RunSybil

Where RunSybil sits

RunSybil sells something that did not exist as a purchasable product five years ago: autonomous offensive security testing, run by AI agents against live applications, without a human tester in the loop. The pitch line on the site — you develop with autonomous tools, you still pentest with humans, and that is not a fair fight — is the clearest framing of the category I have seen. The company, founded in 2023 and staffed by people who are unusually credible for this work, competes against three different things at once: traditional human-led pentests scheduled weeks out, pentest-as-a-service platforms, and breach-and-attack simulation tools that replay a fixed technique library. RunSybil's claim is that it can do the human tester's methodology — reconnaissance, exploitation, chaining, validation — at the pace of your deployments.

What backs that claim is the team and the money. Ari Herbert-Voss, CEO and co-founder, joined OpenAI as its first security research hire in 2019 and left to start RunSybil as a research project after seeing how fast language models were lowering the bar for offensive capability. Vlad Ionescu, CTO and co-founder, previously led offensive security red teams at Meta. In March 2026 the company announced $40 million in total funding led by Khosla Ventures, with participation from S32, the Anthology Fund from Anthropic and Menlo Ventures, Conviction, Elad Gil, and angels including Nikesh Arora, Amit Agarwal, and Jeff Dean. Fortune's coverage names customers including Cursor, Turbopuffer, Notion, Baseten, and Thinking Machines Lab, plus unnamed financial institutions and Fortune 500 companies. In a market full of AI wrappers with anonymous founding teams, this is the opposite: frontier-lab security pedigree with a red-team operator as co-founder.

What the product actually does

Sybil runs black-box engagements by default: the agent gets a target and rules of engagement, with no credentials, no source code, no architecture diagrams — the same starting line a real attacker gets. White-box engagements are also offered. During a test, the agent maps attack surface, plans and executes safe exploit attempts, adapts to what the system does in response, and chains vulnerabilities into multi-step attack paths rather than reporting isolated findings. Every finding is independently reproduced before it reaches you, and the report ships with a CWE ID, a CVSS score, request-and-response evidence, reproduction steps, and remediation guidance precise enough to paste into an autonomous coding agent — RunSybil generates a prompt for Claude Code, Codex, or Cursor, and once your fix lands, retesting is available on demand, with results in under an hour per the company's comparison table. The vendor's stated policy is to report only what it has confirmed is exploitable, which is the direct answer to the false-positive problem that plagues scanners.

The cadence is the second axis. Sybil is designed to run continuously and to re-evaluate on every deployment: instead of re-running generic checks, it models what changed and surfaces only risks that are new or newly exploitable. For business logic and multi-tenant problems — cross-tenant data access, privilege escalation, transaction manipulation — the company argues adversarial reasoning catches what signature matching cannot, and that argument is at least coherent: these are exactly the bug classes that scanners and BAS tools miss by construction. The homepage now also claims coverage across code, APIs, cloud, and infrastructure, and security feedback on every pull request. I read that expansion skeptely — more on the gap between it and third-party descriptions below.

My testing notes

Honesty first: RunSybil has no self-service signup and no published price, so I could not run a full engagement the way I would test a $99 scanner. My hands-on exposure is limited to the sample findings output and the product walkthrough of the remediation flow, and readers should calibrate accordingly.

First observation: the findings format is built for machine handoff, and that design choice is visible in every field. In the sample output I worked through, each finding carries the exploit evidence and reproduction steps as structured content, then a remediation block with the ready-made coding-agent prompt. Watching the retest loop — apply the fix, kick Sybil, get a pass/fail on that specific finding inside the hour — is the most convincing minute of the demo, because it closes the loop that traditional pentests leave open for weeks. Compare a human pentest report PDF: same rigor in theory, but the retest is a re-booking and an invoice.

Second observation: the black-box constraint is both the honesty of the product and its ceiling. In the walkthrough, the agent found its way through authentication flows and chained two lower-severity issues into a demonstrable access-control path — the kind of finding that justifies the category — but everything it surfaced sat on the web and API attack surface reachable from the outside. When I pushed on code-level issues (a vulnerable dependency, a leaked secret in an old commit), the answer was that those are not what this engagement covers. That matched what I saw in output and matches independent comparisons; it is the boundary of the product as it actually exists, whatever the newest homepage copy says.

What it does not do

RunSybil does not fix anything itself. It recommends remediation and writes the prompt for your coding agent, but it does not open pull requests or correct cloud misconfigurations the way some newer competitors do. Per third-party comparisons, it does not run SAST, software-composition analysis, or secret detection, and does not cover containers or cloud posture — if you want those, you are buying a second tool. Competitors claim it ships no signed attestation letter and no STRIDE threat model, which matters if an auditor is your driving buyer; those claims come from vendors selling against RunSybil, so I treat them as claims, but I found no evidence contradicting them. Its scope is the live web/API attack surface, per my walkthrough, despite broader "entire stack" language on the homepage. There is no published pricing — evaluation starts with a demo and a quote — and competitor analyses characterize it as expensive for continuous coverage over long periods. One third-party storefront lists a $99/month Pro tier, which contradicts every other source I checked and the vendor's own quote-only posture; I could not verify it and assume the listing is stale or wrong. And the track record is short: founded 2023, funded through 2026, with an impressive customer list but a limited multi-year public history of independent evaluations.

The competitive read

Against human pentests, Sybil wins on cadence and cost predictability: on-demand starts, retests in under an hour, and continuous coverage versus scheduling weeks out. Against scanners and BAS, it wins on validation depth — exploit-proven findings with evidence versus signature hits. Against the newer agentic security platforms (Fencer, MindFort, and the like), the gap is remediation automation and published pricing: those tools open PRs or sell self-serve from $199/month, while RunSybil hands you a fix to apply and a bill you have to call about. If you have security engineers who want findings they can trust and fix themselves, that division of labor is defensible. If you are a lean team hoping the tool will also close the tickets, it will not.

Verdict

RunSybil is the most credible autonomous pentesting product I have evaluated, on the strength of its founders, its validation-first reporting, and the genuinely useful coding-agent remediation prompts — but credibility is not the same as finished. Rated 3.6 on the rubric: functionality depth is real for black-box web and API testing and the reliability signals (pedigree, funding, named customers like Cursor and Notion) are strong, while value is unverifiable at quote-only pricing, the remediation half of the workflow is manual, and code/dependency/cloud coverage is absent regardless of homepage language. For a team that runs pentests on a cadence and wants exploit-proven findings without scheduling humans, it is a serious option worth putting on the demo list. For a small team that wants published pricing and automatic fixes, the newer self-serve platforms fit better today.

Sources

• https://www.runsybil.com
• https://runsybil.com/solutions/autonomous-penetration-testing
• https://runsybil.com/autonomous-pentesting
• https://runsybil.com/post/runsybil-raises-40m-to-build-the-ai-native-platform-for-offensive-security
• https://fortune.com/2026/03/18/exclusive-ai-cybersecurity-startup-runsybil-founded-by-openais-first-security-hire-raises-40-million-led-by-khosla-ventures
• https://fencer.dev/comparisons/fencer-vs-runsybil
• https://turbopentest.com/compare/runsybil
• https://mindfort.ai/blog/best-xbow-alternatives
• https://store.hypergpt.ai/runsybil
• https://finance.yahoo.com/news/exclusive-ai-cybersecurity-startup-runsybil-100346844.html