ChainReactors
AI-native offensive security platform redefining penetration testing and building threat management products.
Website: https://www.chainreactors.ai/
Cover Block
Publicly reported
| Field | Value |
|---|---|
| Name | ChainReactors |
| Tagline | AI-native offensive security platform redefining penetration testing and building threat management products [chainreactors.ai, retrieved 2024] |
| Headquarters | Lisbon, Portugal [Nathaniel Petre - ChainReactor | LinkedIn] |
| Founded | 2021 |
| Stage | Seed |
| Business model | Open Source / Commercial |
| Industry | Security |
| Technology | AI / Machine Learning |
| Growth profile | Venture Scale |
| Founding team | Co-Founders (2) |
| Funding label | Seed |
| Total disclosed funding | $449,000 [dealroom.co] |
Links
Publicly reported
- Website: https://www.chainreactors.ai/
- GitHub: https://github.com/chainreactors/malefic
Summary and Signal
PUBLIC ChainReactors is an AI-native offensive security startup building penetration testing, attack simulation, and broader threat management tooling, and it merits attention now because its open-source security projects have already shown early developer pull while the company is still at seed scale [chainreactors.ai, retrieved 2024] [dealroom.co] [github.com]. Public materials indicate the company was founded in 2021 and is based in Lisbon, with a product narrative centered on redefining penetration testing through Cairn and adjacent offensive infrastructure such as ASM, C2, and tunneling components [chainreactors.ai, retrieved 2024].
The clearest public signal of differentiation is not revenue or customer disclosure, which is not established in the source set, but product architecture and community adoption: ChainReactors describes an end-to-end agent system designed to search attack paths without preset workflows, while its gogo red-team scanning engine is reported at roughly 2,000 GitHub stars and measured at 2,141 stars with 202 forks in the cited repository snapshot [eu.36kr.com] [dealroom.co] [github.com]. That combination suggests an open-source-led wedge, with commercial value likely intended to sit above the core kernel layer, consistent with the structured business model classification of open source plus commercial [chainreactors.ai, retrieved 2024].
The founder picture is less clean than the product story and deserves careful verification. co] [FoodTech Weekly] [LinkedIn].
On capitalization, the public record supports seed-stage financing but not a tidy round chronology. Dealroom News reports a $449,000 seed round, 36Kr reports a separate undisclosed multi-million RMB seed financing, and a Crunchbase funding entry points to a pre-seed round dated August 2025, so investors should treat funding history as partially corroborated rather than settled [dealroom.co] [eu.36kr.com] [Crunchbase].
Over the next 12 to 18 months, the main questions are execution and proof. Public evidence will need to move from repository traction and company-authored capability claims toward clearer validation on product maturity, customer adoption, and repeatable commercialization of the open-source footprint, especially around Cairn, aiscan, and the broader offensive infrastructure stack [chainreactors.ai, retrieved 2024] [github.com].
Thinly sourced -- Material claims in this section mix partial third-party corroboration on funding and GitHub traction with company-authored product descriptions and unresolved founder and round chronology discrepancies.
Taxonomy Snapshot
| Axis | Value |
|---|---|
| Stage | Seed |
| Business Model | Open Source / Commercial |
| Industry / Vertical | Security |
| Technology Type | AI / Machine Learning |
| Growth Profile | Venture Scale |
| Founding Team | Co-Founders (2) |
| Funding | Seed, total disclosed ~$449,000 |
Company Overview
PUBLIC
The public record on ChainReactors is still thin, but the basic company frame is clear enough: it presents itself as an AI-native offensive security startup founded in 2021 and based in Lisbon, Portugal [chainreactors.ai, retrieved 2024]. The company describes its work in plain terms as penetration testing, threat management, attack simulation, and vulnerability discovery, with an open-source and commercial motion sitting underneath that positioning [chainreactors.ai, retrieved 2024].
