indication of what’s possible. In its YC launch, Parameter said its agents had already found critical vulnerabilities across dozens of companies, including SQL injection, access to private codebases, and vulnerabilities that could be chained into larger attacks. Those findings were responsibly disclosed.

The larger opportunity extends beyond automating today’s penetration tests. Applications, APIs, cloud infrastructure, identities, and deployment environments increasingly connect to one another. Real attackers don’t stay neatly inside the boundaries of a security product. They move through whatever path gives them access.

An autonomous offensive-security system should eventually be able to do the same.

Why We Invested

We invested in Parameter because we think the way software is secured has to change alongside the way software is built.

Development is becoming continuous, increasingly automated, and dramatically faster. A penetration test conducted months ago tells you something about the software you had months ago. Companies increasingly need to know what an attacker could do to the software they have right now.

Parameter also has one of our favorite characteristics in an early product: it can prove its value. Find something important that everyone else missed, demonstrate that it can actually be exploited, and the customer immediately understands why the product matters.

But the team is what made the bet particularly compelling. Ahmad, Huzaifa, and Prama came to the problem from autonomous systems, adversarial thinking, coding agents, and infrastructure. Those backgrounds converge surprisingly well on the problem they’re now trying to solve.

Software is going to keep shipping faster. Attackers are going to keep looking for the next way in.

Parameter is building the attacker you want to get there first.

Visit Parameter at https://www.parameter.ai/.