About XBOW

At XBOW, we’re redefining the future of cybersecurity by building the world's first autonomous pentester, powered by AI. Today, the gold standard for securing software systems is human pentesters, but with the rise of artificial intelligence, we’re stepping up to scale offensive security to meet the ever-growing demand.

AI is transforming the landscape of both cybersecurity and cyberattacks. While millions of people without security expertise are creating software, bad actors are using AI to launch more effective attacks. XBOW fights back with AI-driven superpowers, enabling security teams to stay one step ahead.

What makes XBOW truly unique? Like human experts, it forges creative attacks, adapts its learnings, and continuously works to find vulnerabilities faster than anyone ever could. We’re not only simulating threats—we’re also finding and responsibly disclosing real-world vulnerabilities, ensuring organizations can fix issues before they’re exploited. XBOW isn’t just a tool; it’s a transformative force in the secure development lifecycle.

Backed by Sequoia Capital and a team that includes the creators of GitHub Copilot and GitHub Advanced Security, XBOW is not just keeping up with the times—we’re shaping the future of cybersecurity. Our mission is simple: to defeat the bad actors before they strike, using AI to revolutionize how we approach offensive security.

We’re building something that must be built, and we’re the team to do it. Join us in shaping the next frontier of autonomous security.

Your Role: Information Security Analyst, GRC

We’re looking for a detail-oriented, Information Security Analyst to help scale our security and trust function as we grow. In this role, you’ll play a key part in supporting customer and prospect security reviews, coordinating with legal on reviewing customer contracts, assessing third-party vendor risk, supporting resolution of compliance alerts and continuously improving how we identify and manage risk across the business.

This is an individual contributor role with no initial people-management responsibilities. However, as the risk and compliance function matures, there is a clear opportunity for this role to grow in scope and responsibility.

You’ll work closely with IT, Security, Engineering, Legal, Sales, and Customer teams, acting as a trusted partner in communicating our security posture and ensuring we meet customer and regulatory expectations.

What You'll Do

Support customers and prospects by completing technical security questionnaires, risk assessments, and due-diligence requests
Partner with Sales and Customer teams to explain XBOW’s security controls, architecture, and compliance posture
Assess and manage third-party and vendor security risk, including reviews of SaaS providers and service partners
Investigate and resolve alerts to stay compliant with our compliance programmes using the Vanta product.
Help maintain and improve risk assessment frameworks, methodologies, and documentation
Track and support remediation of identified risks in collaboration with internal stakeholders
Contribute to compliance initiatives aligned with frameworks such as SOC 2, FedRAMP 20x, ISO 27001, and ISO 42001
Maintain clear, well-structured risk registers, policies, and supporting evidence
Coordinate risk management sessions and processes
Identify opportunities to streamline and automate risk and compliance processes as the company scales
Support audits, customer reviews, and internal assurance activities as needed

Skills and Qualifications

Essential

7+ years of experience in risk, compliance, security assurance, or related roles
Experience in hands-on technical roles for example in Engineering, IT or operational security
Hands-on experience completing or reviewing technical security questionnaires and customer risk assessments
Familiarity and experience with common security compliance, and data protection frameworks (e.g. SOC 2, ISO 27001, NIST, GDPR, and HIPAA)
Experience conducting or supporting vendor / third-party risk assessments
Strong written communication skills, with the ability to explain complex security concepts clearly
Highly organized and detail-oriented, with a pragmatic approach to risk
Comfortable working in a fast-moving, remote-first startup environment
Familiar with using modern AI tooling to improve productivity whilst managing risk

Advantageous

Experience working in a SaaS or security-focused company
Experience handling Subject Access Requests for GDPR
Security or risk certifications (e.g. CRISC or CISSP)
Knowledge of cloud security best practices

What We Offer

Compensation & Equity: Competitive salary and meaningful stock options.
Growth: Opportunity to learn from and collaborate with top security and AI experts
Impact: Work on complex technical challenges that support the foundation of our company
Remote-First:Work from anywhere, with regular opportunities to meet in person

What Else You Should Know

Location: Remote UK/EU (all team members are remote but we meet regularly and you’re supported to travel to collaborate with colleagues in person)
Contract: Full-time.
Hiring Process:
1. Talent Introduction
2. GRC & Security Knowledge Interview
  - A conversation about your practical security and GRC knowledge and how you apply it in day-to-day compliance work.
3. Hiring Manager Interview
4. Final Interview with a member of our leadership team

We’re a security company that builds with AI at the core - so you’ll be protecting a team that moves fast, iterates aggressively, and lives in the command line. If that sounds like your kind of environment, let’s talk.

