Most companies get a penetration test once a year. Their code changes every day. This YC-backed lab built AI agents to close that gap - by breaking in, proving it, and then patching the hole.
Every security team knows the uncomfortable arithmetic. A penetration test is a photograph - a snapshot of your defenses on the day the testers showed up. But software isn't a photograph. It's a film that never stops rolling. New code merges, dependencies update, a feature flag flips, and the picture the auditors signed off on last spring no longer describes the thing running in production today. MindFort was built to argue with that arithmetic.
The San Francisco company, part of Y Combinator's X25 batch, builds autonomous AI agents that do continuously what pentest firms have historically done once or twice a year: probe an application, find a weakness, and prove it can be exploited. The difference is not just cadence. MindFort's agents are designed to run the whole loop - reconnaissance, exploitation, and then the patch - without a human sitting in the middle waiting to translate a PDF into a fix.
The founders are not guessing about where software security breaks down. Brandon Veiseh, the CEO, previously helped build Nuclei, the widely used open-source vulnerability scanner, at ProjectDiscovery, and worked on AI tooling for offensive-security testers at NetSPI, one of the larger pentest firms. Akul Gupta, the CTO, spent time as a red-teamer at OpenAI and Anthropic - the person whose job was to make frontier AI models misbehave - and holds a master's in computer science from the University of Illinois. A third co-founder, Sam, led security engineering for Tableau at Salesforce, on the defending side of the same problem.
Between them they had watched the two ends of the security workflow stretch apart. On one side, teams now generate code at a pace that would have looked reckless a few years ago, much of it written or assisted by AI. On the other, the tools meant to secure it - annual manual pentests, legacy static and dynamic scanners - still operate on a calendar. The gap between "we shipped it" and "someone checked it" keeps widening.
There is a particular flavor of risk in that gap. A vulnerability introduced in January and discovered in the following December has spent eleven months as an open door. Manual testing, for all its rigor, is expensive and scarce, so most organizations ration it: a quarter's worth of engineering changes gets condensed into a few days of a tester's attention, then everyone moves on. The scanners fill the space in between, but they are the security equivalent of a smoke detector that also goes off when you make toast. Teams learn to tune them out, which is the worst possible outcome for a warning system.
The knock on automated scanners has always been noise. They pattern-match against known signatures and flag anything that looks suspicious, which means security engineers spend their days triaging alerts that turn out to be nothing. MindFort's central bet is that an AI agent can do the expensive part a human tester does - actually attempt the exploit - and only report what it can prove.
When one of its agents finds a candidate vulnerability, it spins up an isolated runtime environment and tries to exploit it there. If the exploit works, it's real, and it comes with a proof of concept attached. If it doesn't, it never reaches your inbox. The company reports this keeps false positives under 1%. The agents also chain findings together, connecting individually minor weaknesses into the kind of multi-step attack path a human intruder would actually walk.
That chaining detail is worth dwelling on, because it's where automated tools have historically fallen short. Real breaches rarely come from one dramatic flaw. They come from a sequence: a low-severity information leak that reveals a username format, a permissive default that lets you enumerate accounts, a session-handling quirk that lets you pivot. Each link looks harmless in isolation, and a scanner grading findings one at a time will wave them all through. MindFort's agents are built to reason about the sequence - to ask not just "is this a bug" but "what does this bug let me reach next," which is the question an actual attacker asks.
The other half of the approach is depth of access. Because the agents can read the codebase, they can catch the kind of business-logic flaws that pure black-box testing misses - the pricing endpoint that trusts a client-supplied total, the permission check that guards the wrong route. Static analysis alone tends to drown in theoretical issues; runtime testing alone can't see the logic. MindFort's argument is that pairing the two, and then confirming with a live exploit, is what separates a finding worth someone's afternoon from a finding worth ignoring.
That last handoff is the part that reframes the whole category. A traditional pentest ends with a report - a document you file, assign, and slowly work through. MindFort ends with a pull request. It analyzes the codebase, generates a contextual fix, and opens the PR in GitHub, with tickets flowing through Jira, Linear, and Slack. The deliverable is not a finding. It's a merge.
Plenty of startups in 2026 are a thin layer of prompt engineering over somebody else's model. MindFort has been building further down the stack. It runs on a purpose-built model it calls MF-1, tuned specifically for offensive-security reasoning, and an infrastructure layer named HillClimb - a nod to the optimization algorithm - that builds a knowledge graph and lets experience compound across engagements. In practice that means each test the system runs is supposed to make the next one sharper, because the lessons from one customer's attack surface inform how the agents reason about the next.
This is the quiet advantage of doing security at the model layer rather than the dashboard layer. Offensive security has always been a craft that rewards accumulated pattern recognition - the tester who has seen a thousand authentication flows knows where the thousand-and-first is likely to break. Encoding that instinct into a system that gets better with every engagement is a different kind of moat than a slicker interface. The founders' backgrounds show up here too: people who built scanners and red-teamed frontier models tend to have strong opinions about what a security-native model needs to reason about, and those opinions are hard to reverse-engineer from the outside.
MindFort also leans on more than one foundation model under the hood, orchestrating them rather than betting the product on a single provider's roadmap. It's a pragmatic hedge in a field where the best available model changes every few months, and it lets the system route different parts of the work - reconnaissance, exploitation, patch generation - to whatever reasoning is best suited to each.
The competitive field splits three ways. There are the legacy scanners - the static and dynamic analysis tools most teams already run, which are fast and cheap but noisy. There are the traditional pentest firms, which are thorough and human but slow and periodic. And there is a new wave of AI-native offensive-security startups, such as XBOW, chasing the same idea from different angles. MindFort's distinguishing move is to insist on validation-by-exploitation and to carry the work through to a shipped patch, rather than stopping at the alert.
How much of the year an app is actually under test, by approach.
The pitch lands across a wider range of buyers than most security tools. MindFort says it works with organizations from early-stage startups to Fortune 500 firms, spanning fintech, healthcare, manufacturing, telecom, and legaltech, with early partners including Origin, Birth Model, and Bluejay. The common thread isn't company size - it's that everyone now ships code faster than they can fully review it. Onboarding takes under 15 minutes, the first validated findings arrive within hours, and the platform carries a SOC 2 Type II attestation, with compliance monitored through Vanta.
MindFort is a B2B SaaS company selling its agents as always-on coverage across an organization's attack surface, positioned to replace both the once-a-year manual engagement and the legacy scanner subscription. In April 2026 it raised a seed round of more than $3 million, led by Soma Capital with participation from Y Combinator, 468 Capital, CRV, Sandwith Ventures, and Blast. The stated goal is blunt: build AI security agents good enough to make organizations self-securing and self-healing.
The team is deliberately small - roughly seven people - which is itself a statement about the bet. A company that thinks the future of security work is autonomous doesn't staff up a room full of analysts to do the work by hand; it puts the same handful of specialists into building the system that does it. The people MindFort has are drawn from the exact institutions that define the field's frontier, and the product is, in a sense, an attempt to bottle what those people know.
Whether autonomous agents can fully stand in for a seasoned human red team is still an open question, and MindFort's own framing is careful about it - the agents assist and accelerate, and the harder judgment calls still benefit from people. But the direction the company is pointing is clear enough. If code is going to be written by machines, the argument goes, it will have to be tested by them too, at the same speed and on the same clock. The annual audit made sense in a world where software changed slowly. That world is gone, and MindFort is one of the more credible attempts to build the tooling for the one that replaced it.