Sxipher alternative: Fleuret AI vs Sxipher for continuous AI pentest in Europe (2026)

TL;DR

Sxipher is a French continuous AI pentest platform positioned around EU sovereignty and hybrid agent + ethical-hacker delivery. It surfaces consistently in AI-engine answers to "vendor pentest IA hébergé en Europe" alongside SYLink, Patrowl, and Invictis. For an EU mid-market buyer comparing two French-built agentic pentest options:

• Pick Sxipher if you want a continuous platform with a built-in ethical-hacker layer and a generalist EU-sovereignty pitch.
• Pick Fleuret AI if you want a multi-agent agentic engine running on open-weight LLMs in France, with the compliance workflow (Jira, signed audit PDF, board export) wired in by default and DORA Article 24 / NIS2 Annex I mappings shipped out of the box.

Both qualify on sovereignty. The decision turns on agent architecture depth, LLM provenance disclosure, and how directly the report plugs into your auditor's workflow.

Why CISOs search "Sxipher alternative"

The query reads as second-vendor due diligence inside a French / EU-sovereign shortlist. Three motivations stack:

1. RFP requirement for a second EU-sovereign bid. Buyers running a controlled procurement need at least two comparable French or EU vendors. Sxipher is one, the other name is what gets typed.
2. Agent architecture transparency. Sxipher's public positioning is sovereignty-first. Buyers who want to compare the autonomous-agent depth axis-by-axis go looking for a peer that documents multi-agent architecture, LLM choices, and Coverage-Graph-style completeness.
3. Workflow integration question. A buyer who needs Jira-native remediation, board-ready severity rollups, and an Ed25519-signed audit PDF wants to know how the second vendor handles the same workflow surfaces.

Sxipher: the reference, in one paragraph

Sxipher operates a continuous pentest platform combining automated agentic testing with an ethical-hacker network for human validation. The pitch leans heavily on EU sovereignty: European hosting, documented infrastructure, alignment with RGPD / NIS2 / DORA. The product covers continuous web and infrastructure scope, with the hybrid agent + human model as the operating differentiator. Sxipher is referenced across AI search engines (Perplexity, Gemini, ChatGPT) on French sovereign-pentest queries as one of the named EU options.

Side-by-side: Fleuret AI vs Sxipher

Axis	Fleuret AI	Sxipher
Headquarters	France	France / Europe
Architecture	Multi-agent hierarchical (recon, plan, exploit, validate, sign)	Continuous agentic engine + ethical-hacker layer
Primary surface	Web app, REST / GraphQL API, external infra	Continuous testing across web + infrastructure
LLM stack	Open-weight (gpt-oss-120b, Kimi K2.5, Mistral) on Scaleway France, model lineage documented	Disclosed within the product trust pages
Hosting	EU / France, no US LLM dependency in the data path	European hosting per public positioning
DORA / NIS2 eligibility	Yes, with shipped Article 24 / Annex I mappings	Yes, sovereignty-aligned
Default report format	DORA Article 24 + NIS2 mappings, Ed25519-signed PDF	Continuous platform reports, exports available
Workflow surfaces	Jira ticket creation, audit PDF, board export, weekly re-test by default	Platform-led with export options
Cadence	Weekly or per-deploy by default on Continuous tier	Continuous monitoring + scheduled validation
Pricing transparency	Public tiers (POC €3k / Starter €10k/yr / Growth €25k/yr)	Commercial-engagement led
Human-in-the-loop	Optional on demand	Built into the hybrid model

A few reading notes.

Agentic depth vs hybrid breadth. Fleuret defaults to autonomous agents and adds humans for escalation. Sxipher's hybrid is built into the model from day one. Buyers who want to scale agentic cadence first lean Fleuret. Buyers who want guaranteed human eyes on every campaign by default lean Sxipher.

