We got tired of paying for drift twice
Fortify Core was founded by platform engineers who spent too many incidents discovering that production had stopped matching the code months earlier — and then spent the following week proving it to an auditor.
Founded
2024, San Francisco
Team
23 people across 4 time zones
Resources watched
1.4M and counting
Drift events reversed
310,000+
The origin
In 2023 our founders were running platform teams at two different companies and hit the same wall in the same quarter: a security group widened during an incident, never reverted, discovered eleven weeks later by an auditor rather than by a tool. Both teams had Terraform. Both teams had CI. Neither had anything watching the gap between the code and the account.
The prototype was a cron job running refresh-only plans into a Slack channel. It was immediately too noisy to use, which turned out to be the real problem worth solving: classification and remediation, not detection.
Detection without a fix is a shrug
Any tool can print a diff. We only consider a finding handled when there is a reviewable change that closes it, and we measure ourselves on time to reconciliation rather than alert volume.
Least privilege is a product decision
We chose an architecture where we cannot write to your cloud, because the safest credential is the one that was never issued. It costs us some convenience and buys every customer a smaller blast radius.
Boring beats clever in production
Guardrails, delays and volume ceilings are unglamorous. They are also the reason automated remediation has never caused a customer incident.
We run it on ourselves first
Every release scans Fortify Core's own infrastructure before it reaches a customer environment. If a change would be noisy for us, it never ships.
How we work
Fully remote across four time zones with a weekly release train, written proposals instead of status meetings, and a support rotation that includes every engineer. We publish our incidents on the status page with the postmortem attached.
Backed by infrastructure-focused investors and profitable on the Scale plan since 2025. If that sounds like a place you would work, we are hiring.