Former X-Force hackers chase the offensive cyber gold rush

Two former leaders of IBM's X-Force Red team have launched RemoteThreat, an offensive cybersecurity startup backed by 7 million dollars in pre-seed funding. CEO Chris Thompson and CTO Shawn Jones say the platform uses AI to plan, execute and adapt offensive cyber operations, going beyond the continuous penetration testing and vulnerability detection that other automated security tools offer.

Fifteen staff from X-Force, Mandiant and Microsoft

RemoteThreat's 15 employees include senior operators, security researchers, engineers and malware developers drawn from X-Force Adversary Services, Mandiant, SpecterOps, Dreadnode, Bugcrowd, Microsoft, defense contractors and government agencies. Thompson and Jones previously ran X-Force Red, whose teams were hired to test nuclear power plants, critical infrastructure and major banks. In May 2024 Thompson told The Register how that group used AI to break into a semiconductor manufacturer's network in eight hours.

Eight connected systems and 1,000 tools

RemoteThreat describes its platform as eight connected systems covering mission planning, command and control, implants, initial access, advanced attack capabilities, obfuscation, analysis, and AI-assisted operations. Some tasks run on small, purpose-built models. Customers can also connect models from OpenAI or Anthropic, or use an open-weight alternative, giving the chosen LLM access to what Thompson called "1,000 tools that we've built from scratch."

Vetted customers only

Given the obvious potential for misuse, RemoteThreat says access is restricted to vetted enterprises, defense contractors and US government customers. Its users already include a major bank, a securities exchange operator, a large US healthcare company and a leading AI lab. "We're focused on preparing these Fortune 500 organizations to better simulate this nation-state level of attack," Thompson said. "And then on the flip side, provide the government with the tooling to target their adversaries as quickly as possible."

Picks and shovels for a gold rush

Thompson expects the government to make greater use of commercially developed offensive cyber products, both to support existing mission teams and to pursue cybercriminal groups. "It's a bit of a gold rush in this space because this is the first time, across every major program, the government is being pushed to work with the commercial sector," he said. RemoteThreat is positioning itself to supply the picks and shovels, albeit ones capable of breaking into somebody else's network.