As the pace of building and launching applications accelerates worldwide, driven by artificial intelligence and modern programming tools, the scope of threats targeting these applications and the data they handle is expanding in parallel. Cybersecurity is no longer a separate layer added to a product after development is complete; it has become an essential part of the software development and runtime lifecycle, particularly as attackers gain access to the same tools to develop faster and more automated attacks.
The scale of global cybersecurity spending reflects the magnitude of this transformation. Gartner expects worldwide information security spending to reach approximately $244 billion in 2026, up from around $213 billion in 2025, as demand for security solutions continues to rise amid growing threats and the expanding use of artificial intelligence. Gartner also expects global information security spending to continue growing, reaching approximately $322 billion by 2029.
At the same time, real-world attack data points to an increasingly complex threat landscape. Verizon’s 2026 Data Breach Investigations Report (DBIR) found that software vulnerability exploitation has become the most common initial entry point in data breaches for the first time, accounting for 31% of breaches. The report also found that AI is accelerating the exploitation of known vulnerabilities, shrinking the window between vulnerability discovery and exploitation from months to mere hours. Meanwhile, breaches involving third parties increased by 60%, reaching 48% of all breaches analyzed in the report.
Against this backdrop, organizations increasingly need security layers that go beyond scanning code or testing applications before launch, and instead continue to monitor and protect applications while they are running. Such protection can help detect manipulation, fraud, and attacks as they occur and enable an immediate response.
This is where RASPIRE, the Egyptian cybersecurity startup specializing in runtime application protection, comes in. The company was founded by software and cybersecurity engineers Kareem Selim and Hassan Mostafa after years of working with banks, fintech companies, and organizations operating in critical sectors. RASPIRE integrates security layers into applications without requiring developers to modify their source code, while leveraging artificial intelligence, behavioral analysis, and threat intelligence to identify suspicious activity and respond to threats in real time.
In this interview with FollowICT, the Digital Economy Platform, Kareem Selim, Co-Founder of RASPIRE, discusses the founders’ journey from cybersecurity competitions and working with financial institutions to building a company targeting a global market. He also explains the problem that led them to develop the platform, highlights the company’s growth and expansion beyond the region, reflects on their experience with Y Combinator, and outlines RASPIRE’s ambition to build a security ecosystem that makes securing software as easy and fast as building it.
To start, tell us about your professional journey. What were the key experiences and milestones you went through before founding RASPIRE, and how did they shape your perspective on technology and entrepreneurship?
Hassan and I have known each other for ten years now. We first met at university, where we were in the same computer engineering batch. We competed in many hackathons and security competitions together, winning almost all of them. Those experiences taught us how to turn ideas into working products, solve problems under pressure, and work effectively as a team.
We later worked at different companies in cybersecurity consulting, identifying and fixing security gaps for leading banks, fintech companies, and organizations in other critical sectors. Combined with our engineering background, that gave us two valuable perspectives: the developer’s mindset of building software and the attacker’s mindset of breaking it.
We learned the hard way that building a technically strong product does not automatically mean customers will buy it. You need to solve a problem they care about, make the solution easy to adopt, and clearly communicate its value. That is the mindset we adopted when we founded RASPIRE.
You and your co-founder, Hassan Mostafa, spent years developing and fixing applications for banks and fintech companies. What did you learn from that experience, and what security challenges did you identify in the market?
We saw firsthand how challenging it is to secure applications for banks and organizations in other critical sectors. They operate under strict regulatory requirements and tight release schedules, yet addressing security threats often requires specialist expertise, complex integrations, and long testing cycles.
Engineering teams also face constant pressure to deliver new features. Security can become a bottleneck, especially when protections need to be maintained and tested with every application update.
That experience taught us that strong protection needs to be practical to implement. It should fit into the way teams already work and be easy to deploy and maintain without requiring everyone involved to be a security expert
When did the idea for RASPIRE first emerge? What specific problem did you and Hassan believe was important enough to build a company around?
The idea came from years of working in cybersecurity. Our job involved breaking and fixing security implementations for leading banks and organizations in critical sectors, and we kept finding the same gaps.
