‍Ensemble is thrilled to announce our lead investment in the Series A round for Manifest, with participation from AE Ventures, Overmatch VC, and Leap435, as well as existing investors First Round Capital, XYZ, and Homebrew.

Founded in 2022 by Ex-Palantir national security veterans Marc Frankel and Daniel Bardenstein, Manifest is a software and AI supply chain transparency platform addressing the growing urgency of hidden vulnerabilities. By generating Software Bills of Materials (SBOMs), Manifest brings clarity to complex codebases, allowing organizations to assume a proactive stance in the wake of high-profile incidents that exposed the risks of ubiquitous, assumed-safe software. 

Current Manifest customers include the U.S. Air Force, the Department of Homeland Security, Anduril, and several Fortune 500 companies. The platform is deployed across sectors such as financial services, automotive, healthcare, and defense—safeguarding over $100 billion in defense-related software procurement alone.

With software proliferating across every domain—and increasingly generated at massive scale by opaque software—Manifest addresses the critical gap in our ability to trace, verify, and trust the systems we rely on.

• We don’t know what we don’t know: Software is the only critical supply chain without an ingredient label, and periodic global vulnerabilities like Log4shell reveal just how dangerous that ignorance can be.
• Making the opaque legible: As software increasingly comes from murky, untraceable sources, Manifest breaks open the black box and makes trust in code something you can prove.
• Enabling a forward-thinking future: The current model reacts to disaster; Manifest enables one where we can build with confidence from the start, without fearing a looming fire drill.

Marc and Daniel began their careers together at Palantir, working on mission-critical systems across federal agencies and global intelligence networks. 

• Marc later joined Expanse, a pioneer in attack surface management, where he led public sector customer success. Following Expanse’s acquisition by Palo Alto Networks, Marc played a key role in integrating its capabilities into Palo Alto’s cybersecurity platform. 
• Daniel led critical cybersecurity programs at the Defense Digital Service, including Operation Warp Speed (COVID-19 vaccines) and Hack the Pentagon. Most recently, he served as Chief of Technology Strategy at CISA, where he focused on securing critical infrastructure and modernizing internal technology processes.

Ensemble sat down with Manifest founder Marc Frankel to unpack how the December 2021 Log4Shell vulnerability crisis didn’t just expose a software bug, but exposed in real time that most organizations don’t know what they don’t know in terms of their own mission-critical software. Even more jarring? They have no reliable way to find out. Vulnerabilities are themselves extremely dangerous in the moment, but Marc and team address the issue from a 10,000-foot view: software infrastructure has quietly fallen behind its complexity. The legacy model sees cybersecurity as a game of whack-a-mole. We explored how a holistic view of software transparency drove Manifest’s founding, how the company is confronting today’s murky, AI-driven code ecosystem, and why the next era of software will demand a new kind of infrastructure.

‍

_______________________________________

The world’s wake-up call

On December 9th, 2021, Marc Frankel was at his desk at a major publicly traded cybersecurity company when news broke of a vulnerability in a ubiquitous open-source Java logging library called Log4j. Suddenly, as Marc describes, he “watched with abject horror as these large, well-funded, ostensibly sophisticated, mission-critical organizations” scrambled onto thousands of vendor calls to answer two basic questions: 

1) What did we build that has a Log4j dependency?

2) What did we buy that has a Log4j dependency?

That moment was an acute vulnerability crisis to those directly involved, but served as a global wake-up call for Marc and Daniel. At the same time Marc watched the scramble unfold at his cybersecurity company, Daniel was witnessing the parallel response from within the Pentagon. They internalized the reality that even in the halls of cyber-power, software had become so ubiquitous, its safety so assumed, that organizations were not only unaware of their exposure but completely in the dark around how to look for it.

Beyond fixing the immediate issue, Marc and Daniel wondered how the possibility of such a vulnerability was still not only acceptable but standard practice. How much better would it be to build a company, an entire ecosystem, where the origins and dependencies of software were known from the start?

What did we buy?

“Software is the only supply chain without an ingredient label,” Marc told Ensemble. “You buy a house, you get a home inspection. You buy Raisin Bran, you get an ingredient list.”

