We got tired of patching the wrong things.
Derek Voss and Maya Chen spent years in AppSec roles watching engineers burn sprint capacity on CVSS 9.8 advisories in dead code paths. Teams were drowning in advisory noise, trust between AppSec and engineering was eroding, and nothing was actually getting safer.
The problem wasn't that engineers ignored security — it was that the signal was broken. A 300-item CVE list with no reachability context isn't a security program, it's a backlog that everyone learns to ignore. Every existing SCA tool surfaces the same advisory flood and hands the triage problem back to you. We built Patchlynx to solve the triage problem directly: prove which CVEs are on a live call path from your entry points, rank those, and send everything else to a periodic review queue. Founded in Seattle, WA in 2025.
Two practitioners building a practitioner tool
Derek Voss
CEO & Co-FounderSpent six years running vulnerability management programs at SaaS companies shipping 80–120 deploys per week — the kind of environment where a 300-advisory SCA report lands every Monday and engineers have been trained to close the ticket. Built triage workflows, wrote suppression rules, and eventually realized the tooling was the problem: every scanner was reporting on what packages were present, not whether those packages were reachable. Co-founded Patchlynx in Seattle in 2025 to fix the signal, not the workflow.
Maya Chen
CTO & Co-FounderSoftware engineer with a background in static analysis tooling and compiler infrastructure. Built internal call graph analysis tools for two different engineering organizations before joining Derek to turn the approach into a product — at each company the same question came up: why is the SCA scanner flagging 300 packages when the application's call graph touches maybe 40? Wrote the first version of Patchlynx's call graph engine in three weeks, working from that question.
Three principles that don't make for good marketing copy
We don't do SAST, DAST, or secrets scanning. We do one thing: prove which CVEs in your dependency graph are actually reachable from your running code, rank them, and get out of the way. Tools that try to cover everything end up covering nothing well.
Reachability over quantity
We measure success in patches not skipped, not CVEs found. The goal is not to surface every possible vulnerability — it's to surface exactly the ones worth fixing right now. Every feature decision goes through that filter.
Practitioners first
If a security engineer can't act on our output in one sprint, we failed. We build for the person who has to justify their patch list to an engineering team on a Monday morning — not for the CISO who reads the dashboard once a quarter.
Boring infrastructure wins
Patchlynx runs in your CI pipeline, not as a tab you close. Security tooling that requires behavior change is security tooling that doesn't get used. We integrate into the workflow that already exists, not the one we wish developers had.