XXBOW

XBOW is an autonomous penetration tester. Point it at a web application and its AI agents look for vulnerabilities, chain them the way an attacker would and try to exploit them, reporting only findings backed by a working exploit. In June 2025 it reached number one on the HackerOne leaderboard, outscoring thousands of human hackers on real bug bounty programs. It is best for companies that need pentests more often and faster than a consultancy can deliver them.

A self-service test starts at $4,000 with results within five business days, which XBOW contrasts with the $10,000 to $35,000 or more and 35 to 100 days that traditional pentests often take. Continuous coverage is quoted, and the product focuses on application testing rather than a full red team engagement. This review is based on XBOW’s published product pages, pricing and announcements as of October 2026; we have not tested it hands-on.

Bug Bounty Results XBOW Earned in Public

XBOW publishes more evidence of real-world performance than most AI security startups, largely because it competed publicly on bug bounty platforms. Each item below was checked on the source page.

For a buyer, the HackerOne result is the most useful number because it was earned on real programs run by other companies, not on a vendor benchmark. It suggests the agents find issues that matter to bug bounty triagers, who reject noise. The 14,000 zero-day count is XBOW’s own figure and is harder to compare.

The price gap is the second reason to look. If XBOW’s comparison holds for your applications, a team that tests once a year with a consultancy could test several times a year for a similar budget. The funding and the Copilot pedigree reduce the risk of the company disappearing mid-contract.

On-Demand Tests and a Continuous Platform

XBOW sells two ways of using the same autonomous hacker: Pentest On-Demand, a self-service test you start when you need it, and a continuous platform that keeps testing your applications rather than producing an annual snapshot.

Running a Test

1. Point it at a target. You give XBOW the URL of the application to test. There are no scoping calls or kickoff meetings for on-demand tests.
2. Agents explore and attack. Autonomous agents discover the attack surface, look for vulnerabilities and chain them together, using AI reasoning and adversarial workflows modeled on real attack techniques.
3. Findings are proven. XBOW attempts real exploitation and reports a finding only when it has a working proof-of-concept exploit, which it says keeps false positives low.
4. You get a report. Results arrive within five business days, with validated, reproducible findings, mitigation steps for each and documentation suitable for security, external review and audit teams.
5. Fixes are retested. Once developers remediate an issue, integrated retesting confirms the fix.

Continuous Testing

The platform version tests on a rolling basis instead of in a scheduled window, so new releases get checked without waiting for next year’s pentest. XBOW prices it on usage and coverage, and customers can buy it through cloud marketplaces.

On-Demand or Continuous

The two options suit different situations. On-demand testing fits a team that needs a report for an audit, a customer security review or a major release, and wants a known price per test. The continuous platform fits companies that ship code every week and want testing to keep pace, accepting a quoted, usage-based bill in exchange for ongoing coverage. A common path is to start with one on-demand test, judge the quality of the findings against previous human pentests, and then decide whether continuous coverage is worth a quote.

Who Trained It

XBOW pairs its autonomous system with experienced human hackers. CISO Nico Waisman built a team of them to teach the system how real attackers think. XBOW also appears on Microsoft’s MSRC leaderboard.

Scope, Production Sign-Off and Fixes Stay With You

Your team decides what to test and when, signs off on testing production systems, and fixes what XBOW finds. XBOW does not cover social engineering, physical security or internal business logic it cannot see from the outside, and findings still need triage by engineers who know which systems matter most.

A Published Test Price and a Quoted Platform

XBOW publishes a starting price for on-demand tests and quotes the continuous platform.

A Startup Preparing for an Audit

Startup preparing for an audit. One on-demand test at the $4,000 starting price, with retesting of fixes included. By XBOW’s own comparison, a traditional pentest often costs $10,000 to $35,000 or more and takes 35 to 100 days to schedule and report. BloomPath, one of XBOW’s named customers, said the product helped speed its SOC 2 readiness.

Quarterly testing of one application. Four on-demand tests a year at the starting price come to $16,000. Four traditional tests at the $10,000 to $35,000 range XBOW cites would be $40,000 to $140,000. Larger or more complex applications may cost more than the starting price.

Enterprise with many applications. Continuous coverage is priced by usage and scope, so request a quote and ask how cost scales with the number of applications and test frequency. Buying through a cloud marketplace can draw down committed spend you have already agreed.

Comparing quotes. When you compare XBOW with a consultancy, line up the same scope: number of applications, authenticated versus unauthenticated testing, retests included and report format. A lower headline price only matters if the test covers what your auditor or customer expects to see.

Hidden and variable costs. Engineering time to fix findings is the real cost of any pentest, and a faster tester will produce more work for developers. Budget for remediation, and agree testing windows so production teams are not surprised.

