Kusari

Name: Kusari
Brand: Kusari

AI Native

Vulnerabilities are inevitable. Panic is optional.

Est 2022|Valuation $23.1M|Raised $8.1M|12 Ref Customers

LinkedIn 2K|Website|Web traffic 1K|FTEs 13|HQ New York metropolitan area, Pennsylvania, US

MarketsCode Security SCA

Published Oct 15, 2026

01Common complaints

When transparent, self-serve enterprise pricing is required
- The Kusari Platform appears sales-led; organizations that require published enterprise rates for budgeting may find alternatives with public pricing easier to evaluate.
When deep SAST customization and a mature rules ecosystem are the primary requirement
- For organizations whose primary need is highly customizable SAST and an extensive rule library, consider specialized SAST providers such as CodeQL (via GitHub Advanced Security), Semgrep, Checkmarx, or Veracode.
When consolidating on a single DevSecOps suite
- Organizations already standardized on a single platform that provides SCA/SAST/secret scanning (for example, GitLab Ultimate) may find additional overlay tools redundant.
When publicly documented SOC 2/ISO certifications are a procurement requirement
- Public pages accessed in this research did not provide explicit downloadable certification artifacts. If a vendor-provided trust center and public compliance artifacts are mandatory, consider vendors that publish those documents.
When pull request blocking cannot be tolerated operationally
- Any gating or blocked-merge workflow requires policy tuning and change management. Organizations that cannot accommodate that operational change should consider lighter-weight approaches.
Current limitations acknowledged by the vendor
- No public “known issues” page or detailed bug tracker was identified in the accessible sources.
Features on the roadmap
- Roadmap items were not reliably identified from the accessible public sources in this research session.
Scale limitations
- Scale limitations were not publicly documented. Buyers should request performance and scale benchmarks relevant to their environment.
Security or compliance gaps
- Public proof of certifications (SOC 2/ISO) was not located in the accessible sources; absence of publicly available artifacts may be a gap for enterprise buyers unless evidence is provided under NDA.
API limitations or integration constraints
- Public documentation did not detail API rate limits or integration depth for every supported provider. Buyers should validate:
  - Integration depth for each SCM/CI provider
  - Export formats and APIs for governance and reporting

- When transparent, self-serve enterprise pricing is required - The Kusari Platform appears sales-led; organizations that require published enterprise rates for budgeting may find alternatives with public pricing easier to evaluate. - When deep SAST customization and a mature rules ecosystem are the primary requirement - For organizations whose primary need is highly customizable SAST and an extensive rule library, consider specialized SAST providers such as CodeQL (via GitHub Advanced Security), Semgrep, Checkmarx, or Veracode. - When consolidating on a single DevSecOps suite - Organizations already standardized on a single platform that provides SCA/SAST/secret scanning (for example, GitLab Ultimate) may find additional overlay tools redundant. - When publicly documented SOC 2/ISO certifications are a procurement requirement - Public pages accessed in this research did not provide explicit downloadable certification artifacts. If a vendor-provided trust center and public compliance artifacts are mandatory, consider vendors that publish those documents. - When pull request blocking cannot be tolerated operationally - Any gating or blocked-merge workflow requires policy tuning and change management. Organizations that cannot accommodate that operational change should consider lighter-weight approaches. - Current limitations acknowledged by the vendor - No public “known issues” page or detailed bug tracker was identified in the accessible sources. - Features on the roadmap - Roadmap items were not reliably identified from the accessible public sources in this research session. - Scale limitations - Scale limitations were not publicly documented. Buyers should request performance and scale benchmarks relevant to their environment. - Security or compliance gaps - Public proof of certifications (SOC 2/ISO) was not located in the accessible sources; absence of publicly available artifacts may be a gap for enterprise buyers unless evidence is provided under NDA. - API limitations or integration constraints - Public documentation did not detail API rate limits or integration depth for every supported provider. Buyers should validate: - Integration depth for each SCM/CI provider - Export formats and APIs for governance and reporting

Deal disqualifiers (poor fit)

Organizations that require a broad set of independent third-party reviews (for example, many reviews across third-party review platforms) before procurement.
Organizations that require on-prem or strict regional data residency and cannot confirm support from the vendor.
Organizations that only need a lightweight dependency scanner and obtain adequate results from native tooling (e.g., Dependabot, GitHub Advanced Security, or GitLab scanning) and wish to avoid introducing a new platform.

- Organizations that require a broad set of independent third-party reviews (for example, many reviews across third-party review platforms) before procurement. - Organizations that require on-prem or strict regional data residency and cannot confirm support from the vendor. - Organizations that only need a lightweight dependency scanner and obtain adequate results from native tooling (e.g., Dependabot, GitHub Advanced Security, or GitLab scanning) and wish to avoid introducing a new platform.

Churn reasons

No direct, independent churn narratives were located in accessible sources during this research.