The chronology that can be supported from company materials is narrow and worth keeping narrow. ChainReactors' website ties the business to a 2021 founding and outlines an offensive security platform built around products such as Cairn and related infrastructure components [chainreactors.ai, retrieved 2024]. Its published wiki archive also points to product iteration through 2024, including references to an August blueprint and demo of IoM and a September refactored v0.0.2 release, which indicates an active build cycle rather than a static open-source repository set [chainreactors.ai, retrieved 2024].
A public legal entity name is not established in the cited company materials used here. On headquarters, the most direct support is the Lisbon location reflected in the structured company profile and founder-linked public presence, which is directionally consistent with the company's own web footprint but not fully corroborated by a state filing in the materials provided [chainreactors.ai, retrieved 2024].
One source, partially checked -- Confirmed in part by the company website, with chronology supported by company web materials but no state filing or Crunchbase citation used in this section.
The Product and the Stack
The Product and the Stack
MIXED ChainReactors presents itself as an AI-native offensive security company, with public materials centered on a product called Cairn and a broader toolchain for threat management, attack simulation, and vulnerability discovery [chainreactors.ai, retrieved 2024]. The plain-English read is narrower than the branding suggests: the company appears to be building operator tools for penetration testing and red-team workflows, rather than a general security platform already proven across multiple categories [chainreactors.ai, retrieved 2024]. That distinction matters because most of the visible evidence comes from company-controlled properties and open-source repositories, not independent product reviews or customer case studies [chainreactors.ai, retrieved 2024] [github.com].
The clearest public technical artifacts are in GitHub. ChainReactors maintains gogo, described in reporting as a red-team scanning engine with roughly 2,000 stars and 200 forks, while the linked repository snapshot shows 2,141 stars and 202 forks [dealroom.co] [github.com]. It also publishes aiscan, described in its releases as a single-binary AI-driven agent for pentest, red team, and bug bounty work, and malefic, described in its repository as an IoM implant, C2 framework, and infrastructure project [github.com] [github.com]. A public pull request in cyber-harness also indicates active work on Cairn's reproduction flow, including a bug tied to evidence exchange storage and empty reproduction traffic in the UI, which is useful because it points to a real engineering surface rather than a concept-only demo [github.com].
The product claim that deserves the most caution is the company's stated architecture thesis. ChainReactors says it is building offensive infrastructure around AI agents and a reconstructed end-to-end stack spanning ASM, C2, and tunneling, and a 36Kr translation attributes to the company a design in which the model searches attack paths without preset roles or workflows [chainreactors.ai, retrieved 2024] [eu.36kr.com]. Those are concrete claims about autonomy and scope, but they remain company-originated. Public evidence supports an active open-source development footprint and some developer traction around gogo; it does not yet independently verify production deployment, efficacy at enterprise scale, or the company's reported tally of severe and high-risk vulnerabilities found in real environments [chainreactors.ai, retrieved 2024].
No independent source found -- Core product scope and performance claims are primarily company-sourced, with partial corroboration from public GitHub repositories and repository activity.
The Market They Are Entering
PUBLIC The market matters now because offensive security is moving from periodic, consultant-led testing toward continuous validation, and the public evidence around ChainReactors points directly at that shift rather than a standalone point tool [chainreactors.ai, retrieved 2024].
Public source support for a formal TAM, SAM, or SOM is thin, so the cleaner approach is to anchor on analogous markets rather than force precision the record does not support. ChainReactors describes itself as an AI-native offensive security platform spanning penetration testing, threat management, attack simulation, and vulnerability discovery [chainreactors.ai, retrieved 2024]. On that framing, the relevant demand pool sits at the intersection of adjacent security software budgets, red-team and pentest services spend, and the newer category of automated exposure validation, but none of the captured third-party sources provides a named market-size estimate for this company or this exact segment [dealroom.co].
The best public signals here are product-scope signals and developer pull. The company positions Cairn as a product intended to redefine penetration testing, while also building surrounding infrastructure such as IoM and other offensive tooling components [chainreactors.ai, retrieved 2024]. Separately, its open-source scanning engine gogo had either roughly 2,000 stars and 200 forks according to Dealroom coverage, or 2,141 stars and 202 forks on GitHub, depending on snapshot date [dealroom.co] [github.com]. That does not establish commercial demand on its own, but it does suggest a market that is at least paying attention to open-source offensive workflows.
