RunSybil

RunSybil is an AI-native offensive security platform built around Sybil, an autonomous agent that continuously tests applications and infrastructure for exploitable vulnerabilities by reasoning about a system the way an elite human researcher would, across the entire stack, on every deployment. Rather than scanning for signatures, Sybil reasons like an attacker: it interacts with systems dynamically, explores authentication boundaries, finds and validates vulnerabilities, and chains them across layers to surface real exploitable paths, the way an application vulnerability becomes the entry point for full infrastructure compromise. The company frames its role as owning Phase 4 of CTEM, Validation: where most exposure-management programs stop at discovery and prioritization, Sybil continuously attacks applications and infrastructure with real adversarial reasoning to prove whether findings from other tools are actually exploitable, delivering pre-validated findings with zero triage burden. It positions itself as a replacement for both bug bounties (expensive, unpredictable, cherry-picked targets) and point-in-time pentests (stale the moment you ship), offering continuous coverage at predictable cost across application and infrastructure layers, testing for cross-tenant data access, privilege escalation, transaction manipulation, broken authorization, IAM misconfigurations, container escapes, CI/CD secret exposure, and lateral movement. RunSybil describes Sybil as the only platform running live exploitation with AI agents that learn about a target and get more efficient with experience; in one financial-platform engagement Sybil exploited a low-severity flaw, then used that knowledge to probe endpoints and find a critical unauthenticated flaw exposing all customer data that black-box tools missed. Founded in 2023 by OpenAI's first security researcher and Meta's former offensive security lead with a team from Mandiant, NCC Group, and Trail of Bits, backed by a $40M Series A, RunSybil sits in the offensive cluster alongside XBOW, Horizon3, and Terra, differentiated by continuous per-deployment black-box testing that chains vulnerabilities across the full application-to-infrastructure stack.