02Why they buy

unique selling points (as presented in vendor materials)
- A knowledge-graph approach (vendor-described as a “Trust Fabric”) that aggregates signals across existing tools to provide a consolidated view of software component relationships.
- In-PR, shift-left experience via Kusari Inspector (GitHub integration and CI) to surface dependency and code risks earlier in the development workflow.
- Vendor narrative of alignment with supply chain standards and initiatives (GUAC, SLSA, in-toto) as part of product positioning.
Areas where competitors may have advantages
- Snyk: broader market penetration, established brand, and more transparent published pricing tiers for common plans.
- GitLab Ultimate: tighter consolidation of SCM, CI/CD, and security features when an organization already uses GitLab.
- Sonatype/Mend/Black Duck: perceived maturity in enterprise governance, SCA features, and compliance reporting for some buyer needs.

- unique selling points (as presented in vendor materials) - A knowledge-graph approach (vendor-described as a “Trust Fabric”) that aggregates signals across existing tools to provide a consolidated view of software component relationships. - In-PR, shift-left experience via Kusari Inspector (GitHub integration and CI) to surface dependency and code risks earlier in the development workflow. - Vendor narrative of alignment with supply chain standards and initiatives (GUAC, SLSA, in-toto) as part of product positioning. - Areas where competitors may have advantages - Snyk: broader market penetration, established brand, and more transparent published pricing tiers for common plans. - GitLab Ultimate: tighter consolidation of SCM, CI/CD, and security features when an organization already uses GitLab. - Sonatype/Mend/Black Duck: perceived maturity in enterprise governance, SCA features, and compliance reporting for some buyer needs.

03Field reports

Review platform availability reality check

Gartner Peer Insights: no Kusari product review page or review snippets were located in accessible searches during this session.
G2 / TrustRadius / Capterra: no Kusari product listings with third-party reviews were located in accessible search results.

Community/Social and vendor-published quotes (accessible)

Kusari publishes curated customer quotes on its About page. Examples include:
- Mihai Maruseac (Google): “Kusari Inspector is a really cool way of applying AI… Let the LLM do the work for you.”
- Adolfo Garcia Veytia (Carabiner Systems / Kubernetes SIG Release TL): “Shout out to Kusari Inspector and its very detailed report…”
- William Woodruff (zizmor maintainer): notes usefulness for identifying new dependencies and surfacing signal such as licenses and inactivity.
Vendor social posts emphasize benefits such as fewer false positives, detection of typosquatting/malicious dependencies, and in-PR workflow integration. These are vendor-published statements and should be treated as curated.

- Kusari publishes curated customer quotes on its About page. Examples include: - Mihai Maruseac (Google): “Kusari Inspector is a really cool way of applying AI… Let the LLM do the work for you.” - Adolfo Garcia Veytia (Carabiner Systems / Kubernetes SIG Release TL): “Shout out to Kusari Inspector and its very detailed report…” - William Woodruff (zizmor maintainer): notes usefulness for identifying new dependencies and surfacing signal such as licenses and inactivity. - Vendor social posts emphasize benefits such as fewer false positives, detection of typosquatting/malicious dependencies, and in-PR workflow integration. These are vendor-published statements and should be treated as curated.

Balanced take (what’s missing)

The lack of accessible, third-party review coverage on major review platforms makes it difficult to validate the following in an independent manner:
- Support responsiveness and typical ticket SLAs in practice
- False-positive rates compared with competitors
- Real-world deployment complexity and rollout timelines
- Pricing satisfaction and renewal dynamics

Likely drivers for selection (based on vendor materials and testimonials)

Drivers indicated in vendor materials include:
- In-PR approval/denial recommendations and detailed contextual reports.
- Emphasis on transitive dependency visibility and dependency graph context.
- Alignment claims with open standards (GUAC, SLSA, in-toto) and integrations across existing tools.

Vendor case study: Guidewire Cloud Platform / GUAC

Kusari publishes a vendor case study titled “Innovative supply chain security for Guidewire Cloud Platform.” The case study includes positive vendor-published quotes and descriptions of alignment with relevant projects.
Critical evaluation:
- The case study is vendor-published; outcomes and metrics should be considered directional unless corroborated by independent sources.
- The accessible excerpt does not provide detailed quantified KPIs such as mean-time-to-remediate reduction, vulnerability backlog reduction, or audit time saved. Buyers should request baseline vs post-implementation metrics, scope (number of repositories/services), and implementation timeline and staffing.

- Kusari publishes a vendor case study titled “Innovative supply chain security for Guidewire Cloud Platform.” The case study includes positive vendor-published quotes and descriptions of alignment with relevant projects. - Critical evaluation: - The case study is vendor-published; outcomes and metrics should be considered directional unless corroborated by independent sources. - The accessible excerpt does not provide detailed quantified KPIs such as mean-time-to-remediate reduction, vulnerability backlog reduction, or audit time saved. Buyers should request baseline vs post-implementation metrics, scope (number of repositories/services), and implementation timeline and staffing.

Inspector GA announcement (June 17, 2025)

Kusari announced general availability for the Inspector product and described it as using automated analysis embedded in pull requests. The announcement notes that it can call established security tools depending on language.
Critical evaluation:
- The announcement provides product narrative but does not include independently measured accuracy, false-positive rates, or comparative benchmarks.
- The Inspector feature set, including automated approval/denial recommendations, should be validated for governance controls such as override workflows, auditability, and determinism of checks.

