Airtree has invested $5 million in Adelaide startup Metacognition, lifting its pre-seed round to $15 million. Main Sequence put in an initial $10 million. The 2026 median pre-seed round is $1.6 million. Earlier this month, Metacognition released NavGPT-3, an open-source model that lets robots interpret verbal commands and navigate environments. In simulated benchmark tests, it navigated more reliably than models from Alibaba and Mistral. Metacognition wants to build the "operating system" for robots, with guardrails to stop unsafe actions. Co-founder Anton van den Hengel says the startup is hiring 20 people and will need to raise much more to reach 100 staff.

Australian startup Cuttable has raised $20 million in Series A funding to automate ad creative for brands. Airtree Ventures led the round, with seed investors Square Peg and Rampersand also taking part. The round values the company at more than $100 million. Cuttable declined to share a more specific figure. Its technology scans a brand's Meta content and Shopify orders, then builds new AI ads for Meta and TikTok from existing photos and videos. A human must approve each ad before it is published. Each ad keeps a record of the messaging being tested, such as a price promotion or a product's origin story.

Security for NZ startups: why penetration testing does not have to wait until you are big. Auckland Startup Week is a good reminder of something Capture The Bug see often in the Kiwi startup community. Security is on founders' minds, but it rarely makes it to the top of the list. There is always a product to ship. A customer to close. A hire to make. Security feels like something you do later, once the budget is bigger and the team is more settled. The problem is that later often arrives as a breach, a stalled enterprise deal, or a compliance deadline with no evidence to show. Security matters most before those moments, not after them. What NZ founders tell Capture The Bug. Through its partnerships with Airtree and Ministry of Awesome, Capture The Bug has worked with startups at different stages across New Zealand and Australia. A few things come up in almost every conversation. The first enterprise customer almost always asks for a penetration test report. It sits somewhere in the vendor security questionnaire, and it stops deals that took months to build. One missing document, one unanswered question, and the timeline slips by weeks or months. Investors are asking about security posture more often during due diligence, especially at Series A and above. A CREST-certified penetration test is one of the clearest and most credible answers a founder can give. It shows the work has been done by an independently verified tester, not self-assessed. And for founders building in fintech, healthtech, or SaaS that handles personal or sensitive data, compliance obligations arrive earlier than most expect. SOC 2, ISO 27001, and the New Zealand Privacy Act all create security testing expectations that do not adjust for headcount or runway. What am I risking by not acting? Your last pentest is already out of date. Every week you ship without continuous testing is a week a vulnerability goes unseen. See what Capture The Bug finds in your first engagement. What security testing looks like at the startup stage. Most early-stage startups do not need the same scope as a large enterprise with thousands of endpoints and legacy infrastructure. What they need is a focused test of the systems they are actually shipping. The web application. The API. The authentication layer. The user data they hold. That is the attack surface that matters to an enterprise buyer or a SOC 2 auditor, and it is the scope that produces useful findings for an engineering team of four or ten people. A well-scoped startup engagement covers what matters, produces a report that satisfies an auditor or enterprise buyer, and leaves the team with a clear list of what to fix. Then it confirms those fixes actually worked through a retest before the report is delivered. That is what CREST-certified testing at the startup stage looks like. Not a six-figure enterprise engagement. A focused, fast, fixed-price test of the systems you have built so far. Results arrive in days, not months. The report is compliance-ready for SOC 2, ISO 27001, and the New Zealand Privacy Act. Findings go live on a dashboard your team can see in real time. And one round of retesting is included so the report reflects what is actually fixed, not just what was found. If you are building in New Zealand right now. Auckland Startup Week is a good moment to ask whether your security posture matches where you are taking the company, not just where you are today. If you are preparing for your first enterprise customer, launching a new product feature, or heading toward a fundraise or certification, a penetration test is one of the clearest security signals you can add to the conversation. Capture The Bug is expanding its startup-friendly offer to support more NZ teams through the Airtree and Ministry of Awesome partnerships. If you are building something and want to understand what a focused security test looks like at your stage, get in touch. And for a plain explanation of what the test actually produces, the guide to what happens after a penetration test covers the full evidence cycle from findings through to confirmed remediation. Plan Security Better Plan your annual pentesting strategy the right way. Learn how modern SaaS companies structure pentesting across the year to reduce risk, stay compliant, and avoid last-minute panic before audits. Associate Director & Pentester - eWPTX Cybersecurity professional & pentester | Associate Director @ CaptureTheBug | Securing web, APIs & networks one vulnerability at a time. - 07 / RESOURCES