Xalgorix

Company profile:

Startup name: Xalgorix

Tagline: Autonomous AI pentesting with exploit-verified findings

Elevator Pitch: Xalgorix is an autonomous AI security testing platform for developers and security teams. Point it at a live app or source repository and an AI agent runs a structured 22-phase pentest, validates every finding with a working exploit, and produces evidence-backed remediation guidance.

It supports hosted scans, an open-source self-hosted CLI, free pull-request reviews through the GitHub App, CI gating, schedules, webhooks, team workspaces, a REST API, and branded reports. Scans start at $1 and credits never expire.

Target Market: Developers, engineering teams, DevSecOps teams, security teams, startups, and SaaS companies shipping web apps and APIs.

How will you make money?: Usage-based hosted security scanning and team features. Scans start at $1 and credits never expire, while the core self-hosted CLI remains open source.

How much capital have you raised?:

Website: https://www.xalgorix.com/

City/Country:

AI-assisted summary:

Xalgorix is an application-security startup offering a hosted AI penetration-testing platform, alongside an open-source self-hosted engine, for organizations that want to test web applications and repositories for security weaknesses. Its central product claim is that it verifies reported vulnerabilities by reproducing an exploit, positioning the service as an alternative to security scanners that generate findings requiring substantial manual triage. (Source: https://www.xalgorix.com/) (Source: https://github.com/xalgord/xalgorix)

Problem and target users

Web-application teams need continuous ways to identify vulnerabilities in running software, but dynamic application security testing is inherently incomplete: it assesses an application externally and cannot cover all source code or necessarily understand its full attack surface. (Source: https://devguide.owasp.org/en/06-verification/02-tools/01-dast/)

False positives and developer time are material issues in security workflows; OWASP notes that security tooling should be tuned to avoid wasting developers’ time and that penetration-test reports are more useful when they explain both the vulnerability and remediation. (Source: https://owasp.org/www-project-security-culture/stable/7-Security_Testing/)

Xalgorix is aimed at developers, security engineers, platform teams, bug-bounty practitioners, and teams that want to run authorized scans during development or against live web properties. The company explicitly states that scans should be run only on systems the user owns or has permission to test. (Source: https://www.xalgorix.com/) (Source: https://github.com/xalgord/xalgorix)

Product and solution

The hosted product lets users submit a URL, hostname, wildcard target, or repository-related workflow, then runs an autonomous security-testing process covering 22 phases, including reconnaissance, authentication and session testing, injection testing, SSRF, IDOR/broken-access-control testing, API and GraphQL testing, file-upload testing, cloud and infrastructure checks, and an exploit-verification phase. (Source: https://www.xalgorix.com/)

The product’s proposed differentiator is validation: Xalgorix says a separate phase confirms candidate findings before they enter the report, with evidence, CVSS severity information, proof-of-concept material, and remediation guidance. That is a sensible product direction because OWASP highlights the value of reports that show how a vulnerability was exploited and how to fix it. (Source: https://www.xalgorix.com/) (Source: https://owasp.org/www-project-security-culture/stable/7-Security_Testing/)

For engineering workflows, Xalgorix offers a GitHub Action, REST API, webhooks, CLI, scheduled scans, and a GitHub App that reviews pull-request diffs for issues such as injection, authentication problems, SSRF, exposed secrets, and unsafe patterns. The self-hosted repository describes a locally run version where customers supply and control their own LLM provider and infrastructure. (Source: https://www.xalgorix.com/) (Source: https://github.com/xalgord/xalgorix)

The hosted service also states that it provides live scan telemetry, shareable reports, configurable request rates and circuit breakers, while requiring users to confirm their authorization to test a target. (Source: https://www.xalgorix.com/)

Business model, pricing signals, and traction

Xalgorix uses a credit-based SaaS model: the company says customers pay per live host scanned rather than for LLM tokens, while subscriptions add monthly credits and greater scan concurrency. (Source: https://www.xalgorix.com/pricing)

Its public entry point is a $1 one-credit pack; listed subscription tiers begin at $20 per month for 40 credits, $49 per month for 120 credits, and $199 per month for 300 credits. The company also advertises custom enterprise arrangements, including private deployment, SSO, invoicing, and additional controls. (Source: https://www.xalgorix.com/) (Source: https://www.xalgorix.com/pricing)

The reviewed public materials present product and pricing information but do not provide independently verifiable customer, revenue, or funding metrics, so traction should be treated as unconfirmed. (Source: https://www.xalgorix.com/) (Source: https://github.com/xalgord/xalgorix)

Expert take

Xalgorix has a focused position: make penetration testing more self-serve and developer-native while reducing the gap between a scanner alert and evidence a team can act on. The combination of an open-source self-hosted engine and a managed SaaS version is strategically useful because it addresses both privacy-sensitive security practitioners and teams that prefer not to operate scanning infrastructure.

The main diligence question is product efficacy rather than feature breadth. Prospective customers and investors should test whether exploit verification remains reliable across authenticated workflows, business logic, and complex production environments, and whether the tool’s findings provide enough coverage to complement—not prematurely replace—skilled human testing.

Note: Information based on publicly available sources at the time of writing, and summarized by AI.