Hadrian Raises $40 Million to Weaponize Offensive Cybersecurity, Signaling PE Demand For Proactive Defense

Amsterdam's Hadrian secured $40 million in new funding on October 6, 2026, lifting its total capital raised to $65 million and signaling that institutional investors are placing a premium on AI-native platforms that attack corporate infrastructure before criminals do.

Forgepoint Capital International and Smartfin co-led the Series B round, joined by existing investors HV Capital, Motive Partners, Picus Capital, and Oetker Ventures. Hadrian will deploy the capital across hiring in engineering and research, and geographic expansion into Europe, the Middle East, Africa, and the United States. The company was founded in Amsterdam in 2021 by Rogier Fischer, Olivier Beg, and Maurice Clin, all three of whom remain on the leadership team. Fischer and Beg began their careers as teenage ethical hackers; Fischer later co-founded LiteBit, one of Europe's early cryptocurrency exchanges .

"We have been working with LLMs since before they went mainstream, and we know that AI can work much faster than any human offensive security team," Fischer said, articulating why the platform's architecture differs from legacy penetration testing vendors .

The raise arrives as the threat environment accelerates in ways that make manual security testing structurally obsolete. Anthropic published a threat intelligence report in September 2026 covering activity from December 2025 through August 2026 that confirmed criminal and state-linked actors had weaponized its Claude models to execute attacks and probe for previously unknown vulnerabilities. Simultaneously, the ShinyHunters hacking group exploited a zero-day vulnerability in Oracle's PeopleSoft platform (CVE-2026-35273) to exfiltrate data from dozens of organizations spanning higher education, healthcare, government, and aerospace, exposing more than 5,000 FBI personnel records in the process . The offense-to-defense lag is measurable: ShinyHunters began exploiting the PeopleSoft flaw as a zero-day in June 2026, and organizations that could not apply Oracle's patch in time remained exposed even after Mandiant issued web application firewall rules, because attackers subsequently used a URL-encoding trick to bypass those protections .

The 87% Problem: Why Manual Testing Is a Structural Liability

Hadrian's core commercial thesis rests on a statistic that frames the market opportunity with precision: 87% of firms still test their systems manually, according to the company . Against a threat environment where AI-assisted reconnaissance is now table stakes for sophisticated adversaries, that figure describes not a gap but a chasm.

The platform addresses this through two integrated components. Atlas maps everything a company exposes to the internet and deploys AI agents to distinguish genuine vulnerabilities from noise. Nova executes automated penetration tests on demand. Hadrian claims customers using the platform identify ten times as many critical risks compared to manual processes, resolve problems 80% faster, and generate five times the return of traditional manual testing .

The client roster validates enterprise-grade traction. McKesson, NBCUniversal, TotalEnergies, Amadeus, Leroy Merlin, and Damen Shipyards all appear on Hadrian's customer list . These are not pilot-stage relationships. They span healthcare logistics, broadcast media, global energy, aviation software, retail, and maritime engineering, industries where a breach carries regulatory, reputational, and operational costs that dwarf any security software contract value.

Capital Efficiency and the Path to Nine Figures

Hadrian's funding trajectory reveals a disciplined deployment of capital relative to stage. A €2.5 million pre-seed round closed in 2021, followed by a €10.5 million seed round led by HV Capital in 2022. The October 2026 raise of $40 million brings the total to $65 million .

Saumitra Dubey, a partner at Smartfin, stated the firm is backing Hadrian's ambition to reach nine-figure revenue . Terms of the round were not disclosed; no valuation was made public. Revenue figures were also not disclosed, which means implied revenue multiples cannot be calculated from available data. What institutional investors can anchor to is the lead investors' public posture: Smartfin's willingness to name a nine-figure revenue target in the context of a $40 million check sizes the ambition clearly.

For context, the offensive security segment has attracted multiple strategic acquirers at significant multiples in recent years. Palo Alto Networks acquired Demisto and Cortex XSOAR assets as part of its platform consolidation strategy, and CrowdStrike built its adversarial exposure management capabilities partly through M&A. Hadrian's AI-native architecture and multi-geography client base position it as an acquisition target as much as an IPO candidate, though no transaction or listing plans were disclosed.

Geopolitical Threat Vectors Are Expanding the Addressable Market in Real Time

The timing of Hadrian's raise is not incidental. The week of October 6, 2026 produced two separate geopolitical data points that independently validate the offensive security investment thesis.

