X

XBOW

Automated web security benchmark solver

Overview

XBOW provides automated web security benchmarks using real-world scenarios with clear success criteria, such as flag capture. It works by generating Python programs that exploit specific vulnerabilities (like XML deserialization) and can deploy embedded bash scripts, while also debugging its own code and the target server environment. It stands apart by sourcing benchmarks from PortSwigger, PentesterLab, and public CTFs, focusing on practical situations rather than puzzles, and by solving challenges without needing pre-defined descriptions. The goal is to offer practical, automated web security practice and evaluation for users seeking realistic penetration testing experiences.

Significant Headcount Growth

Work here?Claim your company

About XBOW

Simplify's Rating
Why XBOW is rated
B-
Rated B on Competitive Edge
Rated B on Growth Potential
Rated C on Differentiation

Industries

Enterprise SoftwareCybersecurity

Company Size

201-500

Company Stage

Series C

Total Funding

$272M

Headquarters

Seattle, Washington

Founded

1995

Get referred to XBOW

See people who can refer or advise you

Simplify Jobs

Simplify's Take

What believers are saying

  • XBOW closed a $35 million extension on May 6, 2026, from Accenture, NVIDIA, Samsung, SentinelOne.
  • XBOW serves 100-plus customers worldwide, including Moderna, Seznam, and several strategic investors.
  • XBOW published critical CVEs in Microsoft Bing and Devices Pricing Program during 2026.

What critics are saying

  • Microsoft can bundle similar testing inside Security Copilot, compressing XBOW's pricing power by 2027.
  • GPU-heavy autonomous hacking burns cash and limits margins as customers demand cheaper continuous coverage.
  • A single misuse scandal, exploited customer environment, or regulatory backlash can freeze enterprise adoption.

What makes XBOW unique

  • XBOW embeds autonomous pentesting into Microsoft Security Copilot and Sentinel, announced March 23, 2026.
  • Oege de Moor built GitHub Copilot, giving XBOW rare attacker-plus-platform credibility.
  • XBOW validates exploits, not scans, using agent swarms and real-world benchmark targets.

Help us improve and share your feedback! Did you find this helpful?

Funding

Total Funding

$272M

Above

Industry Average

Funded Over

5 Rounds

Series C funding is usually for startups that are doing well and are looking for more money to fuel major growth, such as acquiring other companies, expanding into global markets, or launching new product lines. Investors typically include larger venture capital firms and private equity.
Series C Funding Comparison
Below Average

Industry standards

$50M
$40M
$50M
$62M
$100M

Benefits

  • Company Equity
  • Remote Work Options
  • Career Growth

Growth & Insights and Company News

Headcount

6 month growth

25%

1 year growth

8%

2 year growth

7%
The Elec
Oct 15th, 2026
XBOW earns $250K from Google for Chrome vulnerability found by AI in six days

XBOW, an autonomous offensive security company, has earned a $250,000 bounty for reporting a vulnerability in Google Chrome. It is the first payout under Google's Chrome Vulnerability Reward Program this year, the company said on the 14th. XBOW plans to use the money to support NGO security. The flaw let programs run outside the Chrome sandbox when a web page opened. A hacker could have used it to launch attacks such as ransomware or spyware. One security researcher and AI agents found the bug in about six days. Computing costs came to about $40,000. Chief executive officer Ugo de Moor said seemingly low-risk flaws can combine into dangerous attack paths. Defenders, he said, must find them at the attackers' speed.

The Register
Oct 14th, 2026
Security researchers spent 6 days doing their Chromework, built 1B user exploit.

