AI penetration testing agents attracted real capital in 2026. RunSybil closed a US$40 million round led by Khosla Ventures in March, MindFort announced a US$3 million seed in April, and Hacktron raised a US$2.9 million pre-seed led by Crane Venture Partners. The category sits inside a penetration testing market that Mordor Intelligence sizes at US$2.72 billion in 2026, growing to US$5.54 billion by 2031 at a 15.29% CAGR.
That capital has produced a crowded shortlist and little apples-to-apples information. Several of these companies are barely a year old, and some publish almost nothing about who they are or what they charge.
This is a comparison, not a ranking. Nothing here is numbered or ordered by quality. Stingrai Snipe appears first as the reference point, and the seven startups follow alphabetically. Facts absent from a vendor's own site are recorded as not published rather than guessed.
Comparison at a Glance
Vendor | HQ | Founded | Primary scope | Delivery model | Pricing |
|---|---|---|---|---|---|
Stingrai Snipe | Toronto and London | 2021 | Web apps and APIs | Agent, or agent plus penetration testers | Published |
Casco | United States | 2025 | Web, APIs, infra, AI systems | Autonomous, optional supervision | Not published |
Hacktron AI | Not published | 2025 | Code, pull requests, APIs | Autonomous, inside code review | Published |
MindFort | San Francisco | 2025 | Web, APIs, source code | Fully autonomous | Published |
Penligent | Not published | Not published | Web and APIs, black box | Agentic, operator directed | Published |
RunSybil | San Francisco | 2023 | Web, API, cloud | Autonomous and continuous | Not published |
strike.sh | Not published (Uruguay) | 2021 | Web, APIs, mobile, cloud | AI-led, with human validation | Not published |
ThreatSpike | London | 2011 | Web, network, cloud, red team | Human-led, inside a subscription | Published |
Stingrai Snipe
What it is. Stingrai's autonomous AI agent for web application penetration testing, delivered as an engagement rather than licensed as a tool.
HQ and founded. Toronto, Canada, with a London, UK office. Founded 2021.
What it tests. Web applications and their APIs, in black-box testing and white-box source review. Snipe targets the classes generic scanners miss: IDOR, business logic and broken authorization, and is trained on more than 6,000 HackerOne Hacktivity reports plus Stingrai's own methodology.
Delivery model. Autonomous runs Snipe alone. On Hybrid, Stingrai's penetration testers work at the same time as Snipe throughout, directing where it focuses and extending the attack paths it opens. Both are sold one-time annually or as a continuous program.
Published pricing. Yes, on the pricing page. Autonomous is USD 3,000 per assessment or USD 450 per month; Hybrid is USD 6,800 or USD 1,275 per month. Each covers exactly one web application and its APIs; larger scopes are quoted through the Get a Quote form. A "No High or Critical Finding = Don't Pay" guarantee applies to the Autonomous tier.
Evidence of depth. Firm-level CREST accreditation as a penetration testing service provider, 18 published CVEs, research presented at DEFCON and BSides, and 5.0 out of 5.0 across 19 Clutch reviews.
Compliance and reporting fit. Reports support SOC 2, ISO 27001, PCI DSS 4.0, HIPAA, NIST 800-53, DORA and NIS2. Snipe opens AutoFix pull requests and can gate every pull request in CI.
Consider it when. You want authorization and business logic depth, penetration testers on the engagement, and the price up front.
Casco
What it is. An autonomous testing platform with an optional supervised tier, from a Y Combinator company founded by two former AWS security leaders.
HQ and founded. Founded 2025. Its CREST Marketplace listing records the company in the United States with fewer than ten employees.
What it tests. Web applications, APIs, cloud infrastructure and AI systems, mapped to the OWASP Top 10, API, LLM and Cloud lists and the Agentic Threat Model.
Delivery model. Autonomous by default. Casco Supervised adds security engineers who scope the test and verify every finding, with turnaround inside five business days.
Published pricing. Not published. The site states pricing is based on the scope of the test.
Evidence of depth. No published CVEs, original research or benchmarks. An OWASP Gold Sponsor, naming customers including Gusto, Spreedly and CrewAI.
Compliance and reporting fit. An initial report, a remediation report after retesting, and attestation letters. Casco holds SOC 2 Type 2 and a CREST accreditation.
Consider it when. You want an agent-first test with a credentialed human check on the same engagement.
Hacktron AI
What it is. An autonomous agent that reviews every pull request and reports only vulnerabilities it can demonstrate with a working exploit.
HQ and founded. Founded 2025 by Harsh Jaiswal, Zayne Zhang and Mohan Pedhapati. HQ is not published. Funding is a US$2.9 million pre-seed led by Crane Venture Partners.
What it tests. Source code and pull requests, with API and codebase coverage. Testing is anchored in the codebase, not a running application.
Delivery model. Autonomous, embedded in the development workflow rather than run as a scheduled engagement. Human review before delivery is not published.
