Hacktron Raises $2.9M Pre-Seed to Bring AI-Powered, Attacker-Style Security Testing to Every Code Change
The security model that has governed software development for decades — quarterly penetration tests, periodic vulnerability scans, and manual code review — was designed for a world where code shipped slowly and attackers operated at human speed. Neither of those conditions applies today. AI has given adversaries the ability to discover and exploit vulnerabilities at a pace that quarterly security exercises cannot come close to matching, and modern development pipelines push code changes continuously — meaning that the window between a vulnerability being introduced and an attacker finding it has collapsed to hours or less. Hacktron, the AI-powered continuous security testing platform founded by elite competitive hackers, has raised $2.9 million in pre-seed funding to bring attacker-grade security testing to every code change.
The round was led by Crane Venture Partners, with participation from Project Europe, Vercel Ventures, Plug and Play Ventures, and Cambridge Enterprise Ventures, alongside a network of strategic angel investors. Hacktron was founded in San Francisco by Zayne Zhang, Mohan Pedhapati, and Harsh Jaiswal — three elite competitive hackers with backgrounds spanning DEF CON CTF, Black Hat, and real-world vulnerability research across enterprise software, open-source infrastructure, and developer platforms. The company has already generated approximately $240,000 in revenue in its first nine months — early commercial traction that validates both the product and the market timing.
"Attackers are already using AI to find and exploit vulnerabilities faster than ever. Most companies are still testing security like it's a quarterly exercise. We're building the system that tests every code change like a real attacker would — so teams can move fast without shipping risk."
— Zayne Zhang, Founder, Hacktron
Founded by Elite Hackers — The Team Behind the Platform
What distinguishes Hacktron from the crowded field of application security tooling is the offensive security pedigree of its founding team. Zayne Zhang, Mohan Pedhapati, and Harsh Jaiswal are not security researchers who study vulnerabilities theoretically — they are elite competitive hackers who have participated in DEF CON CTF and presented original research at DEF CON and Black Hat, the industry's most demanding offensive security venues. This is an unusually strong foundation for a product company: the founders understand how adversaries actually think, what techniques they use, and where conventional security tooling fails to catch the vulnerabilities that matter most.
That offensive expertise has already translated into real-world impact. Hacktron's team has identified and responsibly disclosed critical vulnerabilities in widely used systems including BeyondTrust Remote Support, GitHub, GitLab, Next.js, and Cloudflare infrastructure. Most recently, they disclosed critical vulnerabilities in the widely used OAuth2 Proxy open-source project — a tool embedded in enterprise authentication workflows across thousands of organisations globally. The company has also performed security testing work for organisations including Perplexity AI and Supabase, using the same attacker-oriented techniques that now underpin its commercial platform.
This combination — elite hacking expertise translated into a product that runs continuously inside the development lifecycle — is exactly what Crane Venture Partners identified as the defining quality of the investment case. The team does not think like defenders building detection rules. They think like attackers who understand which code patterns are exploitable, which paths through a system an adversary would take, and what the conventional security scanner misses because it only knows what it was programmed to look for.
"The best security founders don't think like defenders — they think like attackers. What stood out immediately about Hacktron was the team's ability to combine elite offensive security expertise with a product vision built for how software is actually developed today. AI is changing the economics of both building and breaking software, and Hacktron is creating what modern software teams will need to succeed."
— Scott Sage, Co-Founder & Partner, Crane Venture Partners
The Platform — What Continuous Attacker-Style Security Testing Actually Delivers
Rather than relying on static scans or signature-based detection, Hacktron's platform combines AI models with attacker-oriented techniques designed to simulate how sophisticated adversaries actually identify exploitable weaknesses. The fundamental insight behind the product is that the question "does this vulnerability exist?" is less important than "is this vulnerability exploitable by a real attacker using real techniques?" Static scanners answer the first question, often generating large volumes of low-confidence findings. Hacktron focuses on the second — running the kind of deep, context-aware analysis that a skilled human pentester would apply, at the continuous cadence that modern development demands.
