Fleuret Raises €4M to Bring Agentic AI Into Continuous Penetration Testing

Fleuret Raises €4M to Build an AI-Powered Offensive Security Platform

French cybersecurity startup Fleuret AI has raised €4 million in pre-seed funding as it works to bring agentic artificial intelligence into penetration testing and offensive security.

The funding round was led by RAISE Ventures, with participation from Auriga Cyber Ventures, Wind Capital, Better Angle, and cybersecurity-focused business angels.

Fleuret announced the round on October 5, 2026, describing its broader objective as moving penetration testing from a periodic audit toward a more continuous security process.

The company says its platform is designed around five core activities: understanding exposed systems, identifying vulnerabilities, proving that vulnerabilities can be exploited, helping teams fix them, and verifying that those fixes work.

The development comes as organizations increasingly operate systems that change frequently through new deployments, application updates, APIs and infrastructure changes. Fleuret argues that a security assessment performed at only one point in time may not reflect the attack surface that exists after subsequent changes.

That gap is where the company sees an opportunity for agentic AI.

From Periodic Pentesting to Continuous Security

Traditional penetration testing is generally performed as a defined security engagement. A security team or external penetration-testing firm assesses a specific scope, identifies weaknesses and provides a report.

That model remains important, particularly for complex security assessments and regulatory requirements. However, modern software environments can change much faster than traditional testing cycles.

A new deployment can introduce a new endpoint. An API change can alter authorization behavior. Infrastructure can be added or removed. Authentication logic can also change as applications evolve.

Fleuret's announcement focuses on this difference between how quickly technology changes and how periodically security assessments are performed.

The company's proposed approach is to use AI agents to repeatedly assess an organization's attack surface as it changes.

Rather than treating penetration testing only as a point-in-time audit, Fleuret wants its platform to become part of an ongoing security process.

How Fleuret's AI Agents Work

According to the announcement, Fleuret uses two AI agents named Emile and Champollion to automate parts of the pentester's work.

The agents are designed to map an organization's environment and explore applications, APIs and infrastructure. They then attempt to exploit vulnerabilities that they identify.

An important part of the company's approach is the use of proof of compromise.

Instead of simply reporting that a vulnerability might exist, Fleuret says its platform provides evidence showing how the vulnerability can actually be exploited.

This distinction matters because vulnerability identification and vulnerability validation are not necessarily the same thing.

A scanner can identify a potentially vulnerable condition based on a rule, signature or other indicator. Exploitation evidence can provide security teams with additional information about whether the issue can actually be used against the target.

Fleuret's announcement says every finding generated by its platform comes with a proof of compromise.

The company also describes capabilities focused on the remediation stage. These include prioritizing vulnerabilities according to exploitability, integrating with tools used by engineering teams, automatically re-testing systems after fixes and generating reports that verify whether a vulnerability has been addressed.

The intended workflow therefore extends beyond discovery.

Find → Prove → Fix → Re-test

That creates a security feedback loop rather than ending the process with a vulnerability report.

Why Agentic AI Is Relevant to Penetration Testing

The term agentic AI generally refers to AI systems that can work through a sequence of tasks toward a goal rather than simply generating a response to a single prompt.

In cybersecurity, that distinction can be important.

A conventional automated security scanner may perform predefined checks. An AI-driven system can potentially reason through a sequence of actions, evaluate results and determine what to investigate next.

Fleuret is applying this concept to offensive security.

Its agents are intended to explore an environment, identify potential weaknesses and attempt exploitation. The company describes this as automating work that would traditionally be performed by a penetration tester.

The broader industry significance is not that AI eliminates the need for security professionals. Instead, the development illustrates how AI is increasingly being applied to parts of the security testing lifecycle.

For organizations, the potential value of this approach lies in increasing the frequency of security assessment as systems evolve.

However, the company's announcement does not claim that agentic AI can replace every form of penetration testing. Additional details were not disclosed in the announcement regarding the full limitations of the approach across different types of security environments.

The Five-Part Security Model

Fleuret describes its platform around five security activities.

1. Know the exposed systems

The first step is understanding what an organization has exposed.

Applications, APIs and infrastructure can form part of an organization's external attack surface. Security testing becomes more difficult when teams do not have an accurate view of what is accessible.

Fleuret says its agents map the company's environment before investigating potential vulnerabilities.

2. Identify vulnerabilities

Once the environment is mapped, the platform looks for weaknesses within applications, APIs and infrastructure.

The goal is not simply to produce a long list of potential issues, but to identify vulnerabilities that can be investigated further.

3. Prove exploitation

Fleuret emphasizes proof of compromise.

The company says its findings include evidence showing how a vulnerability can be exploited. This is intended to give security and engineering teams a concrete basis for understanding the issue.

4. Help fix vulnerabilities

The process then moves toward remediation.

