Steve Carter is the co-founder and chief executive of Nucleus Security, a Florida company whose platform gathers vulnerability findings from many security tools and ranks and routes them for fixing. He spent about 15 years as a security engineer supporting U.S. federal agencies, then founded the managed security provider Rampant Technologies before starting Nucleus in 2018. He built the product out of a practitioner's frustration with how vulnerability management slowed down software teams.
A Security Engineer for Federal Agencies
Carter, who is based in Jacksonville, Florida, described his start on a Nucleus podcast: I spent the first 15 years or so of my career as a security engineer, supporting federal agencies.
His background was also in software development, which shaped his view of the field: So I viewed vulnerability management and vul management processes as kind of an inhibitor to innovation.
Before Nucleus he was an executive at Raytheon, according to citybiz.
Rampant Technologies and a Federal Contract
In 2015 Carter founded Rampant Technologies, a managed security services provider, with his longtime colleague Mike Nixon; its teams supported vulnerability management programs inside federal agencies, he wrote on the Nucleus blog. When a large federal agency asked for new ideas, Rampant submitted a whitepaper on the agency's inability to automate and prioritize its scan results. It won a one-year research and development contract to build a proof of concept, and that's where Nucleus was born.
Starting Nucleus in 2018
Carter co-founded Nucleus with Scott Kuffer, who had worked with him at Rampant, and Nick Fleming, a former Lockheed Martin engineer, and it launched in December 2018. I started Nucleus in 2018 to build the risk based vulnerability management platform that I personally was always looking for as a practitioner in this space and that I always felt should exist
, he said on Mandiant's Defender's Advantage podcast, reprinted by Nucleus. When he explains the product, he starts with what it is not: we're not a vulnerability scanner
. Selling to the largest federal agencies proved hard for a new small business, so the company found its first market with large commercial enterprises facing the same problems.
Nucleus began the FedRAMP authorization process in November 2021, when it had 30 employees, with the Centers for Medicare and Medicaid Services as its sponsor.
When In-Q-Tel joined its $43 million Series B in 2024, Carter said, Our journey has now come full circle, enabling us to continue making a profound and positive impact on our nation's security
.
Announcing a $20 million Series C in February 2026, he summed up the company's pitch: security teams need speed, clarity, and real outcomes, not more data.
Sources
- Nucleus Security: Nucleus x FedRAMP, our full-circle journey in federal security (2022)
- Nucleus Security: VM Short Cuts, accelerating ATOs
- Nucleus Security: Frontline stories, discussing the impact of CISA KEV (Defender’s Advantage podcast)
- citybiz: Nucleus Security closes $20M Series C to push exposure management (2026)
- Help Net Security: Nucleus Security raises $43 million (2024)
- Nucleus Security: Nucleus secures Series C funding (2026)
Sources retrieved October 24, 2026.