- Kusari announced general availability for the Inspector product and described it as using automated analysis embedded in pull requests. The announcement notes that it can call established security tools depending on language. - Critical evaluation: - The announcement provides product narrative but does not include independently measured accuracy, false-positive rates, or comparative benchmarks. - The Inspector feature set, including automated approval/denial recommendations, should be validated for governance controls such as override workflows, auditability, and determinism of checks.

04Best fit

Company sizes

Likely best fit: mid-market to enterprise engineering organizations where:
- There are sufficient repositories and services for transitive dependency visibility to be materially important.
- Compliance or audit requirements drive continuous SBOM and provenance tracking.
Kusari’s learning-center material indicates gated check-in concepts as relevant starting at small team sizes (e.g., small development teams), while the Platform is positioned toward security leaders and enterprise workflows.

- Likely best fit: mid-market to enterprise engineering organizations where: - There are sufficient repositories and services for transitive dependency visibility to be materially important. - Compliance or audit requirements drive continuous SBOM and provenance tracking. - Kusari’s learning-center material indicates gated check-in concepts as relevant starting at small team sizes (e.g., small development teams), while the Platform is positioned toward security leaders and enterprise workflows.

Industries and verticals

Regulated or risk-sensitive sectors where supply chain security is prioritized:
- Financial services
- Healthcare and life sciences
- SaaS vendors serving enterprise customers
- Critical infrastructure and industrial sectors (depending on alignment with IEC 62443 or regional regulation)

Roles and personas

Decision makers:
- Chief Information Security Officer (CISO) / VP Security / Head of DevSecOps
- VP Engineering / Platform Engineering
End users:
- Developers (PR reviewers)
- DevOps/Release engineers (CI/CD owners)
- Security engineers (triage and incident response)

Pain points the product addresses

Limited visibility into transitive dependency risk and blast radius.
Slow response to newly disclosed or exploited vulnerabilities.
Requirements for continuous SBOMs and evidentiary artifacts for audits.
Developer friction from security bottlenecks that can be addressed by in-PR feedback workflows.

Qualification criteria (good fit)

Organizations seeking to enforce supply chain guardrails within pull request/merge request workflows.
Organizations that need to centralize software component intelligence across many repositories and services.
Organizations that value alignment with open supply chain standards and automated SBOM/VEX outputs.

05The pitch

What the product does (core value proposition in objective terms)

Kusari is a software supply chain security platform that provides continuous visibility into an organization’s software bill of materials (SBOM) and dependency graph (including transitive dependencies). The platform enriches findings with exploitability and reachability context and provides workflow automation for triage and remediation.
Product components described by Kusari include:
- Kusari Platform (central management for supply chain visibility and audit readiness)
- Kusari Inspector (shift-left PR/MR reviewer delivered via a GitHub integration and CI integrations)
- Kusari Agent (natural-language querying over the dependency graph for incident response)
- Kusari AutoFix (automated remediation via pull requests)
Kusari describes a core differentiator as a knowledge-graph approach (referred to by the vendor as a “Trust Fabric”) that integrates data from existing scanners and SDLC systems rather than operating solely as a single scanner.

- Kusari is a software supply chain security platform that provides continuous visibility into an organization’s software bill of materials (SBOM) and dependency graph (including transitive dependencies). The platform enriches findings with exploitability and reachability context and provides workflow automation for triage and remediation. - Product components described by Kusari include: - Kusari Platform (central management for supply chain visibility and audit readiness) - Kusari Inspector (shift-left PR/MR reviewer delivered via a GitHub integration and CI integrations) - Kusari Agent (natural-language querying over the dependency graph for incident response) - Kusari AutoFix (automated remediation via pull requests) - Kusari describes a core differentiator as a knowledge-graph approach (referred to by the vendor as a “Trust Fabric”) that integrates data from existing scanners and SDLC systems rather than operating solely as a single scanner.

Target market and market positioning

Target users (per Kusari materials) include:
- Developers: in-PR feedback, dependency and code risk checks, approval/denial guidance.
- Security/DevSecOps leaders: organization-wide visibility, compliance and audit readiness (SBOM/VEX/provenance), and incident response for emerging vulnerabilities.
Positioning: Kusari is presented as an intelligence layer across the software supply chain toolchain; its stated intention is to reduce noisy alerts and help triage and remediation by using a consolidated dependency graph and associated context.

- Target users (per Kusari materials) include: - Developers: in-PR feedback, dependency and code risk checks, approval/denial guidance. - Security/DevSecOps leaders: organization-wide visibility, compliance and audit readiness (SBOM/VEX/provenance), and incident response for emerging vulnerabilities. - Positioning: Kusari is presented as an intelligence layer across the software supply chain toolchain; its stated intention is to reduce noisy alerts and help triage and remediation by using a consolidated dependency graph and associated context.

Get a comprehensive analysis of Kusari including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →