Home / Directory / AI SaaS tooling / AI penetration testing / XBOW
XBOW
Autonomous AI penetration testing platform that attacks web apps and APIs like a human hacker and proves each finding with an exploit. XBOW raised a $120 million Series C in March 2026 and added a $35 million extension in May.
Enterprise security teams that want frequent, on-demand pentests across many web applications and APIs, with retests after each fix.
Small companies that need one compliance pentest a year, or teams whose main risk is internal networks rather than web apps.
Verdict
XBOW is an offensive security company that lists Seattle as its home and works as a remote team, founded in January 2024 by Oege de Moor, who earlier founded Semmle and started the GitHub Copilot project. Security teams at companies such as Moderna use it to run autonomous pentests against web applications and APIs, chain bugs into attack paths, and retest fixes on demand. It stands out because each finding comes with a reproducible exploit, which cuts through long lists of theoretical vulnerabilities and tells developers what an attacker could do today.
Score Breakdown
How XBOW scores in the categories that matter to its buyers.
Pricing
XBOW does not publish prices on its site. Testing is sold through sales and through the AWS, Google, Oracle, and Microsoft cloud marketplaces.
Pricing is usage-based and quoted per customer. An AWS Marketplace listing shows a package of attack credits at $50,000 for 12 months. XBOW holds SOC 2 and ISO 27001 certifications.
The Field at a Glance
How XBOW compares with other AI penetration testing vendors we reviewed, by Overall Score and relative typical engagement cost.
XBOW scores 7.8 in AI penetration testing, ahead of Ethiack (7.7), RunSybil (7.4), and Terra Security (7.3). Relative cost lands upper for this subcategory.
Use-case matrix
| Use case | Fit | Notes |
|---|---|---|
| Web app and API pentests | Strong | Moderna found a firewall bypass that its own review missed. |
| Prioritizing a large backlog | Strong | Every finding comes with an exploit proof. |
| Retesting fixes | Strong | Tests can be triggered on demand without booking a vendor. |
| Attack chains across apps | Strong | Chained an API key, bad input handling, and an IDOR at Moderna. |
| Internal network testing | Weak | The product focuses on web applications and APIs. |
| One yearly compliance test | Mixed | Possible, but the pricing suits continuous testing. |
Review Excerpts
Excerpts from company materials and customer stories for XBOW, plus a representative buyer view drawn from public information. Paid reviews and pay-for-play sites were excluded.
“XBOW identified a WAF bypass through a URL encoding trick that I missed during my own review. It found it right away. That was the moment that led us to choose XBOW as a partner.”
“Before XBOW, we had a huge volume of findings which made remediation difficult. With XBOW, every finding comes with an exploit proof. That tells us exactly what to fix first.”
“For a lean team like ours, XBOW's simplicity and flexibility were game changers. We managed setup and execution ourselves with zero friction and could trigger tests on demand whenever we needed verification.”
“There is no public price list, and an autonomous agent can produce many findings, so teams still need people to triage and fix them.”
Representative buyer view
Where customer reviews couldn't be found, our analysts attempted to give a voice to buyer sentiment, drawing on real information from review sites, forums, and product documentation.
Based on: XBOW’s website
Company Facts
- Founded
- 2024 (CB Insights)
- Headquarters
- Seattle, Washington, United States (CB Insights)
- Total funding raised
- More than $270M (XBOW)
- Key investors
- S Ventures, Samsung Ventures, DNX Ventures, Accenture Ventures (CB Insights)
- Website
- xbow.com
Key Leadership
Oege de Moor
Founder and CEO
Methodology
This page is an independent evaluation of XBOW for buyers comparing options in AI penetration testing. AI Industry Reviews accepts no sponsorships, advertising, or pay-for-placement fees. XBOW did not pay for this review.
What we scored
The headline number is an Overall Score on a 0-10 scale. Eight criteria sit under it in two groups.
- Buyer outcomes (for AI penetration testing)
- Finding real, exploitable bugs
- Exploit proof & prioritization
- On-demand testing & retests
- Small-team affordability
- Company & commercial
- Innovation & product leadership
- Project management & communication
- Pricing
- Contract fairness
Pricing measures whether the price looks fair for the value delivered, including packaging and renewal friction that show up in real buying cycles.
Score Composition
| Input | Weight | What it covers |
|---|---|---|
| Reviews | 40% | A proprietary read of what practitioners say about likes, complaints, and day-to-day use, including public review sites, forums, and private chat rooms. Paid reviews and pay-for-play sites are out of scope. |
| Product | 35% | Hands-on look at screens and workflows. |
| Pricing | 15% | Whether the price looks fair for what you get. |
| Docs & training | 10% | Docs, tutorials, and training material. |
How we balanced the evidence
The Overall Score is the simple average of the eight criteria. Recommendation language follows that score and the use-case matrix above.
Scope
XBOW is graded here as AI penetration testing. Criteria scores can move as more review volume and product checks are added.