As FBI figures show nearly $21 billion in U.S. internet-crime losses, Silicon Valley cybersecurity startup Cyfendo is using AI to help smaller businesses find software vulnerabilities, investigate real threats and prepare tested fixes for developer approval.
MOUNTAIN VIEW, Calif. | October 2026, An AI coding chatbot, a prompt and instructions helped a suspected cybercriminal turn compromised cloud infrastructure into a mass credential-harvesting operation. Within less than six hours, an AI-enabled, multi-agent framework planned, built and executed the campaign, automated scanning, processed results and troubleshot problems. Thousands of third-party credentials were compromised, according to a September 8, 2026 report from Google Threat Intelligence Group.
The operation exposed a widening difference in speed. Attackers can automate increasingly complex technical work, while smaller businesses often rely on one developer or an outside contractor to investigate vulnerabilities and protect the applications that handle customer information. The question is how to give those businesses a practical way to identify and address weaknesses before criminals exploit them.
Bryan Vuong, founder and CEO of Silicon Valley cybersecurity company Cyfendo, has built his latest venture around that problem. Previously an engineering leader at Google and Facebook, he is bringing AI-assisted security investigation to teams that cannot staff a dedicated application-security department. Cyfendo analyzes source code, investigates exploitability where supported, proposes repairs and tests relevant behavior before developers decide whether to approve a change.
“What worries me is the gap between increasingly powerful attack capabilities and the resources ordinary businesses have to defend themselves,” Vuong said in a statement published on Cyfendo’s founder page. “I founded Cyfendo to help them protect what they’ve worked so hard to build.”
A Fast-Moving Threat, a Nationwide Business Challenge
The scale of cybercrime is substantial in the United States. The FBI’s 2025 Internet Crime Report recorded 1,008,597 complaints and approximately $20.88 billion in reported losses, encompassing fraud and other internet-enabled crimes, not application vulnerabilities alone. The U.S. Small Business Administration counted approximately 36.2 million small businesses nationwide in 2025, including more than 4.3 million in California.
Many of those businesses now depend on software to manage orders, appointments, payments, inventory and customer records, but often lack the internal resources of a large technology company. For them, security is not a theoretical question: someone needs to determine whether a flagged weakness is real, what information it could expose, and how to repair it without interrupting legitimate work.
AI Can Build the Application. Who Checks Its Security?
AI coding tools have made it possible for a restaurant group to launch an ordering system, a contractor to create a customer portal, or a founder to build a working application without a conventional development team. But a polished interface can conceal a serious access-control mistake. Imagine a small distributor whose customers download invoices through an online portal. One customer changes a single number in an invoice URL and discovers another customer’s billing record. The page works, the login works and routine functional tests may pass; what failed is the authorization rule that should have kept the records separate.
That hypothetical mistake illustrates the difference between software that functions and software that has been examined for security weaknesses. A database query may return the expected results while mishandling hostile input. A new integration may introduce permissions its developer did not intend. When a team has little time for security review, such problems can remain undetected even after an application goes live.
Applications also travel across development platforms. A team might begin in Lovable, refine code with Cursor, connect Supabase for authentication and storage, maintain versions in GitHub and deploy through another cloud provider. Built-in checks from those platforms remain valuable, but they do not necessarily evaluate every custom authorization decision or business workflow across the finished application. As the codebase changes, developers need a way to inspect the actual application they maintain, not merely trust that an earlier platform check covered every later modification.
Cyfendo is intended to complement those controls. Developers can connect GitHub, GitLab or Bitbucket repositories, upload project files or use a command-line workflow to examine source code across development environments. The security responsibility follows the software, regardless of which tools helped generate or deploy it.
From Detecting Vulnerabilities to Testing Proposed Fixes
Traditional scanners can leave small teams facing long lists of findings with little guidance about which ones are exploitable or how to repair them. Discovering more vulnerabilities is useful only when developers can understand their significance and act on them. A warning is the start of the investigation, not the finished security work.
