What is XBOW?
XBOW is an autonomous offensive security platform that tests web applications and APIs, attempts to exploit what it finds, and returns findings with evidence and remediation steps. It is used through a web console and a REST API, and the vendor says large language models drive its coordinator and attack agents.
Who it's for
Security, audit and compliance teams that want continuous application testing instead of a point-in-time annual pentest; the vendor says coverage can range from a single application to thousands. The vendor describes it as a platform sold on a scoped, usage basis, so it is aimed at organizations that will talk to sales rather than self-serve buyers.
Pros & cons
Strengths
- XBOW says each finding is proven with a working exploit and a reproducible trace, with independent validators confirming it, and reports include evidence, severity and remediation.
- The platform page lists controls for scope, impact level (off, moderate or deep), rate limits, testing windows, a one-session-at-a-time mode, optional human approval for the first run, and pause at any time.
- The platform page lists Jira and GitHub issues as ticketing targets and an API to launch assessments from release pipelines; the docs list Jira, Microsoft Sentinel and Security Copilot integrations.
- XBOW's docs say attack commands are checked by a separate AI model acting as a safety judge plus deterministic rules, and that exploits are demonstrated in known-benign ways.
- XBOW says it retests a fix after deployment and confirms whether the issue is closed.
- The pricing page says it is sold through AWS, Google, Oracle and Microsoft marketplaces so spend can use existing committed agreements.
Limitations
- The pricing page lists no plans or amounts: pricing is described as usage-based and scoped to your environment, with a Request a Quote button and a demo page.
- A November 2025 release and vendor blog give a Pentest On-Demand starting price of $6,000, but the blog now carries an editor's note that Lightspeed (the name in its title) was deprecated as of 2026-07-16 and to contact sales, so that figure may no longer be available.
- No free plan or free trial is mentioned on the pricing page.
- XBOW's trust documentation says the platform is hosted on AWS in the United States, with other residency options in private preview, and that retention follows a Data Management Policy that was not read, so specific retention periods are unconfirmed.
- The platform page says it routes tasks across multiple models but names none, and says some vulnerability classes are in preview rather than generally available.
Plans and pricing
- Platform: Custom. Usage-based pricing that scales with coverage, scoped to your environment; request a quote or demo. No amounts published.
- Pentest On-Demand (Lightspeed, earlier offer): Reported: starts at $6,000. Self-serve test with a target URL and credentials, results in five business days, retesting included, per a Nov 2025 release. The blog says Lightspeed was deprecated as of 2026-07-16, so confirm with sales.
The official pricing page was read and lists no plans or amounts. The $6,000 figure comes from a November 2025 vendor release and blog (Reported) and conflicts with the blog's later deprecation note. Currency is USD as listed; billing basis is not stated. Confirm on the live pricing page.
Details checked October 2026 against the vendor's own pages. Prices and limits change, so confirm before you buy. Official pricing page ↗
Sources
This profile was compiled from these public pages. We have not run hands-on tests.
XBOW — at a glance
XBOW is an autonomous offensive security platform that tests web applications and APIs, attempts to exploit what it finds, and returns findings with evidence and remediation steps. It is used through a web console and a REST API, and the vendor says large language models drive its coordinator and attack agents.
Try XBOW →