About the company

XBOW provides automated web security benchmarks using real-world scenarios with clear success criteria, such as flag capture. It works by generating Python programs that exploit specific vulnerabilities (like XML deserialization) and can deploy embedded bash scripts, while also debugging its own code and the target server environment. It stands apart by sourcing benchmarks from PortSwigger, PentesterLab, and public CTFs, focusing on practical situations rather than puzzles, and by solving challenges without needing pre-defined descriptions. The goal is to offer practical, automated web security practice and evaluation for users seeking realistic penetration testing experiences.

Company Size

201-500

Company Stage

Series C

Total Funding

$272M

Headquarters

Seattle, Washington

Founded

1995

Get referred to XBOW

See people who can refer or advise you

Simplify's Take

What believers are saying

XBOW closed a $35 million extension on May 6, 2026, from Accenture, NVIDIA, Samsung, SentinelOne.
XBOW serves 100-plus customers worldwide, including Moderna, Seznam, and several strategic investors.
XBOW published critical CVEs in Microsoft Bing and Devices Pricing Program during 2026.

What critics are saying

Microsoft can bundle similar testing inside Security Copilot, compressing XBOW's pricing power by 2027.
GPU-heavy autonomous hacking burns cash and limits margins as customers demand cheaper continuous coverage.
A single misuse scandal, exploited customer environment, or regulatory backlash can freeze enterprise adoption.

What makes XBOW unique

XBOW embeds autonomous pentesting into Microsoft Security Copilot and Sentinel, announced March 23, 2026.
Oege de Moor built GitHub Copilot, giving XBOW rare attacker-plus-platform credibility.
XBOW validates exploits, not scans, using agent swarms and real-world benchmark targets.

Help us improve and share your feedback! Did you find this helpful?

Benefits

Company Equity
Remote Work Options
Career Growth

Growth & Insights and Company News

Headcount

6 month growth

25%

1 year growth

2 year growth

The Elec

Oct 15th, 2026

XBOW earns $250K from Google for Chrome vulnerability found by AI in six days

XBOW, an autonomous offensive security company, has earned a $250,000 bounty for reporting a vulnerability in Google Chrome. It is the first payout under Google's Chrome Vulnerability Reward Program this year, the company said on the 14th. XBOW plans to use the money to support NGO security. The flaw let programs run outside the Chrome sandbox when a web page opened. A hacker could have used it to launch attacks such as ransomware or spyware. One security researcher and AI agents found the bug in about six days. Computing costs came to about $40,000. Chief executive officer Ugo de Moor said seemingly low-risk flaws can combine into dangerous attack paths. Defenders, he said, must find them at the attackers' speed.

The Register

Oct 14th, 2026

Security researchers spent 6 days doing their Chromework, built 1B user exploit.

