Ten thousand alerts.
One pentest a year.

Built by people who lived the annual pentest.

At his previous scaleup, Jeff Babb was CTO and ran the security program: years of SAST and DAST tooling, SOC 2 audits, GRC platforms, auditor questionnaires, and the annual engagement with outside penetration testers. What that produced was a backlog of more than 10,000 vulnerability alerts and exactly one piece of real proof a year — a manual pentest, scoped to a snapshot, out of date the week after it landed. The codebase changed every day. The proof did not.

Jake Westbrook ran go-to-market alongside him and kept hearing the same thing from every company they sold to: security got checked annually, shipping happened daily, and everyone knew the gap was there. Meanwhile AI was pushing engineering output — and the vulnerabilities that come with it — up and to the right, while the time from disclosure to exploit in the wild collapsed from weeks to days.

So they built the tool Jeff had always wished he had: autonomous agents that attack a pre-production environment with working exploits, and hand back proof — the request, the response, the reproduction steps — instead of a list of maybes. Xora is headquartered in Utah’s Silicon Slopes and came out of stealth in August 2026. It has found critical-severity vulnerabilities in every codebase it has assessed.

“I built the exact tool I always wished I had.”