Hex-Rays to Buy Israeli AI Security Startup HexAI

CTech (Calcalist) reported on 18 October 2026 that Hex-Rays, “the Belgian developer of the reverse-engineering tool IDA Pro, is acquiring Israeli startup HexAI (previously Ventris) in a deal valued at $30 million to $35 million.”

That dollar range is CTech’s reported figure. It is not confirmed in the article by Hex-Rays or HexAI. CTech’s wording is that Hex-Rays “is acquiring” HexAI — TSN is not saying the deal has closed. At draft time, no matching announcement was found on Hex-Rays’ website or blog.

What Hex-Rays and IDA Pro are

Hex-Rays is a Belgium-based software company best known for IDA Pro, a long-standing professional tool for reverse engineering binaries. On its product pages, Hex-Rays describes IDA Pro as a disassembler, decompiler and debugger used to analyse compiled software when source code is unavailable — the work of mapping machine code back into something humans can inspect for vulnerabilities, malware behaviour or interoperability. That background matters because HexAI’s pitch, as CTech summarises it, is an AI-agent layer aimed at the same security-research world IDA already serves.

What CTech says HexAI built

Founded in 2025 by 25-year-old Elon Gliksberg, HexAI “has remained in stealth while developing an operating system for AI agents designed to conduct security research.” CTech adds: “The six-person company did not raise outside capital, and Hex-Rays plans to invest in expanding its operations in Israel.”

CTO Amit Schendel served alongside Gliksberg in Israel’s Unit 8200, CTech reports.

On the product, CTech writes that the platform “analyzes source code and binary files to identify known vulnerabilities, including those associated with Common Vulnerabilities and Exposures (CVE) identifiers, as well as zero-day vulnerabilities, malware and backdoors.” It “is not tied to a specific AI model and can operate in air-gapped environments.”

Gliksberg is quoted: “Instead of relying on generic agents operating on their own, which are expensive and unreliable, our users can focus on what they want to research, measure performance and validate findings.”

Customer claims — HexAI’s, not verified here

CTech says HexAI “serves government and commercial customers in Israel and internationally” and that “The company says its customers have reported improvements in both the quality and quantity of security findings, alongside substantial reductions in AI model costs,” including with open models. No customers are named, and no benchmarks are published in the article. Treat those gains as HexAI’s claims relayed by CTech.

Caveats to keep attached

Price: “$30 million to $35 million” is CTech’s valuation of the deal, unconfirmed by either company.
Status: Reported as Hex-Rays “is acquiring” HexAI — not described here as closed, completed or already integrated into IDA.
Company silence: No Hex-Rays press note found on its public site/blog at the time of writing.
Unrelated “Hex” brands: Sites such as hex.ai (analytics) and hexai.ai (social agents) are different products and are not this startup.

Why it matters

Buying an AI-agent “operating system” for security research would extend Hex-Rays beyond classic interactive reverse engineering into orchestrated agent workflows — if the deal proceeds as reported. Related TSN threads: Rocket Software’s purchase of Geniez AI (also a six-person Israeli agents startup), Cohere’s letter of intent for AI security startup AISLE, and the open-source REA reverse-engineering MCP tool explainer.

What’s still unknown

Whether Hex-Rays or HexAI will publish a joint statement and confirm price
Closing date and how HexAI’s stack would sit beside IDA Pro
Named customers or third-party evaluations of the agent OS
How large Hex-Rays’ planned Israel expansion would be

What this means

CTech says Hex-Rays, the Belgian maker of IDA Pro, is acquiring Israeli HexAI (formerly Ventris) — a six-person, 2025-founded, bootstrapped builder of an AI-agent OS for security research — for a reported $30m–$35m, with plans to expand in Israel. Keep the price as reported, not confirmed, and do not treat the deal as closed until the companies say so.