As data from the United States Federal Bureau of Investigation shows that internet crime in the U.S. results in losses of nearly $21 billion, Silicon Valley cybersecurity startup Cyfendo is utilizing AI to help small businesses identify software vulnerabilities, investigate real threats, and prepare tested fixations before they are approved by developers.
Mountain View, California, October 15, 2026 / PRNewswire / The attacker does not need a team; they only require a AI encoding proxy, operational instructions, and a set of tools. According to a report by Google Threat Intelligence Group on September 8, 2026, a suspected cybercriminal used a framework that supports AI to launch a large-scale credential collection campaign from the compromised cloud infrastructure in less than 6 hours, planning, constructing, and executing the entire attack process. As a result, thousands of third-party login credentials were leaked.
This attack demonstrates that attackers are capable of organizing a large-scale operation within just a few hours. For a small business, the next security alert might fall on the desk of a developer who also has to handle customer support requests and software updates. Bryan Vuong hopes to make such investigation work less difficult in the future.
The founder and CEO of a Silicon Valley cybersecurity company, Cyfendo, Bryan Vuong, previously worked in engineering roles at Google and Facebook. His company utilizes AI to assist with source code analysis, helping developers identify potential vulnerabilities, investigating whether these vulnerabilities can be exploited with the support of relevant tools, and evaluating proposed fix solutions before any changes are approved. The goal is to enable smaller teams to possess the investigative capabilities that are typically only available within large tech companies.
What worries me is that the attacking capabilities are getting stronger and stronger, while there is a huge gap in the resources available to ordinary enterprises for defense. I founded Cyfendo to help them protect everything they have worked so hard to build.
The cost of cybercrime, and the enterprises that face those risks
The FBI's "2025 Internet Crime Report" recorded 1,008,597 complaints, as well as reported losses from internet crimes, including fraud, amounting to approximately $20.88 billion. Meanwhile, according to the U.S. Small Business Administration, there were about 36.2 million small businesses in the United States in 2025, with over 4.3 million of them located in California.
Small businesses rely on software to take orders, process payments, schedule services, and store customer records. When a problem is detected during a scan, the person responsible for maintaining the application must determine whether attackers could exploit that issue, which information is at risk, and how to fix it without disrupting the functions that customers depend on. This task also has to compete with time constraints for support requests and the release of the next version.
AI can be used to build applications, but who will check their security?
The AI coding tool can help restaurants launch online ordering systems, assist contractors in setting up customer portals, or enable entrepreneurs to build applications without hiring traditional development teams. For example, a small distributor allows customers to download invoices through the portal. A customer can simply modify a single digit in the invoice URL to access another customer's billing records. The website appears normal, and login is successful; ordinary tests may not reveal any issues. However, the error lies in the access rules—invoices belonging to different customers should have been isolated from each other.
Other vulnerabilities are equally difficult to detect. Database queries may return correct information to legitimate users, but they can fail when processing malicious input. A newly integrated service may have access permissions that exceed what is necessary. These errors do not necessarily have to disrupt the normal transaction process, but they are sufficient to expose a company to risks.
A completed application may also go through the hands of multiple tools. Developers might start a project in Lovable, then use Cursor to modify the code, integrate Supabase for authentication and storage, track versions in GitHub, and deploy the project to other locations. Each service has its own security controls, but after these changes, it cannot be assumed that a single check on any one part will cover the entire codebase. It is still necessary for someone to inspect the software actually used by customers.
Cyfendo indicates that in addition to the protection provided by these platforms, code-level review is also implemented. Developers can connect to the GitHub, GitLab, or Bitbucket code repositories to upload project files, or perform operations through the command line. They can check the current actual state of the application, including any new features and integrations that have been added since it went live.
Discovering a vulnerability is just the first step.
Scanners may identify a line of suspicious code, but they do not inform developers about how attackers might exploit it. It still requires someone to reproduce the issue, assess its severity, fix the code, and check whether the application continues to function normally.
Cyfendo indicates that, within the scope of its tool support, it links these steps together. The platform traces the path of untrusted data flowing towards sensitive operations in the source code, runs isolation checks to investigate whether vulnerabilities can be exploited, and prepares a code patch for review. Subsequently, it retests the findings and related application behavior. Developers can view the evidence and decide whether to accept the proposed changes; Cyfendo does not merge the patch directly into the production software.
Bryan Vuong signifies: "Regardless of the size of a company, every business deserves world-class security protection. Protecting what you've built should not depend on whether you can afford a team of experts or not."
