The pitch from CYBRET AI is that most application security tools still read code and cloud config line by line, without a model of what the running system actually is. The Stockholm company, founded in 2025 by Adrian De Gendt, wants to replace that with a single knowledge graph of code, cloud, identity, and APIs, and let agents reason across it at machine speed [CYBRET AI, retrieved 2024].
The company closed a $990,000 pre-seed in December 2025 led by Skyfall Ventures [Nordic9, Dec 2025]. Headcount sits at eleven [LinkedIn, retrieved 2026].
From static rules to a live graph
Traditional application security posture management stitches together SAST, DAST, cloud scanners, and identity tools, each producing its own alert stream. CYBRET's argument is that the reachability question should be answered by the system, not the analyst [CYBRET AI, retrieved 2024]. To do that, the product connects read-only sources to build a live graph, then reasons over it to reconstruct exploitable paths [CYBRET AI, retrieved 2024].
Three products, one graph
The platform is organized into three surfaces that share the underlying graph:
- Exposure Intelligence. The graph layer that ingests code, cloud, identity, and API sources [CYBRET AI, retrieved 2024].
- Validation. Agents that re-attack the paths surfaced by Exposure Intelligence in a controlled way [CYBRET AI, retrieved 2024].
- Runtime Detection. A detection and response layer that operates at call-trace resolution [CYBRET AI, retrieved 2024].
Pricing built around a claim
CYBRET is charging on "paths closed." The published tiers are Startup at $990 per month for 25 applications, Scaleup at $4,800 per month for 200 applications, and a custom Enterprise annual contract [CYBRET AI, retrieved 2024].
The founder and the check
Adrian De Gendt is the sole publicly named founder. His public record includes a stint as a Junior Security Analyst at Telenor Cyberdefence and a dropped Master's in AI [adriandegendt.com, retrieved 2026]. The investor list includes Skyfall Ventures, Inception Fund, Visionaries Club, Wave Ventures, FR8, and angels including Risto Siilasmaa and Peter Sarlin [Nordic9, Dec 2025].
| Metric | Value |
|---|---|
| Pre-seed (Dec 2025) | $0.99M |
What XBOW's shadow means
The named public comparable is XBOW, the US-based autonomous pentesting company. CYBRET's counter is that Validation is one of three surfaces, not the whole product. If the knowledge graph is real, Exposure Intelligence and Runtime Detection are the layers where a pure pentesting agent has no answer.
Where this gets hard
On the technical side, the architecture inherits the failure modes of every graph-first security product before it. Build a live graph of code, cloud, identity, and APIs across a large enterprise and ingestion breaks, the graph gets stale, and reasoning cost grows non-linearly. Getting eleven people, a pre-seed budget, and a knowledge graph to hold up against that comparison at a Fortune 500's traffic volume is the scale problem the team has actually signed up for.