Hadrian raises $40 million for autonomous offensive security

Security vendor Hadrian has raised $40 million to expand its autonomous offensive security platform, SecurityWeek reported on 7 October 2026.

According to the report, Hadrian sells an "agentic" offensive security platform, meaning software agents carry out attacker-style testing with limited human direction. SecurityWeek says the stated aim is to allow defenders to operate at the same speed as attackers.

The report does not identify the investors behind the round, the stage of the funding, the company's valuation, or how the money will be split between engineering, sales and other functions. It also does not give customer numbers or revenue figures. Readers should treat the $40 million figure and the product description as the only confirmed details in the available reporting.

Offensive security tooling of this kind sits in an awkward spot for buyers. The same capabilities that make automated testing useful — enumerating internet-facing assets, probing them, and chaining weaknesses together without waiting for a human tester — are the capabilities that make it sensitive if the tooling is misconfigured, misused or compromised. Any agent that is authorised to attack systems is, by definition, holding permissions that an attacker would value. The available source does not describe what controls Hadrian applies to scoping, authorisation or logging, and this article does not assume any.

The funding is also a signal about where money is moving in the security market. Investors are backing products that promise to replace or compress work that previously required scheduled human penetration tests. Whether autonomous testing finds the same class of issues as a skilled human tester is a question the reporting does not address, and one that buyers will need to answer with their own evaluations rather than vendor claims.

For security teams considering this category, the practical questions are unchanged by the size of the round. Who authorises an agent to act against production systems. What happens when the agent's findings are wrong, and who carries the cost of a false positive that triggers an incident response. How are the agent's actions recorded so that an unexpected outage can be traced back to a test rather than an intrusion. And what guarantees exist that the platform's own credentials and findings — effectively a live map of an organisation's weak points — are held securely.

SecurityWeek's report is the only source for this announcement used here. The Agentic Times has not independently verified the funding amount or the platform's capabilities, and Hadrian has not been contacted for additional comment.