Fleuret AI raises 4 million euro pre-seed to build continuous AI-driven pentesting platform

Both accounts tie the pitch to what NIS2 asks for: more organisations must be able to demonstrate that their IT security holds up ^[6]. A one-off audit demonstrates it for a single date, and a deployment a few days later can change the attack surface that audit described ^[7]. FinTech Global says the platform covers five areas, and the last two are supporting remediation and confirming that fixes worked ^[14]. Those two are still being built. The company lists automatic retesting and reports confirming a flaw has been fixed among the tools it is developing ^[5].

The round is EUR 4 million for a company of around ten people ^[3], roughly EUR 400,000 per current employee ^[16]. FinTech Global reports the money will go to hiring in AI, software engineering and offensive security, and to building the platform faster ^[9]. Every role on that list builds or tests product, so the capital goes into the platform before it goes into selling it. The company did not disclose revenue, pricing or a valuation.

Yanis Grigy, the chief executive and co-founder, said: "We do not simply want to automate penetration testing as it exists today. Our ambition is to build the offensive security layer that will keep companies secure all year round, whatever their size. This round gives us the means to accelerate that vision and to build a platform designed for enterprise environments from day one." ^[10] The same announcement sets the goal as putting offensive security within reach of businesses that lack the budget for regular penetration tests ^[11]. Those are two different buyers. A ten-person team hiring engineers will reach one of them first.

Thibaut Schlaeppi, co-head of RAISE Ventures, said: "AI has changed the nature of cyberattacks by putting powerful tools within everyone's reach, often for free. Organisations have to test their security against every attack technique, including the newest." ^[12] He also said: "We are convinced Fleuret can become the reference in offensive security in Europe." ^[17]

If NIS2 supervisors start asking for test evidence dated after each release, a change-triggered test is what buyers need and Fleuret has a head start. If supervisors keep accepting the periodic audit, Fleuret ends up selling an automated version of the one-off test its founders already sold through the pentest company they set up together as students ^[15]. A third outcome is that the European-hosting argument ^[13] becomes the reason heavily regulated buyers sign, with NIS2 in a supporting role.

I think the middle outcome is the likeliest in the near term. The obligation both accounts describe is to show that defences hold up, and a dated audit already meets it ^[6]. The counter-case is Schlaeppi's own: if free attack tools keep changing, a dated audit goes stale faster, and buyers may move to continuous testing whatever a supervisor accepts ^[12]. The bet fails if Fleuret's clients end up running tests on a calendar and not after deployments.