The Next Chapter of Plexicus: Building the Future of Proof-Driven Application Security

Software is being built faster than ever. Security teams need more than another list of potential vulnerabilities. They need evidence of what can actually be exploited, context about what matters, and a practical path to a reviewed fix. This is the problem Plexicus is building to solve, and why our next chapter matters.

Software development is changing. AI coding assistants, automated workflows, complex third-party components and connected infrastructure help teams ship at a remarkable pace. Every new integration, dependency, API and feature can also introduce new security questions.

The challenge is no longer whether a scanner can flag something suspicious. It is whether a business can establish what is real, why it matters and what should happen next, before exposure becomes an incident.

At Plexicus, we believe application security should be built around proof. Our mission: help teams validate real application risk, understand its impact and remediate it through an evidence-backed workflow.

The problem: more alerts do not mean more security

Modern software teams rely on many kinds of security testing. Static analysis flags suspicious code patterns. Dependency scanning finds vulnerable packages. Dynamic testing explores application behavior. Cloud tools add another layer of visibility.

These capabilities matter. But they often live in separate systems, produce overlapping findings, and leave security and engineering teams with hard questions:

• Is this vulnerability actually exploitable in our environment?
• Which application, API or business workflow does it affect?
• Is it an urgent exposure or a theoretical issue?
• What change fixes it without breaking the product?
• Can the team show that it was fixed?

The gap between detection and verified remediation is an operational problem. More alerts create more triage work without a matching gain in security.

The threat landscape adds urgency. In its 2026 Data Breach Investigations Report, Verizon identifies exploitation of vulnerabilities as a leading initial-access vector, at 31% of the breaches analyzed in that dataset. The figure shows how consequential software exposure has become; it is not a claim about every attack or a measure of Plexicus performance.

Who we are

Plexicus is an AI-powered application security company built around Proof-Driven AppSec. We bring security validation, code-level understanding and reviewable remediation into one connected process, so teams can decide better and act with more confidence.

The person behind Plexicus

Plexicus was founded in May 2025 by José Ramón Palanco. The product is new. The habit behind it is not. José has spent more than two decades in cybersecurity, almost all of it on one question: is this really broken, and can you show me?

José trained as a telecommunications engineer at the University of Alcalá and later completed a Master’s in IT Governance at the University of Deusto. The first working years went into building systems, in R&D at Ericsson and at Optenet (now part of Allot). Building systems teaches you how they fail.

Then came the offensive side: vulnerabilities published with CVE identifiers, and open-source security tools that other researchers still use, among them nmap-scada, ProtocolDetector, escan, pma, EKanalyzer and a SCADA IDS. The talks followed, at OWASP, RootedCON, ROOTCON, MALCON and FAQin.

Before security

A childhood photo from José’s family archive: two boys, two tortoises and a very patient dog.

Dinoflux

Pitching Dinoflux, the threat-intelligence company José founded in 2014, at The Cube Madrid.

APIAddicts

On stage at APIAddicts, walking through the career timeline that runs from 2005 to Plexicus in 2025.

API · MCP · Agentic

The same talk: where security breaks across APIs, MCP and agentic AI.

CMICE

The round table “The impact of AI on the street”, part of the CMICE technical day on AI in Madrid, 10 November 2026. José was on the panel.

Today

José Ramón Palanco, Founder and CEO/CTO of Plexicus.

In 2014 José founded Dinoflux, a threat-intelligence company later acquired by Telefónica, and since 2018 has also worked with 11Paths. Starting a company, selling it and working inside a large organization showed the same problem from three angles: the vendor that produces alerts, the buyer that receives them, and the team that has to act on them.

Plexicus is built for that third team. For twenty years the job was to show people that something they trusted was broken. With Plexicus the sentence gets its ending: here is the proof, and here is the fix, ready to merge.

You can hear José explain it on the @jpalanco YouTube channel, where the full demo below was published, and read more on jpalanco.com.

That history shapes our approach. Security tools should not just generate convincing output. They should help technical teams establish what can be demonstrated, reviewed and fixed.

Our approach: Validate. Understand. Remediate.

Plexicus is built around three connected questions.

1. Validate: can the risk actually be demonstrated?

AI Swarm Pentest, powered by our Nexus engine, coordinates a swarm of AI agents against an authorized, explicitly scoped application. The agents explore attack paths, test hypotheses and produce reproducible evidence for every finding they can confirm. A separate verifier replays the evidence before a finding counts. No PoC, no finding.

Assessments require ownership or authorization of the targets, respect the agreed limits, and keep humans in control of decisions. Read the AI Pentest documentation.

2. Understand: what does the finding affect?

A confirmed weakness is most useful when engineers know where it lives and what it can reach. Deep Code Analysis connects a finding with its code paths, data flows, reachability and surrounding context. That makes it easier to see why a weakness matters, choose the right engineering response and stop wasting effort on alerts without context.

3. Remediate: how can the team fix it with confidence?

Finding problems is only the beginning. The outcome that matters is a safer application. Plexicus Remediation prepares a proposed code change and its supporting evidence as a pull request. Your engineers review, test and merge it. A re-test then checks that the demonstrated issue is gone, depending on the configured workflow.

Our philosophy is simple: AI helps teams move faster without removing human accountability.

What this looks like in practice

Consider a hypothetical online platform that receives an alert about a potentially unsafe API endpoint. The code pattern looks suspicious, but a conventional report alone cannot say whether an attacker can reach the endpoint or exploit it under real conditions.

In a proof-driven workflow:

1. The team defines an authorized test scope.
2. The agents investigate the application’s behavior and collect reproducible evidence where they can.
3. Code analysis links the finding to the affected functions, data flows and business context.
4. A proposed fix is prepared as a pull request for engineering review.
5. Reviewers decide whether to merge it, and a re-test verifies the result.