Fleuret says its platform is being developed with prioritization, engineering-tool integrations and remediation workflows in mind.

5. Verify the fix

The final step is re-testing.

After an organization fixes a vulnerability, security teams need to know whether the change actually resolved the issue.

Fleuret says its platform can automatically re-test systems and generate reports showing whether vulnerabilities have been fixed.

Together, these five stages create a closed-loop approach to security testing.

Fleuret's European Focus

The company is also positioning the platform around the European cybersecurity market.

Fleuret says it currently has around ten people and several customers, including Brevo, Stoïk and Yogosha. The company says its goal is to make offensive security more accessible to organizations that may not be able to conduct regular penetration tests.

The company also emphasizes operating from Europe and using European infrastructure.

This is connected to a wider discussion around digital sovereignty, particularly among organizations operating in highly regulated sectors.

Fleuret says its agents operate on European infrastructure and that the company intends to address increasing sovereignty requirements.

The announcement does not provide additional quantitative details about the company's customer base, revenue, deployment scale or security-testing coverage. Additional details were not disclosed in the announcement.

How the €4M Funding Will Be Used

The €4 million pre-seed round will support Fleuret's next stage of development.

According to the company, the funding will be used to hire additional people in:

• Artificial intelligence

• Software engineering

• Offensive security

The company also plans to accelerate development of its platform.

The investment gives Fleuret additional resources to develop its approach to AI-powered penetration testing and expand the product around continuous security assessment.

The round was led by RAISE Ventures, with Auriga Cyber Ventures, Wind Capital, Better Angle and cybersecurity business angels also participating.

The Founders Behind Fleuret

Fleuret was founded by Yanis Grigy, CEO, and Augustin Ponsin, CTO.

According to the company's announcement, both founders graduated from Télécom Paris and EPITA and had previously founded a company focused on penetration testing during their preparatory studies.

Their experience in penetration testing led them to focus on the difference between continuously changing technology environments and security audits that happen periodically.

The company's current strategy combines that offensive-security background with agentic AI.

What This Means for Cybersecurity Teams

The Fleuret announcement highlights a broader industry shift toward using AI not only to analyze security information, but also to participate in security operations and testing workflows.

For enterprises, this could mean security testing becoming more closely connected to software development and infrastructure changes.

Instead of waiting for a scheduled assessment, organizations could increasingly look at security testing as a recurring activity tied to changes in their technology environment.

This does not remove the need for human security expertise.

Complex environments, unusual business logic, internal infrastructure and high-impact security decisions can require human judgment. Organizations also need appropriate rules of engagement and controls when automated systems are allowed to perform security testing.

The development therefore reflects a move toward human-led security programs supported by increasingly capable automation.

AI Agents Could Change the Security Testing Cycle

Fleuret's funding announcement arrives during a period when AI agents are being applied across software engineering, IT operations and cybersecurity.

In offensive security, the appeal is relatively straightforward.

Attackers do not necessarily wait for an organization's annual security assessment. Systems can also change between security reviews.

A continuous testing model attempts to reduce that gap by making security assessment more closely aligned with the pace of technology change.

The potential benefit is not simply automation.

The more important concept is cadence.

A security weakness discovered shortly after a deployment can potentially be addressed sooner than one discovered during a later scheduled assessment.

Fleuret's model is built around this idea, with AI agents monitoring environments, attempting exploitation and supporting re-testing.

The announcement highlights a broader industry shift toward making security testing more continuous, automated and integrated with engineering workflows.

What Fleuret's Funding Signals

The €4 million round is more than a funding announcement for one cybersecurity startup. It also illustrates how the role of AI in cybersecurity is expanding.

Earlier generations of security automation focused heavily on scanning, signatures and predefined detection rules.

Agentic systems are being explored for more dynamic tasks that involve multiple steps.

In Fleuret's case, those steps involve understanding an environment, investigating vulnerabilities, attempting exploitation and validating remediation.

For security teams, the important question will be how these systems perform alongside existing security processes.

AI-powered testing still needs clear authorization, carefully defined testing boundaries and appropriate oversight. Automated offensive security tools must operate within controlled environments and agreed rules of engagement.

The long-term importance of platforms such as Fleuret will therefore depend not only on their ability to discover vulnerabilities, but also on how effectively they fit into real-world security programs.

Final Takeaway

Fleuret has raised €4 million in pre-seed funding to develop its agentic AI approach to penetration testing.

The French startup wants to move security testing beyond the traditional one-off audit by continuously monitoring attack surfaces, finding vulnerabilities, attempting to prove exploitation, supporting remediation and verifying fixes.

Its two AI agents, Emile and Champollion, are central to that approach.

The funding will support hiring across AI, software engineering and offensive security, while accelerating the development of the company's platform.

For the wider cybersecurity industry, the announcement highlights an important direction: AI agents are increasingly being positioned not just as assistants for security professionals, but as active components in security testing workflows.