The news
Hadrian, an Amsterdam-based company that uses AI agents to attack its customers' systems the way hackers would, has raised a $40 million Series B, according to The Next Web and SecurityWeek. The Next Web reported the Hadrian Series B on October 6, 2026; the round brings total funding to $65 million.
Forgepoint Capital International and Smartfin co-led the round, with participation from HV Capital, Motive Partners, Picus Capital and Oetker Ventures, both outlets reported. Hadrian was founded in 2021 by CEO Rogier Fischer, Olivier Beg and Maurice Clin, according to The Next Web. Beg holds the title of Chief Hacking Officer, SecurityWeek reported.
The company sells two products. Atlas continuously maps the systems a customer exposes to the internet and uses AI to check which weaknesses are real, according to The Next Web. Nova performs on-demand penetration testing, the practice of simulating attacks to find exploitable flaws, run by AI agents rather than human testers.
Hadrian says customers find 10 times more critical risks, fix issues 80% faster and get five times the return compared with manual testing, as reported by The Next Web and SecurityWeek. Those are company claims and were not independently verified. Customers named by The Next Web include McKesson, NBCUniversal, TotalEnergies, Amadeus, Leroy Merlin and Damen Shipyards.
Fischer told The Next Web that the company has worked with large language models since before they went mainstream, and that "AI can work much faster than any human offensive security team." In a statement reported by SecurityWeek, Hadrian said attackers now move at machine speed while many security teams lag years behind.
The new money will fund expansion across Europe, the Middle East and Africa and the United States, plus larger engineering and research teams, according to both outlets. The Next Web reported earlier funding of a €2.5 million pre-seed in 2021 and a €10.5 million seed round led by HV Capital in 2022.
The numbers
- Series B
- $40 million
- Total funding
- $65 million
- Founded
- 2021, Amsterdam
- Claimed faster remediation (company figure)
- 80%
Why CEOs should care
For CISOs, the shift is from testing once or twice a year to testing continuously. A human penetration test is a snapshot; internet-facing systems change weekly. If you buy an automated offensive tool, ask how it confirms a finding is exploitable, how it avoids disrupting production systems, and what its false-positive rate looks like on an environment like yours.
CFOs should press vendors on the return claims. Hadrian's 5x return and 10x visibility figures are its own; ask for reference customers in your industry and a pilot measured against your current pentest spend and time-to-fix data. Automated testing can complement human testers, but regulators and auditors may still expect human-led assessments, so check compliance requirements before cutting either.
Boards should ask a simpler question: who is testing our defenses between audits? If the answer is nobody, attackers using automation may be finding exposures before your team does.
The bigger picture
Security spending is moving toward tools that act like attackers, as AI makes it cheaper to probe systems at scale on both sides. Hadrian's pitch rests on that symmetry: if criminals automate reconnaissance and exploitation, defenders need automated testing to keep pace. Investors are backing several companies with similar agent-based approaches, which means buyers will have a crowded field to evaluate.
Hadrian's planned US push puts it in direct competition with American attack surface management and pentesting providers.
What’s next
Watch for Hadrian's US hiring and customer announcements, and for independent evaluations of agent-led penetration testing, which will determine whether these tools move from pilots to standard security budgets.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
