XBOW

XBOW integrates with Jira (work items from findings), a Microsoft Sentinel connector and Security Copilot (query findings, run assessments), sends webhooks for assessment and finding events, and gives the agents an offensive toolkit they chain during testing.

Sourcedocs.xbow.com/integrationsread 2026-09-28

A coordinator decides what to test, where and in what order and directs short-lived attack agents across the fleet, with independent validators confirming exploitability. Agents run concurrently by default, or one at a time in sequential mode. The agents are all XBOW's own.

Sourcexbow.com/platformread 2026-09-28

Source code, documentation, API specifications and prior reports go into a file library shared by the organization and are chosen as context for each assessment, alongside a live map of the attack surface. There is no index or retrieval layer over that library, so context is assembled for each run.

Sourcedocs.xbow.com/console/how-to/provide-target-contextread 2026-09-28

The customer sets scope, a limit on requests per second, testing windows (business hours, off hours or custom) and sequential mode, and can pause an assessment. In Autonomous Exposure Management the customer approves the target list before any testing begins, XBOW sorts what it finds into what it may attack and what it may only visit, agents prove exploits benignly (a SQL injection gets a one time sleep, not a dropped table), and assessments pause when a target becomes unstable. There is no approve or confirm step before an individual exploit attempt runs.

Sourcedocs.xbow.com (execution options) and xbow.com/blog/introducing-autonomous-exposure-managementread 2026-10-24

Enterprise organizations get single sign-on through the customer's identity provider, user roles that control what each member can see and do, an IP allowlist and audit events. XBOW's console documentation names SOC 2 Type 1, SOC 2 Type 2 and HIPAA, and a trust center sits at trust.xbow.com. The SOC 2, ISO 27001, PCI DSS and NIS 2 line on the homepage describes the customer's compliance requirements, not XBOW's attestations.

Sourcedocs.xbow.com/console/get-started/introductionread 2026-10-25

Every action the agents take is logged and can be reviewed. The running assessment shows endpoints assessed, the current request rate and the attack agents' behavior, with a log view on pause.

Sourcedocs.xbow.com/console/how-to/monitor-assessmentread 2026-09-28

Agents are short-lived and retired after each mission. The attack surface map and context library feed each assessment, and context reused on a retest is configuration, not agent memory.

Sourcexbow.com/platformread 2026-09-28

Each organization lives in one region, with findings, assessment results, asset inventory, credentials, uploaded specs and source code, audit logs and user identity stored there. Regions run in the US, the EU and Singapore, and since October 2026 in Australia, Canada and Japan in private preview.

Each is a full deployment on AWS with its own console at console.xbow.com or its .eu, .sg, .au, .ca or .jp form. Billing, support tickets and telemetry stay global, and assessments use approved global model providers, so model processing may happen outside the region. Delivery is SaaS, and the cloud marketplaces are purchase channels.

Sourcexbow.com/blog/xbow-data-residency-now-available-in-australia-canada-and-japanread 2026-10-24

Assessment types (a full application assessment or a vulnerability retest) are modes of one product, the customer defines assessment types and context, and the attack agents are XBOW's internal machinery. There is no catalog of assets to adopt.

Sourcedocs.xbow.com/console/how-toread 2026-09-28

Customers can trigger a pentest on merge or pre-deploy through the API from their own CI or scheduler. Console runs start from a Start assessment button, and testing windows pause and resume a running assessment automatically. The trigger is wired through the customer's pipeline.

Sourcexbow.com/apiread 2026-09-28

XBOW names no model provider, model choice or routing.

Sourcexbow.com/platformread 2026-09-28

XBOW has a REST API to create and configure assets, trigger assessments, retrieve findings and set scope, authentication and safety controls, with bearer-token auth, a pinned X-XBOW-API-Version header, a versioned API reference in preview and signed webhooks with delivery history.

Sourcedocs.xbow.com/apiread 2026-09-28

The product tests the customer's applications, not an agent under evaluation, and its validators check XBOW's own findings. There is no harness for evaluating a change to an agent.

Sourcexbow.com/platformread 2026-09-28

The offensive toolkit includes a steerable headless browser the agents use against the customer's web applications, and XBOW does not describe how the agent drives it.

Sourcexbow.com/platformread 2026-09-28