Security researchers spent 6 days doing their Chromework, built 1B user exploit. Xbow earned a $250K bug bounty and all the AI model got was a lousy t-shirt Published Wed 14 Oct 2026 // 19:12 UTC Researchers at security startup Xbow used OpenAI's GPT-5.6 Sol model to help chain three zero-day vulnerabilities in Chrome into an exploit capable of executing code outside the browser's sandbox on Windows machines. Xbow estimates that this could affect about one billion users worldwide. Google fixed all three, and paid the Xbow team a $250,000 bounty, its top reward for a Chrome full-chain exploit. The payout also proves a nice return on investment for the human bug hunters - Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers - who spent just six days during the Black Hat and DEF CON conferences and about $40,000 in token charges to discover the vulnerabilities and build the attack chain. "The number on the check is impressive, but the time it took our team, with the help of a publicly available AI model, to break in is even more impressive," Xbow CEO and founder Oege de Moor said on Tuesday. "A three letter intelligence-agency veteran told me that his team used to spend six months trying to identify this kind of vulnerability and get total access. We did it in six days." In a separate technical writeup about the attack chain, Dolan-Gavitt detailed the work done by humans and AI agents. Agents, using OpenAI's GPT-5.6-Sol model, searched source code, tested the team's hypotheses, and developed proofs of concept and exploit stages, he said. Meanwhile, the AI pen-testing security startup's researchers chose targets, provided context, challenged the agents' results, and decided which attack components to chain. "We did apply a fair bit of our own human expertise and judgment," he wrote. Crossing two security boundaries in 3 steps. Google's Chrome browser uses several layers of security to protect users, and this includes sandboxes - barriers to contain compromised code and ensure that someone who hacks an individual website can't take over the entire computer. This includes deploying the V8 sandbox to prevent any memory corruption flaws in the V8 JavaScript engine from impacting other memory. The V8 sandbox sits inside the operating-system process sandbox, and this nested design means that escaping V8's memory restrictions doesn't automatically grant native code execution. Even if an attacker achieves native code execution inside Chrome's renderer, the outer process sandbox restricts access to the rest of the machine. "The chain crossed both boundaries in three vulnerability stages," abusing Chrome to run code on Windows machines, Dolan-Gavitt wrote. The attack combines a V8 compiler bug, an animated-WebP decoder bug, and a memory-safety bug in Crashpad. The first vulnerability is in Maglev, V8's mid-tier optimizing compiler, and it's due to a reused, mutable boxed number during deoptimization. This gives attackers read and write access throughout V8's pointer-compression cage. The second stage, the animated-WebP bug, is a V8 sandbox escape. "But rather than attacking the sandbox itself we exploited a property that the V8 sandbox deliberately does not enforce and that Blink incorrectly assumed it could trust," Dolan-Gavitt explained. "Finally, the exploit used an overflow in Crashpad to cross the final outer process boundary and achieve unsandboxed code execution on the host." While Google patched all three security issues, and Chrome installs updates on its own, a fix only takes effect once the user relaunches the browser. If you use Chrome, make sure you are running version 152.0.7977.82 or later. The time and money spent to achieve a full chain Chrome exploit illustrate - yet again - that "the bar is significantly lower" for attackers armed with LLMs, Dolan-Gavitt wrote. "Defend accordingly."(R)

WOWTALE
Aug 3rd, 2026
Horizon3 raises $250M Series E at $2B+ valuation to lead the 'AI vs. AI' security era.

Horizon3 raises $250M Series E at $2B+ valuation to lead the 'AI vs. AI' security era. Cyberattacks now move at the speed of AI, and traditional, human-paced defenses are struggling to keep up. As attackers increasingly wield AI of their own, the industry has entered what some call an "AI vs. AI" era - one in which defenders must fight machines with machines. Horizon3, an AI-native proactive security company based in San Francisco, is betting that the best defense is a good offense. Its flagship platform, NodeZero, is an autonomous penetration-testing tool that safely attacks an organization's own production environment. It shows exactly how an adversary would chain together misconfigurations, weak credentials, and identity gaps to compromise critical systems, offers fix guidance, and then instantly verifies that the remediation worked. As it tests, NodeZero can also plant honeypots to catch AI attackers already inside the network. That "attack, fix, verify" loop has driven 120% year-over-year ARR growth. Horizon3 now protects more than 7,000 organizations worldwide, including multinational banks, major healthcare networks, and four Fortune 10 enterprises. The company is FedRAMP High authorized and says it has safely executed 310,000 tests in production environments - the "data moat" it credits for its results. Discover more Stocks & Bonds Foreign Language Resources Horizon3 was founded in 2019 by CEO Snehal Antani and a team of technology and military veterans. Antani previously served as the first CTO of the U.S. military's Joint Special Operations Command (JSOC), and before that as CTO and SVP at Splunk and CIO at GE Capital, beginning his career as a software engineer at IBM. The company announced a $250 million Series E co-led by existing investors NightDragon and NEA. The oversubscribed round drew seven new investors - including Acrew Capital, Sapphire Ventures, Singapore's EDBI, and SAIC - alongside returning backers such as Craft Ventures and Qualcomm Ventures. The round values Horizon3 at more than $2 billion, roughly triple its $650 million valuation at Series D just over a year ago. As part of the deal, Dave DeWalt - founder of NightDragon and former CEO of FireEye and McAfee - and NightDragon managing director Morgan Kyauk will join Horizon3's board. The company plans to use the capital to scale its go-to-market operations, expand into Singapore, Australia, and across EMEA, and build a continuous learning loop between AI attackers and AI defenders, including new autonomous "blue-team" agents that remediate findings directly from NodeZero pentests. A crowded 'AI vs. AI' security market. Capital is pouring into cybersecurity as AI automates both attack and defense. In the offensive, autonomous-pentesting niche where Horizon3 operates, rivals include XBOW and Pentera. On the defensive side, security-automation firm Torq reached unicorn status on a $140 million round, while others race to embed AI across detection, endpoint, and identity. The common thread: as vulnerabilities multiply, the winners will be those that can not just find exploitable problems, but fix them at machine speed.

Premier Media Group
Jul 14th, 2026
Everett company topped region's 2Q VC deals; seattle-area total down from year ago.

Everett company topped region's 2Q VC deals; seattle-area total down from year ago. * john stearns * 21 hrs ago. Everett fusion-energy company Helion recorded the largest fundraising deal in the second quarter in the greater Seattle-Tacoma-Bellevue metropolitan area, according to the latest venture-capital report from Seattle-based PitchBook and the Washington, D.C.-based National Venture Capital Association. Helion in June announced a $465-million Series G investment round to accelerate commercial deployment of fusion, scale manufacturing capacity, and expand the company's ability to deliver clean electricity to customers. The latest deal valued the company at more than $15 billion. The Helion deal comprised almost a third of the $1.5 billion invested in greater Seattle area companies last quarter in about 78 deals. That was up from the roughly $1.2 billion raised in the first quarter in 77 deals, but far below the $2.3 billion from second quarter 2025 in about 100 deals, data showed. Nationally, $143.9 billion was invested last quarter in an estimated 5,039 deals, up from $85.8 billion in second quarter 2025, according to the PitchBook-NVCA Venture Monitor for 2Q 20206. Redmond-based Starcloud, which is developing space-based data centers, reported the greater Seattle area's second-largest deal in the second quarter, raising $170 million and taking its valuation past $1 billion. Seattle-based Xbow, which says it's an autonomous offensive security company redefining cyber defense for the AI era, raised $155 million in Series C financing in the quarter, rounding out the top three deals. Another space-industry company, Starfish Space, a satellite-servicing startup based in Tukwila, raised an estimated $115 million, the fourth-largest deal in the metro area last quarter. Seattle-based Gradial, an agentic AI company focused on transforming enterprise marketing operations, took the No. 5 spot in the quarter, raising $65 million. Other deals included Seattle-based Endurance Energy, which is developing subsea geothermal power, $54 million in a Series A, and Seattle-based Vedana Therapeutics, a biotechnology company developing next-generation therapies for migraine prevention, which reported a $46-million Series A. Commenting on the national VC landscape, Nizar Tarhuni, executive vice president of research and market intelligence at PitchBook, said in a statement, "SpaceX's IPO was the first of three potential trillion-dollar listings by US VC-backed companies in 2026, and what many want to view as the opening of an IPO window. The scale of these companies is their differentiating factor, though, largely boxing out the rest of VC from public markets." "The pipeline of companies in IPO registration remains low, and broad liquidity hasn't yet returned, leaving exit value very concentrated through Q2, and very likely through the rest of 2026," he continued Tarhuni. "The same concentration is showing up in how capital gets raised: nearly half of all H1 (first half 2026) capital commitments went to just three firms, and managers with track records pulled in more than nine out of every 10 dollars deployed into venture funds. LPs aren't spreading bets anymore - they're consolidating around track records and brands, a response to five years of thin distributions. This year's numbers will look like a recovery, but for most of the industry, it likely won't feel like one." In a separate statement, Bobby Franklin, president and CEO at NVCA, said, "The second quarter reinforced an emerging trend: capital is flowing back into American innovation with real force. Investment activity is picking up, fundraising is improving, and there are early signs the IPO market is beginning to reopen. AI continues to drive much of the market's momentum, even as investment and fundraising remain concentrated across a relatively small number of companies and funds. Healthier IPO and M&A markets will be critical to unlocking value, restoring liquidity, broadening access to capital, and supporting the next generation of American innovators across the country."

Xbow
May 7th, 2026
XBOW Secures Additional $35M from Strategic Investors, Including Select Customers and Ecosystem Partners

Accenture Ventures, DNX Ventures, Liberty Global, NVentures, Samsung, and SentinelOne Back Rising Demand for Continuous Offensive Security

Recently Posted Jobs

Sign up to get curated job recommendations

XBOW is Hiring for 5 Jobs on Simplify!

Find jobs on Simplify and start your career today

Don't see your dream role? Check out thousands of other roles on Simplify. Browse all jobs