Phylum

Name: Phylum
Brand: Phylum

AI Native

The Software Supply Chain Security Company

Est 2020|Valuation $46.5M|Raised $19.5M|3 Ref Customers

LinkedIn 3K|Website|FTEs 21|HQ Evergreen, Colorado, US

MarketsApplication Security Testing (AST)

Published Oct 15, 2026

01Common complaints

1. An organization requires abundant third‑party customer reviews to de-risk the purchase; public review signals are minimal for Phylum in the captured sources. 2. An organization needs self-serve SMB pricing or individual plans; the documented offering is positioned for teams and enterprises and the free Community edition was sunset on Feb 24, 2025. 3. If an organization cannot tolerate enforcement that may block builds or installs (even selectively), firewall-style enforcement tools may introduce operational friction. 4. The organization has already standardized on an artifact repository and SCA vendor that meets governance requirements (Sonatype, JFrog, Snyk, Mend), and prefers consolidation. 5. The organization requires clearly documented compliance (SOC 2/ISO) without entering an NDA or direct vendor review; public documentation was not found in the captured sources.

Deal disqualifiers (poor fit)

Very small teams seeking free or individual licensing (the community edition was sunset).
Organizations that require public SOC 2/ISO evidence without an NDA.

Documented or observable limitations

- **Community edition sunset:** Vendor documentation states the free Community version was sunset on February 24, 2025; current offerings target teams and enterprises. - **Configuration overhead for dependency files:** The `.phylum_project` file uses an explicit allowlist of dependency files and does not support pattern-based include/exclude mechanisms, which can add maintenance overhead in monorepos. - **Transition risk:** Documentation indicates that Phylum technology is being integrated into Veracode, which may affect product packaging, access, and support during the transition.

Roadmap and future availability

Veracode’s acquisition announcement indicated integration into Veracode SCA with general availability expected following the acquisition. The current state of GA and packaging should be confirmed directly with Veracode sales or support.

02Why they buy

Unique selling points supported by available evidence

- **Threat feed with automation plus researcher triage:** Documentation and vendor materials describe a threat feed that combines automated analysis and human review. - **Behavioral and multi-domain risk scoring:** Vendor materials describe risk scoring across multiple domains (vulnerabilities, license, malware, author reputation, engineering risk). - **Policy enforcement at consumption time:** Vendor materials describe enforcement capabilities integrated with developer tools and artifact/package manager workflows.

Where claims require independent validation

Marketing or acquisition statements that quantify superiority (for example, specific percentage-based detection claims) do not include methodology or independent benchmarking in the captured materials and should be validated before being used as procurement criteria.

03Field reports

Review platform availability (G2, Capterra, etc.)

Capterra: A vendor listing exists but no user reviews were publicly available in the captured snapshot.
G2: No usable Phylum review page was captured in the research results (could be absent, rebranded, or hard to find).

Implication: Traditional review platforms do not currently provide meaningful sentiment signals for Phylum; buyers should compensate with reference calls, pilots, and security evaluations.

Community / social sentiment (quotes)

Public user-style comments about the product are limited in the captured sources. What is available is mostly organizational or hiring-related posts rather than product reviews.

Why customers choose products like Phylum (inferred from positioning)

Based on vendor documentation and press coverage, organizations may choose Phylum when they:

Require detection of malicious packages beyond CVE tracking.
Need policy enforcement at the point of dependency consumption (CI/package manager/artifact repository).
Want near-real-time monitoring of newly published packages.

Why some customers might not purchase or might churn

Not evidenced via review platforms in the captured sources, but plausible reasons include: - Cost or contract structure perceived as high or complex. - Security teams preferring consolidated platforms already in use (e.g., Snyk, Mend, Sonatype, JFrog). - Implementation friction such as false positives and developer pushback. - Post-acquisition product packaging or roadmap uncertainty regarding what remains available as a standalone capability versus integrated into Veracode SCA.

Vendor-published analytics (not independent case studies)

Phylum’s public-facing "Evolution of Software Supply Chain Security" reports provide ecosystem-wide analytics and summarized findings, describing large-scale analysis of source files and package publications along with identified suspicious behaviors (for example, packages executing install-time code, typosquats, and other indicators). Critical evaluation: - These are vendor-published ecosystem analytics, not customer ROI case studies. - Methodology details (sampling, false positive rates, definitions of "malicious," validation approach) are not fully described in the captured snippets. - They are useful for understanding Phylum’s data-processing scale and research orientation, but should not be treated as proven customer outcome metrics without independent validation.

Threat feed as an operational example

Phylum documentation describes a threat feed where packages originate from automated analysis and are triaged or reviewed by security researchers, indicating a blend of automation and human verification.

04Best fit

Company sizes (practical ranges)

Mid-market to enterprise organizations are the primary fit.

Industries

Most relevant for industries with elevated supply-chain risk and compliance pressure:

Financial services, SaaS, healthcare technology, government contractors, and organizations with high-value IP and extensive OSS dependency surfaces.

Roles and personas

Economic buyers: CISO, VP AppSec, VP Engineering/Platform.
Champions: Staff security engineers, DevSecOps/platform engineers.
End users: Developers interacting via CLI, CI checks, or GitHub App feedback.

Pain points addressed

Preventing malicious OSS packages and typosquats from reaching production.
Reducing sole reliance on CVE signals for OSS risk identification.
Enforcing security and compliance policy at dependency selection time.

Qualification criteria (good fit)

Large OSS consumption footprint across multiple ecosystems.
Willingness to enforce policy gates.
Organizational maturity to manage exceptions and tune policies.

05The pitch

What the product does (objective)

Phylum is a software supply chain security product focused on open-source package risk—particularly detecting and preventing malicious packages (not just known CVEs) before they enter developer environments, CI/CD pipelines, or artifact repositories. Its approach emphasizes near-real-time analysis of newly published packages across major registries, plus policy enforcement to block or gate usage. Phylum is commonly positioned as a control between public package ecosystems and internal development workflows, with intent similar to Sonatype Firewall (and, to a lesser extent, Snyk’s open source monitoring), but with heavier emphasis on malware and behavioral risk.

Target market and market positioning

- **Primary buyers:** Security/DevSecOps, AppSec leaders, platform engineering teams, and organizations with strict supply-chain controls. - **Typical environments:** Organizations consuming large volumes of OSS dependencies across npm, PyPI, Maven, NuGet, RubyGems, etc. - **Positioning:** A package gatekeeper combined with continuous monitoring and a threat intelligence feed. Vendor materials differentiate Phylum from "CVE-only" SCA by highlighting malware, typosquatting, author risk, and behavior-based detection.

Get a comprehensive analysis of Phylum including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →