Skip to content

We wrote the book. This is the sequel.

Crash Override was founded by Mark Curphey, who founded OWASP, and John Viega, who wrote the first book on software security. They're building on that with a leadership team from NS1 and GitLab, and a company that follows its own rules.

  • John Viega

    John Viega

    CEO and co-founder

    1. Wrote the first book on software security, and eight in all.
    2. Inventor of AES-GCM encryption, a NIST standard.
    3. Co-founder and CEO of Capsule8 (acquired by Sophos).

    Used to run the Dave Matthews mailing list. Invented the unsubscribe link.

  • Mark Curphey

    Mark Curphey

    Co-founder

    1. Founded OWASP in 2001 and defined AppSec.
    2. Shipped Microsoft's developer tools to the world.
    3. Built the first pure-play SCA company, SourceClear (acquired by Veracode).

    Ultra-distance gravel racer and new sailor.

Crash Override, 2022

Manifesto

We stop bad code.

  • Mark Curphey
  • John Viega

  1. Security teams are losing visibility. AI agents write code in the developer workspace and nobody can see what they're producing. Dependencies get pulled in from everywhere. Builds make decisions no human reviews. Attackers use AI to find the flaws in minutes. What ships to production is a mystery, and when something breaks, the team is flying blind.

  2. The build system is the only place where decisions are actually made. It's where source becomes software. Where dependencies are resolved. Where containers are assembled. Where everything that ships to production is determined. Everything else is opinion. The build is the truth.

  3. Yet nobody looks inside. Scanners stop at the repository. The build is a black box. What happens in the build, stays in the build. Vegas rules.

  4. We believe if you want to know what's in your software, you have to be there when it's made. Not before. Not after. During. You have to see what's written in the developer workspace, record what's built, and follow it into production. When anyone can find the flaw, the only defense is not shipping it.

  5. That's what we built. Not another scanner. Not another dashboard. AppSec for the AI era: the workspace sensor where code is written, the build sensor where it's built, and a data plane that connects them to everything running in production. Deterministic. Cryptographic. Irrefutable.

Facts, not guesses. Build systems don't hallucinate.

Leadership

  • Brandon Edwards

    Brandon Edwards

    Chief Technology Officer

  • David Coffey

    David Coffey

    Chief Product Officer

  • Mike Flouton

    Mike Flouton

    Chief Marketing Officer

  • King Krompicha

    King Krompicha

    Chief Human Resources Officer

We are backed by Google Ventures, Syn Ventures, and Blackstone.

  • Google Ventures
  • Syn Ventures
  • Blackstone

See it on your own code.

30 minutes with our team, on a repo you pick.

Book a demo