As FBI data shows that internet crime losses in the United States approach $21 billion, Silicon Valley cybersecurity startup Cyfendo is using AI to help small businesses identify software vulnerabilities, investigate real threats, and prepare tested remediation solutions before developer approval.
Mountain View, California, October 15, 2026 /PRNewswire/ — Attackers no longer need a team; all they require is an AI coding agent, operational instructions, and a set of tools. According to Google’s Threat Intelligence Group’s report dated September 8, 2026, a suspected cybercriminal leveraged an AI-enabled framework to plan, build, and execute a large-scale credential harvesting campaign from compromised cloud infrastructure in under six hours. As a result, thousands of third-party login credentials were compromised.
This attack demonstrates the scale of operations attackers can organize within just a few hours. For a small business, the next security alert might land on a developer’s desk, who is also juggling customer support requests and software updates. Bryan Vuong hopes to make such investigations less difficult.
Bryan Vuong, founder and CEO of Silicon Valley cybersecurity company Cyfendo, previously led engineering teams at Google and Facebook. His company uses AI-assisted source code analysis to help developers identify potential vulnerabilities, investigate their exploitability with tool support, and evaluate proposed fixes before any changes are approved. The goal is to enable smaller teams to access the investigative capabilities typically available only within large tech companies.
Bryan Vuong said: “What concerns me is the growing gap between increasingly powerful attack capabilities and the limited resources available to ordinary businesses for defense. I founded Cyfendo to help them protect everything they’ve worked hard to build.”
The cost of cybercrime and businesses at risk
The U.S. Federal Bureau of Investigation’s 2025 Internet Crime Report documented 1,008,597 complaints and approximately $20.88 billion in reported losses from internet crimes, including fraud. Meanwhile, the U.S. Small Business Administration reports that there were approximately 36.2 million small businesses in the United States in 2025, with over 4.3 million located in California.
Small businesses rely on software to take orders, process payments, schedule services, and store customer records. When a scan flags an issue, the person responsible for maintaining the application must determine whether an attacker could exploit it, what information is at risk, and how to fix it without disrupting features customers depend on. This work must also compete for time with support requests and the next version release.
AI can build applications—who checks their security?
AI coding tools can help restaurants launch online ordering systems, assist contractors in building customer portals, or enable entrepreneurs to build applications without hiring a traditional development team. For example, a small distributor allowed customers to download invoices through a portal. One customer simply changed a single digit in the invoice URL and gained access to another customer’s billing records. The website appeared to function normally, and login worked without issue—standard testing might reveal no problems. The error lay in the access rules: invoices for different customers should have been isolated from one another.
Other vulnerabilities are equally difficult to detect. Database queries may return correct information to legitimate users but fail when processing malicious input. A newly integrated service might have access permissions exceeding what is necessary. These errors need not disrupt normal transaction flows yet are sufficient to expose the business to risk.
A completed application may pass through multiple tools. Developers might start a project in Lovable, modify code with Cursor, integrate Supabase for authentication and storage, track versions on GitHub, and deploy the project elsewhere. Each service has its own security controls, but after these changes, it cannot be assumed that any single check covers the entire codebase. Someone still needs to review the software that customers are actually using.
Cyfendo adds code-level reviews beyond the protections offered by these platforms. Developers can connect GitHub, GitLab, or Bitbucket repositories, upload project files, or use command-line operations. They can inspect the current real-time state of their application, including features and integrations added after deployment.
Discovering a vulnerability is only the first step.
The scanner may flag a line of suspicious code but won't tell developers how an attacker might exploit it. Someone still needs to reproduce the issue, assess its severity, fix the code, and verify that the application continues to function properly.
Cyfendo connects these steps within the scope of its tooling. The platform traces paths from untrusted data to sensitive operations in the source code, runs isolation checks to determine whether vulnerabilities are exploitable, and prepares a code patch for review. It then retests the finding and associated application behavior. Developers can review the evidence and decide whether to accept the proposed changes; Cyfendo does not directly merge patches into production software.
Bryan Vuong said: "Every company, regardless of size, should have access to world-class security. Protecting everything you've built shouldn't depend on whether you can afford an expert team."
