RunSybil raises $40M to automate penetration testing with AI agents that hack like humans

RunSybil Secures $40 Million in Funding for AI-Powered Security Platform

RunSybil has closed a $40 million in funding round led by Khosla Ventures, marking a significant investment in AI cybersecurity innovation1

1

. The round attracted participation from S32, Anthropic's Anthology Fund, Menlo Ventures, and Conviction, alongside notable angel investors including Nikesh Arora, Amit Agarwal, Jeff Dean, and Elad Gil2

2

. This venture capital funding validates the startup's approach to offensive security, which uses autonomous AI agents to simulate human hackers and identify software vulnerabilities before malicious actors can exploit them.

How RunSybil's AI Agent Transforms Penetration Testing

The company's core technology, an AI agent called Sybil, conducts continuous autonomous penetration tests against live applications without requiring access to source code1

1

. Unlike tools such as Claude Code Security that rely on static code analysis before deployment, RunSybil tests software that is already running in production environments. The platform performs black-box testing by exploring systems through their standard interfaces, searching for forgotten endpoints, and probing authentication boundaries to uncover paths to sensitive data2

2

. This method enables the AI to chain together multiple minor vulnerabilities that legacy scanning tools typically overlook, replicating the reasoning and intuition of sophisticated attackers.

Addressing Critical Gaps in Traditional Security Testing

Companies traditionally rely on a combination of manual penetration testing, bug bounty programs, and internal red team exercises to identify security gaps1

1

. However, these approaches face significant limitations. Manual penetration testing conducted by human experts is expensive and slow, leading most organizations to conduct assessments only once or twice annually. Bug bounty programs produce inconsistent results as independent researchers often cherry-pick easy-to-find bugs for quick payouts rather than conducting comprehensive evaluations of a system's attack surface2

2

. Co-founder and CEO Ari Herbert-Voss explained that "both approaches miss huge chunks of your actual attack surface," positioning RunSybil as the first to provide comprehensive testing using AI to reason like a security researcher without ever seeing a line of code2

2

.

Proven Results and Growing Adoption

RunSybil's security testing capabilities have already demonstrated measurable impact for early customers including AI startups Cursor and Notion Labs, along with several Fortune 500 companies2

2

. These organizations report detecting critical flaws that were repeatedly missed by traditional bug bounty hunters and penetration tests. The platform has reduced false positives by 90% compared to standard security scanners, while its AI agents continuously improve by learning from each interaction with a system. This capability becomes particularly valuable as companies increasingly deploy AI across procurement, legal, finance, engineering, and operations, yet security testing remains treated as a discrete, scheduled event on a separate timeline1

1

.

Founders Bring Rare Expertise to Automate Penetration Testing

RunSybil was co-founded in 2023 by Ari Herbert-Voss, who joined OpenAI as its first security research hire in 2019, and Vlad Ionescu, who previously led offensive security red teams at Meta1

1

. Herbert-Voss dropped out of his Harvard Ph.D. program studying machine learning after recognizing that rapid AI scaling would unlock powerful new capabilities. After seeing GPT-2, he realized "this changes everything about the economics of what it would take to run a cyber campaign" and joined OpenAI after sending hacker demos to CEO Sam Altman1

1

. By 2022, he recognized that offensive cyber capabilities could evolve rapidly once powerful language models became widely available, including to malicious actors conducting cyberattacks.

Investor Confidence in Frontier Security Technology

Vinod Khosla, who made an early bet on OpenAI in 2019, told Fortune that "what it takes to add security and penetration testing to the AI world is definitely frontier—RunSybil is on the edge"1

1

. He noted there is currently little competition in this part of the offensive security market, though incumbents such as Palo Alto Networks may eventually enter the space. Khosla emphasized that "we invest in founders who tackle large, unsolved problems with technically ambitious solutions," adding that Herbert-Voss and Ionescu "are building exactly the kind of platform security teams will need as software complexity and AI-driven development accelerate"2

2

.

What This Means for Enterprise Security

Herbert-Voss emphasized that RunSybil aims to transform where, when, and how customers discover and fix security issues: "Not as a project, but as a permanent capability embedded in how they build"1

1

. This shift becomes especially critical for highly regulated industries such as finance, insurance, and healthcare, which face strict legal and audit requirements around cybersecurity. The company plans to use its funding to accelerate research and development, expand its agentic security testing capabilities, scale go-to-market teams, and hire additional researchers2

2

. As AI reshapes enterprise operations and development cycles accelerate, continuous automated testing may become essential for organizations seeking to protect their systems against increasingly sophisticated threats while meeting compliance requirements.