The Tech TL;DR:

The Funding: Corma closed a $60 million seed round led by Sequoia Capital, featuring Khosla Ventures and Coatue.

The Problem: Frontier models tested by the startup successfully implanted persistent backdoors in 85 percent of runs during simulations, but detected only 19 percent of incoming attacks.

The Solution: Deploying autonomous agentic defenders that operate across structured machine data, audit trails, and on-disk states to autonomously mitigate enterprise network intrusions.

The Reality of Real-Time AI Mitigation

The operational reality of automated defense was recently highlighted during a field test involving a Fortune 100 enterprise customer. According to Pluda in an interview with The Register, a security executive received a notification on his smartwatch while walking his dog. The message from a Corma agent stated: “I just caught a live attack. I need your permission to block it.” The executive approved the action, allowing the agent to neutralize the malware and stop the attacker from traversing the corporate network in under 10 minutes.

The customer later described the incident to Pluda as “one of the most magical moments of his year.” Derived from the Elven word for “ring,” the startup’s name reflects its founding objective, as Pluda noted: “We’re building the one ring to rule them all, but this time for the defenders to have this power.”

Benchmarking the Offensive and Defensive Disparity

To quantify the capabilities of modern language models, Corma tested four frontier models—Claude Opus 4.8, GPT-5.5, Grok 4.3, and DeepSeek V4—against a simulated multi-business enterprise network environment. Across 241 scored engagements pairing models as attackers and defenders, the models successfully implanted a persistent backdoor in 85 percent of their runs. Conversely, when tasked with finding and stopping those same intrusions, the models detected a mere 19 percent of the attacks.

According to Pluda, this discrepancy stems from the training data and objectives optimized into general foundation models. While models from OpenAI, Anthropic, and Google excel at writing code, fixing software bugs, and orchestrating multi-step workflows, defensive security tasks rarely involve clean source code. Instead, defenders must parse structured machine data, system configurations, event logs, and audit trails that comprise a much smaller share of training corpora. Furthermore, offensive actions have a deterministic finish line, whereas defensive reasoning remains open-ended and reactive.

Architecting Agentic Defenders for Enterprise Infrastructure

To address this structural imbalance, Corma trains its models to achieve what Pluda terms “superintelligence for defensive cybersecurity.” Organizations deploy these AI agents to function as generalized workforce team members capable of executing complex security workflows.

Early deployments across Fortune 100 and 500 organizations in critical infrastructure, healthcare, energy, and financial services have yielded significant performance shifts. According to company metrics, these deployments reduced threat response times by more than 94 percent, expanded security coverage fifteenfold across discrete security operations, and uncovered multi-stage attack campaigns.

# Example CLI check for active container network listeners
kubectl get pods --all-namespaces -o jsonpath='{range .items[].spec.containers[]}{.name}{"n"}{end}'
netstat -tulpn | grep LISTEN

The Trajectory of Autonomous Defense Systems

Closing the defense gap requires shifting AI architectures from passive vulnerability scanners to active, context-aware operational partners. As autonomous systems take on the burden of reading complex audit trails and disk states, security teams can pivot from reactive triage to architectural hardening.