Ghost Security

Ghost Security is an Austin based cybersecurity company building autonomous application and API security around agentic AI, rather than layering AI onto legacy scanners. Its open source foundation, Reaper, is a modern AppSec testing framework, licensed Apache 2.0 and engineered to be usable by humans and AI agents alike, that consolidates reconnaissance and domain discovery, a man in the middle HTTPS proxy, request tampering, business logic fuzzing of live apps and APIs, and reporting into one workflow. Instead of brute force, Reaper uses agentic AI to select and prioritize attacks from real time reconnaissance and the target's structure, refining its approach from prior attempts to produce tightly scoped, resource efficient tests with AI generated, actionable remediation reports. Ghost frames its roadmap in levels of autonomy: a free launch tool for automated testing and reporting, an Autopilot AI only mode and a Co-op human in the loop mode with a Ghost API key, and a commercial Ghost Platform that adds continuous, context aware testing across source code and internal and external assessments with continuous discovery, monitoring and risk context spanning the OWASP Top Ten and beyond. An experimental system called ReaperBot shows the direction of travel, orchestrating a team of specialized agents, a Discoverer and a Tester, that drive Reaper through its APIs to autonomously find and validate vulnerabilities, and Ghost publishes agent skills so AI agents can operate its tooling directly. Founded by serial security entrepreneurs Greg Martin and Josh Larsen and backed by investors including Munich Re Ventures, Ghost Security is pursuing fully autonomous application security for cloud native environments.