This approach is particularly useful when a person responsible for an application built with AI also needs to respond to support requests and deliver new features. While this developer may have a deep understanding of the business itself, they may not have the time or training to investigate each security finding from scratch.
According to the scanning data of Cyfendo itself, the company finds an average of 4 severe issues in each codebase. Approximately seven out of ten of these issues are classified as high-risk or severe. These results come from projects that have been scanned by Cyfendo and do not represent a representative survey of enterprise applications. Cyfendo states that this also explains why the company emphasizes investigating the findings and preparing fix plans, rather than adding another list of alerts for developers.
Cyfendo also separately published its results on the standardized OWASP testing benchmark. According to its assessment in September 2026, the company reported that on Java Benchmark v1.2 (2,740 test cases), the recall rate was 94.06%, and the precision rate was 96.38%; on Python Benchmark v0.1 (1,230 test cases), the recall rate was 90.04%, and the precision rate was 93.78%. The recall rate measures how many known vulnerability cases were detected; the precision rate measures how many of the marked cases actually contained vulnerabilities. Cyfendo indicates that these are the testing results reported by the company itself and do not represent the endorsement of OWASP, nor are they an independent verification of the automated repair capabilities. Cyfendo has made its benchmark testing methods available for external review.
The code security platform of Cyfendo is now live. Its free plan covers up to 10,000 lines of protected code, allows for 5 scans per month, and provides detailed findings along with limited patch evaluation services. The paid self-service subscription starts at $99 per month, including automatically generated patches for review, as well as an increased number of scans. The company's application penetration testing services, which are offered separately, are currently still in a private testing phase for certain enterprises and are not included in the aforementioned subscription.
Professional experience of Bryan Vuong: From research in AI to applied security
Vuong's background covers project management, machine learning, and academic research. From 2020 to 2026, he held the position of AI and Senior Security Engineering Manager at Google, working in areas related to privacy, security, and protection. Prior to that, at what is now part of Meta, under Facebook, he served as a Machine Learning Research Scientist and Engineering Manager.
He holds a Doctor of Philosophy in Computer Science from the University of Wisconsin-Madison, with research interests including databases, information extraction, and data integration. Prior to that, he obtained a Bachelor of Engineering degree from Nanyang Technological University in Singapore, graduating with honors. When publishing research under the name Ba - Quy Vuong, he participated in studies related to unstructured information and user feedback in information extraction systems. He is also listed as a co-inventor of three authorized U.S. patents involving search and information processing, which have been assigned to entities associated with Walmart.
In 2024, Vuong co-founded InnoSearch AI, an online shopping service designed for blind and low-vision users. This service helps users to enjoy a smoother online shopping experience, which is not always tailored for them. Through Cyfendo, he is addressing another type of capability gap: smaller organizations can now build quite complex software, but often lack the professionals necessary to assess its security.
Automated analysis cannot replace sound access control, timely updates, or the judgment of developers themselves. However, when a security issue originally requires expert intervention for investigation, it can provide evidence and a set of repair recommendations for review to smaller teams.
A Google survey shows what kind of actions attackers can organize within just a few hours. What Cyfendo focuses on is the work developers face after discovering potential vulnerabilities: determining whether they can be exploited, reviewing fix plans, and checking the results of the changes. Nowadays, more small businesses can use AI to build their own applications; they also need an effective way to check the security of their software once it is launched.
About Cyfendo
Cyfendo Inc is an application security company headquartered in Silicon Valley, founded by Bryan Vuong. The company's AI drive platform combines source code analysis, vulnerability investigation, exploitableness checks with support, proposed patches, and retesting. Developers can connect to code repositories or upload projects to view the findings and approve or reject the proposed code changes. The company offers both free and paid code security subscription services; application penetration testing, with a defined scope, is currently in a private testing phase for select enterprises.
Constructed with AI, verified with Cyfendo.
About Bryan Vuong
Bryan Vuong, also known as Ba - Quy Vuong, is the founder and CEO of Cyfendo. His experience includes working in engineering and machine learning management at Google and Facebook. He holds a Doctor of Computer Science degree from the University of Wisconsin-Madison, has participated in academic research, and is a co-inventor of 3 authorized U.S. patents, which have been assigned to entities related to Walmart. He previously co-founded an accessible e-commerce platform InnoSearch AI for blind and low-vision users.
Media contact: Wendy Nguyen, (650) 262-6576
