Echo raises $35M to secure the enterprise cloud's base layer — container images — with autonomous AI agents

Hey there, tech enthusiasts! Let’s dive into a game-changing startup that’s shaking up the cloud infrastructure scene. As companies rush to adopt LLMs and agentic workflows, they’re running into a major roadblock: security issues lurking in the container base images that power these applications.

Echo, a dynamic Israeli startup, just secured a whopping $35 million in Series A funding (bringing their total funding to $50 million) to revolutionize how cloud infrastructure is constructed.

The funding round was led by N47, along with investments from Notable Capital, Hyperwise Ventures, and SentinelOne. But beyond the capital injection, what truly sets Echo apart is its bold mission to overhaul the chaotic open-source supply chain with a secure-by-design operating system.

Unveiling the Cloud’s Hidden Operating System

To grasp Echo’s significance, let’s start with the unsung heroes of the internet: container base images.

Imagine a “container” as a neat package for software. It houses the application code and all the essentials for it to run smoothly, including the crucial “base image.” For the less tech-savvy folks, think of a base image as the Operating System (OS) in a new laptop. Without it, the computer is just a fancy paperweight.

In the cloud realm, the base image serves as that vital OS. Whether it’s a basic web app or a complex AI network, companies rely on these pre-built layers (like Alpine, Python, or Node.js) to define the underlying frameworks and dependencies.

Here’s where the trouble brews. Unlike mainstream OS like Windows or macOS, most base images are open-source and crafted by volunteer communities. Designed to cater to a broad audience, these images often come bloated with unnecessary tools and settings.

Eylam Milner, Echo’s CTO, paints a stark picture of the risks involved: “Using software straight from the open-source world is akin to plugging a random computer from the street into your network.”

Traditionally, companies attempt to address this by scanning the image for bugs and trying to patch them up. However, it’s a losing battle. Echo’s research reveals that official Docker images often carry over 1,000 known vulnerabilities (CVEs) right from the moment they are downloaded. This leaves enterprise security teams grappling with a mountain of infrastructure debt before their developers even start coding.

Echo: Spearheading the “Enterprise Linux” Revolution for AI

For Eilon Elhadad, Echo’s CEO and co-founder, history seems to be repeating itself. “Just like the shift to Enterprise Linux post the Linux era, we envisage being the ‘enterprise AI native OS’ in the AI-centric age,” Elhadad shared with VentureBeat.

“We envision ourselves as the bedrock of the AI native epoch,” he added.

The Breakthrough Tech: A Factory for Software Compilation

Now, here’s the kicker: Echo isn’t your typical vulnerability scanner. It doesn’t just hunt for bugs post-facto. Instead, it functions as a “software compilation factory” that reconstructs images from the ground up.

According to Milner, Echo’s strategy to eradicate vulnerabilities hinges on a meticulous two-step engineering process for every workload:

1. Compilation from Source: Echo starts afresh, building binaries and libraries from source code rather than patching existing bloated images. This guarantees that only essential components make the cut, significantly shrinking the attack surface.
2. Hardening & Provenance (SLSA Level 3): The resulting images are fortified with stringent security configurations to deter exploitation. Crucially, the build pipeline adheres to SLSA Level 3 standards, ensuring that each artifact is signed, tested, and verifiable.

The outcome? A seamless “drop-in replacement.” Developers just need to tweak a single line in their Dockerfile to link to Echo’s registry. The application runs flawlessly, but the underlying OS layer is squeaky clean and devoid of known CVEs.

Battling AI with AI

The need for such stringent hygiene practices stems from the escalating “AI vs. AI” security race. Malevolent actors are increasingly leveraging AI to shrink exploit windows from weeks to mere days. Meanwhile, AI-driven “coding agents” are churning out code in bulk, often picking outdated or vulnerable libraries from open source.

To counter this, Echo has constructed a proprietary network of AI agents that autonomously handle vulnerability research.

• Continuous Monitoring: Echo’s agents keep tabs on the 4,000+ new CVEs added to the National Vulnerability Database (NVD) every month.
• Unstructured Research: Beyond official sources, these agents scour unstructured platforms like GitHub comments and developer forums to spot patches before they go mainstream.
• Self-Healing: Once a vulnerability is confirmed, the agents identify affected images, implement the fix, run compatibility tests, and generate a pull request for human scrutiny.

This automation empowers Echo’s engineering team to maintain a library of over 600 secure images—a feat that would typically demand an army of security experts.

Why CISOs Should Take Note

For the tech decision-makers out there, Echo symbolizes a shift from “mean time to remediation” to “zero vulnerabilities by default.”

Dan Garcia, CISO of EDB, highlighted in a press release that the platform “saves at least 235 developer hours per release” by obviating the need for engineers to sift through false alarms or manually patch base images.

Echo is already safeguarding critical workloads for industry giants like UiPath, EDB, and Varonis. As enterprises transition from containers to agentic workflows, the ability to place unwavering trust in the underlying infrastructure—sans the hassle of managing it—could define the future of DevSecOps.

Pricing details for Echo’s solution aren’t public, but the company states on its website that it tailors pricing “based on image consumption, ensuring scalability in line with your software development and deployment needs.”