Image credit: QuestorAI
QuestorAI announced a $3M seed round on October 21, 2026. Paladin Capital Group led the financing, with participation from Denver Ventures. The Seattle-based company builds application security technology that automatically identifies and fixes software vulnerabilities.
The company’s argument is that AI is speeding up software development, which means more code to secure and a growing remediation backlog. Traditional application security tools mostly flag potential vulnerabilities and pass the findings to engineers, who must then investigate, validate, prioritize, fix, and test each one. QuestorAI is building an alternative that goes beyond finding problems to fixing them.
CEO and co-founder Graham Calladine said that model will be hard to scale as AI raises the speed and volume of development. He said security shouldn’t be another system engineers have to operate, and that QuestorAI is meant to let information security behave more like infrastructure: always there, continuously working, and increasingly autonomous.
The platform pairs deterministic code analysis with targeted use of foundational or locally deployed large language models. It is designed to work out whether vulnerabilities are exploitable, give engineers the context behind an issue, and generate and validate fixes that preserve the software’s intended behavior. As organizations gain confidence in the platform, those fixes can increasingly be applied without human intervention.
QuestorAI says it is built to fit into existing enterprise security and development environments, without proprietary rule languages or complex configuration. Organizations can deploy models locally, so source code stays in their own environment. For external use cases, the platform aims to minimize the code and context sent for inference. The company is working with design partners at major technology companies and regulated enterprises to test the platform against real production codebases.
Christoper Steed, Chief Investment Officer at Paladin Capital Group, said enterprises can’t keep relying on a security model that finds problems faster than engineering teams can fix them. He pointed to the founders, Graham, Rob, and Dan, as bringing a strong mix of application security, engineering, and product experience.
The funding will go toward accelerating development of the analysis and autonomous remediation platform, expanding work with enterprise design partners, and growing the team ahead of broader availability. Paladin is a multi-stage investor focused on AI, cyber, and deep tech, headquartered in Washington, D.C. According to its own description, it has backed more than 90 companies since 2008.
The product capabilities and design partner work described above are self-reported by the company.
