Bryan Onel’s father worked as a locksmith, and Onel refers to himself as the digital version of that profession.
Onel was passionate about ethical hacking from a young age. He pursued artificial intelligence at university and later transformed his interest in hacking into a career. “For ten years, I conducted penetration tests for more than 150 organizations in various industries,” Onel shared with TechCrunch, noting that he frequently found vulnerabilities in companies that had already cleared their security audits.
Onel observed that security measures typically fell into two categories: either they were effective but cumbersome, or easy but insufficient. He noticed that most businesses only met the minimum requirements for cybersecurity and compliance, since implementing robust security often demands significant effort, specialized tools, and skilled personnel.
Clients frequently approached Onel, asking if he could develop a solution to address their security challenges, so he decided to try.
In 2022, Onel joined forces with his wife, Ora, and his university friend Erik Vogelzang to establish Oneleet, a comprehensive platform for security compliance. Their startup’s mission is to help companies achieve security certifications and strengthen their defenses more efficiently.
Onel explained to TechCrunch that most compliance platforms on the market simply collect evidence: users upload data from their systems, pay a fee, and then receive a certificate declaring them secure.
“This leads to what I call compliance theatre,” Onel told TechCrunch. “You might have a certificate, but your systems can still be exposed to a range of threats.”
According to Onel, Oneleet stands apart by offering a comprehensive set of security features, including penetration testing, code analysis, cloud security, attack surface monitoring, security training, and more, all designed to give companies deeper insight into their security posture.
“Since our platform is built to be fully integrated, clients can implement end-to-end security with just one click,” Onel added. “This approach saves clients countless hours and removes the blind spots that come from juggling multiple disconnected tools.”
Oneleet also collaborates with independent auditors to conduct official certification assessments.
On Thursday, Oneleet revealed it had secured $33 million in Series A funding, led by Dawn Capital, to support its expansion. Onel described the fundraising as “straightforward,” saying he met Dawn Capital in San Francisco and felt an instant connection.
“They already possessed a strong understanding of the security and compliance industry and immediately grasped our vision for Oneleet, so we were on the same page from the start,” Onel said.
Other backers in this round include Y Combinator, Dropbox co-founder Arash Ferdowsi, and Frank Slootman, former CEO of Snowflake and ServiceNow. Oneleet was part of Y Combinator’s Summer 2022 batch, and now, two-thirds of the new companies in the VC’s portfolio have become its clients.
Vanta, Secureframe, and Sprinto are among the competitors in this sector. Oneleet, meanwhile, has achieved $9 million in annual recurring revenue and has raised a total of $35 million so far.
The newly acquired funds will be used to grow Oneleet’s engineering team, enhance its AI features, and broaden its customer base. Onel said the company’s mission is to put an end to “compliance theatre” at a time when cybersecurity is more critical than ever.
Onel pointed out that AI is transforming the landscape of cyber threats. He noted that sophisticated attackers are automating cybercrimes, making it easier for inexperienced hackers to launch harmful attacks.
He also mentioned that some companies are acting irresponsibly, such as using unreliable “vibe coding” tools or granting AI access to sensitive business data without proper safeguards. In compliance, Onel said, AI can be misused to create fake documents, giving a false impression of security.
Onel stated that his company makes extensive use of AI for tasks like threat modeling and security evaluations, as well as policy drafting. However, he emphasized that a human team always reviews the information to ensure clients don’t encounter AI-generated errors. “We use it responsibly,” he said.
“The best security should be seamless,” Onel went on. “Businesses ought to focus on creating outstanding products instead of being preoccupied with security concerns. We believe we can empower companies to protect themselves more effectively than ever before.”
This article has been updated to correct inaccuracies related to ARR.
