For a regional manufacturer or a 50-person accounting firm, the annual penetration test is a budget line item, not a continuous security posture. It's a point-in-time snapshot, often expensive, that leaves months of exposure before the next scheduled engagement. AvalonX, a cybersecurity startup that emerged from stealth in late October, is betting that small and midsize businesses would rather have a persistent, AI-powered attacker simulation running on subscription [Associated Press, October 2026]. The company's Artemis platform starts at $249 a month, promising initial results the same day and aiming to make enterprise-grade red teaming a continuous, affordable process [avalonx.ai, retrieved 2026] [Pulse 2, retrieved 2026].
The Wedge: AI Agents and Human Verification
The core of the bet is a product called Artemis, which uses autonomous agents to mimic an attacker's behavior. The system is designed to identify entry points, validate vulnerabilities, map potential lateral movement through a compromised network, and generate remediation guidance [Associated Press, October 2026]. What makes the model distinct, according to the company, is the AI engine powering it: a proprietary 400-billion-parameter model named Aether, trained on nine years of real-world offensive security data and supported by approximately 60 billion dark-web records [Associated Press, October 2026] [Pulse 2, retrieved 2026]. The commercial motion is straightforward. A customer enters a domain, authorizes the systems for testing, and receives a report. No software installation is required for external assessments, which cover domains, applications, IP ranges, cloud accounts, and internal networks [Citybiz, October 2026] [Associated Press, October 2026]. Crucially, AvalonX does not claim to be fully automated. Human penetration testers are included in the service to verify the AI's findings, a layer meant to address the skepticism that often greets purely algorithmic security claims [Associated Press, October 2026].
A Team Built for the Enterprise Sale
The leadership team suggests a focus on credibility and enterprise sales motions, even while targeting the SMB segment. CEO and co-founder Craig Goodwin was previously chief information security officer at Fujitsu, Monster, and CDK Global, bringing over 20 years of security industry experience [Associated Press, October 2026] [CIO Views Magazine, retrieved 2026]. He is joined by co-founders Ricardo Valdes and Ben O’Nion, with the trio collectively claiming more than 50 years in information security and technology [Associated Press, October 2026]. Goodwin's background includes a prior role as chief product and strategy officer at cybersecurity managed services firm Cyvatar, which points to experience in productizing and scaling security offerings [Forbes Technology Council, retrieved 2026]. This is not a team of fresh PhDs building an AI model in isolation; it's a group with a track record of selling security to large organizations, now applying that rigor to a lower-price-point product.
Funding and the Path to Traction
AvalonX launched with a significant financial runway, announcing it had secured up to $10 million in a seed funding facility from Ridown Capital, the investment firm associated with Onecom co-founders Aaron Brown and Darren Ridge [Associated Press, October 2026]. The company stated it had operated in stealth for 18 months prior to its October 2026 launch, suggesting the capital is intended to fuel its go-to-market push [Associated Press, October 2026]. Public traction metrics, such as customer counts or annual recurring revenue, were not disclosed at launch. The go-to-market plan appears to hinge on a classic land-and-expand motion within the SMB sector, starting with external attack surface testing.
| Co-Founder | Role | Key Prior Experience |
|---|---|---|
| Craig Goodwin | CEO | CISO at Fujitsu, Monster, CDK Global; Co-Founder at Cyvatar [Associated Press, October 2026] [Forbes Technology Council, retrieved 2026] |
| Ricardo Valdes | Co-Founder | Information security and technology experience (company report) [Associated Press, October 2026] |
| Ben O’Nion | Co-Founder | Information security and technology experience (company report) [Associated Press, October 2026] |
The Realistic Competitive Set
AvalonX is entering a crowded security testing market, but its positioning creates a specific competitive frame. It is not directly challenging the premium, human-led red-team engagements sold by firms like Bishop Fox or Coalfire. Instead, its realistic competitors are other vendors offering automated or continuous testing to the mid-market.
- Cobalt. A known competitor in the space, Cobalt offers a platform that connects companies with a community of penetration testers for on-demand testing, blending human expertise with platform tools [Source]. AvalonX differentiates by centering its proprietary AI as the primary "attacker" and including human verification as a bundled service.
- Bug Bounty Platforms. Services like HackerOne and Bugcrowd operate on a crowdsourced, findings-based model. AvalonX's subscription for continuous, scheduled testing offers a predictable cost and scope, contrasting with the variable outcome and cost of bug bounty programs.
- Legacy VA/Scanners. Traditional vulnerability scanners from companies like Tenable or Qualys identify known CVEs. Artemis aims to simulate attacker behavior and chain vulnerabilities, positioning itself as a step closer to a true penetration test rather than a compliance scan.
The ideal customer profile is clear: a security-conscious small or midsize business,think a fintech startup, a specialized manufacturer, or a professional services firm,that understands the need for penetration testing but has been priced out of or dissatisfied with the traditional annual model. This buyer likely has a part-time IT manager or a small internal team, not a dedicated security staff. They are budget owners looking for a measurable improvement in security posture without a six-figure consulting engagement.
Where the Proof Will Be Required
The risks for AvalonX are not about the problem space, which is well-established, but about execution and market adoption at its chosen price point. The $249 monthly entry point is aggressive, and the unit economics of bundling human verification at that tier will be tested at scale. The company must prove that its AI model, Aether, consistently finds novel or chained vulnerabilities that simpler scanners miss, justifying the premium over basic vulnerability assessment tools. Furthermore, the SMB security market is notoriously difficult to sell into, with long sales cycles and price sensitivity. AvalonX's answer appears to be the combined weight of its founding team's enterprise credibility and the low-friction, no-installation trial experience. The next twelve months will be about converting the initial funding into a visible customer base and demonstrating renewal rates that confirm the product is becoming a non-disposable line item in its customers' security budgets.
Sources
- [Associated Press, October 2026] AI STARTUP AVALONX EMERGES FROM STEALTH WITH $10 MILLION IN FUNDING FROM RIDOWN CAPITAL | https://apnews.com/press-release/getnews/press-release-bf5cc51d4015fb7a7c13fe17c5ee57c7
- [Citybiz, October 2026] AvalonX Launches AI-Powered Penetration Testing Platform With Up to $10M in Funding | https://www.citybiz.co/article/927074/avalonx-launches-ai-powered-penetration-testing-platform-with-up-to-10m-in-funding/
- [Pulse 2, retrieved 2026] AvalonX coverage | https://www.pulse2.com/
- [avalonx.ai, retrieved 2026] AvalonX website and pricing | https://www.avalonx.ai/
- [Forbes Technology Council, retrieved 2026] Craig Goodwin profile | https://profiles.forbes.com/members/tech/profile/Craig-Goodwin-Co-Founder-%7C-Chief-Product-Strategy-Officer-Cyvatar/49d70fb4-3ef7-4bde-9f47-72fdcbb6a91e
- [CIO Views Magazine, retrieved 2026] Craig Goodwin profile | https://cioviews.com/