Investors put $40M behind Hadrian's plan to sell attack-surface monitoring and AI pentests together

A scanner export lands in a security analyst's queue with 1,000 findings. By Hadrian's figure, about five of them are flaws an attacker could actually use ^[15][19]. Hadrian sells agents that confirm which exposures are real before a person spends time on them, and that sorting is the product ^[4].

The fundraising pitch points somewhere else. It leans on Anthropic's threat report, which covered Claude misuse from December 2025 to August 2026 ^[6]. "We have been working with LLMs since before they went mainstream, and we know that AI can work much faster than any human offensive security team," chief executive Rogier Fischer said ^[8]. He also said "most people are focused on automating the wrong bits" ^[7]. In his account, the bits worth automating are the attack paths hackers take. He said the platform emulates those paths so customers can see their biggest risks and decide where to spend their security resources ^[9].

By Hadrian's count, most users still test by hand: 87% of organizations still rely on manual penetration tests ^[14]. Damen Shipyards ran a version of that setup. Hans Quivooij, the shipbuilder's chief information security officer, said Damen used to rely on periodic assessments and a known asset inventory ^[10]. Hadrian now gives it "continuous visibility into what an attacker can actually see and potentially exploit," he said ^[11]. That describes Atlas, the monitoring half. Hadrian's claim to be different rests on the pairing, since it says no other vendor offers continuous exposure management and agentic penetration testing on one platform ^[18]. The sources do not show how many customers use Nova alongside Atlas.

The outcome numbers are self-reported. Beyond the tenfold visibility and faster fixes, Hadrian claims five times the return of manual testing ^[17]. Seeing more critical exposures measures how much got looked at. Resolution speed is closer to time-to-value. Hadrian reports it as an average across a customer base that includes McKesson, NBCUniversal, TotalEnergies, Amadeus and Leroy Merlin ^[16][12]. Smartfin partner Saumitra Dubey said the firm is backing Hadrian's plan to "build a nine-figure revenue business" ^[13].

Two variables sort the purchase. One is how fast the internet-facing estate changes. The other is whether the team loses more hours finding exposures or proving which ones are real. With a stable estate and a finding problem, an accurate inventory and the periodic test may be enough. A churning estate with the same problem points to the monitoring half alone. Stable assets buried in unconfirmed scanner output point to on-demand testing. The bundle pays where the estate churns and triage is the bottleneck. A team in that position would otherwise start each investigation over when a finding moves from monitoring to testing ^[4].

The quickest forcing number is the share of last quarter's scanner findings the team confirmed as exploitable. If it sits near Hadrian's 0.47%, the triage pitch fits ^[15]. I'd trial the platform on the churning, triage-heavy assets first. The tradeoff is concentration. When one vendor builds the map and runs the test, an asset Atlas fails to discover is also an asset Nova is never sent to probe ^[4].