Published pricing. Yes. Pro is USD 40 per developer per month for 50 pull requests, with extras at USD 1 each. Open source projects are free.
Evidence of depth. Published advisories include a pre-authentication RCE in BeyondTrust Remote Support, plus CVEs in PAN-OS GlobalProtect, OpenAM and WordPress. The team has DEF CON CTF wins and Black Hat talks. Customers include Perplexity and Supabase.
Compliance and reporting fit. Not published as an audit deliverable. This is a code security product, not a report for your auditor.
Consider it when. You want bugs caught before merge and fixed in engineering, not in a compliance binder.
MindFort
What it is. A platform the company describes as fully autonomous red teaming and patching, from a Y Combinator team with backgrounds at ProjectDiscovery, NetSPI and OpenAI.
HQ and founded. San Francisco, founded 2025. Funding is a US$3 million seed led by Soma Capital.
What it tests. Live web applications and APIs, source code through static and dynamic analysis, business logic and attack surface mapping.
Delivery model. Fully autonomous, with no human review step published. Agents find, validate and fix, opening pull requests automatically and retesting the patch.
Published pricing. Yes, metered in credits. Growth is USD 199 per month for 400 credits and two pentests; Scale is USD 999 for 800 credits and four.
Evidence of depth. Internal benchmarks report pass@1 and pass@3 results against OWASP Juice Shop in the 31% to 52% range. Third-party benchmarks and CVEs are not published.
Compliance and reporting fit. Not published.
Consider it when. You want autonomous testing tied to a fix pipeline, and no human signature on the report.
Penligent
What it is. An agentic tool that orchestrates more than 200 existing security tools through a single agent, from asset discovery through exploitation to reporting.
HQ and founded. Not published. The site footer attributes the product to Future Share LLC.
What it tests. Web applications and APIs in black box mode, covering injection, IDOR, authentication bypass, CSRF and broken authentication.
Delivery model. Agentic and operator directed. The vendor states it does not rely on manual review for every critical finding, and that teams can steer the agent.
Published pricing. Yes, including a free tier. Pro is USD 39.92 per month billed annually with 6,000 credits; Team and Enterprise are custom.
Evidence of depth. No published CVEs, third-party benchmarks or named enterprise customers. The core agent is not open source.
Compliance and reporting fit. Reports are marketed as SOC 2 ready and ISO 27001 aligned, exportable as PDF or Markdown.
Consider it when. You want an agent to accelerate your own team's testing at a low licence cost.
RunSybil
What it is. Sybil, an AI agent that runs continuous autonomous penetration tests against live applications. RunSybil has raised the largest disclosed round of the seven startups here.
HQ and founded. San Francisco, founded 2023 by Ari Herbert-Voss, OpenAI's first security researcher, and Vlad Ionescu, formerly head of offensive security at Meta. Funding is US$40 million led by Khosla Ventures.
What it tests. The web and API attack surface: authenticated functionality, access control including IDOR and privilege escalation, business logic, injection and multi-tenant isolation, plus cloud, IAM and CI/CD.
Delivery model. Autonomous and continuous, triggered on deployment. A human validation step is not published. Retests complete in under an hour.
Published pricing. Not published.
Evidence of depth. An engineering blog with substantive AI security research, including a June 2026 post on reproducing leading AIxCC results with general access models for about US$600. No published CVE portfolio. Customers include Notion, Cursor and Carta.
Compliance and reporting fit. Findings carry CWE IDs and CVSS 3.1 scores with request and response pairs, exportable as PDF, CSV, JSON and MCP. The company states customers have satisfied SOC 2 Type II and ISO 27001 audits using Sybil's output.
Consider it when. You want continuous autonomous coverage of a live product and can negotiate pricing.
strike.sh
What it is. A PTaaS platform that pairs AI-led test execution with human validation, aimed at continuous coverage rather than point-in-time engagements.
HQ and founded. Founded 2021 by Santiago Rosenblatt and Facundo Lopez Juncal. Uruguayan, with no headquarters address published. The about page cites US$13.5 million raised.
What it tests. Web applications, APIs, mobile and cloud, alongside attack surface management, automated scanning and phishing monitoring. Manual pentesting is an add-on.
Delivery model. Hybrid, and unusually explicit. Strike states AI agents report up to 80% of the findings its human researchers discover, and that human triage is mandatory before delivery.
Published pricing. Not published.
Evidence of depth. No published CVEs or third-party benchmarks. Aggregate claims include 97% precision and more than 6,000 critical vulnerabilities reported. Customers include Santander, Mercado Libre and Okta.
Compliance and reporting fit. Audit-ready reports formatted for PCI DSS, HIPAA, ISO 27001 and SOC 2. The company holds ISO 27001 and SOC 2, and states plainly that it does not issue those certificates itself.
Consider it when. You want continuous validation across a mixed estate with a human check on every finding.
ThreatSpike
What it is. The outlier here. ThreatSpike bundles managed IT, defensive security, a 24/7 SOC and offensive security into one subscription. Its AI sits in operations, not the penetration test.