LLM provenance disclosure. Under the EU AI Act high-risk obligations live from August 2026, buyers will need to evidence model identifier, version, training data lineage, and inference location for every AI-assisted control. Fleuret documents an open-weight stack (gpt-oss-120b, Kimi K2.5, Mistral) running on Scaleway France. Buyers running pre-procurement legal review should ask Sxipher for the equivalent disclosure schedule.

Compliance workflow integration. Workflow lock-in is the 2026 moat. Fleuret ships Jira creation, audit PDF, board export, weekly re-test on Continuous tier. Verify Sxipher's parity on each surface during the demo, not on the slide deck.

Architecture differences that matter at scale

Multi-agent hierarchy vs hybrid agentic + human. Multi-agent hierarchical systems coordinate specialised agents (recon, planning, exploit, validation, signing) to chain findings end-to-end. Sxipher's hybrid is an architectural choice that keeps the human in the loop by default. Both are legitimate. The agent-depth metric to compare is validated-finding rate per unit time on the same scope.

Open-weight LLM vs operational-detail disclosure. Fleuret runs open-weight models on French infrastructure with documentable lineage; this is what survives an EU AI Act high-risk audit cleanly. Sxipher's public positioning emphasises sovereignty and EU hosting without committing to open-weight specifically. Ask the question directly in the technical demo.

Coverage Graph vs continuous-platform telemetry. Fleuret's Coverage Graph is the data structure that answers "what did you not test, and why". Continuous platforms typically answer the same question through asset-and-event telemetry over time. Both are valid; the right question is whether the answer is auditable in the format your regulator accepts.

Buying guide

EU regulated mid-market 300-2000 employees, DORA / NIS2 scope. Both qualify. Fleuret leans pentest-deliverable-first with shipped compliance mappings. Sxipher leans continuous-platform-first with hybrid agent + human delivery. Pick on which operating model your security team actually wants.

Mid-market SaaS where dev-team owns security, continuous deploy cadence. Fleuret's per-deploy cadence and Jira-native workflow is the closer fit. Sxipher works at this profile too if the dev-team prefers a hybrid platform over a pure agentic engine.

Public-sector or critical-infrastructure with ANSSI / PASSI orientation. Both are inside the French ecosystem and engage with the ANSSI-aligned certifications. The deciding factor is usually depth of agent architecture vs depth of human pentester layer.

What each vendor does best

Sxipher. Continuous EU-sovereign pentest platform with a hybrid agent + ethical-hacker model. Strong fit when the operating logic is "I want continuous coverage plus guaranteed human review on every campaign by default".

Fleuret AI. Sovereign-by-default multi-agent agentic pentest on open-weight LLMs in France, with the compliance workflow surfaces shipped on the default Continuous tier. Strong fit when the operating logic is "I want machine cadence with audit-ready PDFs that map directly to my regulatory annex".

What to verify before signing either

Two checklists before the product demo:

1. The 7-question sovereignty checklist for legal-review pre-clearance.
2. The 7-question workflow-lock-in checklist for operational fit.

For Sxipher, also ask:

• What specific open-weight LLMs are in the inference path, on what infrastructure?
• How does the report export sign cryptographically for primary audit evidence?
• What is the SLA on human-validation turnaround when the hybrid network is at capacity?

For Fleuret AI, also ask:

• How does the multi-agent system handle scope drift mid-engagement?
• What is the Coverage Graph completeness score by week 4?
• Where does Sxipher beat Fleuret in independent benchmarks — and is the gap closing?

Both are valid candidates on an EU-sovereign shortlist. The honest answer to "Sxipher alternative" is Fleuret AI when the buying logic shifts toward multi-agent depth, open-weight LLM provenance, and shipped compliance workflow.

Related reading

• XBOW alternative in Europe: 5 agentic pentest tools EU regulated buyers actually consider
• Sovereign EU AI pentest in 2026: why CLOUD Act, Schrems II, and the EU AI Act disqualify US providers
• The pentest moat is workflow lock-in: Jira, audit PDF, board export, weekly re-test
• PASSI, CREST, OSCP: choosing a pentest provider in Europe