AI software supply-chain cybersecurity

Reactive security today.
Preventive intelligence
earlier in the software lifecycle.

Clarveil brings threat intelligence, fleet-wide exposure discovery, decision support and controlled response into one platform across repositories and Windows, macOS and Linux developer/build environments — while proprietary AI/ML R&D moves security decisions earlier in the software lifecycle.

Talk to us about a pilot
Preventive AI/ML
Proprietary AI/ML
Fleet-wide
Visibility
End-to-end
Response
Human-controlled
Action
R&D validation
MBIE New to R&D status
R&D eligibility
Successfully completed

MBIE’s R&D eligibility assessment was completed with no major concerns or rework required to Clarveil’s R&D Activity section.

Conditional-approval pathway
Proceeding

Clarveil has elected to proceed through MBIE’s conditional-approval pathway following completion of the R&D eligibility assessment. The remaining financial due diligence and approval formalities are now being progressed.

Current indicative milestone: conditional approval targeted around October 2026, subject to MBIE’s remaining assessment and approval process.

Co-funding period
Up to 6 months after conditional approval

If conditional approval is granted, Clarveil will have up to six months to secure and evidence the remaining required co-funding. Eligible grant claims can proceed only once that funding condition has been satisfied.

The R&D eligibility assessment has been successfully completed; the remaining work relates to financial due diligence, formalisation of the conditional-approval pathway and subsequent completion of the required co-funding. Clarveil’s current funding focus is on satisfying that co-funding requirement while accelerating product development and enterprise commercial validation.

Conditional approval and grant funding remain subject to completion of MBIE’s assessment and applicable funding conditions.

One platform. Two security horizons.

Respond to what is known.
Make the security decision earlier on what isn’t.

REACTIVE · AVAILABLE NOW

Known / emerging threat

A known or emerging package threat is identified
Detect
Locate
Decide
Act

Find what risky software is already inside the organisation, where it exists across repositories and managed developer/build fleets, and move directly into controlled response — without stitching together multiple disconnected tools and manual processes.

PREVENTIVE · PROPRIETARY AI/ML R&D

Earlier in the software lifecycle

Clarveil preventive security intelligence
Independent security decision layer

Proprietary AI/ML R&D designed to support software-security decisions earlier in the software lifecycle.

PROPRIETARY AI/ML R&D

Security teams shouldn’t need multiple
tools to answer one question.

Intelligence

Detect

Monitor known and emerging package-security events, including package-level disclosures that may appear before a formal CVE or advisory.

Exposure

Locate

Reverse lookup determines where the affected package/version exists across repositories and managed Windows, macOS and Linux developer/build machines.

Context

Decide

Organisation-specific context, priority and remediation guidance help determine the appropriate response.

Response

Act

Human-approved PR/ticket workflows and enterprise response integrations move the finding toward controlled resolution.

From global package intelligence to organisation-specific action — one connected journey instead of disconnected tools and manual investigation.

Fleet-wide visibility

Your repositories aren’t your
whole software estate.

Software dependencies can exist across repositories, developer endpoints and build environments. Clarveil correlates package intelligence across managed Windows, macOS and Linux systems alongside repository context to provide fleet-wide visibility of organisation-specific exposure.

So when a new package threat appears, “are we exposed right now?” has an answer specific to your organisation rather than a global one — with the location, the context and the next action.

Available now
Software sources
  • Code repositories
  • VS Code extensions
  • IntelliJ plugins
Fleet coverage
  • Windows COMING SOON
  • macOS COMING SOON
  • Linux COMING SOON
  • Developer/build machines COMING SOON
Deployment & workflow
  • Jamf COMING SOON
  • Intune COMING SOON
  • Slack
  • Microsoft Teams
Proprietary preventive AI/ML R&D

Security decisions,
earlier in the software lifecycle.

Most software supply-chain security acts after a vulnerability or malicious package becomes publicly known. Clarveil is developing proprietary AI/ML preventive security intelligence designed to support software-security decisions earlier in the software lifecycle.

AI coding assistants
Agentic development systems
Autonomous software-development agents
Clarveil preventive security intelligence
Independent security decision layer
IDEs & developer platforms
Package publishers & ecosystems
Enterprise security platforms

Designed to become consumable wherever software dependencies are selected, recommended, generated, published or introduced.

The surfaces shown are prospective integration and platform opportunities. They are not current integrations, partnerships or endorsements.

PROPRIETARY AI/ML R&D

New Zealand and U.S. priority patent applications already filed · International PCT filing in preparation, targeted for early October 2026

AI & agentic development

AI can introduce software at machine speed.
Security needs a decision point before it does.

As AI-assisted development becomes increasingly agentic and autonomous, dependencies can be selected and introduced faster than traditional security review processes can respond. Clarveil’s preventive intelligence is designed to become an independent security decision layer these systems can consume earlier in the dependency lifecycle.

THE NEW DECISION POINT

Dependencies now arrive with a suggestion attached

Package selection increasingly begins with a machine recommendation, and it is acted on quickly — often before any security review has taken place.

As development systems become more autonomous, that decision is made earlier and faster than most review processes were designed for.

AI DEPENDENCY SAFETY

What happens when an AI suggests a dependency?

// A development system selects
// a dependency
 
// It suggests:
package-name-x
 
// Before adoption:
Is this package legitimate?
Does it require additional
  security review?
Should the organisation allow,
  review or hold the dependency?

Clarveil is developing preventive security intelligence designed to support that decision before the dependency enters enterprise software.

A SECURITY DECISION LAYER

Consumable by the systems writing the software

The intended consumers are not only people. Enterprise security platforms, developer tools, AI coding assistants, agentic development systems and autonomous agents all select dependencies.

