Don’t just find vulnerabilities, Prove which ones an attacker can actually exploit.
Lehi, Utah — August 24, 2026 — Xora, an AI-native penetration testing company, exited stealth today with a platform that autonomously tests whether the vulnerabilities in a company’s own applications can actually be exploited — and generates proof of the ones that can.
“I built the exact tool I always wished I had,” said Jeff Babb, CTO and co-founder of Xora. As the security leader and CTO at his previous scaleup, Babb was buried in scanner noise and false positives — at one point staring at more than 10,000 alerts for potential vulnerabilities. Static analysis tools flagged endless possibilities but never answered the question that mattered: which of these are real, and which are actually exploitable?
For years, application security leaned on a single annual penetration test as the real measure of an app’s security. It was widely treated as the industry standard, but the founders considered the status quo grossly insufficient.”If your application is the lifeblood of your business — if your revenue, your customers, and your reputation all depend on it — why would you only check where you stand once a year? Especially when your codebase changes every day,” said Jake Westbrook, CEO and co-founder, who led go-to-market alongside Babb at their previous venture and was struck by how low the bar for security testing had become.
Two shifts have made continuous, autonomous testing both necessary and possible. AI has sent engineering output soaring — as well as vulnerabilities along with it. Now 45% of AI-generated code introduces a security flaw (Veracode, 2025). Meanwhile, attackers are moving faster: average time-to-exploit collapsed from 63 days to five between 2018 and 2023, a 92% drop (Mandiant 2024, ).
“Humans used to write code full of holes, and now LLMs are writing code full of holes, but at a speed most companies are not able to keep up with,” said Ryan Basden, a career pentester who recently joined Xora as the Head of OffSec. Until recently, penetration testing could only be done by humans; AI has turned autonomous pentesting into a category of its own.
“I was surprised how quickly Xora added value,” said John Epeneter, a Xora customer . “We didn’t have to hire another AppSec engineer to find our vulnerabilities — Xora does that for us. We can do more with less.” Across its first cohorts of design partners and customers, Xora says it has identified critical-severity vulnerabilities (CVSS 9+) in every codebase it has assessed to date.
“Xora surfaced exploits that our previous pentesters should have caught but didn’t,” said Conrad Southworth, another Xora customer. “The landscape has changed so much — autonomous pentesting is the future.”
Xora is built to bridge the gap between “vulnerability found” and “fixed and no longer exploitable.” The platform scans an entire codebase, learns its unique business context, identifies potential vulnerabilities, and then goes a step further — proving which ones are genuinely exploitable, so teams can prioritize the fixes that actually reduce risk.
Beyond reducing risk exposure, customers use Xora to:
– Consolidate legacy SAST and DAST tooling
– Serve as their penetration testing provider more efficiently and cost-effectively
– Cut engineering hours spent identifying, testing, triaging, and patching vulnerabilities
– Improve audit readiness for compliance frameworks such as SOC 2
Xora calls its approach “modern application security for a new era of threats.”
About Xora
Xora is an AI-native penetration testing platform that proves the exploitability of a company’s own code before it ships. By running working exploits against pre-production environments, Xora gives engineering and security teams verified evidence of real risk even before code is shipped to production, and ongoing support for compliance frameworks such as SOC 2. Xora is headquartered in Utah’s Silicon Slopes. Learn more at getxora.ai.
Media Contact Jake Westbrook, Co-Founder & CEO Xora Jake@getxora.ai
