The story of how Arcseer
came to exist — and why it matters.

From too expensive
to irresistible.

The early costs of LLM-powered AI made serious, production-grade use of the technology for security assurance effectively prohibitive. Running meaningful assessments at the token volumes required was not a viable commercial proposition. We were not alone in recognising this — but we were also not willing to build something that only worked on paper.

What changed that calculation was not a single breakthrough but a compounding of several. Model capability improved exponentially while inference costs dropped substantially. Reasoning quality — the ability of a system to work through a multi-step problem with the kind of structured logic that security work demands — reached a threshold that made previously theoretical applications suddenly tractable. By early 2025, the picture had changed materially. The tipping point had arrived.

Initial experiments yielded results that moved us from interested to genuinely excited. Not because the technology was perfect — it was not — but because the direction was clear and the trajectory was compelling. We began a more serious development effort.

Building something
that actually works.

What followed was a genuine engineering and research challenge. Building an AI-driven penetration testing capability that produces outputs a senior security professional would trust required solving a series of interconnected problems that do not yield to off-the-shelf answers.

Multi-agent architectures gave us the ability to decompose complex assessments into parallel workstreams — running reconnaissance, exploitation, and analysis simultaneously rather than sequentially. Budget-managed assessment design allowed us to control the scope and depth of each engagement with the precision that enterprise clients require. MCP adoption and tool access gave the agents the ability to interact with real systems in the ways that matter. Memory techniques and embedding management addressed the challenge of maintaining coherent context across long and complex assessments. Each of these capabilities was developed, tested, and refined against real-world conditions.

We also witnessed, at close range, the rise of what the industry came to call AI slop — the flood of low-quality, unverified, hallucination-prone output that AI tooling was producing in adjacent fields, and the damage it was beginning to cause in security specifically. Bug bounty programmes were being overwhelmed with automated noise. Reports were being filed that had not been validated. Findings that looked real in a summary were incoherent under scrutiny. The reputational damage to the idea of AI-assisted security work was real, and it was being caused by tools that had been built fast without being built carefully.

Hallucination management became one of our core technical concerns. An AI system that invents vulnerabilities is worse than useless — it actively undermines the trust that security assurance depends on. Our approach required that every finding be grounded in evidence that could be traced, reproduced, and reviewed. If it could not be verified, it did not make the report.

Humans in the loop —
not out of it.

We had the technical ambition to build a fully automated assessment platform. But we did not want to take humans out of the process. That distinction matters, and it is not a compromise — it is a deliberate position.

The value of experienced offensive security professionals does not disappear when AI can automate reconnaissance or chain exploits at scale. It concentrates. What seasoned practitioners bring — contextual judgement, pattern recognition developed across hundreds of real engagements, the ability to recognise when an anomaly is interesting rather than just anomalous — becomes more valuable in an AI-augmented workflow, not less. The question is not whether to include human expertise, but how to deploy it where it creates the most impact.

Our model ensures that qualified security professionals are present throughout. In review, in supervision, in the interpretation of complex findings, and in direct contribution when the nature of an engagement calls for it. Automation handles the volume and the velocity. Humans handle the judgement. The result is something neither could produce alone.

The journey has only just started.

We do not believe we have finished building Arcseer. We believe we have started. Our research identifies new capabilities and possibilities with remarkable regularity, and we intend to pursue them rigorously.

The cybersecurity industry has always been driven by research — research undertaken by some of the most talented and intellectually committed individuals in technology. That will not change. What AI changes is the speed at which insights can be operationalised, the scale at which hypotheses can be tested, and the range of attack scenarios that can be explored in a single assessment. The practitioners who understand both domains — offensive security and AI capability — are among the most valuable people in the industry right now. We have built a team around that intersection.

The threat landscape will continue to evolve. Attacker tooling will continue to incorporate AI. The demands placed on defenders will continue to grow. We are building a platform designed to move with that landscape — not to describe it from a distance, but to stay ahead of it.