$2.65m · Pre-Seed · Software · London, UK
Image: Ossprey
Ossprey, a London company building software-supply-chain security for engineering teams, has raised $2.65m in pre-seed funding. Episode 1 Ventures led the oversubscribed round, with Osney Capital and Octopus Ventures participating. The company said the capital will fund product development, engineering and commercial hiring, and expansion from the UK into Europe and North America.
Watching package behaviour before signatures exist
Open-source packages give development teams a faster way to assemble software, but they also create an indirect route into production. A malicious package can install cleanly and still execute credential theft, data exfiltration or other unwanted behaviour before a vulnerability database or security vendor has catalogued it. Ossprey argues that this gap has widened as AI coding tools increase the volume of code and dependencies moving through software pipelines.
The company positions its platform alongside existing development tooling rather than as another approval queue. It combines static analysis with behavioural techniques, continuously scanning packages across major ecosystems and giving security teams context on what suspicious code is trying to do. The commercial promise is lower-friction risk control: engineering-led companies can add a specialist detection layer without forcing developers to stop and manually review every dependency.
That workflow fit is central to the product’s economics. Security software loses value when noisy alerts create so much triage that teams route around it. Ossprey is therefore selling not only detection coverage but also the claim that a narrower focus on malicious package behaviour can produce alerts that are specific enough to act on. Proving that signal quality across many languages, package ecosystems and customer environments will matter as much as the breadth of its scanning.
The round funds a move from detection to repeatability
Ossprey said it had grown to seven people after closing the round, expanded the platform and launched a public scanning service that was already identifying newly published malicious packages. Episode 1 principal Millan Suri pointed to the founders’ direct experience of the problem and the detection engine’s ability to catch threats that signature-based tools miss.
The financing now gives co-founders Nate Dunning and David Read room to turn those early technical results into a repeatable enterprise product. International expansion will require more than finding malicious code: customers will need dependable integrations, low false-positive rates and evidence that the system can keep pace with fast-changing attacker techniques. If Ossprey can preserve engineering speed while making dependency risk easier to act on, the product can sit between conventional vulnerability scanning and the moment unknown code reaches production.
Sources checked:
Ossprey company announcement · Ossprey product site · Ossprey team · Ossprey LinkedIn · Tech.eu report · UKTN report · Tech.eu Funding Explorer