Every application release or update brought another cycle of testing, fixing, and retesting. This often delayed releases and put regulatory deadlines under pressure. We started asking ourselves whether we could build something better: protection that works out of the box, without complex configuration, and adapts to evolving threats, including those powered by AI.
We believed developers should not have to become security specialists just to release an application or an update. That became the idea behind RASPIRE: making advanced application protection easy to adopt, without specialist teams or months of integration work.
With the rapid evolution of modern programming tools, including “vibe coding,” applications can now be built and launched much faster. How has this changed the cybersecurity landscape?
AI has given people something close to superpowers when it comes to building software. An app that once took months to develop can now be built and launched over a weekend. That’s exciting because it opens the door for more entrepreneurs to turn their ideas into real products. But being able to build an application doesn’t automatically make it secure.
Attackers have access to the same tools. They can use AI to analyze applications, find weaknesses, and try different attacks much faster.
Security has to keep up. Even teams with security experts can struggle to keep pace when updates go out every day. Security needs to be easy to integrate and deploy, and it needs to stay active once the application is released.
Why are traditional approaches such as backend security, code scanning, and penetration testing no longer sufficient on their own? What gap did you identify in the market?
These approaches remain essential, but each addresses a different part of the problem. Code scanning identifies potential weaknesses, penetration testing evaluates how a system could be attacked, and backend security protects servers and services.
The gap is that applications also run on devices and in environments the organization does not control. An attacker may alter an application, inject code, or manipulate its execution even after it has passed a security assessment. Fraud, for example, can happen through legitimate application features, so it isn’t always something you can spot or fix in the code.
Organizations therefore need an additional layer that can detect and respond to those conditions inside the running application. It complements the work they already do to secure their code and infrastructure.
RASPIRE focuses on runtime protection. Could you explain what this means in simple terms, and how runtime protection differs from traditional code-scanning and penetration-testing tools?
Runtime protection means protecting an application while it is running. Think of a building: security testing helps identify weak points and assess whether someone could break in. Runtime protection is the security system that stays active after people move in.
Inside an application, it watches for signs of fraud, attempts to manipulate application logic, or interference with sensitive operations, and responds when it detects a threat. Code scanners can find weaknesses in the code, but they cannot detect and stop runtime threats like fraud as it happens. Runtime protection helps the application defend itself while people are using it.
You describe RASPIRE as acting like a “security expert inside the application,” monitoring, detecting, and blocking attacks in real time. How does the platform work in practice?
RASPIRE fits into the release process just before an application goes into production. Developers can integrate RASPIRE’s security suite without modifying their codebase, and the platform automatically selects and adds the required protection layers.
Once the protected application is running, those layers monitor for runtime threats and can respond immediately for example, by terminating a compromised session or stopping the application.
Our AI-powered defenses and behavioral analysis help assess suspicious activity, supported by our cloud threat defense and threat intelligence capabilities. The dashboard gives security teams the full visibility into detected threats.
Developers can also integrate shielding into their CI/CD pipelines or run the shielding process entirely on-premises.
RASPIRE addresses threats such as AI-powered attacks, API abuse, and runtime threats. How are these threats evolving, and what makes them increasingly difficult for organizations to detect and prevent?
Attacks are becoming more automated and better at imitating legitimate activity. AI agents can automate interactions with an application, reducing the effort and expertise needed to carry out sophisticated attacks. The resulting requests may look normal to the backend, even when the application sending them has been manipulated.
That makes detection difficult: a request can look valid without coming from a trustworthy application or environment.
Runtime signals provide that missing context. They help identify whether an application’s logic or behavior has been manipulated, something that may not be visible in server logs alone. But detection is only part of the solution. Once a threat is detected, the application needs to respond immediately to stop the attack.
What has RASPIRE achieved over the past period since its launch? What key growth indicators can you share, whether in terms of customers, users, applications, or overall adoption?
