The archive · Developer & Business Tools · Strategic decision · 2024–2026
SubImage bets an open-core security graph can take on Wiz
SubImage (YC W25) bets security teams want an extensible open-core alternative to Wiz: Cartography's creators raised $4.2M seed in Nov 2025.
SubImage
What the business is
SubImage sells a hosted security platform that maps AWS, SaaS and internal infrastructure into a queryable graph, exposes attack paths and misconfigurations, and generates fixes such as AWS CLI commands or automated infrastructure-as-code pull requests.
Starting capital：$4.2M seed (announced 2025-11-17) from FundersClub, Y Combinator, Phosphor Capital and Transpose Platform.
How it started
Alex Chantavy, who started in security at the NSA and later led penetration tests on Microsoft's Red Team, joined Lyft in 2019 and helped build Cartography to map cloud infrastructure as an attacker would. Kunaal Sikka, a Lyft staff engineer, co-created the project; the two kept working together and founded SubImage in 2024, joining Y Combinator's Winter 2025 batch and launching on Hacker News on 2025-02-24.
What happened
The launch pitch was direct: Cartography was a CNCF project used by more than 70 companies, and SubImage would 'pick up where Cartography leaves off' with a fully hosted offering, fix suggestions, a natural-language query interface and custom data enrichment. The founders positioned the product as an open-core alternative to Wiz, raised a $4.2M seed before YC Demo Day, and announced it publicly on 2025-11-17 with plans to grow the engineering team and expand customer pilots.
How it ended up
As of 2026-09-05 the company is still active: Y Combinator's directory lists SubImage as an active Winter 2025 company with a four-person team in San Francisco, still maintaining Cartography as open source while building the managed offering on top.
Background
SubImage, founded in 2024 by Alex Chantavy and Kunaal Sikka, sells a hosted security graph platform built on Cartography, the open-source tool the pair created at Lyft in 2019. It maps cloud, SaaS and internal infrastructure into a graph so security teams can see attack paths to sensitive data and get concrete fixes rather than another alert feed.
The strategic bet was openness: while Wiz popularized cloud-native security platforms, SubImage launched as an open-core alternative, letting customers extend the graph with their own data, write Python plugins and inspect the underlying schema instead of being locked into a proprietary ecosystem.
Cartography's history supplied the wedge. Created for Lyft red teams, open-sourced in 2019 and later adopted by the CNCF, the project gave SubImage a community of more than 70 companies the founders could sell the managed layer to. The company went through Y Combinator's Winter 2025 batch and launched publicly on Hacker News on 2025-02-24, drawing 135 points.
SubImage announced a $4.2M seed round on 2025-11-17 from FundersClub, Y Combinator, Phosphor Capital and Transpose Platform. As of 2026-09-05 it remains an active four-person company in San Francisco, maintaining Cartography while building remediation, change tracking and access-management features on top.
What has to be true
- Security teams already trusted Cartography, so SubImage's hosted product launched with a reference community instead of a cold start.
- Keeping the graph open lets customers verify how findings are produced and extend coverage to proprietary internal systems, a trust advantage closed competitors struggle to match.
- Graph-based attack-path modeling came from the founders' red-team experience, giving the product a defensible origin story competitors could not copy.
- Automating the fix, from CLI commands for small teams to IaC pull requests for large ones, targeted the 'last mile' where visibility tools usually stop.
What can be applied
An open-source project can be moat and distribution channel: monetizing the hosted layer of a CNCF tool gave SubImage trust and a user base a seed-stage vendor normally has to buy.
Aftermath
As of 2026-09-05, SubImage is an active Y Combinator Winter 2025 company with a four-person team in San Francisco. It raised $4.2M in seed funding announced 2025-11-17 from FundersClub, Y Combinator, Phosphor Capital and Transpose Platform, earmarked for engineering hires, customer pilots and features that shorten time-to-fix. Cartography remains open source under the CNCF, and the company's stated roadmap covers pruning excessive permissions, enforcing security invariants, detecting risky infrastructure changes and expanding misconfiguration coverage across clouds and SaaS.
Sources
- Launch HN: SubImage (YC W25) – See your infra from an attacker's perspective
- SubImage Raises $4.2M to Map the Cloud and Secure Everything
- SubImage: The Open-Core Security Graph
spotted an error? The archive wants to know.
Your turn
You just read one. Describe what you are building, and see who is betting on the same thing.
Free account · 3 free questions · no card