Security researchers spent 6 days doing their Chromework, built 1B user exploit. Xbow earned a $250K bug bounty and all the AI model got was a lousy t-shirt Published Wed 14 Oct 2026 // 19:12 UTC Researchers at security startup Xbow used OpenAI's GPT-5.6 Sol model to help chain three zero-day vulnerabilities in Chrome into an exploit capable of executing code outside the browser's sandbox on Windows machines. Xbow estimates that this could affect about one billion users worldwide. Google fixed all three, and paid the Xbow team a $250,000 bounty, its top reward for a Chrome full-chain exploit. The payout also proves a nice return on investment for the human bug hunters - Brendan Dolan-Gavitt, Andres Luksenberg, Baul Lee, and Willem Pinckaers - who spent just six days during the Black Hat and DEF CON conferences and about $40,000 in token charges to discover the vulnerabilities and build the attack chain. "The number on the check is impressive, but the time it took our team, with the help of a publicly available AI model, to break in is even more impressive," Xbow CEO and founder Oege de Moor said on Tuesday. "A three letter intelligence-agency veteran told me that his team used to spend six months trying to identify this kind of vulnerability and get total access. We did it in six days." In a separate technical writeup about the attack chain, Dolan-Gavitt detailed the work done by humans and AI agents. Agents, using OpenAI's GPT-5.6-Sol model, searched source code, tested the team's hypotheses, and developed proofs of concept and exploit stages, he said. Meanwhile, the AI pen-testing security startup's researchers chose targets, provided context, challenged the agents' results, and decided which attack components to chain. "We did apply a fair bit of our own human expertise and judgment," he wrote. Crossing two security boundaries in 3 steps. Google's Chrome browser uses several layers of security to protect users, and this includes sandboxes - barriers to contain compromised code and ensure that someone who hacks an individual website can't take over the entire computer. This includes deploying the V8 sandbox to prevent any memory corruption flaws in the V8 JavaScript engine from impacting other memory. The V8 sandbox sits inside the operating-system process sandbox, and this nested design means that escaping V8's memory restrictions doesn't automatically grant native code execution. Even if an attacker achieves native code execution inside Chrome's renderer, the outer process sandbox restricts access to the rest of the machine. "The chain crossed both boundaries in three vulnerability stages," abusing Chrome to run code on Windows machines, Dolan-Gavitt wrote. The attack combines a V8 compiler bug, an animated-WebP decoder bug, and a memory-safety bug in Crashpad. The first vulnerability is in Maglev, V8's mid-tier optimizing compiler, and it's due to a reused, mutable boxed number during deoptimization. This gives attackers read and write access throughout V8's pointer-compression cage. The second stage, the animated-WebP bug, is a V8 sandbox escape. "But rather than attacking the sandbox itself we exploited a property that the V8 sandbox deliberately does not enforce and that Blink incorrectly assumed it could trust," Dolan-Gavitt explained. "Finally, the exploit used an overflow in Crashpad to cross the final outer process boundary and achieve unsandboxed code execution on the host." While Google patched all three security issues, and Chrome installs updates on its own, a fix only takes effect once the user relaunches the browser. If you use Chrome, make sure you are running version 152.0.7977.82 or later. The time and money spent to achieve a full chain Chrome exploit illustrate - yet again - that "the bar is significantly lower" for attackers armed with LLMs, Dolan-Gavitt wrote. "Defend accordingly."(R)

WOWTALE

Aug 3rd, 2026

Horizon3 raises $250M Series E at $2B+ valuation to lead the 'AI vs. AI' security era.

Horizon3 raises $250M Series E at $2B+ valuation to lead the 'AI vs. AI' security era. Cyberattacks now move at the speed of AI, and traditional, human-paced defenses are struggling to keep up. As attackers increasingly wield AI of their own, the industry has entered what some call an "AI vs. AI" era - one in which defenders must fight machines with machines. Horizon3, an AI-native proactive security company based in San Francisco, is betting that the best defense is a good offense. Its flagship platform, NodeZero, is an autonomous penetration-testing tool that safely attacks an organization's own production environment. It shows exactly how an adversary would chain together misconfigurations, weak credentials, and identity gaps to compromise critical systems, offers fix guidance, and then instantly verifies that the remediation worked. As it tests, NodeZero can also plant honeypots to catch AI attackers already inside the network. That "attack, fix, verify" loop has driven 120% year-over-year ARR growth. Horizon3 now protects more than 7,000 organizations worldwide, including multinational banks, major healthcare networks, and four Fortune 10 enterprises. The company is FedRAMP High authorized and says it has safely executed 310,000 tests in production environments - the "data moat" it credits for its results. Discover more Stocks & Bonds Foreign Language Resources Horizon3 was founded in 2019 by CEO Snehal Antani and a team of technology and military veterans. Antani previously served as the first CTO of the U.S. military's Joint Special Operations Command (JSOC), and before that as CTO and SVP at Splunk and CIO at GE Capital, beginning his career as a software engineer at IBM. The company announced a $250 million Series E co-led by existing investors NightDragon and NEA. The oversubscribed round drew seven new investors - including Acrew Capital, Sapphire Ventures, Singapore's EDBI, and SAIC - alongside returning backers such as Craft Ventures and Qualcomm Ventures. The round values Horizon3 at more than $2 billion, roughly triple its $650 million valuation at Series D just over a year ago. As part of the deal, Dave DeWalt - founder of NightDragon and former CEO of FireEye and McAfee - and NightDragon managing director Morgan Kyauk will join Horizon3's board. The company plans to use the capital to scale its go-to-market operations, expand into Singapore, Australia, and across EMEA, and build a continuous learning loop between AI attackers and AI defenders, including new autonomous "blue-team" agents that remediate findings directly from NodeZero pentests. A crowded 'AI vs. AI' security market. Capital is pouring into cybersecurity as AI automates both attack and defense. In the offensive, autonomous-pentesting niche where Horizon3 operates, rivals include XBOW and Pentera. On the defensive side, security-automation firm Torq reached unicorn status on a $140 million round, while others race to embed AI across detection, endpoint, and identity. The common thread: as vulnerabilities multiply, the winners will be those that can not just find exploitable problems, but fix them at machine speed.

