Meet Norigen, tracing third-party cyber risk to the products it affects

From left: Nicolas Yauny (Co-founder & CTO), Pedro Merino (Founder & CEO).

The problem

When a software vulnerability strikes, companies face three critical questions: Which products use it, which supplier introduced it, and who needs to fix it?

What Norigen does

Norigen shows exactly which products and services are exposed to third-party cyber risk.

Norigen maps the dependencies between suppliers, software components, and vulnerabilities directly to the core business operations, giving security teams instant clarity on blast radius, response ownership, and audit-ready proof.

Why it matters

For regulated companies, this speed is no longer optional. With regulations like the EU Cyber Resilience Act (CRA) requiring early warnings within 24 hours of an exploited vulnerability, manual reviews are no longer compliant.

Norigen turns complex supply chain dependencies into instant compliance and risk visibility.

How it started

Norigen was built around a simple question: why does it take up to a month and 5 different departments to figure out which products are exposed when a supplier component breaks?

Pedro and Nicolas built Norigen to make those hidden dependencies instant and visible; turning weeks of supply chain guesswork into a confident, immediate response.

Why this team

Founder and CEO Pedro Merino brings a rare combination of firepower: former Kivra security engineer, practicing lawyer, and PhD. He built Norigen alongside Co-founder and CTO Nicolas Yauny, a veteran developer and founder of legal-tech platform Överklaga.

Together, they bridge deep technical security with legal compliance to turn complex regulatory headaches into usable software.

Why Sting

Norigen joined Sting to learn from experienced founders and build a repeatable sales engine.

Norigen is one of 21 startups in Sting Core Fall 2026. Meet the rest of the cohort in Meet the 21 startups joining Sting this autumn.