XBOW funding, valuation and investors

Overview

XBOW is a Seattle-based autonomous offensive security company founded in January 2024 by Oege de Moor (former GitHub Next VP). Its platform uses AI reasoning and adversarial workflows modeled on real attack techniques to continuously identify, exploit, and validate vulnerabilities — replacing point-in-time manual pentests with machine-speed coverage. XBOW offers Plus, Premium, and Enterprise tiers, including continuous scanning via API integrations. The company raised $120M in Series C financing in March 2026 led by DFJ Growth and Northzone at over $1B valuation, bringing total funding to approximately $237M.

Why XBOW is interesting

Founded by GitHub veteran Oege de Moor, XBOW became the first autonomous system to top HackerOne's U.S. leaderboard — then raised $120M Series C at $1B+ to sell continuous AI pentesting to enterprises.

Product & use cases

AI-driven autonomous pentesting platform that runs reconnaissance, exploitation chains, and validation continuously across application portfolios — with Plus/Premium one-time scans and Enterprise continuous monitoring.

• Continuous vulnerability validation for fast-moving SaaS codebases
• Replacing annual manual pentests with always-on offensive testing
• Streaming pentest results into SIEM and vulnerability management via API
• Proving exploitability to reduce false positives from traditional scanners

Key facts

• Series C (Mar 2026): $120M led by DFJ Growth and Northzone at $1B+ valuation; ~$237M total raised (BusinessWire, SecurityWeek)
• First autonomous system to reach #1 on HackerOne U.S. leaderboard (XBOW blog, Help Net Security)
• Founded Jan 2024 by Oege de Moor, former GitHub Next VP and Semmle founder (SecurityWeek)
• Enterprise tier offers continuous scanning; Plus/Premium for one-time application assessments (SiliconANGLE)

Funding history (newest first)

Investors in our directory

Funds linked from XBOW's profile — open a fund page for stage focus and related deal articles.

Competitive landscape

Edge: Validates findings through real exploitation chains — demonstrated by reaching #1 on HackerOne's U.S. leaderboard as an autonomous system, not a human researcher.

Offensive security is shifting from annual consultant-led pentests to continuous validation as attack surfaces expand with SaaS sprawl and AI-driven threats. XBOW leads on public proof points (HackerOne ranking) but faces enterprise procurement cycles and safety concerns running autonomous exploits in production environments.

• Synack adjacent

  Crowdsourced human researcher platform — higher touch and slower than continuous AI agents.

• Horizon3.ai (NodeZero) direct

  Autonomous penetration testing for enterprises — similar continuous validation thesis with different agent architecture.

• Pentera direct

  Automated security validation platform — competes for continuous testing budgets vs point-in-time audits.

Notable stories

• When Oege de Moor founded XBOW in January 2024, few believed AI could think like a hacker at machine speed — the HackerOne #1 ranking became the public proof point before Series C (SecurityWeek, Mar 2026).
• DFJ Growth venture partner Ramin Sayar, former Sumo Logic CEO, joined XBOW's board at Series C to help scale enterprise go-to-market (BusinessWire).

Industries

Related funding articles

Venture Capital Tracker pieces that cover XBOW's financing or category context.

• XBOW's $120M Series C: Autonomous Pentesting Moves Into the Enterprise
• Seattle Startups We Cover 2026: Enterprise, AI Infra, Space & Defense