Paris startup Fleuret AI has raised €4 million for continuous penetration testing by AI agents, betting that software teams need fresh exploitation evidence after deployments rather than an annual security snapshot. RAISE Ventures led the pre-seed round, announced on October 5, 2026, with Auriga Cyber Ventures, Wind Capital, Better Angle and cybersecurity executives participating.
The capital is intended for AI, software-engineering and offensive-security hiring. Fleuret has around ten employees and names Brevo, Stoïk and Yogosha as customers. Founders Yanis Grigy and Augustin Ponsin previously started a pentesting business while studying. Financing and customer names are useful commercial signals, but neither establishes detection coverage or production safety.
Two agents aim to close the loop from discovery to a verified fix
Fleuret describes Émile and Champollion as coordinated agents working on web applications, APIs and external infrastructure within a customer's explicit authorization. Émile maps applications and APIs as an attacker would; Champollion helps turn findings into evidence and remediation workflows. Public architecture detail and the frequency of human review remain limited, so the names do not establish precisely how independently every step runs.
An agent combines a language model with tools, memory and decision logic to choose actions, interpret results and revise a plan. A scanner usually follows predefined checks and reports matches. An agent can investigate an unexpected response and chain steps—potentially testing a business relationship that a signature misses.
Weak object authorization illustrates the difference. A tester may need to change identifiers and understand account structure before discovering that an endpoint exposes another customer's record. This is an example of the reasoning required, not a published Fleuret success rate or a newly disclosed customer breach.
Fleuret says it reports no finding without reproducible exploitation evidence. The platform attaches a proof of concept, links the issue to remediation, lets engineers assign and fix it, then repeats the same path to verify whether vulnerable behavior remains. Discover, exploit, remediate and retest becomes a software loop rather than a document delivered once.
A pre-release assessment remains valid evidence of what was tested, but cannot cover later code or configuration. Deployments can repeatedly change the attack surface between formal engagements. Preserving attack logic could shorten that gap and reveal recurring authorization failures across releases, services or teams, pointing to shared middleware, code-review or architecture weaknesses.
Better evidence is not the same as complete or safe testing
Reproducible proof can reduce queues of suspected weaknesses requiring manual validation and improve prioritization: a replayable compromise explains which path worked. It does not eliminate false negatives. An agent can provide accurate evidence for found flaws while missing deeper authorization failures or unfamiliar attack chains.
Unsafe execution is a separate problem. An autonomous tester has tools capable of interrupting service, corrupting data or reaching outside authorized systems. Safe operation depends on technically enforced scope, action controls, credentials, rate limits, monitoring and emergency stops. Reading an endpoint differs from modifying a record; testing access differs from creating persistence; proving a weakness differs from maximizing damage.
Detailed logs should preserve attempted steps, tools, supporting evidence and blocked actions. Contract wording alone cannot enforce those boundaries. Authentication, destructive actions, unexpected data and changing application state require concrete answers, not a general assertion that the platform is autonomous or safe.
Fleuret had not published an independent safety assessment, broad comparative benchmark or enough independent evaluation to establish coverage. Human review frequency was also unspecified. Autonomy spans guided automation through largely independent execution; a product label cannot identify where a particular deployment sits.
Research cautions against extending benchmark results to production
An ACM-published study of autonomous enterprise-network testing found irrelevant paths, information lost between planning and execution, and safety concerns requiring human oversight. Other evaluations cited difficulties with graphical interfaces, complex business logic and higher false-positive rates. Performance can vary with model, prompt, tools and target environment. These are general research cautions, not measured Fleuret-specific failure rates.
Benchmarks often provide known vulnerabilities, clear goals or patterns represented in model training. Production combines custom workflows, inconsistent documentation, partial permissions, third-party services and unique business rules. Success under a defined test condition does not prove expert-level assessment across every live application.