This approach is especially useful when the person responsible for an AI-built application also handles support requests and delivers new features. This developer may have deep knowledge of the business itself but may not have the time or training to investigate each security finding from scratch.
According to Cyfendo’s own scanning data, the company finds an average of four critical-level issues per codebase. Approximately seven out of ten findings are rated as high or critical. These results are derived from projects scanned by Cyfendo and do not represent a representative survey of enterprise applications. Cyfendo notes that this explains why the company emphasizes investigating findings and preparing remediation plans, rather than simply adding another alert list for developers.
Cyfendo also separately published its results on the standardized OWASP detection benchmarks. According to its evaluation as of September 2026, the company reported a recall rate of 94.06% and a precision rate of 96.38% on the Java Benchmark v1.2 (2,740 test cases), and a recall rate of 90.04% and a precision rate of 93.78% on the Python Benchmark v0.1 (1,230 test cases). Recall measures the percentage of known vulnerabilities detected, while precision measures the percentage of flagged cases that are actual vulnerabilities. Cyfendo stated that these are self-reported detection results and do not constitute endorsement by OWASP or independent validation of automated remediation capabilities. Cyfendo has published its benchmarking methodology for external review.
Cyfendo’s code security platform is now live. Its free plan covers up to 10,000 lines of protected code, with five scans per month, providing detailed findings and limited patch assessment. Paid self-service subscriptions start at $99 per month and include automatically generated patches ready for review, along with higher scan limits. The company’s additional application penetration testing service is currently in private beta for select enterprises and is not included in the above subscriptions.
Bryan Vuong's professional journey: from AI research to application security
Vuong’s background spans engineering management, machine learning, and academic research. From 2020 to 2026, he served as a Senior Engineering Manager for AI and Security at Google, working in areas involving privacy, security, and safety. Prior to that, at Facebook—now part of Meta—he worked as a Machine Learning Research Scientist and Engineering Manager.
He holds a Ph.D. in Computer Science from the University of Wisconsin-Madison, with research interests including databases, information extraction, and data integration. Prior to that, he earned a Bachelor’s degree in Engineering from Nanyang Technological University in Singapore, graduating with first-class honors. Under the name Ba-Quy Vuong, he contributed to research on user feedback in unstructured information and information extraction systems. He is also listed as a co-inventor on three granted U.S. patents related to search and information processing, assigned to entities associated with Walmart.
In 2024, Vuong co-founded InnoSearch AI, an online shopping service designed for blind and low-vision users. The service helps users navigate online shopping experiences that were not always built with them in mind. Through Cyfendo, he is addressing another gap in accessibility: smaller organizations can now build fairly complex software, but often cannot afford to hire the specialized personnel needed to assess its security.
Automated analysis cannot replace sound access controls, timely updates, or the judgment of developers themselves. However, when a security issue would otherwise require expert investigation, it can provide small teams with evidence and a reviewable remediation recommendation.
Google's survey shows how quickly attackers can organize attacks. Cyfendo focuses on the work developers face after identifying potential vulnerabilities: determining whether they can be exploited, reviewing patch solutions, and verifying the results of changes. Today, more small businesses can use AI to build their own applications; they also need an effective way to check the security of their deployed software.
About Cyfendo
Cyfendo Inc. is a Silicon Valley-based application security company founded by Bryan Vuong. The company’s AI-powered platform combines source code analysis, vulnerability investigation, exploitability checks where supported, proposed patches, and retesting. Developers can connect their code repositories or upload projects, view findings, and approve or reject proposed code changes. The company offers both free and paid code security subscriptions; scoped application penetration testing is currently in private beta for select enterprises.
Built with AI, verified by Cyfendo.
About Bryan Vuong
Bryan Vuong, also known as Ba-Quy Vuong, is the founder and CEO of Cyfendo. His background includes engineering and machine learning management roles at Google and Facebook, a Ph.D. in Computer Science from the University of Wisconsin-Madison, involvement in academic research, and three granted U.S. patents as a co-inventor, assigned to entities related to Walmart. He previously co-founded InnoSearch AI, an accessible e-commerce platform for blind and low-vision users.
Media contact: Wendy Nguyen, (650) 262-6576