Available now
Detect known and emerging package threats, locate them across the fleet, and drive a controlled response.
Preventive R&D direction
An independent security decision between a machine-generated recommendation and the software that enters the organisation.
5.2%–21.7%
Package hallucination rates
A large-scale USENIX Security study measured package hallucination rates of at least 5.2% for commercial code-generating models and 21.7% for open-source models.
USENIX Security 2025 ↗
1 every 6 minutes
New malicious open-source packages
Sonatype reported 21,764 malicious open-source packages in Q1 2026 — equivalent to approximately one newly identified malicious package every six minutes.
Sonatype Q1 2026 Malware Index ↗
205,474
Unique nonexistent package names
Researchers identified 205,474 unique nonexistent package names generated across 16 code-generating LLMs in a large-scale package-hallucination study.
USENIX Security 2025 ↗
Future platform direction

Preventive intelligence can start
before enterprise adoption.

Clarveil’s longer-term direction extends to package publishers and software ecosystems, where preventive intelligence could identify software requiring additional security attention, provide actionable guidance, support improvement and allow reassessment before wider adoption.

Package publisher
Clarveil intelligence
Security guidance
Improve / reassess
Stronger package decision

FUTURE PLATFORM DIRECTION

Where Clarveil extends the
software-supply-chain response loop

Capability
Typical current approach
Clarveil
Known-threat detection
Established
✓
Repository visibility
Common
✓
Windows/macOS/Linux developer-fleet visibility
Varies
COMING SOON
Organisation-wide package reverse lookup
Varies
✓
Connected Detect → Locate → Decide → Act journey
Often fragmented
✓
Human-approved remediation
Varies
✓
Known-bad installation blocking
Established/emerging
ROADMAP
Intelligence earlier in the software lifecycle
Primarily reactive to known indicators
PROPRIETARY AI/ML R&D
AI/agentic security-decision integration
Emerging
R&D / PLATFORM DIRECTION
On the roadmap

Where the platform
goes next.

Expanding Clarveil from fleet-wide detection and response into broader prevention, prioritisation and software-estate coverage.

Capability
Status
Direction
Controlled known-bad package installation blocking
ROADMAP
Prevent already-confirmed malicious or unsafe packages from being introduced into managed development environments.
Impact analysis
ROADMAP
Help security teams understand the organisational impact of an identified software-package threat.
Reachability analysis
ROADMAP
Add execution and dependency context to help prioritise which exposures require attention first.
Expanded remediation orchestration
ROADMAP
Extend controlled, human-approved remediation and response workflows across more enterprise environments.
Additional ecosystems
ROADMAP
Expand package and software-ecosystem coverage as the platform develops.
Expanding software-estate coverage · Roadmap
Environment
Status
Direction
Container images
ROADMAP
Extend package exposure visibility into container images used across build and deployment pipelines.
VM images
ROADMAP
Bring virtual-machine images into the same fleet-wide package inventory and exposure view.
Cloud environments
ROADMAP
Correlate package intelligence across managed cloud environments alongside repositories and endpoints.
Workloads
ROADMAP
Extend exposure mapping to running workloads as the software estate broadens.
Company

Built in Auckland.
Validating in enterprise environments.
Building for a global market.

Clarveil Security Limited is an Auckland AI software supply-chain cybersecurity company combining fleet-wide reactive threat response with proprietary preventive intelligence designed to move software security decisions earlier.

Working product

Clarveil has a functioning enterprise platform under technical evaluation and design-partner discussions.

Enterprise-first

Built around real software estates — repositories plus managed Windows, macOS and Linux developer/build environments.

Proprietary R&D

Preventive AI/ML security intelligence designed to move security decisions earlier in the software lifecycle.

Intellectual property

One New Zealand patent application and two U.S. provisional patent applications have already been filed and form the priority basis. International PCT filing is in preparation, targeted for early October 2026.

MBIE R&D

R&D eligibility assessment successfully completed with no major concerns or rework required. Conditional-approval pathway proceeding; remaining FDD/co-funding requirements in progress.

Founder

18+ years global technology experience with a history of building teams, platforms and enterprise capabilities from the ground up.

Meet the founder

Clarveil is engaging with investors, enterprise design partners and technology ecosystem partners interested in the future of AI-driven software supply-chain security.

Talk to the founder

Built to run inside
your network.

Clarveil is designed for enterprise-controlled deployment, with package inventory and developer telemetry kept within the customer-controlled environment wherever the deployment model allows.

Detect.
Locate.
Decide.
Act.

Today, Clarveil helps security teams determine whether a known or emerging package threat affects their organisation, where it exists across their software estate, and what should happen next.

Our proprietary AI/ML R&D moves the security decision earlier in the software lifecycle — supporting safer decisions about software dependencies.

We are engaging with selected enterprise design partners. Talk to us about a pilot.

Email atul@clarveil.com
Privacy

Clarveil is designed for customer-controlled enterprise deployment. Package inventory, source-code context and developer telemetry are intended to remain within the customer-controlled environment. Public package-security intelligence can be pulled into the deployment on a configurable schedule. Deployment and outbound-connectivity requirements are agreed with each pilot organisation.

This website. Clarveil sets no cookies and runs no analytics or advertising trackers on this site. Fonts, styles and scripts are self-hosted, so the page itself requests nothing from any third party. The site is served through Cloudflare, our hosting and content-delivery provider: to deliver the page and protect it from abuse, Cloudflare processes your IP address and request metadata under its own privacy policy, and may ask your browser to report failed connections to Cloudflare (Network Error Logging). We do not receive or retain visitor-level data from either. Privacy questions: atul@clarveil.com.