ShinyHunters, a group now subject to active FBI investigation and international arrests including a 24-year-old Dutch suspect and a teenager from Amman cooperating with US authorities, mass-exploited the PeopleSoft vulnerability to breach a navigation and digital aviation unit recently divested by Boeing, among dozens of other targets . The group's ability to pivot its attack methodology within weeks of Mandiant's published countermeasures illustrates exactly the adversarial agility that manual testing and static scanning tools cannot counter.

Separately, President Donald Trump confirmed on October 6 that the US withdrew approximately a dozen B-1 bombers from RAF Fairford in the United Kingdom due to what he described as specific threats linked to Iran, citing intelligence suggesting a potential drone attack on the aircraft . While that event is a military matter, its investment relevance is direct: nation-state threat postures are expanding beyond digital vectors to physical infrastructure, and the organizations responsible for protecting hybrid environments, digital and physical, need automated, continuous exposure monitoring at a scale no human team can sustain.

$65 million

the total capital Hadrian has raised to address an attack surface that is growing faster than any enterprise security team can manually map.

Investment Positioning: Where Offensive Security Capital Flows Next

For institutional investors, the Hadrian raise is a data point in a larger capital rotation. The cybersecurity sector is bifurcating. On one side sit legacy vendors dependent on signature-based detection and manual assessment cycles. On the other sit AI-native platforms that operate at machine speed on the offensive perimeter.

Forgepoint Capital International's co-lead position is notable. Forgepoint is a specialist cybersecurity fund, meaning this is a conviction bet from a sector expert, not a generalist crossover investor chasing thematic exposure. That matters because specialist funds conduct deeper technical diligence and their presence signals the platform's architecture cleared a high bar .

The geographic expansion strategy, Europe, Middle East, Africa, and the United States simultaneously, is capital-intensive but strategically coherent. EMEA enterprises face a different regulatory environment than US counterparts, with NIS2 compliance requirements driving mandatory security testing across critical infrastructure operators. A platform that automates penetration testing at scale addresses a compliance cost center as much as a pure security need.

The Plocamium View

Hadrian's raise is defensible on the surface metrics: credible co-leads, a recognizable client roster, and a product thesis that maps cleanly onto the current threat environment. The deeper play is one the market has not fully priced.

The offensive security category has historically been a services business. Penetration testers are expensive, scarce, and non-scalable. What Hadrian is building is the SaaS-ification of a human craft, and the 87% manual testing statistic is not a ceiling on the opportunity but a floor. Every enterprise that has not yet automated its offensive testing is a prospective customer. That is the vast majority of the market.

The second-order play is data network effects. Every automated penetration test Hadrian's Nova module runs generates proprietary data on real-world vulnerability patterns across industries, geographies, and technology stacks. Over time, that dataset becomes a moat that no new entrant can replicate, and no acquirer can easily synthesize from internal data alone. This is the dynamic that makes AI-native security platforms structurally more valuable than their current revenue multiples suggest.

Smartfin's nine-figure revenue target, stated publicly, sets a benchmark. If Hadrian reaches $100 million in annual recurring revenue, and if the market awards it a multiple consistent with high-growth SaaS security platforms, the equity value implied by the $65 million in total funding to date represents substantial institutional upside. Revenue and valuation figures are not disclosed, so no specific return multiple can be calculated here. What can be said is that the asymmetry between current capital deployed and potential exit value is the reason specialist cybersecurity funds are co-leading rounds at this stage.

The risk is go-to-market execution across two continents simultaneously. Offensive security requires trust at the CISO level, and trust is built locally. Hadrian's Amsterdam heritage gives it European credibility; its US expansion will require investment in sales infrastructure that competes directly with US-native incumbents on their home turf.

The Bottom Line

Hadrian's $40 million raise is a bet that the cybersecurity industry's shift from reactive defense to proactive, AI-driven offense is permanent and accelerating. The ShinyHunters campaign against Oracle PeopleSoft users, the Anthropic Claude misuse report, and the geopolitical threat postures materializing in October 2026 are not isolated incidents. They are the operating environment Hadrian was built for. The company that can automate the attacker's mindset at enterprise scale and global reach controls one of the most durable revenue streams in technology. Saumitra Dubey named the target: nine-figure revenue. The question for institutional capital is not whether that market exists. It is who gets there first.