XBOW (Seattle, founded Jan 2024 by Oege de Moor of GitHub Copilot/CodeQL lineage; CISO Nico Waisman, ex-Lyft) is a fully autonomous offensive-security platform: it attacks web applications and APIs "like an elite human attacker," returns only validated, exploitable findings — each with a working exploit, request/response evidence, repro steps, the chained attack path, and a full decision log — and chains individual flaws into attack chains scanners can't reach (xbow.com). The credibility arc: first AI to pass 75% of web-security benchmarks autonomously (2024, ~$20M from Sequoia); #1 on HackerOne's US leaderboard on June 24, 2025 — the first autonomous system ever to top it — with ~1,060 submitted vulnerabilities (TechRepublic, HN discussion, hackerone.com/xbow). Funding now: $120M Series C at $1B+ valuation (Mar 18, 2026, DFJ Growth + Northzone; Sofina, Alkeon, Altimeter, NFDG, Sequoia participating; $237M raised to date at that point), a ~$35M extension (May 6, 2026) including a strategic Accenture investment — roughly $270M total. Customers: 200+ security teams; a Fortune 50 ran 180 apps in a month for 1,216 validated findings; Moderna, Superhuman, Seznam, a top-5 US bank. 2026 trophies: Google's first $250K Chrome full-chain reward of 2026 (V8 → Animated-WebP decoder → Crashpad sandbox escape, six days, ~1B users affected — AFP), three independent critical CVEs, a Microsoft MSRC leaderboard rank, and a Fast Company "Next Big Things in Tech" win (Oct 2026).
Three public descriptions converge (#1 post, product page, model-eval blog):
exec → execFile); after the fix ships, a free unlimited retest re-runs the exploit and marks it fixed. Continuous, CI/CD-cadence testing rather than annual pentest.Their model-eval methodology is the quiet masterpiece: they rank frontier models by plugging them into the XBOW orchestration and counting validated vulns found in live apps frozen at versions where real CVEs existed — an end-to-end agentic eval (browser use, script execution, both raw API and inside Claude Code). Latest result: Claude Mythos Preview > Opus 4.6 > GPT-5.5, Mythos cutting false negatives 42% (55% with source); but cost-normalized, cheap models given more attempts matched Mythos per dollar — the single most important data point for a small-model strategy like ours.
SaaS console + Public API (Mar 30, 2026, public preview — programmatic assessments, findings, webhooks, launch post) — the "bolt-on" motion: embed XBOW scans into your DevTools/CI pipeline. Jira integration, EU data residency, Microsoft Security Copilot integration + APAC expansion (Apr 2026), AWS Marketplace listing. Compliance wall: SOC 2, ISO 27001, ISO 42001, PCI DSS, NIS 2; customer-defined scopes, protected URLs, rate limits, command checker blocking destructive actions, "no model training on customer data." Pricing: published $4,000 "Lightspeed" tier retired Jul 2026 in favor of usage-based enterprise quotes (CodeAnt) — moving upmarket, away from self-serve.
Strengths: verification-first loop (false positives are the category killer and they solved it); benchmark-as-GTM (leaderboard #1 → unicorn in 9 months); exploit chaining; continuous attack→fix→verify; enterprise trust posture; frontier-model-agnostic harness that improves with every model release. Limits: web/HTTP(S) application layer only — no network protocols, infra, physical, or social engineering (MAPTA's scope critique); static-target focus — frozen known-vuln apps and scoped bug-bounty targets, not live adaptive adversaries; business-logic flaws hard to distinguish from intended behavior (false negatives); closed system, closed models — MAPTA flatly notes XBOW "lacks scientific reproducibility"; and their own eval shows the raw-model edge erodes per-dollar against cheaper models given more attempts.
Direct product overlap: none. XBOW sells cloud-run autonomous scanning to enterprise security teams with compliance paperwork; we build a local, open-weight copilot for a human operator, trained on self-generated environments. Their motion commoditizes autonomous web scanning — a market we should explicitly not enter (their $270M and Mythos-class harness win it). Real threats: (1) mindshare capture — "AI pentesting" now means XBOW to enterprise buyers, so our framing must be copilot/operator-augmentation, purple loops, local data; (2) talent/model gravity — they benchmark every frontier model the day it ships (their eval blog is the best free model-selection intel in offensive security); (3) if they ever distill a local/bolt-in agent for regulated air-gapped buyers, they'd land on our flank — no public sign of it as of Nov 2026. Their 104-challenge benchmark, meanwhile, is free eval infrastructure for our models.
The verification-first agent loop is the transferable core: hypothesis → probe live system → exploit → programmatic validator (headless browser proving payload execution) before anything is counted; "PoC || GTFO" as the only pass criterion; action budgets per task; validators-as-peer-reviewers to crush false positives; attack→fix→free verify-retest as the retention loop; end-to-end agentic model evals ranked by validated findings, reported cost-normalized (their own table shows cheap-models-with-more-attempts parity — our exact thesis). Also copy benchmark-as-GTM: one public leaderboard win bought them the category.
Primary sources: xbow.com · #1 post · model-eval blog · Public API · SecurityWeek Series C · MAPTA arXiv:2508.20816
See also: [[bugcrowd-rl-environments]] · [[uk-aisi-open-weights-cyber]] · [[htb-ai-range]] · [[landscape-2026]]