Cyfendo connects several stages of that process. Its platform traces the movement of untrusted data through source code toward potentially sensitive operations. For supported findings, it uses isolated tests to investigate exploitability, produces a contextual code patch and re-tests the relevant vulnerability and application behavior. Developers receive the evidence and proposed change for review; the system does not automatically merge edits into production software.
This workflow is especially relevant to businesses using AI-generated applications. Their developers may be able to ship working software without having the experience or time to conduct advanced vulnerability research. Cyfendo aims to reduce that burden while keeping control over code changes with the people responsible for operating the application.
The company has also published results from standardized OWASP detection benchmarks. In its September 2026 evaluations, Cyfendo reported 94.06% recall and 96.38% precision on the Java Benchmark v1.2, which has 2,740 test cases. It reported 90.04% recall and 93.78% precision on the Python Benchmark v0.1, which has 1,230 cases. Recall measures the proportion of known vulnerable cases identified; precision measures how many flagged cases were truly vulnerable. These are company-reported detection results, not an OWASP endorsement or independent validation of repair performance; developers can examine Cyfendo’s published benchmark methodology.
Cyfendo’s code-security platform is available now. The free plan covers up to 10,000 protected lines of code and five scans each month, with detailed findings and limited patch evaluation. Paid self-service subscriptions begin at $99 per month and add automated generation of review-ready patches and larger scanning allowances. A separate application penetration-testing service remains in private beta for select businesses and is not included in those subscriptions.
Two Decades in AI, Now Focused on Defense
Vuong’s experience spans large-scale engineering, machine learning and academic research. From 2020 to 2026, he served as Senior Engineering Manager, AI and Security, at Google, with work involving privacy, safety and security. Earlier, at Facebook, now part of Meta, he worked as a machine-learning research scientist and engineering manager.
He earned a Ph.D. in Computer Sciences from the University of Wisconsin–Madison, studying databases, information extraction and data integration, after receiving a Bachelor of Engineering with First Class Honours from Nanyang Technological University in Singapore. Publishing under the name Ba-Quy Vuong, he contributed academic work on unstructured information and user feedback in information-extraction systems. He is named as co-inventor on three granted U.S. patents involving search and information-processing technology, assigned to Walmart-related entities.
In 2024, Vuong co-founded InnoSearch AI, an online shopping platform designed for blind and low-vision users. The two companies address different problems but share a practical concern: sophisticated technology should be usable by people who do not have specialist resources at their disposal. With Cyfendo, that means helping business owners and developers understand what their software exposes and what they can do about it.
AI-assisted security analysis does not replace access controls, timely updates, incident procedures or a developer’s judgment. But as more businesses use AI to create and maintain applications, the work of identifying and resolving weaknesses cannot remain accessible only to organizations with large specialist teams.
The Google incident demonstrated how quickly attackers can use AI to increase the speed and scale of an operation. Cyfendo’s response is to make investigation and proposed repair more practical for the people defending their own applications. As attackers gain speed and scale, small businesses need security tools that can help them respond with greater speed, evidence and confidence.
About Cyfendo
Cyfendo Inc. is a Silicon Valley-based application-security company founded by Bryan Vuong. Its AI-powered platform combines source-code analysis, vulnerability investigation, exploitability validation where supported, proposed remediation and re-testing. Developers can connect repositories or upload projects, inspect findings and retain approval authority over proposed code changes. Cyfendo offers free and paid code-security subscriptions, with application penetration testing separately available in private beta for select businesses.
Build with AI. Verify with Cyfendo.
About Bryan Vuong
Bryan Vuong, also known as Ba-Quy Vuong, is founder and CEO of Cyfendo. His background includes engineering and machine-learning leadership at Google and Facebook, a Ph.D. in Computer Sciences from the University of Wisconsin–Madison, research publications and co-inventorship on three granted U.S. patents assigned to Walmart-related entities. Before Cyfendo, he co-founded InnoSearch AI, an accessible e-commerce platform for blind and low-vision users.