One of our most important milestones has been moving from proving the technology to protecting production applications in sectors where security and reliability are critical. Our platform has now blocked more than 100,000 real-world attacks targeting applications and user data, and RASPIRE-protected applications serve over 50 million users worldwide.
For us, those numbers reflect the trust organizations place in RASPIRE to protect applications that people rely on every day. Earning that trust has been a significant part of our progress.
Applications powered by RASPIRE are currently used by more than 50 million users worldwide. What types of applications are these, and which industries are currently relying on your technology?
The applications we protect span banking, fintech, telecommunications, healthcare, and digital services. People use them to access financial services, manage accounts, make payments, and interact with businesses.
Large enterprises depend on RASPIRE to protect their applications and users from daily attacks. We take this responsibility very seriously and continually improve our defenses to keep up with new threats.
Which markets is RASPIRE currently operating in? Have you already started serving customers outside Egypt and the region, and which markets are you currently targeting for expansion?
Our customers are based across MENA, where we serve organizations with demanding security requirements.
And we are expanding in the United States by engaging with prospective customers and running pilots, supported by the relationships and market exposure we gained through Y Combinator.
RASPIRE primarily targets banks, fintech companies, insurance firms, government entities, and other organizations handling sensitive data. Why did you choose these industries as your core target market?
We chose these industries because an application attack can have serious consequences. They handle financial transactions, personal information, and access to essential services, so a security failure can lead to fraud or operational disruption.
Our experience with banks and fintech companies also gave us a strong understanding of their technical needs and regulatory requirements.
These organizations often work with complex systems and strict deployment requirements. Supporting their existing application frameworks, including legacy ones, providing prompt technical support, and offering different deployment models helps us meet those needs.
One of RASPIRE’s key differentiators is that it provides application protection without requiring developers to write a single line of code. How did you achieve this, and why is this particularly important for technology teams?
We built RASPIRE to work directly with the package prepared for distribution. This allows us to add protection without requiring developers to change their source code or manually integrate an SDK.
Making that work across different platforms, frameworks, application architectures, and operating-system versions required substantial engineering.
For technology teams, the benefit is straightforward: protection becomes part of the release process instead of a separate integration project. It reduces implementation effort, simplifies protecting subsequent updates, and allows customers to keep their source code private.
RASPIRE recently joined Y Combinator. What does this milestone mean to you as an Egyptian cybersecurity startup, and how do you expect the program to support your global ambitions?
Joining Y Combinator’s Spring 2026 batch as the first cybersecurity company from the MENA region meant a lot to us. It gave us more confidence that Egyptian founders can build companies that compete internationally and that the problem we are solving is global.
What really changed our mindset was the pace in Silicon Valley. When you’re surrounded by founders building and shipping so quickly, you naturally push yourself to move faster and think bigger. Hearing people like Paul Graham, Sam Altma and Brian Chesky speak openly about their journeys also helped us see our own challenges differently.
We also built relationships with founders, investors, and potential customers from around the world. Those connections continue to help us enter new markets and grow internationally.
What have been the biggest challenges you have faced since founding RASPIRE, whether in building the product, acquiring customers, or competing in the global cybersecurity market, and how have you overcome them?
One of our biggest challenges has been keeping our protection layers up to date and effective against evolving threats while maintaining application performance and a smooth user experience. Applications are built using different frameworks and run across a wide range of devices and operating system versions. We address this through continuous testing in dedicated testing labs, alongside proactive security research.
Competing globally has also required us to clearly demonstrate what sets RASPIRE apart. Listening closely to customers has helped us focus on capabilities they value most: straightforward deployment, on-premises operation, and real-time visibility into threats.
Finally, what are RASPIRE’s key goals for the coming period? What do you aim to achieve in terms of global expansion, product development, and the number of customers and users?
Our priorities are to build on the momentum we gained during Y Combinator, expand into international markets, and increase the number of organizations and users we protect.
On the product side, we are building out RASPIRE into a broader security suite by adding new security products to the platform and extending our protection to more use cases and platforms. We are also developing more sophisticated defenses while keeping them easy to integrate and use.
Our long-term ambition is to make securing software as easy and fast as building it.