TENZAI builds autonomous AI agents that carry out penetration tests on enterprise applications and networks.
Security and engineering teams use it to find weaknesses an attacker could actually exploit, prove them with reproducible exploits and get them fixed, without waiting for the next scheduled manual test.
At A Glance
| Vendor | TENZAI |
|---|---|
| Category | AI-driven penetration testing |
| Agentic AI | Autonomous AI agents that run penetration tests |
| Customers | Markus Alliance |
| Certifications | SOC 2, public Trust Center |
| Funding | $75 million seed round, founded 2025 |
| Market classification | Agentic AI Identity |
What TENZAI Does
TENZAI’s agents behave like an attacker: they learn how an application is meant to work, look for business logic flaws and chained vulnerabilities, and back each finding with an exploit, which keeps false positives down. Each run feeds what the agents learned into the next one. The platform also closes the loop after a finding. It can block the issue at the web application firewall straight away, guide developers to a permanent fix and then re-test to confirm it holds. Findings from existing scanners and bug bounty programmes can be passed through the same validation, so teams know which of them are real.
Products
Agentic Testing Platform
The core platform runs black box, gray box and white box penetration tests. A test starts within seconds and returns actionable results within hours, so teams can test whenever an application changes. Targets include web applications, APIs, AI and MCP systems, and external and internal networks; mobile apps are tested on emulated Android devices, with static analysis for both Android and iOS. Model Sets choose which AI models to use for a test, balancing cost against the intelligence each test needs.
AI Application Testing
AI Application Testing is for organisations shipping applications with AI features. It chains vulnerabilities across web, API and AI surfaces, so a weakness in a model integration can be followed through to the systems behind it.
Continuous Testing Features
These features make testing keep pace with development:
| Incremental Testing | Tests only the code that changed, for continuous pentesting during development |
|---|---|
| Automation Rules | Takes a finding from proof of exploit to a validated fix automatically |
| Autonomous WAF Mitigation | Turns a validated exploit into a deployed defence |
| Interactive Testing | Lets a user lead a team of AI agents through a test |
How It Works
The platform is designed so that security teams can see and control what the agents do.
| Component | What it does |
|---|---|
| Learning | Before testing, agents learn the application’s business purpose and workflows. Knowledge from earlier runs carries forward, so later tests build on what was already discovered. |
| Transparency | Every step is visible, with the agent’s reasoning, its assumptions and the evidence it collected. |
| Steering | Users can direct a test as it runs and feed in business context and risk priorities. |
| Guardrails | “Layered guardrails enforce scope at the network level”, and every action is checked against the rules of engagement. |
| Remediation | Outputs include WAF rule suggestions, prompts for coding assistants and tickets, followed by a re-test. |
| Connected platforms | In Palo Alto Networks Cortex Exposure Management, agents test new exposures and write the results back to the Cortex issue. Base44 workspace admins connect with a TENZAI access key to pentest published apps and receive severity-ranked reports. |
Company Background
| Founded | 2025 by a team of offensive security specialists; an Israeli company. |
|---|---|
| Leadership | Pavel Gurvich (Co-Founder and CEO). |
| Funding | A seed round announced in November 2025, led by Battery Ventures, Greylock Partners and Lux Capital, with Swish Ventures and Jibe Ventures participating. |
Note: This overview is compiled from TENZAI’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.