XBOW is an offensive security company whose platform runs autonomous penetration tests against web applications and APIs. It is for security teams that release software faster than they can schedule human pentests and want proof of what is exploitable, not another list of possible issues.
It replaces the gap between annual pentests with testing that can run on every release, against production or staging, and that reports only what it has actually managed to exploit.
At A Glance
| Vendor | XBOW |
|---|---|
| Category | Autonomous offensive security and penetration testing |
| Deployment | Multi-tenant SaaS with XBOW Console and API |
| Agentic AI | Persistent coordinator plus short-lived autonomous attack agents |
| Certifications | SOC 2 Type 1, SOC 2 Type 2, HIPAA |
| Customers | Moderna, Rogo, Superhuman, Seznam, BloomPath AI |
| Funding | A reported $120 million Series C (March 2026) |
| Market classification | AI Model Security |
What XBOW Does
Vulnerability scanners produce findings that someone still has to prove. XBOW starts from the other end. The platform behaves like an attacker, building working exploits, and independent validators confirm each one is reproducible before it reaches the customer. No human drives the attack.
The working pattern is simple: XBOW attacks, the customer’s team fixes, and XBOW verifies the fix. Results can be mapped to SOC 2, ISO 27001, ISO 42001, PCI DSS, NIS 2, HIPAA and GDPR, among more than 40 frameworks.
Products
XBOW Console
XBOW Console is the main interface for security teams that want automated penetration testing of their web applications and APIs. It systematically probes each page and endpoint of an asset, validates exploitable vulnerabilities with evidence, and produces downloadable reports. Webhooks and event automation hand results to other systems, and an audit trail records assessment activity.
XBOW API
The API suits teams that want testing triggered from their own pipelines. It launches assessments programmatically, and findings can flow straight into Jira, GitHub issues or coding agents for fixing.
Guardrails And Governance
Testing a live system needs limits, and these controls let customers set them.
| Scope | Defines what may and may not be tested. |
|---|---|
| Impact levels | Off, moderate or deep. |
| Pacing | Rate limits, testing windows and a one-session-at-a-time mode. |
| Safety judge | Reviews each action before it runs, with production-safe checks that prove exploitability without modifying data or disrupting systems. |
| Oversight | Every action logged, with the option to review and pause, and custom headers to tag XBOW traffic. |
How It Works
XBOW runs as multi-tenant SaaS. Data residency is in private preview, with regions in Australia, Canada, Europe, Japan and Singapore; each organisation uses one region, and the choice is permanent. Customers often begin with unauthenticated external testing, then move to authenticated runs. A test moves through six stages.
| Component | What it does |
|---|---|
| Learn | Customers can supply documentation, credentials, API specs, architecture notes and source code. The platform runs without them but goes deeper with them. |
| Map | XBOW builds a live model of applications, endpoints, parameters and authentication flows. |
| Coordinate | A coordinator decides what to test, where and in what order. |
| Attack | Agents work in parallel with an offensive toolkit and a headless browser, chaining vulnerabilities together. |
| Prove | Independent exploit validators confirm each exploit. Preview vulnerability classes are marked as such in results. |
| Verify | Once a fix is deployed, XBOW re-tests to confirm the issue is closed. |
Agentic AI Capabilities
Coordinator And Agents
The coordinator is persistent and debriefs agents after each mission. The agents are short-lived workers, each with fresh context and a single objective, retired after their task so earlier assumptions do not bias the next attempt. What each agent learns flows back to the coordinator, which plans the next missions, and thousands of agents can test applications and APIs in parallel.
Model Routing
XBOW benchmarks several frontier models, routes each task to the one that currently performs best, and switches as the field changes.
Company Background
| Founded | January 2024. |
|---|---|
| Leadership | Oege de Moor, CEO. |
| Funding | The Series C, announced on 18 March 2026, was led by DFJ Growth and Northzone, with new investors Sofina and Alkeon Capital and existing investors Altimeter, NFDG Ventures and Sequoia Capital, at a reported valuation above $1 billion. |
| Track record | More than 1,500 reported reproducible exploits on production targets, and use by more than 200 security teams. |
Note: This overview is compiled from XBOW’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.