Demand tailwinds are visible even without a quantified market model. First, security teams are under pressure to validate real attack paths rather than rely only on static vulnerability inventories, and ChainReactors' public materials repeatedly emphasize attack simulation and vulnerability discovery rather than basic scanning alone [chainreactors.ai, retrieved 2024]. Second, the company is distributing parts of its stack as open source while commercializing business logic, which fits a broader developer-first adoption motion in infrastructure and security software [dealroom.co]. Third, the architecture described in public materials, with agents searching for attack paths in a shared state space, aligns with buyer interest in reducing manual workflow overhead in red-team and pentest work, though that remains a product claim rather than independently validated usage evidence [eu.36kr.com].
Adjacent and substitute markets matter because this company is unlikely to sell into a single clean budget line. The nearest adjacent pools appear to be attack surface management, breach and attack simulation, vulnerability management, red-team tooling, and traditional penetration-testing services, based on the company's own description of its product surface and infrastructure components such as ASM, C2, and implant tooling [chainreactors.ai, retrieved 2024] [github.com]. The substitute in many accounts is still human-led consulting, not another software seat, which means software adoption will depend on whether automated workflows can produce evidence and reproducibility that practitioners trust [github.com].
Regulatory and macro forces cut in both directions. On the supportive side, rising board and regulator focus on cyber resilience tends to favor products that can document exposure validation continuously rather than once a year, and that logic is consistent with the company's product direction [chainreactors.ai, retrieved 2024]. On the constraining side, offensive security products that include C2, implant, or red-team infrastructure face a narrower trust envelope, since buyers, hosting providers, and cross-border regulators often treat dual-use tooling with more scrutiny than defensive analytics software, a risk implied by the public repositories even if no enforcement or policy issue is cited in the source set [github.com].
| Market lens | What public sources support | Source quality |
|---|---|---|
| Core market | AI-native offensive security, penetration testing, attack simulation, vulnerability discovery | Company-described scope only [chainreactors.ai, retrieved 2024] |
| Adoption signal | Open-source developer traction around gogo at roughly 2,000 to 2,141 GitHub stars | Mixed, media plus repository snapshot [dealroom.co] [github.com] |
| Budget adjacency | ASM, C2, threat management, red-team infrastructure suggest overlap with several security spend buckets | Company and repository evidence [chainreactors.ai, retrieved 2024] [github.com] |
| Commercial constraint | Dual-use offensive tooling may face tighter procurement and governance review | Inference from product scope and repositories [github.com] |
The table points to a market that is easier to describe qualitatively than size precisely from the current public record. The practical implication is that the category question is less about whether security spend exists, and more about which budget owner, tooling standard, and trust model ChainReactors can fit.
No independent source found -- This section relies primarily on company materials and public repositories, with limited independent third-party corroboration and no named third-party market-sizing report in the captured sources.
The Competitive Field
MIXED ChainReactors appears to sit in a crowded offensive security stack where the differentiation, on public evidence, rests less on owning a clearly separated category and more on combining open-source red-team tooling with an AI-native workflow for penetration testing and attack-path discovery [chainreactors.ai, retrieved 2024] [github.com] [dealroom.co].
The first competitive fact pattern is structural: the company spans several product surfaces that are usually occupied by different vendors. Its public materials place it across penetration testing, threat management, attack simulation, vulnerability discovery, and offensive infrastructure such as ASM, C2, and tunneling [chainreactors.ai, retrieved 2024]. That makes the relevant alternatives broad. Incumbents in enterprise security testing tend to sell established vulnerability management, exposure assessment, and breach-and-attack simulation products, while open-source challengers often win initial usage through operator tooling and community adoption. Adjacent substitutes also matter here, particularly internal red teams, boutique pentest firms, and researchers stitching together point tools rather than buying a unified platform. On the evidence available, ChainReactors is competing less against one named public rival and more against a workflow made up of service providers, in-house expertise, and fragmented open-source software [chainreactors.ai, retrieved 2024] [github.com].
