Defender-only cyber models fill the gap left by locked-down frontier labs

Both ideas already have real competitors, but the AI MDR idea is much more crowded. For mid-market AI MDR, incumbents like Sophos (on OpenAI Daybreak), Arctic Wolf and Rapid7 are adding frontier-lab agents to existing customer bases. AI-native players like AirMDR, UnderDefense, Dropzone, Exaforce and Prophet already sell agentic investigation with human sign-off. Being lab-agnostic doesn't set you apart, because the labs only give access through partner programs and the incumbents are those partners. Seconds-level response also makes price the main way to compete, and a newcomer without distribution can't win on price. Unless you target a narrow vertical or region, I'd skip this one. The fix-the-findings idea is more open, but the opening is narrower than it looks. On the open-source side, OpenAI's Patch the Planet with Trail of Bits already does deduplication, severity correction and patch writing for flagship projects. Trail of Bits says it will open-source its triage tooling. Foundations are getting $12.5M through Alpha-Omega/OpenSSF, which makes them grant-makers rather than paying customers, and Anthropic now attaches suggested patches to its findings. On the enterprise side, Pixee, Corgea, ZeroPath and GitHub Copilot Autofix already triage and fix scanner output. What's left is the long tail of open-source maintainers and downstream enterprises who get duplicate reports for the same bug from several labs, bounty hunters and scanners. The thing to build is a neutral clearinghouse, not another scanner. It would merge findings across Anthropic, OpenAI, Google and independent researchers, check them against reachability and code that's actually deployed, coordinate one patch upstream, and send that fix back to every affected enterprise fork and vendored copy. The labs each only see their own findings, and Pixee-style tools only see one company's code. Something that works across every reporter and every downstream copy is the uncovered position. Enterprises paying for upstream-fix SLAs is a more plausible business model than selling to foundations.

• OpenAI Patch the Planet (with Trail of Bits, HackerOne, Calif)

  This is the closest direct overlap with the fix-the-findings idea. OpenAI pays Trail of Bits engineers to deduplicate and filter AI-found bugs, fix severity ratings, and turn findings into tested patches before maintainers see them. Early participants include Python, Go, cURL, Sigstore and NATS. Trail of Bits says it will publish its triage tooling as open source, which would make that layer a free commodity.

• Trail of Bits triage tooling

  Trail of Bits names deduplication, false-positive filtering and severity correction as the core bottlenecks. It reports that simple AI-based deduplication grounded in the affected code lines already works well, and it plans to release this tooling to maintainers.

• Alpha-Omega / OpenSSF maintainer fund (Linux Foundation)

  Anthropic, AWS, GitHub, Google, Microsoft and OpenAI put up $12.5M to help maintainers cope with floods of AI-generated bug reports. The money funds foundation-run work rather than vendors, so open-source foundations are more likely to give grants to this layer than to buy it.

• Anthropic Claude Code Security / Mythos coordinated disclosure

  Anthropic scans for free and suggests patches. Its own disclosure dashboard says human triage is the limiting factor, and it calls the gap the patching bottleneck: about 1,596 vulnerabilities disclosed but only about 97 confirmed patched. That confirms the pain is real. Anthropic is also attaching suggested patches to its findings itself.

• Pixee

  Pixee sits behind SAST/SCA scanners and handles triage, false-positive reduction and merge-ready fixes for enterprise AppSec teams. It raised $15M and reports a 76% merge rate, a vendor figure. This is the enterprise side of the fix-the-findings idea.

• Corgea

  Corgea does AI detection, triage and auto-remediation inside developer workflows, priced from about $34 per developer per month.

• ZeroPath

  ZeroPath is an AI SAST tool with automatic patching on paid tiers. It competes for the same enterprise AppSec budget.

• Sophos MDR on OpenAI Daybreak

  Sophos, an incumbent MDR provider, is putting frontier-lab models into its MDR with its own analysts in the loop, and claims 89-second threat response. The AI speed advantage goes to the incumbent's 625,000-customer base, not to a new entrant. Tenable has also joined Daybreak.

• AirMDR

  AirMDR is an AI-native MDR with agentic investigations and human-in-the-loop governance, aimed at lean SOC teams. This is almost exactly the lab-agnostic AI MDR idea, already funded and winning awards.

• UnderDefense Agentic AI SOC

  UnderDefense sells agentic AI plus human analysts on call to mid-market companies, layered on their existing Splunk, Sentinel or Chronicle setups.

• Stellar Cyber + M-Theory

  This is an AI SOC with human-in-the-loop validation, aimed at organizations that can't staff a 24/7 SOC. Arctic Wolf, Rapid7, Dropzone, Exaforce, Prophet and Intezer also compete for the same mid-market AI SOC/MDR buyers.

Checked 2026-10-09