almanax.ai

Almanax is an AI-native application security platform founded in March 2024 and headquartered in New York. Positioning itself as "The AI Security Engineer," it applies large language models to identify vulnerabilities in code, business logic, and infrastructure — with specialized support for blockchain ecosystems including Solana, Ethereum, Base, Stellar, and Aptos.

The Problem

Web3 security has a cost, speed, and accuracy problem. Traditional smart contract audits run tens to hundreds of thousands of dollars, have waitlists stretching up to eight months, and deliver point-in-time assessments that go stale the moment code changes. Compounding the risk, 91% of contracts breached in 2022 had already been audited, and conventional static analysis tools carry false-positive rates around 90%. Meanwhile, LLMs now generate an estimated one billion lines of code per day, dramatically expanding the attack surface.

Almanax was built by engineers who had worked directly inside this gap. Co-founder and CEO Francesco Piccoli previously led product at AnChain.AI, where he investigated multi-million dollar hacks for US regulators, and conducted AI research at Ripple. Co-founder and CTO Maxwell Watson was a senior engineer at Coinbase overseeing blockchain infrastructure and built runtime security products at Capsule8, which was later acquired by Sophos.

How It Works

Almanax integrates via a GitHub app. Once installed, it indexes a repository's codebase to build contextual understanding, then runs continuous security reviews on every pull request — flagging vulnerabilities before they reach production and optionally blocking merges for risky code. Alongside PR-level monitoring, teams can initiate manual scans to surface latent vulnerabilities across an entire codebase.

The platform's detection layer combines proprietary language models with real-time internet access for threat intelligence, access to custom documentation, and ecosystem-specialized models tuned for EVM chains, Solana, Stellar, and Aptos. This combination lets the system understand chain-specific exploit patterns — reentrancy, integer overflow, improper access control — in the context of each ecosystem's runtime behavior.

Beyond detection, Almanax generates automated patch suggestions with committable code changes and runs automated threat modeling: mapping system architecture, identifying trust boundaries, applying STRIDE-based threat classification, and updating the threat model continuously as code evolves.

Key Products and Features

Continuous PR Review: Automated security analysis on every pull request with configurable blocking for high-risk code. The agent learns from team interactions over time to reduce false positives.

Manual Codebase Scanning: On-demand scanning that surfaces existing vulnerabilities across a full repository, with reachability analysis for third-party alert triaging.

Automated Threat Modeling: Ongoing STRIDE-based analysis that maps trust boundaries and updates as the system architecture changes — replacing one-time threat modeling exercises.

Custom Rules in Natural Language: Teams can define organization-specific security policies in plain English, which the platform enforces during code review.

ALMX-1 Model: Almanax's proprietary AI model for smart contract vulnerability detection, which demonstrated state-of-the-art performance on benchmark evaluations and identified a vulnerability in a smart contract authored by Ethereum co-founder Vitalik Buterin.

Web3 Security Atlas: An open-source vulnerability dataset launched in December 2024, covering critical security incidents and vulnerability patterns across Solana, Ethereum, Base, and Stellar. Developed in partnership with TRM Labs, AnChain.AI, and Hypernative, with backing from the Stellar Development Foundation. An updated release accompanied ALMX-1.5.

Solana Ecosystem Role

Almanax has a direct relationship with the Solana Foundation, which provides Solana builders a one-year Almanax subscription as part of its developer support program. The platform's Solana-specialized model is trained on the ecosystem's specific vulnerability patterns, and Almanax clients include the Solana Foundation itself alongside other ecosystem teams.

The company has ethically disclosed hundreds of security issues across blockchain codebases and won competitions against thousands of security researchers — work that is reflected in its client roster, which includes Privy, Phantom, Dfns, Hypernative, Coala, Axal, Algorand, Aptos, Stellar, Keplr, and 0G. As of the time of writing, the platform had scanned over 100 million lines of code.

Security and Compliance

Almanax holds SOC 2 Type II certification, verified through Vanta. It offers on-premises deployment for enterprise customers with strict data handling requirements and guarantees no AI training on customer code. The platform supports organization-level role-based access controls and multi-language codebases.

Funding and Recognition

Almanax raised a pre-seed round from defy.vc, a San Francisco venture firm managing over $700 million. In January 2025, it closed an additional $1 million, bringing total capital raised to $1.5 million. That round included Blockchain Builders Fund, Exor Ventures, Vento Ventures, Italian Angels for Growth, Eden Ventures, Moonbase, and strategic angel investors. Almanax is also a member of NVIDIA's Inception Program for innovative startups.

The team has expanded to include engineers and operators from Fireblocks, Circle, Mastercard, and MIT.

Recent Developments

In June 2026, Almanax announced it is joining depthfirst, a cybersecurity company focused on product security. The founders described the move as a strategic combination to address what they view as an underserved market: product security lacks a dominant incumbent in the way that network security has Palo Alto Networks, endpoint has CrowdStrike, and cloud has Wiz. Prior to the announcement, Almanax had established partnerships with Keplr (operational security and CI/CD, February 2026), the Algorand Foundation (accelerator program support, December 2025), mcp-use for Model Context Protocol security (December 2025), and Vanta for continuous compliance integration (March 2026).