The clearest edge visible today is distribution through developer and operator attention, not proof of commercial scale. Dealroom attributed roughly 2,000 GitHub stars and 200 forks to the gogo red-team scanning engine, while the referenced repository shows 2,141 stars and 202 forks [dealroom.co] [github.com]. That level of open-source engagement suggests some ability to attract practitioners at the top of the funnel, which matters in offensive security because user trust is often earned through tooling quality before procurement begins. The edge is also perishable. GitHub traction can seed credibility, but it does not by itself create durable data advantages, contractual lock-in, or a channel that larger platforms cannot replicate. Public sources do not yet show named enterprise customers, ecosystem partnerships, or regulatory moats that would make the position harder to dislodge [chainreactors.ai, retrieved 2024] [dealroom.co].
The main exposure is category breadth. Public claims describe Cairn, aiscan, IoM, malefic, and a wider offensive infrastructure agenda, but the same breadth can make market positioning harder if buyers want a single best-of-breed tool rather than an emerging multi-product stack [chainreactors.ai, retrieved 2024] [github.com]. There is also a more basic exposure around naming and comparability. Some public references in the source set point to similarly named but unrelated projects and companies, including an academic privilege-escalation project called ChainReactor and a separate industrial biology company using Chainreactor branding [github.com] [chainreactor.bio, retrieved 2026]. That does not weaken the underlying technology by itself, but it can dilute discoverability and complicate brand capture in a field where trust and clarity matter.
The most plausible 18-month scenario is a split between community adoption and enterprise conversion. If open-source usage continues to deepen and the company can turn tools such as gogo and aiscan into a coherent commercial control plane, ChainReactors is the winner if practitioner adoption becomes the buying wedge, because its public footprint is already strongest with technical users [github.com] [dealroom.co]. The likely loser in that scenario is the fragmented do-it-yourself workflow, where teams piece together separate scanners, C2 frameworks, and reproduction utilities. The inverse case is also straightforward: ChainReactors is the loser if larger security vendors or well-capitalized offensive security platforms package similar AI-assisted testing features into existing enterprise relationships before ChainReactors proves repeatable commercial deployment. Public evidence does not yet establish which side of that line the company is on [chainreactors.ai, retrieved 2024].
Opportunity
Upside case
PUBLIC The prize here is not a better pentest point tool, but a credible shot at becoming a software layer that automates parts of offensive security work that are still expensive, manual, and fragmented across red teaming, attack simulation, and vulnerability reproduction, if ChainReactors can turn its open-source foothold into a commercial control point [chainreactors.ai, retrieved 2024] [github.com] [dealroom.co].
The largest plausible outcome is a category-defining offensive security platform built around AI-assisted operator workflows. That sounds ambitious, but the public evidence does show the company assembling more than a single utility: the website describes Cairn as part of a broader effort spanning threat management, attack simulation, and vulnerability discovery, while public repositories show work across scanning, agent tooling, and command-and-control infrastructure [chainreactors.ai, retrieved 2024] [github.com]. The reach is still mostly company-described, so this should be treated carefully, yet the shape of the product surface matters because platform outcomes in security usually start with one developer-loved wedge and then expand into adjacent workflows. The gogo project's roughly 2,141 GitHub stars and 202 forks suggest at least some early open-source pull that could support that motion [github.com] [dealroom.co].
A reasonable upside path is that ChainReactors becomes the default offensive workflow stack for a subset of security teams that want one environment for discovery, simulation, and evidence capture. Public materials indicate an open-source/commercial model, and third-party coverage says the company is trying to rethink pricing with token-based billing, which implies management is at least testing a monetization structure aligned to usage rather than seat count [dealroom.co] [eu.36kr.com]. If that combination works, the company could occupy a useful position between standalone offensive tools and broader security validation suites, especially as buyers look for faster iteration cycles from AI-assisted products [chainreactors.ai, retrieved 2024].
