AvalonX emerges from stealth with up to $10M: AI pen-testing for small businesses that attackers test least

What launched#

Artemis uses autonomous agents to test a company's defenses the way a malicious actor would, according to AvalonX: searching for ways in, then determining how far an attacker can move once inside. The platform is powered by Aether, the company's proprietary 400-billion-parameter security AI, trained on nine years of real-world offensive-security data and backed by 60 billion dark-web records. Those are AvalonX's figures, not independently verified results, and they are the core of its claim: a model steeped in attack data should find the paths a checklist scan misses.

Autonomous testing supplies the speed and scale. AvalonX's human penetration testers supply the judgment: potential vulnerabilities that require expert analysis are evaluated by a tester, so customers get what the company calls meaningful, actionable findings rather than a flood of automated alerts. It is a deliberate division of labour, and a familiar one in security — machines for breadth, people for the calls that decide whether a finding matters.

Why small businesses are the target#

Smaller organizations face many of the same attack vectors as large ones, AvalonX argues, but with smaller teams, less money and fewer chances to test whether their defenses hold. Many rely on periodic penetration tests, leaving long stretches between assessments while systems, software and threats keep changing. The company cites Verizon's 2025 Data Breach Investigations Report, which found ransomware in 88% of breaches involving small and midsize companies, compared with 39% at larger organizations.

“Large enterprises test constantly. They have red teams, consultants, and budgets to match,” said Craig Goodwin, AvalonX's CEO and co-founder and a former chief information security officer at Fujitsu, Monster and CDK Global. “A 50-person accounting firm or a regional manufacturer faces the same threats as their enterprise counterparts with none of the concomitant resources to protect themselves. Most such organizations test once a year, if they can afford it, and attackers don't wait eleven months to strike.”

How it works#

The customer experience is intentionally straightforward, by design rather than by accident. A business enters its domain, defines what AvalonX is authorized to test, and receives results the same day. External testing requires no software installation, and findings are written in plain language with clear next steps. Findings also map to SOC 2, ISO/IEC 27001, PCI DSS v4.0 and HIPAA, which matters for small firms whose customers and auditors ask for those frameworks by name.

The service runs as a monthly subscription combining autonomous attack simulation with human expertise, and businesses can run a free initial test. AvalonX has not disclosed subscription pricing, so the affordability claim — the whole pitch, really — is still unpriced. The authorization step is also doing real work here: an autonomous agent probing a company's systems is only a pen test, rather than an incident, because the scope is defined up front.

Who is behind it#

AvalonX is led by Goodwin, Ricardo Valdes and Ben O'Nion, who bring more than 50 years of combined information security and technology experience, according to the company. The backer, Ridown Capital, is the investment firm of Onecom co-founders Aaron Brown and Darren Ridge. Onecom serves more than 65,000 small and midsize businesses, and Ridown Group's portfolio spans telecommunications, cybersecurity and e-commerce, with revenues of more than $500 million in the U.K. alone.

“At Onecom we've spent two decades serving small and midsize businesses, more than 65,000 of them today, and we hear the same thing: they're targeted like enterprises but resourced like startups,” Brown said. “AvalonX is built for them from the ground up. That's why we backed it.”

What to watch#

The open questions are the ones no launch announcement answers. How do Aether's findings compare with a traditional human-led pen test on the same target, and how often do its autonomous agents cry wolf? What does the monthly subscription actually cost, and does continuous testing stay continuous once the first free test is done? And as AI-driven attack simulation spreads, the authorization and scoping discipline — what is tested, and what is explicitly off-limits — becomes the product's most important feature, not its least glamorous one. AvalonX is available now; the evidence for its central claim will come from the customers who run it twice.

Sources: AvalonX's October 28, 2026 announcement via Presswire and coverage by Wisevoter.