SubImage 押注开放核心安全图谱，挑战 Wiz

做的是什么生意

SubImage sells a hosted security platform that maps AWS, SaaS and internal infrastructure into a queryable graph, exposes attack paths and misconfigurations, and generates fixes such as AWS CLI commands or automated infrastructure-as-code pull requests.

启动资金：$4.2M seed (announced 2025-11-17) from FundersClub, Y Combinator, Phosphor Capital and Transpose Platform.

起因

Alex Chantavy, who started in security at the NSA and later led penetration tests on Microsoft's Red Team, joined Lyft in 2019 and helped build Cartography to map cloud infrastructure as an attacker would. Kunaal Sikka, a Lyft staff engineer, co-created the project; the two kept working together and founded SubImage in 2024, joining Y Combinator's Winter 2025 batch and launching on Hacker News on 2025-02-24.

经过

The launch pitch was direct: Cartography was a CNCF project used by more than 70 companies, and SubImage would 'pick up where Cartography leaves off' with a fully hosted offering, fix suggestions, a natural-language query interface and custom data enrichment. The founders positioned the product as an open-core alternative to Wiz, raised a $4.2M seed before YC Demo Day, and announced it publicly on 2025-11-17 with plans to grow the engineering team and expand customer pilots.

结果

As of 2026-09-05 the company is still active: Y Combinator's directory lists SubImage as an active Winter 2025 company with a four-person team in San Francisco, still maintaining Cartography as open source while building the managed offering on top.

可借鉴之处

开源项目可以成为护城河和分发渠道：将 CNCF 工具的托管层货币化给了 SubImage 信任和用户群，而这些通常是种子阶段的供应商需要花钱购买的。