| Scenario | What happens | Catalyst | Why it's plausible |
|---|---|---|---|
| Open-source wedge to team standard | gogo and related tools become the entry point, then paid workflows around Cairn, reproduction, and orchestration become the standard environment for smaller red teams and security consultancies | Sustained GitHub adoption and visible packaging of commercial workflows around open repositories | The company already shows an open-source distribution motion, and gogo has public GitHub traction with more than 2,000 stars and about 200 forks [github.com] [dealroom.co] |
| AI-native offensive platform | Cairn and adjacent products mature into a broader system for attack simulation, vulnerability discovery, and evidence handling used by internal enterprise security teams | A stable commercial release that proves AI agents can reduce manual operator time without breaking auditability | ChainReactors publicly positions itself around AI-native offensive infrastructure, and repository activity points to work on reproduction flow and runtime boundaries, which are the sort of operational details needed for enterprise use [chainreactors.ai, retrieved 2024] [github.com] |
| Infrastructure layer for modern red teaming | The company becomes embedded not just as an app, but as a reusable engine that practitioners build into custom offensive workflows | Wider adoption of single-binary and modular agent tooling, plus broader community contribution | Public releases describe aiscan as a single binary for pentest, red team, and bug bounty use cases, while the company also maintains multiple offensive-security repositories that could support modular adoption [github.com] [chainreactors.ai, retrieved 2024] |
The compounding mechanism, if it appears, is familiar from successful security tooling. An open tool draws practitioners because it is useful on day one, those practitioners generate testing patterns and edge cases, the company productizes the painful parts such as orchestration, evidence capture, and team workflows, and a paid control plane sits on top of an ecosystem that remains attractive to individual users [github.com] [chainreactors.ai, retrieved 2024]. ChainReactors has not publicly proven that flywheel at commercial scale, but there are early signs of the first turn of it: a visible GitHub footprint, multiple repos that map to adjacent operator jobs, and company claims that it is building beyond scanning into broader offensive infrastructure [github.com] [dealroom.co] [chainreactors.ai, retrieved 2024].
The size of the win is hard to anchor because no direct public comparable was supplied in the source set for this specific category. Even so, if the company were to become a meaningful offensive-security platform with durable open-source distribution and a commercial layer that enterprises standardize on, the outcome could reasonably sit in the range associated with venture-scale security software rather than niche tooling, though any numeric valuation would be speculative on this record. The practical point is narrower: the upside case depends less on a one-off pentest product and more on whether ChainReactors can own a repeatable workflow inside offensive security teams, where successful platforms tend to widen from one operator task into several over time [chainreactors.ai, retrieved 2024] [github.com].
Thinly sourced -- Section relies on public GitHub and Dealroom signals for open-source traction, but product breadth and platform claims are still primarily company-described with limited independent corroboration.
Sources
Publicly reported
[chainreactors.ai, retrieved 2024] ChainReactors | https://www.chainreactors.ai/
[dealroom.co] Chainreaction raises $449K seed to rewrite how security is priced | https://dealroom.co/news/165434-chainreaction-raises-449k-seed-to-rewrite-how-security-is-priced/
[github.com] GitHub - chainreactors/malefic: IoM implant, C2 Framework and Infrastructure | https://github.com/chainreactors/malefic
[eu.36kr.com] Open-Source Security Startup "Chain Reaction" Secures Multi-Million RMB Seed Round, Rewrites Industry Pricing Power With Token-Based Billing | https://eu.36kr.com/en/p/4037822855058307
[chainreactor.bio, retrieved 2026] Chainreactor | The infrastructure for industrial biology | https://www.chainreactor.bio/
[github.com] Releases · chainreactors/aiscan | https://github.com/chainreactors/aiscan/releases
[github.com] refactor: converge extension ownership and runtime boundaries by M09Ic · Pull Request #130 · chainreactors/cyber-harness | https://github.com/chainreactors/cyber-harness/pull/130
Articles about ChainReactors
- ChainReactors' Open-Source Engine Is Rewriting the AI Attack Playbook — The Lisbon startup is commercializing an open-source red-team scanner that uses AI planning to autonomously chain vulnerabilities, backed by $449,000 in seed funding.