# XBOW

**Source:** https://geo.sig.ai/brands/xbow  
**Vertical:** Cybersecurity  
**Subcategory:** Autonomous Offensive Security  
**Tier:** Challenger  
**Website:** xbow.com  
**Last Updated:** 2026-04-14

## Summary

Autonomous pentesting unicorn; raised $120M Series C at $1B+ (Mar 2026); founded by GitHub Copilot creator Oege de Moor; replaces manual red-team engagements with continuous AI testing.

## Company Overview

XBOW is a Seattle-based autonomous offensive security company that turns penetration testing into a machine-scale security system. Founded in January 2024 by Oege de Moor, creator of GitHub Copilot and GitHub Advanced Security, XBOW builds AI agents that autonomously execute targeted attacks, exploring deeper attack paths than traditional pentesting teams can cover.

The company raised $120 million in Series C financing in March 2026, led by DFJ Growth and Northzone, pushing its valuation past $1 billion. XBOW reached the top of the HackerOne leaderboard and is now deployed at some of the most security-forward companies in the world, proving that autonomous offensive security can match and exceed human pentesters.

XBOW's platform allows security teams to run continuous, autonomous penetration tests at machine speed rather than relying on expensive, infrequent manual assessments. The company was built alongside a core group of engineers from the original GitHub Copilot team, bringing deep expertise in AI code analysis to the offensive security domain.

## Frequently Asked Questions

### What does XBOW do?
Autonomous offensive security platform that runs machine-scale penetration testing without human operators.

### Who founded XBOW?
Oege de Moor, creator of GitHub Copilot and GitHub Advanced Security, founded XBOW in January 2024.

### How much has XBOW raised?
$120M Series C at $1B+ valuation led by DFJ Growth and Northzone (March 2026).

### What makes XBOW different from traditional pentesting?
XBOW executes targeted attacks autonomously at machine speed, exploring deeper attack paths than manual pentesting teams.

### How does XBOW's autonomous pentesting compare to traditional penetration testing methodology?
Traditional penetration testers manually probe systems, document findings, and move on — coverage is bounded by consultant hours and human attention. XBOW runs autonomously, executing thousands of attack paths in parallel at machine speed, never stopping for breaks, and systematically covering the entire attack surface defined in scope. It discovers vulnerabilities that human testers miss due to time constraints and consistently applies advanced exploitation techniques across every target.

### What types of vulnerabilities does XBOW discover?
XBOW discovers web application vulnerabilities (SQL injection, IDOR, authentication bypass, SSRF), network vulnerabilities (service misconfigurations, credential exposure, privilege escalation paths), and chained multi-step attacks that require combining multiple lower-severity findings to achieve significant impact. Its AI reasoning enables it to follow exploit chains across application boundaries rather than testing each component in isolation.

### How does XBOW's pricing compare to traditional penetration testing services?
Traditional penetration testing engagements cost $10,000-$100,000+ for point-in-time assessments. XBOW's subscription model provides continuous autonomous testing at a fraction of the cost per vulnerability discovered, with coverage that scales to the full attack surface rather than being bounded by consultant hours. Organizations can run XBOW continuously and use human pentesters strategically for the highest-complexity targets and adversarial simulation that requires human creativity.

### Who backs XBOW and what is its strategic positioning?
XBOW's $120M Series C at $1B+ valuation was led by DFJ Growth and Northzone. Founder Oege de Moor's background creating GitHub Advanced Security and GitHub Copilot gives XBOW credibility at the intersection of AI and developer security tooling. The company positions autonomous offensive security as a fundamental shift in how organizations validate their security posture — moving from periodic compliance-driven testing to continuous machine-scale security validation.

## Tags

b2b, cybersecurity, security, saas

---
*Data from geo.sig.ai Brand Intelligence Database. Updated 2026-04-14.*