HQ and founded. London, founded 2011 by Adam Blake and Kate Blake, with offices in New York, Paris and Dubai and around 80 staff.
What it tests. Web application, network, infrastructure, API, cloud, red team, social engineering, IoT and OT, mobile, source code review and Wi-Fi.
Delivery model. Human-led. The company states its CREST-accredited testers average more than ten years' tenure, and that testing is unlimited within the subscription.
Published pricing. Yes. All testing types are included at USD 135 per user per month, with no day rates and no per-test fees.
Evidence of depth. Testers hold OSCP, OSWE, CISSP, CREST CRT and CREST CPSA. The company reports more than 350 customers across 90 countries. Published CVEs are not listed.
Compliance and reporting fit. Compliance-aligned engagements across more than 15 regulatory frameworks, delivered by a CREST-certified provider.
Consider it when. You want IT and security outsourced together, with unlimited human-led testing.
How to Evaluate an AI Penetration Testing Vendor
The category is young enough that marketing outruns evidence. Six questions separate the products quickly.
Who verifies the findings, and when. An agent that ships raw output, an agent whose findings a human checks before delivery, and an engagement where penetration testers test alongside the agent are three different products. Put the answer in the statement of work.
Business logic and authorization coverage. Most AI tools are strong on the known-class floor and weak above it. Broken object level authorization, privilege escalation across tenants and workflow abuse are where breaches live. Ask for a redacted finding in each class.
Scope beyond the OWASP Top 10. A vendor that maps only to the Top 10 is telling you where it stops. Check whether the agent tests authenticated multi-role functionality, chains findings, and reaches your APIs.
Retests, and what they cost. Fixes break. Confirm retesting is included, how fast it runs, and whether it is capped. Some vendors include same-hour retests; others meter them.
Auditor acceptance. Your auditor cares about methodology, scope statement, tester credentials and evidence. Our guide to pentest evidence auditors accept covers what gets signed off.
Published pricing and accreditation. Five of the eight publish a price, a reasonable proxy for how procurement will go. Firm-level accreditation such as CREST is audited, not self-declared. See also how to verify AI vulnerability discovery claims, our 2026 guide to AI pentesting tools, and the pentest cost calculator.
Frequently Asked Questions
Which AI penetration testing vendor should I choose in 2026?
There is no single answer, because these vendors sell different things. Choose Stingrai Snipe for an autonomous agent that hunts authorization and business logic flaws, with penetration testers testing alongside it and prices published up front. Choose Hacktron AI for exploitable bugs caught at pull request time. Choose MindFort or RunSybil for continuous autonomous coverage, and ThreatSpike for unlimited human-led testing inside a managed platform.
How much do AI penetration testing tools cost in 2026?
Published prices run from USD 0 for Penligent's free tier to USD 999 per month for MindFort's Scale plan, with Hacktron at USD 40 per developer per month and ThreatSpike at USD 135 per user per month. Stingrai is USD 3,000 per assessment or USD 450 per month for Autonomous, and USD 6,800 or USD 1,275 per month for Hybrid, each covering one web application and its APIs. Casco, RunSybil and strike.sh do not publish pricing.
Are AI penetration testing findings accepted by SOC 2 and ISO 27001 auditors?
Findings are accepted when the report carries a clear scope statement, a stated methodology, reproducible evidence and identifiable tester credentials. Which agent found the issue matters less than the evidence around it. A testing vendor supports your audit, while the certificate or attestation comes from your assessor.
Can an AI agent find business logic and authorization flaws?
Generic AI scanners largely do not, which is why business logic remains the most cited gap in AI security tooling. Purpose-built agents are a different case. Snipe is trained on more than 6,000 HackerOne Hacktivity reports and on Stingrai's own methodology to reach IDOR, broken authorization and business logic. Ask any vendor for a redacted example.
What is the difference between an autonomous AI pentest and a hybrid pentest?
An autonomous pentest runs the agent alone and delivers what it produces. A hybrid pentest puts penetration testers on the same engagement at the same time as the agent, directing where it focuses and pursuing what it surfaces. Hybrid costs more and reaches further into chained and workflow-specific issues.
Do these vendors replace an annual penetration test?
Some are built for continuous coverage and some for point-in-time assurance, and plenty of buyers need both. Stingrai delivers either a one-time annual penetration test or a continuous year-round program at the same published prices. If your driver is an audit deadline, confirm the report will be dated, scoped and acceptable to your assessor.
Where This Leaves You
The honest summary of this category in 2026 is that the technology has outrun the evidence. Two of these companies have a published CVE record and conference research behind them. Five publish a price. Most were founded in the last eighteen months.
That is not an argument against AI penetration testing. It is an argument for buying it like any other assurance service: check who verifies the findings, ask for proof in the classes that cause breaches, and confirm the report will survive your auditor.
To see an agent run against your own application with penetration testers working alongside it, book a 30-minute demo and requirements consultation with our founder, or send your scope through the Get a Quote form.
