When Offroad surfaced from stealth mode this past June, it didn't lead with the usual playbook—glossy demo videos, customer logos, or founder pedigree. Instead, the New York and Tel Aviv-based startup published research that effectively indicted the OAuth ecosystem: nearly one in three publicly available apps, the company found, carried structural security flaws serious enough that they'd likely never pass a human security review.
And yet they're installed more than 1.85 billion times.
The timing wasn't accidental. Offroad, which raised $7 million in seed funding led by Ibex Investors and Skywell Capital Partners, is positioning itself as what it calls an "agentic identity security team"—AI that doesn't just flag threats but acts on them. The OAuth audit, released alongside the funding announcement on June 4, served as both a credibility signal and a mission statement: identity security, the company argues, has outgrown the tooling built to manage it.
The Shift Offroad Is Betting On
Founded in 2023, Offroad's core premise rests on a familiar enterprise pain point that's gotten significantly worse. Identity management used to be a compliance exercise—provision accounts, manage permissions, check the box. Now it's an operational tangle spanning identity providers, HR systems, SaaS sprawl, cloud infrastructure, and support tickets that bounce between security teams and business owners who may or may not understand what they're approving.
The company's answer is what the industry has started calling agentic AI: software that gathers context across those fragmented systems, surfaces real-time threats and posture risks, then either resolves them autonomously when it's safe to do so or routes them—context intact—to the right human owner. Offroad's scope includes human users, non-human identities like service accounts and OAuth apps, and increasingly, AI agents themselves.
Whether that vision holds up in production environments remains to be seen. But the research Offroad published as its coming-out party suggests the problem space is larger than many organizations realize.
What the OAuth Numbers Actually Say
Offroad's team audited 2,890 public OAuth apps across Google Workspace Marketplace and GitHub Marketplace as of May 2026. The results, published on ohauth.ai—a free OAuth security catalog the company released alongside its announcement—painted a picture of an ecosystem with minimal oversight.
According to Help Net Security's breakdown of the findings, 677 apps requested permissions that exceeded their stated function, with a combined install base of roughly 1.82 billion. Another 266 apps had what Offroad classified as "off-purpose high-tier Drive access," accounting for 1.26 billion installs. Perhaps most concerning: 49 AI-powered apps carried broad write access, installed 81.6 million times.
The numbers invite skepticism—install counts can be inflated, and "structural security concerns" is a broad categorization. But the sheer scale, if even directionally accurate, underscores a gap between how OAuth was designed to work and how it's actually been deployed at scale.
The Team Behind the Bet
CEO Dan Bendler isn't new to ambitious technical pivots. He previously co-founded two AI startups that raised more than $45 million combined, according to the company. That includes Shopic, a computer-vision retail tech venture that secured a $35 million Series B in 2022, and an earlier project called Social Wonder.
His co-founder, CTO Philip Shteyn, brings a different pedigree: a former captain in Israel's Unit 8200 who went on to help build Palo Alto Networks' Cortex platform. It's the kind of résumé combination—startup velocity and enterprise security depth—that investors in the identity space have rewarded before.
The company operates with teams split between New York and Tel Aviv. As of early June 2026, IVC Online listed 18 employees, though the company's website still displays a stealth-mode landing page with minimal detail about the product itself.
Entering a Crowded, Well-Funded Space
Offroad is stepping into an identity threat detection and response (ITDR) market that's seen a wave of capital over the past two years. Silverfort, Veza, and Oasis Security have collectively raised hundreds of millions, and incumbents like CrowdStrike and Microsoft have expanded aggressively into identity. The seed round, while respectable, isn't the kind of war chest that guarantees breakout traction.
What Offroad does have—at least for now—is a research-backed entry that frames the problem in ways security teams will recognize. Whether that translates into product-market fit depends on execution the company hasn't yet demonstrated publicly.
The secondary coverage around the funding suggests the $7 million will go toward expanding operations and accelerating product development, though Offroad's own announcement didn't specify allocation details. That's typical for stealth-mode startups, but it also means the company's claims remain largely hypothetical until customers start talking.
For now, Offroad is making a straightforward bet: that identity security has become too complex, too fragmented, and too urgent for manual processes to keep up. The OAuth research was the opening argument. The product still has to make the case.
