Following PHP2Shell, Montreal startup brings agentic development security to Microsoft's enterprise customers
BoostSecurity, a provider of security for the agentic software development lifecycle, today announced its acceptance into the Microsoft for Startups Pegasus Program. The invite-only program connects select business-to-business (B2B) startups with Microsoft's global network of enterprise customers and partners to accelerate growth.
The news lands during what the industry is already calling "Black October." In the six days between October 16 and October 22 alone, there were at least nine major software supply chain incidents, including the PHP2Shell flaws disclosed on October 21, the compromised emSign certificate authority keys, Node2Shell, and a malicious release of LiteLLM, the open-source gateway used across AI stacks. Each one set off the same scramble: are we affected, what is the exposure, and what do we do about it. Teams are still working through those questions today.
Through Pegasus, large organizations built on Microsoft's platform that need to secure their entire agentic development pipeline will be able to trial and adopt BoostSecurity. The company will also have the support of Microsoft's go-to-market team in reaching those enterprises.
Enterprises are moving quickly from AI-assisted coding to autonomous coding agents that write, test, and ship software. That shift expands the attack surface: agent-generated code, agent-controlled developer endpoints, and CI/CD pipelines that now run largely without human review. BoostSecurity secures that full lifecycle, from the coding agent on the developer's machine through generated code, build pipelines, and production, so that security teams can let engineering teams adopt agents without losing control.
"Many of the world's largest enterprises run their entire software lifecycle on Microsoft technology, from the developer's machine through CI/CD to production. Agents now sit at every stage of that path, and every one of them is a new way in. These companies are asking the same question: how do we govern what the agents build without slowing them down," said Zaid Al Hamami, Founder and CEO of BoostSecurity. "PHP2Shell showed AI can turn a flaw that sat in PHP for more than a decade into a working exploit, and the same week brought a malicious LiteLLM release and weak certificate authority keys. Every one of these incidents sends teams scrambling to figure out if they're affected. BoostSecurity gives them a platform built for exactly that question. Joining the Pegasus Program lets us put that answer in front of the enterprises that need it now, with Microsoft's reach behind us."
"We're excited to welcome BoostSecurity to the Microsoft for Startups Pegasus Program. This initiative gives select startups access to Azure's cutting-edge AI models, enterprise-grade security and privacy, and unique go-to-market support to accelerate growth. Through Pegasus, startups can build fast, scale smart, and sell more by tapping into the full power of Azure and the Microsoft ecosystem," said Tom Davis, General Manager, Microsoft for Startups.
BoostSecurity's platform spans three product lines:
- Agentic Endpoint Security, which governs AI agents and ensures generated code is secure pre-commit;
- Application Security Posture Management (ASPM), which consolidates findings across code, dependencies, and infrastructure and prioritizes them based on exploitability risk;
- Supply Chain Security, which hardens CI/CD pipelines and third-party components against supply chain attacks.
The platform integrates directly with customers' software development infrastructure, cloud, and security tools. BoostSecurity's customers include Workato, Demandbase, Gusto, Travelport, Hub International, Deluxe, and Greenlight Financial, among many more.
For more on Microsoft for Startups, visit startups.microsoft.com.
.svg)