A customer-controlled staging environment resembling production would permit monitored comparison with a recent human-led assessment and review of every action. Evaluation should separate discovery, exploitation validation, business-logic coverage, false positives and false negatives, while stating target complexity and human assistance. Time spent validating results and getting consequential verified issues repaired matters more than a raw finding count.
European rules create demand, not a compliance shortcut
NIS2 extends cybersecurity risk-management and reporting duties across 18 critical sectors, including energy, healthcare, transport, digital infrastructure, manufacturing and public administration. European Commission guidance includes vulnerability management and supply-chain security, with stronger senior-leadership accountability for failures. It does not simply require every covered organization to buy automated pentesting.
The value is an evidence trail: what was tested, what was exploitable, how the organization responded and whether remediation worked. Continuous testing may connect new findings to deployments and verify a patch's intended effect. Signed reports and replayable evidence still have to meet the expectations of the relevant assurance program and auditor.
DORA adds ICT testing requirements for covered financial entities and threat-led penetration testing for selected entities, simulating real actors against critical production systems under controlled conditions. Scope validation, tester suitability, risk controls and production safeguards mean an ordinary automated scan cannot alone satisfy every requirement. Fleuret can support evidence and frequent testing without automatically replacing regulated assessments.
Fleuret says findings are hosted in Paris through European cloud provider Scaleway. That can help data-residency procurement because testing workspaces may hold architecture, exploit paths, credentials and compromise evidence. It does not settle sovereignty or the entire service chain: subprocessors, retention, access, encryption and incident response still matter. Hosting location is a design choice, not blanket compliance.
The competitive test is the interval between expert engagements
Skilled manual testers investigate business logic, challenge assumptions and recognize operational meaning in unusual behavior. Their depth is valuable, but most organizations cannot commission a full assessment after every deployment. Continuous platforms aim to repeat known checks, explore changed surfaces and verify fixes without rebuilding an engagement each time.
Horizon3.ai's NodeZero targets networks, cloud and enterprise infrastructure through autonomous attack paths. In August 2026 the company announced major financing and said it had run hundreds of thousands of production tests; its international expansion and predictable-production-testing emphasis create a reference point, not independently verified Fleuret equivalence. Application-focused XBOW announced substantial Series C financing in March 2026, while Pentera spans internal and external automated security validation.
Fleuret's narrower opening is an integrated European option for applications, APIs, audit evidence and remediation. Early-customer proximity may help adapt to procurement and sector constraints, but European buyers already have international alternatives. Rivals can add European hosting, agent workflows, broader coverage and remediation integration. Geography alone is not a durable advantage.
The workflow must retain original requests, observed behavior, exploit proof, affected service, owner, ticket, code change, fix and retest without losing context. A current, searchable technical knowledge record helps the right people use that chain. Human consultants can meanwhile focus on unusual threat models, complex logic, social engineering, physical controls and creative chains while agents cover repeatable work between engagements. That hybrid is more credible near term than wholesale replacement.
What would turn the funding into a defensible service
Independent comparisons with experienced pentesters across realistic applications would test whether Fleuret offers more than fast scanning. Broader adoption in financial services, healthcare and critical infrastructure would test identity controls, evidence acceptance, residency and production safeguards. Case studies must explain scope, remediation outcomes and the role of human assessments; customer counts alone cannot answer those questions.
A stronger position would connect every exploit to a fix and verified retest with less repetitive effort. Extensive manual validation, separate tools needed for meaningful coverage or procurement delays caused by autonomous execution would weaken the speed argument. More financing would not resolve those operational tradeoffs.
For developers, the potential is shorter feedback from a code change to evidence of exploitability; for security teams, more coverage between expert-led engagements. The €4 million round funds that attempt, not proof of complete replacement. Its value will be determined by verified consequential issues reaching remediation without unacceptable operational risk—and by whether the platform reduces the backlog rather than merely changing its format.
Sources
Funding announcement · NIS2 guidance · DORA text · Horizon3.ai market report · XBOW financing · Related reading: engineering knowledge base · ACM enterprise testing study · Original discovery (Google News aggregation)