How Hacktron Is Bringing AI-Native Security Testing Into Modern Software Development
Supporting the Future of Offensive Security Infrastructure
Salim Laouiti, Matt Hennigan and Tim Solle
Building an AI-Powered Security Platform
Hacktron, a London-based cybersecurity startup, is building an AI-native platform for penetration testing and continuous application security, designed for the pace and complexity of modern software development.
Founded by elite offensive security researchers and competitive hackers, Hacktron transforms how security testing is performed by embedding attacker-style reasoning directly into the software development lifecycle. The platform encodes the tacit expertise of top-tier security researchers into LLM-powered agents that continuously test codebases for vulnerabilities as software is written, reviewed, and deployed.
Today, Hacktron operates through a CLI-based workflow, with plans to expand into a fully integrated CI/CD security infrastructure that sits directly inside developer workflows, from IDEs to staging and production environments.
The company recently raised a $2.9 million pre-seed round led by Crane Venture Partners, with participation from Vercel Ventures, Project Europe, Plug and Play Ventures, and Cambridge Enterprise Ventures.
The investment reflects Plug and Play’s continued focus on backing infrastructure companies building foundational security systems for the AI era.
Why Is This Problem Significant, & How Large Is Its Impact?
Software development is accelerating faster than traditional security infrastructure can keep up with.
As AI-assisted coding tools become increasingly embedded into engineering workflows, the volume of code being shipped continues to grow exponentially. By 2025, AI-generated code will already account for approximately 41% of production code across the industry, dramatically increasing the scale and complexity of modern attack surfaces.
At the same time, the supply of elite security researchers capable of identifying sophisticated vulnerabilities remains extremely limited.
Most existing application security tools still rely heavily on static rules, known vulnerability signatures, or surface-level scanning techniques. While effective at detecting previously identified issues, these systems often fail to detect complex business-logic vulnerabilities, novel exploit chains, or framework-specific attack paths that require contextual reasoning.
Hacktron has already demonstrated this gap in real-world environments.
Recently, the company identified critical vulnerabilities in Supabase’s authentication infrastructure and exploitable vulnerabilities within Perplexity’s Comet browser. In both cases, the affected companies already had dedicated security teams and existing tooling. The vulnerabilities persisted because traditional scanners could not reason through the nuanced exploit paths required to uncover them.
This challenge extends far beyond individual companies.
Cybercrime is estimated to cost the global economy approximately $10 trillion annually, while the combined application security and penetration testing market currently exceeds $8 billion and continues growing at roughly 14–15% per year. As AI-generated software proliferates, security buyers increasingly include not only CISOs, but also developers, DevOps teams, and platform vendors seeking security embedded directly into development workflows.
Hacktron addresses this problem by bringing continuous, attacker-grade security testing into every code change, enabling teams to identify exploitable vulnerabilities before software reaches production.
Meet the Team Behind Hacktron
Hacktron is led by a founding team with deep expertise across offensive security, vulnerability research, and security infrastructure.
Zayne Zhang, Co-founder and CEO, is a DEF CON CTF runner-up in both 2023 and 2024, has identified 15 CVEs, and previously conducted white-box security audits at Cure53 alongside his co-founders while studying computer science at Cambridge.
Mohan Pedhapati, Co-founder and CTO, brings more than 10 years of offensive security experience, having discovered vulnerabilities across platforms such as Discord, Microsoft, and Slack. He has presented research at both DEF CON and Black Hat and previously founded Electrovolt, a security auditing company that generated approximately €1.5 million in revenue.
Harsh Jaiswal, Head of Research, is a globally ranked bug bounty researcher recognized by Forbes for identifying vulnerabilities within Apple systems, and previously worked at ProjectDiscovery.
The founding team has collaborated for more than three years across Cure53 engagements and competitive capture-the-flag teams, providing strong technical alignment and operational continuity from the earliest stages of the company.
CEO & Co-founder
“Attackers are already using AI to find and exploit vulnerabilities faster than ever. Most companies are still testing security like it’s a quarterly exercise. We’re building the system that tests every code change like a real attacker would so teams can move fast without shipping risk.”
Why We’re Excited to Invest
Hacktron is addressing a critical infrastructure challenge emerging from the rapid adoption of AI-assisted software development.
Rather than building another static-scanning tool, the company is developing an AI-native offensive security platform that can reason about vulnerabilities the way experienced human researchers do. By integrating directly into developer workflows and understanding code semantically, Hacktron enables continuous testing against evolving real-world attack patterns rather than static historical checklists.
What stood out most was the combination of technical credibility, product vision, and market timing.
The founders are not simply building for the security market. They come directly from it, with years of experience identifying vulnerabilities across major technology platforms and participating at the highest levels of offensive security research. The product itself emerged naturally from workflows and techniques the team already used in real-world engagements.
Hacktron has also demonstrated an unusually effective go-to-market motion. In several cases, the company identified vulnerabilities within live production systems, disclosed them responsibly, and converted those engagements directly into customer relationships.
Beyond capital, Hacktron will gain access to Plug and Play’s global ecosystem of enterprise partners, cybersecurity operators, strategic investors, and technical mentors across Europe, Silicon Valley, and broader international markets.
Plug and Play is one of the most active VCs globally. Our goal is to fund the teams building the defensible businesses of the future. Join our ecosystem today.
Investment Manager, Plug and Play
"Three things stood out. The founders don't just understand this market, they are the market. The product existed before the company did. The GTM motion is unlike anything I've seen in security: they hack the product, disclose the vulnerability, and convert the security lead into a customer in a single conversation."
Related announcements
Discover our global locations
We have a community of experts all over the world. We work as a bridge between Silicon Valley and the rest of the world, making innovation open to anyone, anywhere.