XBOW Compared With CrowdStrike Charlotte AI, Microsoft Security Copilot and Dropzone AI

XBOW sits on the offensive side of security, while the other cybersecurity agents on our site defend: they triage and investigate alerts in a security operations center. The table shows how they differ so buyers can see which job each one does. The closest like-for-like alternative to XBOW is still a traditional human-led pentest.

Many companies will want one of each: an offensive agent such as XBOW to find weaknesses before attackers do, and a defensive agent to handle alerts when something gets through. If budget allows only one, choose by your bigger gap. Teams with untested applications and audit deadlines should start with XBOW; teams with a SOC drowning in alerts should start with a triage agent. See more on our cybersecurity agents page.

Audit-Bound Startups and Fast-Shipping Product Teams

• Startups facing audits or customer security reviews: a $4,000 starting price and five-day turnaround suit teams preparing for SOC 2; see our startup agents page.
• Product teams that ship often: continuous testing checks new releases without waiting for an annual pentest window.
• Security teams with more applications than pentest budget: lower per-test cost lets you test applications that never made the annual list.
• Enterprises with cloud commitments: marketplace buying through AWS, Google, Oracle or Microsoft can use existing spend; see our enterprise agents page.
• Teams tired of noisy scanners: findings come with working exploits, so engineers spend less time chasing false positives.

Full Red Team Needs and Alert Triage Seekers

• Organizations needing a full red team: social engineering, physical intrusion and insider scenarios need human testers.
• Teams that need help with alert triage, not testing: a defensive agent such as Dropzone AI or Charlotte AI fits that job.
• Buyers who need a fixed, published subscription price: continuous coverage is quoted.
• Very small sites without a security owner: someone has to approve scope and fix what the test finds.

Exploiting Live Systems and Vendor Figures

• Testing live systems: real exploitation against production can have side effects, so agree scope, timing and contacts with engineering before each test.
• Vendor figures: the 14,000 zero-day count, 150-plus security teams and price comparison with traditional pentests come from XBOW.
• Integration detail: XBOW could add more detail on ticketing or CI/CD integrations to its product pages, so confirm how findings reach your developers.
• Auditor acceptance: reports are described as compliance-ready, but check with your auditor whether an AI-run pentest meets your framework’s requirements.
• Remediation load: more frequent testing means more findings, so plan developer time to fix them.

Accenture and NVIDIA Join the Series C

On May 6, 2026, XBOW added $35 million to its Series C from strategic investors including Accenture Ventures, NVIDIA’s NVentures, Samsung Ventures and SentinelOne S Ventures. On March 18, 2026, it raised a $120 million Series C at a valuation above $1 billion, led by DFJ Growth and Northzone, with Ramin Sayar joining the board; SecurityWeek reported total funding of $237 million.

On November 13, 2025, XBOW launched Pentest On-Demand, a self-service autonomous pentest starting at $4,000 with results in five business days.

For Companies That Need More Pentests Than They Can Buy

For companies that need application pentests more often than they can afford to buy them from a consultancy, yes. XBOW scores 8.4/10 on our scale. It is one of the few security agents that completes the whole job on its own, from discovery to proven exploit to retest, and its number one HackerOne ranking in June 2025 is public evidence that the approach finds real issues. The $4,000 starting price makes it easy to trial on one application.

The score reflects limited public detail on integrations and controls so far, quote-only pricing for continuous coverage and no public user ratings yet. Start with one on-demand test on a non-critical application, compare the findings with your last human pentest, and check with your auditor before relying on it for compliance.

What XBOW Will and Will Not Test

How Much Does an XBOW Pentest Cost?

Pentest On-Demand starts at $4,000 per test and includes validated findings, mitigation steps, retesting and compliance-ready documentation. Continuous coverage uses usage-based pricing that XBOW quotes for your environment.

How Long Does an XBOW Pentest Take?

XBOW says on-demand tests deliver complete results within five business days, with no scoping calls or kickoff meetings. It contrasts that with 35 to 100 days for many traditional pentests.

Did XBOW Really Beat Human Hackers on HackerOne?

XBOW reached number one on the global HackerOne leaderboard in June 2025, ahead of thousands of human hackers working on real bug bounty programs. That ranking reflects accepted vulnerability reports, not a lab benchmark.

Can XBOW Replace a Human Penetration Tester?

For many application tests it can do the discovery, exploitation and retesting on its own. It does not cover social engineering, physical security or scenarios that depend on inside knowledge, and your team still sets scope and fixes findings.

Who Founded XBOW?

XBOW was founded by Oege de Moor, who created GitHub Copilot and GitHub Advanced Security. Its CISO, Nico Waisman, previously led security at Lyft, and core engineers came from the original Copilot team.