Cotool: AI agents for cybersecurity ops teams — and Ramp is their first customer

Summary

Cotool is building AI agents for cybersecurity operations teams. Ramp is its first customer. The company focuses on the ops-sec side of security, not offensive or application security. Its work spans ticket triage, anomaly detection, and workflow automation. A concrete example is impossible travel detection, which flags a login from Singapore when an employee was in the office in New York an hour earlier and automatically determines whether the login warrants action.

Most cybersecurity work is analysts grinding through alert queues, not Hollywood hacker drama. Cotool's agents plug into existing tools like Okta, Panther, and Slack. Security teams write and customize their own agents to handle repetitive triage tasks. The go-to-market strategy starts with technically sophisticated teams already comfortable with automation, builds a library of shared agents, then expands to less technical enterprise buyers who want a plug-in-and-automate experience.

Cotool does not require an enterprise-wide rollout on day one. The entry point is typically the detection and response team, which gets plugged in first through AI tool-calling across the existing security stack. The founders are betting on a user-built agent library that compounds as more teams contribute and share.

Launch video

Cotool got significant investor inbound from a launch video that cost low five figures but looked like a $100,000 production. A YC advisor suggested riffing on the Rippling saga, described as YC-on-YC humor. The final cut was produced through a network of LA comedians and directors. Timing mattered. The founders believe dropping it even a month later would have killed the joke as the cultural moment passed.