Premier Media Group

Jul 14th, 2026

Everett company topped region's 2Q VC deals; seattle-area total down from year ago.

Everett company topped region's 2Q VC deals; seattle-area total down from year ago. * john stearns * 21 hrs ago. Everett fusion-energy company Helion recorded the largest fundraising deal in the second quarter in the greater Seattle-Tacoma-Bellevue metropolitan area, according to the latest venture-capital report from Seattle-based PitchBook and the Washington, D.C.-based National Venture Capital Association. Helion in June announced a $465-million Series G investment round to accelerate commercial deployment of fusion, scale manufacturing capacity, and expand the company's ability to deliver clean electricity to customers. The latest deal valued the company at more than $15 billion. The Helion deal comprised almost a third of the $1.5 billion invested in greater Seattle area companies last quarter in about 78 deals. That was up from the roughly $1.2 billion raised in the first quarter in 77 deals, but far below the $2.3 billion from second quarter 2025 in about 100 deals, data showed. Nationally, $143.9 billion was invested last quarter in an estimated 5,039 deals, up from $85.8 billion in second quarter 2025, according to the PitchBook-NVCA Venture Monitor for 2Q 20206. Redmond-based Starcloud, which is developing space-based data centers, reported the greater Seattle area's second-largest deal in the second quarter, raising $170 million and taking its valuation past $1 billion. Seattle-based Xbow, which says it's an autonomous offensive security company redefining cyber defense for the AI era, raised $155 million in Series C financing in the quarter, rounding out the top three deals. Another space-industry company, Starfish Space, a satellite-servicing startup based in Tukwila, raised an estimated $115 million, the fourth-largest deal in the metro area last quarter. Seattle-based Gradial, an agentic AI company focused on transforming enterprise marketing operations, took the No. 5 spot in the quarter, raising $65 million. Other deals included Seattle-based Endurance Energy, which is developing subsea geothermal power, $54 million in a Series A, and Seattle-based Vedana Therapeutics, a biotechnology company developing next-generation therapies for migraine prevention, which reported a $46-million Series A. Commenting on the national VC landscape, Nizar Tarhuni, executive vice president of research and market intelligence at PitchBook, said in a statement, "SpaceX's IPO was the first of three potential trillion-dollar listings by US VC-backed companies in 2026, and what many want to view as the opening of an IPO window. The scale of these companies is their differentiating factor, though, largely boxing out the rest of VC from public markets." "The pipeline of companies in IPO registration remains low, and broad liquidity hasn't yet returned, leaving exit value very concentrated through Q2, and very likely through the rest of 2026," he continued Tarhuni. "The same concentration is showing up in how capital gets raised: nearly half of all H1 (first half 2026) capital commitments went to just three firms, and managers with track records pulled in more than nine out of every 10 dollars deployed into venture funds. LPs aren't spreading bets anymore - they're consolidating around track records and brands, a response to five years of thin distributions. This year's numbers will look like a recovery, but for most of the industry, it likely won't feel like one." In a separate statement, Bobby Franklin, president and CEO at NVCA, said, "The second quarter reinforced an emerging trend: capital is flowing back into American innovation with real force. Investment activity is picking up, fundraising is improving, and there are early signs the IPO market is beginning to reopen. AI continues to drive much of the market's momentum, even as investment and fundraising remain concentrated across a relatively small number of companies and funds. Healthier IPO and M&A markets will be critical to unlocking value, restoring liquidity, broadening access to capital, and supporting the next generation of American innovators across the country."

Xbow

May 7th, 2026

XBOW Secures Additional $35M from Strategic Investors, Including Select Customers and Ecosystem Partners

Accenture Ventures, DNX Ventures, Liberty Global, NVentures, Samsung, and SentinelOne Back Rising Demand for Continuous Offensive Security

XBOW

Information Security Analyst - GRC

About the job