CodeWall, a London-based cybersecurity startup, has closed a $4 million pre-seed round led by Osney Capital, with backing from InReach Ventures, Antler, and several angel investors. The company announced the funding on October 14, 2026, but declined to share its valuation.
The round represents the entirety of CodeWall's financing since its March 2026 incorporation—an unusually large pre-seed for a company this young, though perhaps not surprising given the pedigree of its founder and the intensity of enterprise security concerns.
At its core, CodeWall deploys what it calls autonomous attack agents: software that probes corporate defenses the way an external adversary would, starting with no credentials, no source code, no inside knowledge. The agents work together through what the company describes as a persistent investigation graph, linking vulnerabilities into verified exploit chains complete with step-by-step proof of concept.
The platform runs continuous tests across web applications, APIs, large language model deployments, and MCP servers. Some tests are broad surface scans; others dig deeper through blackbox or authenticated gray-box methods. CodeWall also offers targeted "Hunts" that pull from CISA's Known Exploited Vulnerabilities catalog, the National Vulnerability Database, GitHub Advisories, and earlier findings. Each hunt concludes with one of three outcomes: confirmed vulnerability, clean verdict, or inconclusive with explanation.
Safety mechanisms are baked in—scope enforcement, depth controls, action restrictions, approval gates. The company points to its Adversarial Cyber Agent Proof certification, an open standard that evaluates scope adherence, resistance to prompt injection, prevention of destructive actions, operational transparency, and resource discipline. Whether that certification carries weight beyond CodeWall's own claims remains to be seen; the cybersecurity industry has no shortage of self-awarded badges.
Axos Financial, a publicly traded bank holding company, is working with CodeWall as a design partner. "We're working with CodeWall to bring autonomous offensive security into our security program," said Raghu Valipireddy, the bank's senior vice president and chief information security officer. The company says other banks and financial institutions are already using the platform, though it has not named them.
The founder, Paul Price, built his reputation over the past decade under the handle @darkp0rt. In 2015, he disclosed a security flaw in Moonpig's website. A year later, Fortune reported his discovery of a bug in Domino's Android app that would have allowed free pizza orders—a vulnerability with obvious appeal, if ethically fraught implications. Price holds CISSP and CSIR certifications dating to 2018 and 2017.
What likely caught investor attention was Price's research from earlier in 2026, which demonstrated his platform's capabilities in dramatic fashion. In March, a CodeWall agent reportedly gained read and write access to McKinsey's production database for its Lilli AI tool in roughly two hours. The Register covered the incident; McKinsey later stated that a third-party forensic review found no evidence that client data had been accessed by Price or any other unauthorized party. CodeWall followed with similar findings at BCG's X Portal and Bain's Pyxis platform. All three consultancies have since remediated the issues, according to the company.
The funding will support expansion of the platform's operational scope, development of sustained testing and remediation workflows, and hiring across offensive security, engineering, customer success, and sales. CodeWall's careers page currently lists openings for security researchers, penetration testers, software engineers, technical customer success roles, a forward-deployed offensive security engineer, and a founding account executive—all based in London.
"Enterprises shouldn't have to wait for a real attacker to find out whether their defenses hold," Price said. "We're turning offensive security from a periodic assessment into a permanent capability."
The company enters a market where automation in attack-surface management and penetration testing has been heating up. Amsterdam-based Hadrian recently raised $40 million, bringing its total to $65 million. Horizon3.ai has raised roughly $100 million and claims to have run more than 150,000 autonomous penetration tests. Pentera, another player in the space, disclosed a $60 million Series D in early 2025 and reported surpassing $100 million in annual recurring revenue.
Paul Wilkes, a partner at Osney Capital, framed CodeWall's approach as an opportunity to flip the traditional defensive posture. Osney closed its debut fund at a £60 million hard cap in June, giving the firm dry powder to back early-stage enterprise security bets. Whether CodeWall can translate technical prowess into sustained commercial traction is the test that matters now—one that money alone won't solve.