Marc even broke the fourth wall to make his point: “We're doing this meeting on Zoom, and undoubtedly, Ensemble conducts an uncomfortable percentage of its mission, business, and critical functions on Zoom. I would bet you dollars to donuts that Gopi [Sundaramurthy] didn't ask Zoom what's inside.”

In Marc’s eyes, this isn’t a missing feature but a structural flaw. The most critical infrastructure of our time has no inspection process. And now, as AI accelerates the pace of development, the problem is multiplying. Every week, we interact with new tools and platforms that sit atop increasingly murky stacks of code (the code itself often AI-generated), models, and third-party services. The surface moves fast while the foundations remain invisible. 

From audit to architecture

In the aftermath of Log4Shell, a wave of security tools promised to help organizations “get compliant.” But, Marc points out, compliance wasn’t the problem. The problem was architectural. Most solutions treated software risk like a box to check, as if visibility could be retrofitted after the fact. The foundational issue wasn’t that people failed to respond to Log4Shell fast enough,  but that they couldn’t have responded any faster without knowing what they were running. 

“Transparency shouldn’t be patched on,” Marc says. “It should be built in.”

That’s why Manifest started with the Software Bill of Materials (SBOM)—a digital ingredient list for code that identifies every dependency, every library, every hidden piece of the puzzle. But that’s only the beginning. The long-term vision isn’t just to document software, but to reshape how we build and trust it in the first place. Manifest is laying the groundwork for a future where transparency is the default, not an afterthought.

The future will be regulated. Manifest has the receipts  

Industries from healthcare to finance to defense are already tightening standards for software transparency. Europe’s Cyber Resilience Act will soon require SBOMs for any software sold in the EU. U.S. federal contractors are facing similar mandates. And behind closed doors, the next wave of AI regulation is already being written. 

Manifest is positioned to be the leading SBOM provider as governments and their contractors move into a proactive paradigm for cybersecurity. And while selling to the government can feel like a steep hill to climb for new companies, for Manifest, it’s the kickoff of a flywheel in which proving the viability of such high-stakes solutions acts as a proof point for commercial applications. 

Dual-use is Manifest’s DNA

With careers in global cybersecurity shaped by early years at Palantir, Marc and Daniel didn’t need to be convinced of the value of dual-use. They had seen in practice that government adoption reinforces commercial viability rather than diluting it. When a defense prime uses Manifest, it doesn’t just improve internal security, but sends a signal to the Army, to policymakers, and to competitors. And when a federal agency adopts Manifest, it tells the commercial market that this isn’t vaporware. It’s battle-tested.

“It ends up being cultural,” Marc told Ensemble. “The ‘carrot’ is: you will know with the click of a button, your blast radius for the next software supply chain vulnerability, as opposed to 50,000 hair-on-fire emails. Culturally, are you working from crisis to crisis, or are you implementing an ounce of prevention ahead of time?”

In the cybersecurity world, trust spreads laterally, and visibility is contagious. One deployment leads to another, not through press releases, but through operators talking to operators. 

‍

Partnering with Ensemble

By the time Manifest set out to raise its Series A, Marc noted that the company was fortunate to already have strong partners in First Round Capital and XYZ—investors who had been deeply supportive from the start. With that foundation in place, the goal for the A was to find a lead who could complement that support: a firm that brought clear alignment, strategic access, and the ability to move fast when it counted.

What stood out about Ensemble, Marc shared, was how quickly the firm began delivering on those fronts, even before a term sheet was signed. Ensemble made early introductions to stakeholders across defense and critical infrastructure, and provided enterprise leads that ultimately converted to revenue. Ensemble’s ethos around “doing what we said we were going to do” was the difference maker. 

___________________________________________

We’re especially excited about Manifest’s work not just in SBOMs, but in expanding those capabilities to AIBOMs—an essential step in this “brave new world” of proliferating, self-generating software. As AI systems become more deeply embedded in critical infrastructure, understanding what models are being used, where they came from, and how they’re deployed is no longer optional. Manifest is building the transparency layer for the next era of software, and they’re hiring. For those interested in joining the mission, check out Manifest’s job board. 

‍