- Milan’s Bynario raised €2.1 million in pre-seed funding led by 360 Capital Partners.
- Its AI-assisted Apple bug nearly went unreported amid a bug bounty backlog.
- Vulnerability exploits now cause 31% of breaches, edging out stolen credentials.
In August, the Financial Times reported that Apple had started capping how many vulnerability reports individual researchers could submit to its bug bounty program, after a wave of fabricated findings — what security researchers now call “AI slop” — overwhelmed Apple’s review team.
Caught in that backlog was a seven-person Milan startup that had been using AI models to hunt for macOS bugs of its own. Bynario’s chief executive, Alfredo Pesoli, told the FT the flaw his team had found in Apple’s Screen Sharing technology could fetch up to $200,000 on the black market. Apple eventually reviewed the submission and patched it.
Bynario has now turned that scrutiny into money: the company has raised €2.1 million in pre-seed funding, led by 360 Capital Partners, with participation from PranaVentures.
Building the fix nobody else offers
Bynario, founded in 2025 by Alfredo Pesoli, Giancarlo Russo and Lorenzo Cavallaro, builds an autonomous application security platform called Atlas that scans code, cloud infrastructure and software supply chains for exploitable flaws.
Rather than flagging every possible issue the way most scanners do, Atlas is built to confirm which vulnerabilities are actually reachable in a customer’s specific environment, then prioritise and help fix them. A scanner might flag hundreds of theoretical weaknesses in a company’s cloud setup. In short, Bynario’s pitch is to tell a security team which handful an attacker could exploit that week.
The pre-seed round will go toward expanding Bynario’s engineering team and building out the platform for enterprise customers, though the company has not disclosed specific hiring targets.
It comes from 360 Capital Partners, a Paris- and Milan-based venture firm with more than €700 million under management and a portfolio of over 80 companies, including robotics unicorn Exotec and fellow Italian cybersecurity startup Equixly. PranaVentures, the round’s other backer, merged with fund manager P101 SGR earlier this year to form a platform overseeing more than €600 million.
“Defence at scale needs the same depth as offense. Attackers are fundamentally incentive-driven. As AI continues to reduce the cost of vulnerability research and exploitation, more exploitable vulnerabilities become attractive targets. The challenge for defenders is only becoming more acute,” said Pesoli.
AI is changing the cybersecurity arms race
Bynario is entering a security market where nearly every recent funding round has an AI angle, even if the targets differ.
Escape raised $18 million in March to run AI agents against live production systems, hunting for logic flaws that only show up once code is deployed. Qevlar AI raised $30 million the same month to automate the alert investigations that swamp corporate security operations centres. Mindgard raised $30 million in August to red-team AI models and agents themselves, turning up flaws in tools like Cursor and ChatGPT.
None of the three covers what Bynario is trying to own: the full loop from finding a vulnerability, to proving it’s exploitable, to actually closing it.
“Bynario’s approach of autonomous vulnerability discovery, validation, prioritisation, and remediation is what is needed in modern cybersecurity,” said Cesare Maifredi, partner at 360 Capital.
Giancarlo Russo, Bynario’s co-founder and chief operating officer, pointed to the team’s mixed background as the company’s edge: “We’ve assembled a team of security researchers, engineers, entrepreneurs, and academics who understand both the theory and practice of cybersecurity. That combination allows us to bridge the gap between cutting-edge security research and practical solutions that organisations can deploy at scale,” he added.
Bynario wants enterprises to trust AI to find and fix their vulnerabilities faster than attackers can exploit the. Whether autonomous validation is the fix, or whether the industry ends up needing humans to referee the AI referees, is the open question.
