terra, trading as Terra Security, runs continuous penetration testing with AI agents and human experts working together. It is built for security and engineering teams that want to know which weaknesses in their web applications, AI systems, APIs, mobile apps, networks and cloud can actually be exploited, rather than waiting months between manual tests or sorting through scanner noise.
The aim is proof rather than possibility: a finding should come with a working exploit and a path to a fix, with human testers steering the critical decisions. The motto is “Discover. Validate. Remediate.”
At A Glance
| Vendor | terra (Terra Security) |
|---|---|
| Category | Agentic offensive security and continuous penetration testing |
| Deployment | Multi-tenant SaaS, Bring Your Own Cloud, on-premises or air-gapped |
| Agentic AI | Ambient and copilot AI agents with Human-ON-the-Loop oversight |
| Certifications | SOC 2 Type II, CREST member, AWS Security Competency |
| Funding | Seed and Series A, led by Felicis |
| Market classification | AI Model Security |
What Terra Does
A traditional pentest is a snapshot: it takes weeks, and by the time the report lands the code has changed. Terra replaces that with always-on testing tied to code changes, with a reported reduction from four to six weeks to two to four hours per test. Its agents learn the customer’s business context and code, then try real exploitation and capture the evidence, so a finding is a demonstrated attack and not a possibility. Findings from other tools are held to the same standard before anyone works on them. The resulting reports are used as evidence for SOC 2, ISO 27001 and HIPAA audits.
Products
Terra Platform
The platform brings the testing modules together:
| Web Apps | Works through authentication flows and business logic the way an attacker would |
|---|---|
| External Network | Maps exposed services and chains misconfigurations into attack paths |
| Internal Network | Traces lateral movement and privilege escalation inside the estate |
| AI Red Teaming | Tests what copilots, agents, LLMs and MCP servers can reach and trigger, including tool integrations and the data flows between them; chained tests show how one tool call can lead to privilege escalation, and fix guidance is scoped to the exact prompt, tool permission or integration involved |
| Agentic Remediation | Provides fix guidance, opens pull requests and proves that a repeated attack now fails |
Validation Hub
Security teams drown in findings from scanners and bug bounty programmes, many of them unexploitable. Validation Hub imports those results, including from HackerOne and Bugcrowd, as unverified drafts, has agents test each one in the customer’s environment, and promotes only proven issues to a Finding. Duplicates between imported and Terra-discovered issues are flagged, so the same flaw is not worked twice.
TORCH
The Terra Offensive Research Collaboration Hub is where human testers direct the copilot agents, review what they have found and make the calls that should not be left to a model.
How It Works
Terra offers three deployment tiers, all of which can use the customer’s own model.
| Component | What it does |
|---|---|
| Multi-tenant SaaS | The default, fully managed by Terra. |
| Bring Your Own Cloud | A dedicated single-tenant environment in AWS, Azure or GCP, where source code analysis, agent orchestration and finding validation stay inside the customer’s boundary. Existing IAM policies and network controls apply to the instance. |
| On-premises or air-gapped | Runs on the customer’s hardware with no internet dependency. |
| Bring Your Own AI | Connects to the customer’s own LLM endpoint in any tier. |
| Guardrails | Tool permissions, guardrails and policy enforcement sit outside the model, so a misbehaving model cannot widen its own scope. |
Agentic AI Capabilities
Ambient And Copilot Agents
Terra runs hundreds of specialised agents in two modes. Ambient agents test in the background and check each code change as it lands. Copilot agents take instructions from the human on the loop through TORCH.
Oversight And Audit
People supervise the agents rather than approving every step, and step in on the critical decisions. Every agent action and every human decision is logged and traceable, so a test can be reconstructed afterwards and its evidence reviewed by an auditor.
Company Background
| Leadership | Shahar Peled (Co-Founder and CEO) and Gal Malachi (Co-Founder and CTO) |
|---|---|
| Funding | A reported $8 million seed round and $30 million Series A led by Felicis; investors include SYN Ventures, Felicis and Capital One Ventures, with SVCI as a strategic investor |
| Recognition | Included in Fast Company’s Next Big Things in Tech list and CRN’s 2026 Tech Innovator Awards |
Note: This overview is compiled from terra’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.