What Anytool does

Anytool, Inc., operating commercially as Hex Security, is an early-stage applied research lab building AI-powered autonomous penetration testing software for organizations that run web applications, APIs, and production infrastructure. Founded in 2025 and headquartered in San Francisco, the company ships a single product—Hex Security—in which AI agents designed to reason like elite security researchers probe customer systems continuously rather than on an annual engagement basis. The platform targets vulnerability categories including SQL injection, broken access controls, authentication bypasses, remote code execution, cross-site scripting, and sensitive data exposure, and every finding is delivered with a working proof-of-concept to eliminate false positives, accompanied by reproduction steps and remediation guidance surfaced through a web-based triage dashboard (app.hex.co).

The product architecture combines autonomous agent decision-making with structured analysis of application data flows, authentication logic, and business logic. Findings are produced as text-based vulnerability reports enriched with structured metadata (priority, status, assignee), and the workflow surface includes triage, assignment, and history views that integrate into a security team's existing operational cadence. Distribution is direct-to-enterprise: prospects are routed through a Cal.com–based demo booking flow on the hex.co landing page, and the company's positioning explicitly contrasts its continuous, agent-driven model against annual manual pentests that take weeks, cost six figures, and deliver outdated reports.

Anytool is backed by Y Combinator as part of the W26 batch, with a $1,000,000 round dated January 7, 2026. The revenue model is described as a recurring subscription for continuous security testing, but no pricing tiers, contract values, ARR figures, customer counts, or named customer logos are disclosed in the source material. The primary customer segment is framed as organizations with web applications and APIs; a secondary segment is technology companies and unicorns, with the company claiming its methodology has uncovered critical vulnerabilities at "countless unicorns" without naming any.

Name

Anytool

Legal name

Anytool, Inc.

Website

https://anytool.sh

Company type

Private

Founded year

2025

Operating status

Operating

Short description

Anytool (DBA Hex Security) is a San Francisco–based AI lab that sells Hex Security, an autonomous penetration testing platform using AI agents to continuously find and validate vulnerabilities in customers' web applications, APIs, and infrastructure on a subscription basis.

Ownership category

akta.pro rank

Product category

Application Security Testing

NAICS

Testing Laboratories and Services (541380)

SIC

Services-Testing Laboratories (8734), Services-Computer Integrated Systems Design (7373)

akta.pro primary industry

Application Security Testing (SAST/DAST/IAST/SCA) (HDADACAC)

akta.pro secondary industries

Vulnerability Management, Pen Testing & Attack Surface Management (ASM) (HLACAJAN), Security Architecture & Engineering Advisory (Zero Trust, IAM, Network) (BPAKADAF)

Keywords

• Autonomous penetration testing
• AI security testing
• Continuous vulnerability testing
• Application security platform
• API security validation

Headquarters

HQ city

San Francisco

HQ country

United States

HQ region

North America

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations

Revenue model

1. Security Testing Platform: Subscription-based AI-powered autonomous penetration testing service. The platform is offered as a continuous security testing solution rather than one-time assessments, suggesting recurring subscription revenue model.

Go-to-market motion1 record

Distribution channels1 record

Marketing channels1 record

Core offering

Anytool, Inc. operates Hex Security, an AI-powered autonomous penetration testing platform that continuously probes web applications, APIs, authentication flows, and infrastructure for critical vulnerabilities. AI agents reason like elite security researchers, validate findings with working proof-of-concept exploits, and deliver prioritized remediation guidance through a triage dashboard. The service replaces traditional annual manual pentests with continuous, on-demand security validation.

Product overview

Anytool offers a unified product portfolio centered on Hex Security, an AI-powered autonomous penetration testing platform. Hex Security provides continuous, AI-driven security testing that identifies vulnerabilities in web applications, APIs, and infrastructure—moving beyond traditional annual or periodic security assessments. The platform features autonomous AI agents that validate findings with proof-of-concept demonstrations to eliminate false positives, delivering prioritized security findings with remediation guidance through a dedicated dashboard interface.

Differentiator

Problem solved

Functional benefit

Products and services

• Hex Security AI-powered autonomous penetration testing platform that continuously finds vulnerabilities in web applications, APIs, authentication flows, and infrastructure. Uses AI agents that reason like elite security researchers to probe systems continuously, validate each finding with a working proof-of-concept to eliminate false positives, and deliver prioritized findings with reproduction steps and remediation guidance through a dedicated triage dashboard.

Quantifiable outcome

• SQL injection exposing 947 billion records identified and validated
• +1 more outcomes

Segments2 records

Ideal customer profiles1 record

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability4 records

Feature2 records

Scale indicators2 records

Recent moves4 records

Expansion highlights3 records

Emerging players

• StackHawk: StackHawk provides DAST scanning purpose-built for developers and CI/CD pipelines, competing for the same continuous testing of web apps and APIs that Hex enables.
• Escape Security: Escape is an AI-driven API security testing startup focused on discovering business-logic flaws and broken object-level authorization — overlapping with Hex's API and authentication-bypass focus.
• Astra Security: Astra Security is a continuous pentesting platform combining automated scanners with manual expert review, positioned similarly to Hex for SMB and mid-market web application security.

Broad incumbents

• Bishop Fox: Bishop Fox is a well-known offensive security consultancy offering manual pentesting, red teaming, and attack surface management — the traditional incumbent whose budget Hex aims to disrupt.
• Snyk: Snyk is a developer-first security platform spanning SCA, SAST, container, and IaC scanning. It competes for adjacent budget and represents a likely platform-expansion competitor to a continuous-pentest vendor.
• HackerOne: HackerOne is the largest bug bounty and vulnerability disclosure platform; while crowdsourced rather than autonomous, it competes for the same security testing budget and buyer relationships.
• Veracode: Veracode is an established application security testing suite covering SAST, DAST, and SCA. It overlaps with Hex on DAST/API scanning and competes for the same enterprise AppSec buyer.

Direct peers

• Pentera: Pentera is the leading automated security validation platform, performing continuous, agent-driven penetration testing across enterprise networks, endpoints, and cloud — the closest direct competitor to Hex's autonomous pentest model.
• Hadrian: Hadrian offers AI-powered, continuous penetration testing and attack surface management for enterprise customers, directly competing with Hex on the autonomous-agent pentest thesis with similar target buyers and use cases.
• Cobalt: Cobalt operates a Pentest-as-a-Service marketplace connecting customers with vetted human researchers — the incumbent model Hex is positioning against as a fully autonomous alternative.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights6 records

Customer concentration

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds1 record

Investors1 record

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Anytool