Continuous Security Testing on Every Pull Request and Code Change
Hacktron runs deep security checks on every pull request and code change — shifting security left from a periodic, manual exercise to a continuous, automated function embedded in the development workflow. By running at the cadence of development rather than on a quarterly schedule, the platform closes the window between a vulnerability being introduced and its detection, before it reaches production and before an attacker has the opportunity to find it first.
Deep Exploitable Vulnerability Identification — Beyond Known Patterns
Conventional scanners match code against known vulnerability signatures — an approach that is fast and scalable but fundamentally limited to what the scanner was trained to recognise. Hacktron's AI, trained on the attacker-grade research of its founding team, identifies deep, exploitable vulnerabilities that go beyond pattern matching — the kind of logic flaws, authentication bypasses, and chained vulnerabilities that skilled adversaries actively hunt for and that static analysis consistently misses.
Reduced False Positives and Real-Time Remediation Assistance
One of the most significant productivity drains in application security is false positives — the stream of low-confidence findings that require analyst time to triage, investigate, and dismiss. Hacktron's attacker-oriented approach reduces false positive rates compared to traditional scanners and newer AI tools, ensuring that what developers and security teams receive is a focused, high-confidence set of findings that warrant action. For each confirmed finding, the platform assists with remediation directly — helping developers understand and fix vulnerabilities in the flow of active development rather than as a separate, disruptive process.
Real-World Vulnerability Research — The Foundation of Hacktron's Credibility
One of the most commercially significant aspects of Hacktron's positioning is that its credibility is not built on claims — it is built on a documented track record of finding real vulnerabilities in widely deployed systems before adversaries did. The responsible disclosures across BeyondTrust, GitHub, GitLab, Next.js, Cloudflare, and OAuth2 Proxy are not marketing examples — they are evidence that the team's methodology works against the same software that enterprise organisations run in production.
The company plans to continue publishing deep technical research — including a forthcoming deep dive into its OAuth2 Proxy findings — as part of a deliberate strategy to educate the market and demonstrate real-world capability. For an application security company competing against established vendors with large marketing budgets, this research-led approach serves as both market education and the most compelling possible demonstration of what the platform can find.
Critical vulnerabilities responsibly disclosed in BeyondTrust Remote Support and Cloudflare infrastructure — systems deployed across enterprise security and networking environments globally.
Vulnerabilities identified and disclosed in GitHub, GitLab, and Next.js — platforms used by millions of developers daily, where a single finding can have blast radius across the global software development ecosystem.
Critical findings in OAuth2 Proxy — widely deployed in enterprise authentication — plus commercial security testing engagements for Perplexity AI and Supabase using the attacker techniques that underpin the platform.
Key Takeaways
Hacktron has raised $2.9 million in pre-seed funding led by Crane Venture Partners — with Vercel Ventures, Project Europe, Plug and Play Ventures, and Cambridge Enterprise Ventures participating — to bring AI-powered, continuous attacker-style security testing to every pull request and code change.
Founded by three elite competitive hackers — Zayne Zhang, Mohan Pedhapati, and Harsh Jaiswal — with active research presented at DEF CON and Black Hat and critical vulnerability disclosures in BeyondTrust, GitHub, GitLab, Next.js, Cloudflare, and OAuth2 Proxy, the founding team's offensive pedigree is the platform's strongest differentiator.
Hacktron's platform combines AI with attacker-oriented techniques to identify deep, exploitable vulnerabilities — going beyond known pattern matching — while reducing false positives compared to traditional scanners and providing real-time remediation guidance directly in the development workflow.
With $240,000 in revenue within its first nine months — including commercial security testing for Perplexity AI and Supabase — the funding will accelerate engineering and security research team expansion, product development, and go-to-market scaling. Learn more at hacktron.ai.
Hacktron's pre-seed raise reflects a clear and compelling market thesis: the combination of AI-accelerated development and AI-accelerated attacks has made periodic security testing structurally inadequate, and the companies that solve this problem most credibly will be those whose product is built on genuine offensive security expertise rather than detection engineering alone. A founding team with documented vulnerability research across the most widely deployed enterprise and developer platforms in the world — and $240,000 in early revenue from customers who saw that research — is the most convincing possible opening argument for why Hacktron's approach works in practice, not just in theory.
To learn more about Hacktron's continuous attacker-style security testing platform, visit hacktron.ai.