The example is illustrative, not a customer case or a product benchmark. It shows the direction of the workflow: from possible risk to evidence, context and a responsible next action. For the business, decisions are easier to explain. For security teams, findings can be defended with technical evidence. For engineers, the path from report to reviewed code is shorter.

The full product story, in under two minutes:

The full demo, from dashboard to merged fix

Why now?

Several trends are converging.

AI is changing the speed of software delivery. Generative AI helps engineers write, transform and review code, but faster output does not remove the need for secure design, validation and human review. A July 2026 eu-LISA report on generative AI in software development highlights the security and quality questions that AI coding assistants raise. Security workflows must keep pace.

Vulnerability management is an operational problem. An organization may own many applications, cloud services, repositories and supply chains. Security teams are not short of information; they need prioritization and actionable context, and a fast path from a confirmed finding to a reviewed fix.

European product-security requirements are evolving. The Cyber Resilience Act reinforces product-security and vulnerability-handling obligations for products in its scope. Some reporting obligations began on 11 September 2026; the main obligations generally apply from 11 December 2027. See the European Commission’s CRA overview. No platform makes a company compliant on its own, but documented processes and defensible evidence matter more than ever.

Security teams are asking for measurable outcomes. Finding counts are a weak proxy for security. Organizations need to know which risks were validated, who acted, which changes were reviewed and what evidence remains afterward.

What makes Plexicus different

Our difference is not a promise that automation will replace every security specialist, or that every vulnerability can be found automatically. It is how security work is organized and substantiated.

• Evidence before conclusions. Findings are backed by reproducible technical proof, not a confidence score or a plausible AI explanation.
• A connected workflow. Validation, code-level understanding and remediation form one sequence, not handoffs between disconnected tools.
• Security within real engineering constraints. Assessments stay inside the approved scope, and every proposed change goes through human review and merge controls.
• Built for developers and security teams together. The same finding is understandable to a security reviewer, actionable for an engineer and explainable to a business stakeholder.

Like any technology business, we have to keep proving this through product usage, customer feedback, measurable results and comparison with alternatives.

From vision to product: the progress so far

Plexicus is not starting from an idea alone. We have been building the product, documenting the workflow and putting it in front of technical audiences.

Sources: Azure credits announcement · Startup Wise Guys graduation · CDTI NEOTEC 2026 program · CDTI provisional resolution, 6 November 2026.

Building evidence of traction

External recognition is useful, but it is not commercial traction. The real test of a product company is whether it earns adoption, serves customers well and turns technical capability into repeatable value.

We are focused on turning product validation and early commercial engagement into sustainable adoption. Our near-term priorities are to deepen customer relationships, establish repeatable deployment processes and measure the outcomes security and engineering teams value most.

Our business: turning security capability into repeatable value

A strong cybersecurity company needs more than an impressive demonstration. It needs a product customers want to adopt, a workflow they can trust and a business model that can fund long-term engineering, infrastructure and service.

Our platform serves organizations that build or operate software and need better visibility into application risk, from developers and AppSec practitioners to engineering leaders and security decision-makers. Our commercial focus is practical onboarding, scoped assessments, usable evidence, clear remediation workflows and enterprise-ready delivery.

The opportunity is not to sell the largest number of alerts. It is to help customers make better security decisions and act on them.

Why we are preparing for our next stage of growth

Building an ambitious security platform takes sustained execution. Product research must become dependable workflows. Demanding customers need secure infrastructure, solid integrations, documentation and support. Distribution needs relationships, education and an understanding of how engineering teams buy and adopt security software.

As Plexicus looks toward its next chapter, we are opening conversations with investors who share our long-term vision. We see external capital, structured appropriately, as a way to accelerate specific areas of execution, not as a substitute for strong product fundamentals. Our priorities for the next stage:

• Deepening product and AI research: better validated findings, wider coverage of relevant attack paths, stronger code-level reasoning and remediation, with human supervision and clear evidence at the center.
• Expanding adoption and distribution: helping more development and security teams move from evaluation to daily use of Proof-Driven AppSec.
• Strengthening infrastructure and customer readiness: reliability, deployment options, integrations, support and the operational controls organizations expect from a security platform.
• Building the team for sustained execution: product, security research, engineering and go-to-market capabilities.

These are strategic areas of focus, not an approved budget, a capital allocation or guaranteed milestones.

If you want to follow this next stage, you can register your interest on our investor page. Registration is non-binding. It is not an offer of securities, and any investment opportunity will be communicated through approved channels and documentation.

Register your interest

Our longer-term vision

We believe the future of application security is neither a dashboard full of unsorted findings nor a black box that asks users to trust an AI answer. It is a workflow where relevant risk is demonstrated, its context is understood, and the right fix is reviewed and verified.

The opportunity is meaningful, but building a cybersecurity company is hard. The market is competitive, enterprise adoption takes time, AI systems need careful testing, and neither security products nor investments in early-stage companies are free of risk. Our responsibility is to keep turning technical promise into trustworthy, measurable execution.

We started Plexicus because security should produce evidence that engineers can act on. This is the next chapter of Plexicus: fewer unsupported conclusions, clearer security decisions and a more direct path from risk to resolution.

Explore the Proof-Driven AppSec platform, read the technical documentation or talk to our team.

Company update. This article describes Plexicus’ product, strategy and aspirations. It is not an offer to sell securities, a solicitation to invest or a substitute for official investment documentation. Any future investment communication will be subject to the relevant approvals, disclosures and legal requirements.