AvalonX Emerges From Stealth With AI-Powered Continuous Penetration Testing for Small Businesses

A new AI security startup from Alpharetta, Georgia, has stepped out of stealth with a pitch aimed squarely at smaller companies. AvalonX announced on October 28, 2026 that it has raised 10 million dollars in funding and launched a continuous, AI-powered penetration testing platform. The company says its system combines autonomous attack simulation with human expertise, and it is built for small and midsize businesses that cannot afford a full enterprise security team.

Penetration testing is a controlled attempt to break into a system before a real attacker does. Large companies run these tests often, sometimes constantly, with in-house red teams and outside consultants. Smaller firms, by contrast, often test once a year, if they test at all. AvalonX argues that gap is the problem: systems change every week, new software ships, staff join and leave, and threats keep moving, while a once-a-year report quietly goes out of date.

What AvalonX says its platform does

According to the company announcement, AvalonX runs ongoing simulated attacks against a customer’s systems rather than a single point-in-time test. Its security AI was trained on nine years of real-world offensive security data, the company says, and it is designed to find weaknesses in the same way an attacker would, then report them with enough detail for a small team to act.

The platform pairs that automation with human review. That combination matters, because automated scanners alone often produce long lists of findings with little sense of what is urgent. A human analyst can check whether a finding is a real risk in context, whether it can actually be exploited, and what fix should come first. AvalonX says this blend is what makes continuous testing practical for businesses without a dedicated security staff.

The company describes its target customer in plain terms: a 50-person accounting firm, a regional manufacturer, or a similar business that faces the same attack methods as a large enterprise but with a fraction of the budget. Its pitch is a monthly subscription model, which spreads the cost across the year instead of asking for a large one-off payment for a single test.

Why smaller businesses are an exposed target

The announcement points to a striking figure from Verizon’s 2025 Data Breach Investigations Report: ransomware appeared in 88 percent of breaches involving small and midsize companies, compared with 39 percent at larger organizations. That contrast, AvalonX argues, shows why periodic testing leaves smaller firms exposed for most of the year.

There is a simple logic behind the claim. Attackers often look for the easiest way in, not the biggest prize. A small supplier, a local professional firm, or a regional manufacturer can hold valuable data, connect to larger partners, or process payments, and still run with a lean IT team. When testing happens only once a year, a weakness introduced in February can sit unnoticed until the next scheduled test, or until someone exploits it.

Who is behind the company

AvalonX is led by Craig Goodwin, its chief executive and co-founder, who previously served as chief information security officer at Fujitsu, Monster, and CDK Global, according to the announcement. That background is part of the company’s credibility pitch: Goodwin says he built AvalonX to offer smaller businesses the kind of testing he relied on as an enterprise security chief.

The funding round came from Ridown Capital, and the company says it spent 18 months in stealth before launch. Eighteen months is a long quiet period for a startup, and it suggests the team spent that time building the platform and training its models before seeking public attention. The announcement does not disclose customer numbers, pricing tiers, or independent test results, so those claims remain company statements for now rather than verified performance data.

What to check before trusting any continuous testing tool

AvalonX is not the only company selling continuous testing, and buyers should compare tools on the same questions. First, ask what is actually in scope: which systems, applications, and cloud accounts will be tested, and which are left out. A test that skips the customer portal or the remote access tool may miss the most likely entry point.

Second, ask how findings are validated and ranked. A useful report explains the risk in plain language, shows evidence, and lists the fix in order of urgency. A report that dumps hundreds of low-priority alerts on a two-person IT team will likely sit unread.

Third, ask about safety rules. Penetration testing, even simulated, must avoid disrupting live systems, corrupting data, or locking users out. A reputable provider should explain its guardrails, its testing windows, and how it handles a finding that could cause an outage if exploited in the test itself.

Fourth, check what happens after the finding. Testing only helps if fixes are tracked to completion and then retested. Ask whether the platform verifies that a fix worked, and whether it keeps a history a business can show to a customer, insurer, or auditor.

What this launch says about the security market

AvalonX joins a crowded field of security tools aimed at smaller businesses, from managed detection services to automated vulnerability scanners. Its specific bet is that offensive testing, once reserved for large enterprises, can be packaged as an affordable subscription. If that bet works, it could push more small firms to test far more often than once a year.

For now, AvalonX is a new name with a clear pitch and a fresh funding round, not yet a proven track record in public. Small businesses watching this space should note the launch, compare it with other options, and judge any tool by its findings, its fixes, and its safety record, not by its launch announcement alone.

Frequently Asked Questions

What is penetration testing?

Penetration testing is a controlled, authorized attempt to find weaknesses in a system by simulating an attacker. The goal is to discover flaws before a real attacker does, then fix them in order of risk.

How is continuous penetration testing different from a yearly test?

A yearly test gives a snapshot at one moment in time. Continuous testing runs simulated attacks on an ongoing basis, so weaknesses introduced by new software, new staff, or changed settings can surface sooner.

Should a small business replace its other security tools with a testing platform?

No. Testing finds weaknesses, but it does not replace patching, backups, strong passwords and multi-factor authentication, staff training, or an incident response plan. It works best as one layer inside a broader security routine.