XBOW
XBOW runs penetration tests of web applications with AI agents that probe for vulnerabilities, confirm each one with a working exploit and report how to fix it, so teams can test every release instead of booking a consultancy once a year.
CyberReviewed Editorial Team · Updated · xbow.com
Company details
- Score
- 6.5/10Ranked 22 of 27 (tied)
- Category
- Penetration testing
- Founded
- 2024
- Headquarters
- Seattle, Washington
- Leadership
- Oege de Moor, founder and CEO
- Funding disclosed
- $75 million Series B; $120 million Series C in March 2026 at a valuation above $1 billion, extended by $35 million in May 2026
- Pricing
- Usage-based and scoped to each environment; sold directly and through AWS, Google, Oracle and Microsoft marketplaces
- Best fit
- Companies with many web applications that want continuous, exploit-validated testing between or instead of manual pentests
Our take
XBOW is one of the most capable autonomous pentesting products for web applications, and its record on HackerOne shows its agents can find real vulnerabilities. It is young, prices are quoted, and its self-service test was retired in July 2026. It does not yet test networks, mobile apps or APIs without a web front end.
Scores by criterion
| Criterion | Score |
|---|---|
| Pricing transparency | 4.6 |
| Product scope and fit | 6.1 |
| Company durability | 7.4 |
| Evidence of adoption | 6.8 |
| Ease of adoption | 7.7 |
| Overall score (average of the five) | 6.5 |
Each criterion is defined on our methodology page.
Agents that find and prove exploits
XBOW's agents test a web application the way an outside attacker would, then confirm each finding with a proof-of-concept exploit and give remediation steps, which keeps false positives low.12 Buyers point it at a URL and supply a test account.3 In June 2025 it reached first place on HackerOne's U.S. leaderboard, ahead of human researchers in live bug bounty programs.45
XBOW currently tests only web applications and their APIs; it does not test an API without an interactive web front end, and support for other asset types is on its roadmap.6 Logins through Google accounts and authentication that requires a CAPTCHA are not supported.7
Usage-based prices and a retired $4,000 test
XBOW says its pricing is scoped to each environment and is usage-based, not a fixed annual engagement, and it sells through the AWS, Google, Oracle and Microsoft marketplaces so customers can use committed cloud spend.1 In November 2025 it launched a self-service product, Pentest On-Demand, later called Lightspeed, starting at $4,000 per test.4 XBOW retired Lightspeed on July 16, 2026, and now asks buyers to contact sales.3
The Copilot team turns to offense
Oege de Moor, who founded the code analysis company Semmle and later led the team at GitHub that built Copilot, founded XBOW in January 2024 with engineers from the original Copilot team.2 Chief information security officer Nico Waisman, formerly CISO at Lyft, joined at the start.2 The company raised a $75 million Series B and in March 2026 a $120 million Series C led by DFJ Growth and Northzone that valued it at more than $1 billion.25 A $35 million extension in May 2026 came from investors including Accenture Ventures, NVentures, Samsung Ventures and SentinelOne, when XBOW said it had more than 100 customers.8
How it compares with Horizon3.ai and Cobalt
Horizon3.ai's NodeZero runs autonomous tests of internal and external networks and publishes an entry price on AWS Marketplace. Cobalt books human pentesters through a platform and has added its own autonomous test. XBOW is the most specialized of the three, focused on deep testing of web applications by AI agents.
Limits
XBOW does not publish prices, and the $4,000 self-service test that gave smaller companies an entry point has been retired.13 Its testing is limited to web applications and their APIs.6
Buyer sentiment
- “It proves each finding with a working exploit, which is a big step up from older scanners, and it clears out the easy bugs so our testers can spend their time on harder ones.”
- “Results have been hit or miss for us, depending on which AI model is running underneath.”
- “It still struggles with deep business logic, like authentication bypasses that take several steps, so it does not replace a manual pentest.”
- “Its top HackerOne ranking came from disclosure programs that pay no bounties, where fewer skilled hackers compete, so I would want independent testing before trusting the headline.”
Where customer reviews couldn't be found, our analysts attempted to give a voice to buyer sentiment, drawing on real information from review sites, forums and product documentation.
Based on: Reddit r/Pentesting thread on AI pentesting, Utku Sen, Does XBOW AI Hacker deserve the hype?, Hacker News discussion of XBOW reaching the top of HackerOne
Sources
- XBOW, Pricing, accessed October 24, 2026
- XBOW, XBOW raises $120M to scale, March 18, 2026
- XBOW, Stop scheduling security: XBOW Lightspeed Pentest On-Demand, accessed October 24, 2026
- XBOW, Announcing XBOW Pentest On-Demand for security at machine speed, November 13, 2025
- XBOW, Top 1: how XBOW did it, accessed October 24, 2026
- XBOW documentation, Asset types, accessed October 24, 2026
- XBOW documentation, Authentication methods, accessed October 24, 2026
- XBOW, XBOW secures additional $35M from strategic investors, May 6, 2026
