Hadrian Raises $40M for Agentic AI Cybersecurity as AI-Driven Attacks Accelerate

Hadrian, an Amsterdam-based cybersecurity startup using AI agents to find and validate exploitable security weaknesses, has raised $40 million in new funding, announced October 6. The round was co-led by Forgepoint Capital International and SmartFin, with participation from existing investors HV Capital, Motive Partners, Picus Capital, and Oetker Ventures. Total funding now stands at $65 million.

Offense-driven defense

Hadrian combines continuous attack-surface monitoring with AI-driven penetration testing. Its Atlas system maps an organization's external assets and determines which exposures are actually exploitable, while Nova performs deeper agentic penetration testing. The distinction matters: Hadrian's own 2026 Offensive Security Benchmark Report found that only 0.47% of vulnerability scanner findings were genuinely exploitable, leaving security teams drowning in alerts that may never translate into real attacks.

The company lists customers including McKesson, NBCUniversal, TotalEnergies, Amadeus, Leroy Merlin, Francisco Partners, and Damen Shipyards, and says customers have seen faster remediation and higher visibility into exploitable risk, though those metrics come from the company rather than independent testing.

Why the timing matters

AI models are increasingly used to automate parts of the hacking process, from reconnaissance and vulnerability discovery to exploit development. Anthropic recently reported cases involving criminals and state-linked groups using AI models across portions of attack chains, including work related to zero-day vulnerabilities. Against that backdrop, relying on penetration tests conducted once or twice a year looks increasingly outdated.

The capital will fund expansion across the United States and EMEA plus deeper investment in engineering and research. The strategic question for the category: do AI offensive-security platforms become standalone companies, or do they get absorbed as features inside the major cybersecurity suites?

What this means for your business

First, shift from alerts to exploitability. Most security stacks measure coverage by alert volume; Hadrian's 0.47% figure suggests the real metric is which vulnerabilities an attacker can actually turn into an attack path. Ask your security team whether they can rank findings by exploitability, not just severity.

Second, continuous testing beats annual pen tests. Attackers are automating reconnaissance and exploit generation with AI. Your defenses need software that operates continuously too, not a snapshot review every year.

Third, budget for the agent-versus-agent era. Attackers and defenders are now both deploying AI agents. The winning security posture treats this as a capability race: whichever side tests and adapts faster wins. If your security tooling cannot demonstrate it against AI-assisted attack techniques, it is testing against yesterday's threat.