RunSybil

What is RunSybil?

RunSybil is an AI offensive-security platform that tests a company’s own web apps, APIs and cloud set-up for weaknesses an attacker could use. Its AI agents probe an approved target, confirm each finding and suggest fixes, so defenders can close gaps before a breach.

Each engagement moves through six stages: signing in to the app, mapping it, testing it, validating findings, writing fix guidance and retesting. Teams can share no code, partial context such as API documents and test accounts, or full source. Tests can repeat on each pull request, on a schedule or on demand.

Founders Ari Herbert-Voss, reportedly OpenAI’s first security hire, and Vlad Ionescu, a former Mandiant and Meta red teamer, raised a $40 million Series A led by Khosla Ventures in March 2026. The company has hubs in San Francisco and New York, and its site was taking demo bookings when we checked in October.

Key Features

RunSybil’s most useful features are validated findings and continuous retesting, because together they cut triage time and keep results current as code changes.

• Agent-based testing: AI agents map the approved application, its APIs and its login flows, then test them the way an outside attacker would. Third-party write-ups describe separate discovery, login and testing agents that share what they learn during a run.
• Finding validation: Each candidate issue passes a multi-stage reproducibility check before it reaches the report. Duplicates and false positives are removed, and one application security site notes the vendor’s claim of over 90% fewer false positives than conventional scanners.
• Three access levels: Tests can run black-box with no internal access, grey-box with API documents or test accounts, or white-box with source code. More context generally means deeper coverage, and the company says white-box testing finds more issues.
• Continuous runs: Runs can be triggered by a GitHub or GitLab pull request, started manually or set on a schedule. This replaces the usual yearly test with feedback at release pace, and retests of fixes typically finish in under an hour.
• Evidence-rich reports: Every finding comes with a CVSS 3.1 severity score, a CWE reference, reproduction steps and the affected components. AI-written remediation advice sits alongside, so developers can act without waiting for a separate consultant debrief.
• Compliance output: A SOC 2 penetration testing service produces an audit-ready report, an engagement letter and remediation tracking for each finding. The output is also pitched at ISO 27001 evidence, which helps firms answering customer security questionnaires.

Pros

RunSybil’s main appeal is speed with low noise: same-day starts, retests in under an hour and only confirmed findings in the report.

• Fast turnaround: Engagements can start the same day, with complex applications given a 24-hour maximum. Retests of fixed issues usually complete in under an hour, which suits teams shipping several releases a week.
• Less triage: Only validated findings reach the report, each backed by request and response evidence. Security teams spend less time chasing scanner alerts that turn out to be harmless or duplicated.
• Developer friendly: Results flow into pull requests and a Fix with AI option for Claude, Codex and Cursor. An MCP server lets coding assistants read findings directly, shortening the path from report to patch.
• Flexible access: You choose how much the platform sees, from no internal access to full source code. Cautious teams can start black-box and widen access once they trust the process and its reports.
• Credible team: The founders bring OpenAI security and Mandiant and Meta red-team experience. Named customers include Notion, Cursor, Carta, Baseten and Thinking Machines, which offers some reassurance for a young product.

Cons

The biggest drawback is opaque pricing, since every engagement needs a demo and a custom quote before you see a figure.

• No public pricing: No plan prices, free tier or trial appear on the website. Budgeting means a sales call first, which slows comparison with rivals that publish per-test rates.
• Managed, not self-serve: Security review sites describe RunSybil as a managed service without self-service sign-up or public API documentation. Teams that want to explore a product alone before buying will find this restrictive.
• Few independent reviews: Independent user reviews remain scarce, and one directory reports a 4.2 rating from only nine reviews. Most published detail still comes from the vendor and its own case studies.
• Integration set-up: Continuous testing depends on connecting code hosts and pipelines. One directory notes that this CI/CD set-up takes effort, so smaller teams may need engineering time before seeing ongoing value.
• Overkill for small sites: The service is built for software companies with frequent releases and audit pressure. A brochure site or low-risk internal tool may not justify the cost or the scoping work involved.

Who is Using RunSybil?

RunSybil is used mostly by fast-moving software and fintech companies that need frequent, evidenced security testing of systems they own.

• AI and SaaS firms: Notion, Cursor and Baseten are named customers. Cursor’s case study describes keeping its shipping pace without dropping security checks.
• Fintech teams: Carta has a published case study on building a modern security programme. Regulated firms use the evidence-rich reports to show auditors and partners what was tested.
• Start-ups facing audits: Firms preparing for SOC 2 use the dedicated pen testing service for audit evidence. Furl’s case study describes a solo security lead validating its attack surface in days to win a customer.
• AppSec teams: In-house security teams use it to replace once-a-year tests with continuous coverage. Some run it alongside bug bounty programmes to catch issues between external researcher reports.

Pricing

RunSybil uses quote-based pricing only, with no plan prices, free tier or trial on its website (official site, October 2026).

Directories such as Toolradar simply list it as a paid product, so we found no conflicting price figures to report.

Disclaimer: scope and testing depth drive the quote, so ask for the price and retest terms in writing.

What Makes RunSybil Unique?

RunSybil confirms each weakness on the approved target before reporting it, then repeats the test on every code change rather than once a year.

Signature-based scanners tend to produce long lists that a person must triage, while a traditional consultancy test often runs for weeks and dates quickly. RunSybil sits between the two, pairing agent-led reasoning with evidence for each finding and fast retests. Its MCP server also hands findings straight to AI coding assistants, a link few rivals advertise.

Compatibilities and Integrations

RunSybil runs as a hosted web service and connects to code hosts, AI coding tools and common report formats.

• Platform: Managed web-based service, with nothing to install on your own machines.
• Code hosting: GitHub and GitLab pull requests can trigger test runs.
• AI coding tools: An MCP server and a Fix with AI flow for Claude, Codex and Cursor.
• Export: Findings download as PDF, CSV or JSON, or come through a REST API.
• Trust and data: The trust centre lists SOC 2 Type 2, offers a data processing agreement and names subprocessors such as AWS, OpenAI and Anthropic.

RunSybil Tutorials

A first RunSybil test starts with a demo and a written scope, then moves to continuous runs once fixes are flowing.

1. Book a demo and agree the scope in writing.
2. Confirm you own, or have written permission to test, each target.
3. Choose black-box, grey-box or white-box access, ideally against a staging copy.
4. Review the validated findings and assign them to developers.
5. Retest each fix, which usually takes under an hour.
6. Connect GitHub or GitLab so later pull requests trigger new runs.

How We Rated It

RunSybil earns 4.0 out of 5 from us, as fast, validated testing is held back by quote-only pricing and limited public documentation.

Summary

RunSybil suits software and fintech firms that want frequent, validated testing of apps and infrastructure they own. Its strengths are speed, low noise and close links to developer tools. Opaque pricing and a thin base of independent reviews are the main drawbacks, so expect a sales call before any figure. Agree a written scope, start with a staging copy, and widen access only once you trust the reports.