Senior Frontend Engineer

Hyperscale remediation: secure your software estate autonomously. Blitzy reverse engineers hundreds of millions of lines of enterprise code, reasons across your entire codebase to uncover known and zero day vulnerabilities, determine which findings are reachable and exposed, and turn validated risks into remediation pull requests. Rapid improvement in frontier model capabilities arm attackers with an increasingly evolving arsenal of tools to exploit vulnerabilities before patches exist, while organizations can take an average 55 days to remediate known flaws according to Edgescan's Vulnerability Statistics Report. The problem isn't detection alone. It's knowing: * Reachable: Can your application's execution path reach the vulnerable code? * Exposed: Can an attacker access that path, such as through an internet-facing service? * Impact: What dependencies or functionality could the fix affect? Blitzy answers all three. Blitzy is introducing Proactive Insights. It does three things that no other tool does in unison: it finds vulnerabilities in proprietary code, it tells you with certainty rather than confidence intervals which of them your architecture actually exposes, and batch automates PRs to remediate them at scale. What Proactive Insights does. Proactive Insights is driven by Blitzy's unique capability of understanding enterprise codebases at scale. No matter how large the ecosystem, Blitzy can reverse engineer it down to the file and variable level in days. From there, you pick a branch from any connected repository. Blitzy reports two categories. Discovered by Blitzy. Blitzy analyzes your entire codebase with a proprietary blend of multi-model orchestration to uncover vulnerabilities absent from public CVE databases, advisories, and security signatures. When exploitable and unpatched, they represent zero-day risk, hidden in proprietary code that traditional tools have not examined in full-system context. Publicly known. Blitzy reconciles what you already run, like Snyk, Mend, Sonatype, and GitHub Advanced Security. This is not a replacement for your scanners. They are good at the classes they were built for. What they cannot tell you is which of their own findings your architecture exposes. For every finding, Blitzy goes beyond detection: it determines real exposure, evaluates whether the issue can be fixed safely, and generates the remediation. Prioritize by real exposure. Findings are deduplicated by instance rather than exploded per package, and filterable on severity and reachability. In one customer's transaction-processing system, Blitzy found a vulnerable function used by three services, two exposed to the internet. It also identified sites the fix would affect and included all in the remediation plan. Traditional scanners stop at the finding; Blitzy plans and executes the fix. Validate the fix before committing. Blitzy checks whether the fix is achievable without introducing a new vulnerability. If it is not, you are told before an engineer is committed. You can proceed with the manual steps identified, adjust scope and re-analyze, or abort. Turn findings into pull requests. Blitzy generates a project per finding with the prompt pre-populated, plans it, generates pre-tested code, and opens a pull request in your repository. You approve the plan. You review the PR. It re-runs on every codebase sync. Why this could only come from Blitzy. Blitzy was designed from inception to solve problems faced by enterprise software development teams. Before writing code, most large scale projects begin with an archeology expedition. Blitzy removes the need for this by reverse-engineering hundreds of millions of lines into a knowledge graph mapped to the exact line, tracing every node, and keeping it current as developers merge. Blitzy built that to accelerate enterprise grade software development. A graph that knows every call site in your estate turns out to be the only structure that can say which vulnerabilities are real, and what fixing them costs before you commit. That distinction matters because the alternative is volume. OX Security's 2026 Application Security Benchmark, drawn from 216 million findings across 250 organizations, reports: The average organization now faces 865,398 security alerts, up 52% from 569,354 a year earlier. After prioritization, the average organization is left with 795 critical findings. That is 0.092%. Nobody needs another list. Every tool in your stack reads a file or a manifest. None of them has a global, real-time understanding of your estate, so none can answer the only three questions worth answering: is it reachable, is it exposed, and what breaks if I fix it. Blitzy does not introduce vulnerabilities. According to Veracode's Spring 2026 GenAI Code Security Update, testing 80 coding tasks against successive model generations, it found that only 55% of generation tasks result in secure code. This means that in 45% of cases, the model introduces a known security flaw into the codebase. The longitudinal finding is the damning one: while syntax pass rates have climbed steadily from about 50% to 95% since 2023, security pass rates have remained essentially flat, hovering between 45% and 55% regardless of model generation or release date. Veracode's conclusion: Models have become excellent at writing code that compiles. They've failed at writing code that's safe. Blitzy is built so that it does not introduce vulnerabilities, as an architectural property rather than a policy. The majority of its compute goes to validation rather than generation. Security review runs inside the build against every artifact, at hard checkpoints where execution pauses so review agents inspect, classify, and mitigate before a pull request exists. Security shouldn't wait for someone to ask. Proactive Insights is now available in Blitzy, starting with security and expanding to more enterprise codebase insights soon.

Blitzy, an autonomous software development platform founded by Harvard MS/MBA graduate Sid Pardeshi, has reached a $1.4 billion valuation after securing $200 million in funding. The Cambridge-based startup, which currently employs 80 people, automates code writing, testing, security checks and error fixing for enterprise clients. Pardeshi, who previously spent six years at NVIDIA designing AI tools, co-founded Blitzy with Brian Elliott whilst studying at Harvard. The platform can complete approximately 80% of typical software development tasks, allowing human engineers to focus on strategy and conceptualisation. The company plans to expand to over 300 employees and strengthen partnerships with laboratories and cloud service providers. Blitzy is the second unicorn founded by an MS/MBA alumnus, following Nominal's AI-driven aerospace analytics platform.