SubImage GTM brain

SubImage provides a managed security graph and cloud security platform for infrastructure security teams.

category

Security graph and CNAPP

market profile

  • text: Cloud security engineers need a connected view of assets, identities, vulnerabilities and attack paths.
  • text: SubImage builds a commercial managed offering around the open-source Cartography project.

personas

  • title: Cloud security engineer
    pains:
    • Cannot quickly connect an exposed workload to its permissions, dependencies and owner
    • Static alerts miss context needed to prioritize remediation
  • title: Security engineering leader
    pains:
    • Limited staff must prioritize real attack paths over noisy findings
    • Maintaining a self-hosted graph and integrations consumes engineering capacity
  • title: Vulnerability management lead
    pains:
    • CVE lists do not reveal which vulnerable images are exposed or running
    • Fixes require coordination between security and infrastructure teams

icp

  • text: Cloud-intensive technology organizations with security engineering teams and infrastructure spanning cloud, code and identity systems.
  • text: Both startups and enterprises are targeted; the company offers managed and self-hosted deployment.

message pillars

  • text: Connect exposure to reachable assets.
  • text: Give practitioners an investigative graph.
  • text: Use graph context to prioritize risk.

objections

  • objection: Why pay when Cartography is open source?
    response: The managed offering adds features such as prioritization, vulnerability management, attack paths and access controls.
  • objection: Can we deploy in our own environment?
    response: The pricing page says fully self-hosted environments are supported; request details.
  • objection: Will costs increase with feature use?
    response: The company says all features are included and quotes based on environment and deployment requirements.

competitors

  • name: Cisco Attack Surface Management with JupiterOne
    why: Graph-based asset inventory and security relationship mapping.
  • name: Microsoft Defender for Cloud
    why: Cloud security posture and workload protection platform.

keywords

  • cloud security graph
  • attack path analysis
  • cloud asset inventory
  • Cartography managed security
  • CNAPP vulnerability prioritization
  • cloud security investigation

voice

  • Technical and practitioner-led
  • Direct and security-focused

signals

  • text: A team already runs Cartography and wants managed operations or richer triage.
  • text: Security teams are investigating exposed workloads across AWS, identity and source control.

stack

  • Cartography
  • AWS
  • Okta
  • GitHub
  • Cypher

hiring

  • Product Designer
  • Founding Engineer

pricing

model: contact_sales

motion

hybrid

channels

  • GitHub
  • open source community
  • SEO
  • sales demos

confidence

high

Founders

  • name: Alex Chantavy
    title: Founder/CEO
    role: CEO
    bio: Co-founder & CEO at SubImage. Former Staff Engineer at Lyft: Created https://cartography.dev, the open source security graph. Built first-of-its-kind container scanning and remediation platform. Former Security Engineer on Microsoft Red Team: did cloud hacking before it was cool. Worked on [REDACTED] at the NSA.
  • name: Kunaal Sikka
    title: Founder/President
    role: Founder
    bio: Co-founder at SubImage. Previously Member of Technical Staff at Anthropic and Staff Engineer at Lyft. At Lyft, reported directly to CISO, new grad to Staff Engineer in 4 years. Architected SIEM, insider abuse, and vulnerability management platforms. Graduated from University of Washington CS in 2 years.

Back to YC companies