On May 20, Socket, a code security company, announced the completion of a $60 million Series C funding round, pushing its valuation past $1 billion and into unicorn territory.
Thrive Capital led the round, with participation from a16z, Abstract Ventures, and Capital One Ventures. Including previous rounds, Socket has raised a total of $125 million.
The number itself isn't flashy—AI startups raising $60 million Series C rounds are common these days. What makes this news noteworthy is Socket's customer list: Anthropic, xAI, Replit, Cursor, Figma, Vercel, Gusto, Mercado Libre, and Cribl.
The first four are top-tier AI companies—one builds Claude, one builds Grok, one builds a cloud IDE, and one builds a coding agent—all quietly paying Socket.
There's a certain irony here. Socket's job is precisely to clean up the mess these AI companies create.
What problem is Socket solving?
CEO Feross Aboukhadijeh stated plainly in the funding announcement:
"AI is changing how software gets built at every level. Teams are moving faster, more code is generated, and more of what ends up in production comes from outside the company. The hard part is keeping that speed without losing visibility into what's actually getting shipped."
In simple terms: AI coding tools have multiplied code output. Copilot, Cursor, and Codex can generate thousands of lines of code per team per day. The problem is that much of this code pulls directly from open-source packages on npm, PyPI, and GitHub. Are these packages safe? Manual review was already overwhelmed; AI coding has made it worse.
Socket's solution: real-time scanning of all open-source dependencies entering production, using AI-assisted and manual review to flag malicious code, suspicious patterns, and undisclosed vulnerabilities.
This isn't entirely new—tools like Snyk, Dependabot, and JFrog offer similar services. Socket's differentiator is "real-time": others scan periodically; Socket intercepts dependencies the moment they are introduced.
The Axios poisoning incident: Socket's breakout moment
Socket's capability was demonstrated vividly during the Axios incident. Axios is an HTTP library used by nearly every JavaScript project, with over 50 million weekly npm downloads. Recently, attackers injected malicious code into a popular Axios derivative package, designed to steal tokens and keys from environment variables.
The timeline:
- Malicious package released: Attacker uploads compromised version
- 6 minutes later: Socket platform flags and blocks the version
- Within 24 hours: Over 2,000 organizations urgently sign up for Socket
Six minutes means that before most companies' CI/CD pipelines could pull the package into production, Socket had already blocked it for its users. Gaining 2,000 customers in 24 hours is a powerful testament—essentially free market education.
In traditional vulnerability disclosure, this process typically takes days or even weeks: researchers discover the issue, security teams reproduce it, a CVE is assigned, SBOM tools sync, and users update dependencies. Socket compresses that timeline to minutes.
Why investors are willing to pay a unicorn valuation
Thrive Capital partner Philip Clark said in the announcement:
"Security is changing radically and rapidly. Legacy tools were designed to react to known vulnerabilities..."
The message is clear: traditional code security tools are reactive—they wait for vulnerabilities to be discovered and then fix them. In the AI coding era, that pace is insufficient; the approach must shift to "block the code the moment it arrives."
a16z, a returning investor from Socket's Series A and B, participated again. Capital One Ventures' entry signals another trend: the financial industry is beginning to treat open-source supply chain risk as a top-tier compliance concern.
According to a recent OWASP survey, software supply chain failure is ranked as the top security risk for enterprises. Yet the same report shows that only 36% of organizations have conducted any form of assessment on their open-source dependencies. This gap is Socket's market.
The subtle irony: AI companies feeding Socket
Returning to the customer list—Anthropic, xAI, Cursor, Replit, Vercel. These companies all sell the "AI-accelerated coding" story. Cursor's valuation recently hit $50 billion; Replit is building the entry point for vibe coding; Anthropic pushes Claude Code; xAI pushes Grok Code Fast.
The more successful their products, the more AI-generated code exists in the world. More AI-generated code means more code merged without review. More unreviewed code means a higher likelihood of bombs hidden in open-source dependencies.
This isn't moral condemnation—the selling point of AI coding tools is precisely to eliminate manual review. It's a real market feedback loop:
One hand sells the shovel, the other sells the shield.
And those who know the shovel's power best are the ones selling it.
So it's no surprise these AI companies are writing checks to Socket. They know best how many new attack surfaces their products create for customers, and they've likely been bitten by their own tools during internal dogfooding.
This space will only get more crowded. Snyk last month integrated Claude into its scanning pipeline; GitHub Advanced Security is adding AI detection layers. Socket's unicorn valuation now reflects its early mover advantage, but how deep its moat can go will be tested in the coming year.
For now, every line of code spat out by AI coding tools helps Socket sell another license.
Sources: AI security startup Socket hits $1B valuation after $60M raise to stop software supply chain attacks (Tech Startups); Socket Raises $60M Series C at a $1B Valuation to Help Enterprises Build Securely With AI (Socket Blog); CocoLoop; Code security startup Socket raises $60M in funding (SiliconANGLE); Security Firm Thwarting Nation-State Hackers Valued at $1 Billion (Bloomberg)