Problem

Hex Security addresses the gap between fast-changing software and point-in-time manual penetration tests. Its YC launch says companies typically test only once a year because penetration testing is manual, expensive, and slow; by the time the report arrives, the codebase may have changed. The company frames the stakes as more than $10 trillion in annual losses from preventable vulnerabilities, while external pricing guides put a standard assessment at roughly $4,000–$20,000 or more and manual testing at about $10,000–$35,000 per engagement. The killer use case is a fast-moving company that needs to continuously catch high-impact flaws in its web applications, APIs, and infrastructure—such as SQL injection, broken access controls, and authentication bypasses—before attackers exploit them.

Product / Service

Hex Security provides autonomous AI agents that run continuous penetration tests against applications and infrastructure. Customers point the service at an application without weeks of scoping; the agents probe APIs, authentication flows, and business logic, chain exploits together, and can test production systems. Findings are validated with working proof-of-concepts and delivered with reproduction steps and remediation guidance, which is intended to reduce false positives and compress the cycle from discovery to protection from months to minutes. The company offers a free initial pentest and a call-based onboarding or discovery model, rather than publishing a self-serve price.

Market

Hex Security competes in agentic offensive security, AI-powered penetration testing, and continuous security validation—a software-driven alternative to annual manual pentests. Comparable vendors and adjacent offerings identified in category roundups include XBOW, Simbian, Horizon3.ai’s NodeZero, Pentera, Corgea, and traditional pentest marketplaces such as HackerOne. The company is early-stage: Y Combinator lists it as Parameter, formerly Hex Security, from Winter 2026, with a ten-person team and active status. Its website says it is backed by Y Combinator and trusted by YC companies, while its launch post claims the agents found critical vulnerabilities in dozens of YC companies and estimated more than $3 billion in avoided potential damages. That indicates meaningful pilot or early-customer validation, but the cited evidence does not establish audited recurring revenue; one directory's roughly $606,000 revenue figure is explicitly an estimate, so Hex is best characterized as an early commercial company rather than a proven scaled vendor.