Beelzebub raises €3M to trap AI-powered attackers inside enterprise networks

Beelzebub (Milan) has raised €3 million in a Seed round led exclusively by United Ventures, the Italian DeepTech VC. This follows a €300,000 pre-Seed from strategic investors and advisers; total funding stands at €3.3 million. The company was founded by Mario Candela, who began the underlying research in Milan in 2021 and incorporated Beelzebub in July 2025.

From perimeter to assumed breach

The dominant model in enterprise cybersecurity for the past two decades has been perimeter defence: keep attackers outside the network, raise an alarm if they breach it. AI-powered attackers have made that model untenable. Automated vulnerability discovery, custom malware generation, and large-scale simultaneous attack campaigns compress the window between breach and damage to the point where human response time is no longer adequate.

Beelzebub's starting assumption is the opposite: an attacker is already inside. Its platform does not try to prevent entry; it waits, detects movement, and traps the attacker before damage occurs. The approach is designed for the NIS2 Directive and Cyber Resilience Act — European frameworks that significantly raise security obligations for regulated organisations — where reactive incident response is increasingly insufficient to satisfy compliance requirements.

Inside the trap

The platform has three integrated components. Arcangelo runs continuous attack simulations to probe an organisation's defences from within, mimicking the techniques an advanced attacker would use. Beelzebub Managed deploys AI-powered decoy infrastructure across the network — fake servers, databases, APIs, and cloud systems indistinguishable from real assets — designed to attract any attacker already present. The moment a decoy is touched, the attacker is isolated and the attack chain severed.

Caronte, the platform's AI analyst, then reverse-engineers the malware and produces a full incident report. Critically, Caronte runs entirely on-premises — essential for public-sector clients and regulated enterprises that cannot route sensitive data through cloud-based analysis tools. Decoys update in real time to mirror new CVE registrations, forcing dormant attackers to reveal themselves rather than waiting silently. More than 60 independent security researchers worldwide feed live threat intelligence into the platform.

The product is available as SaaS or fully on-premises and is NIS2-ready by design. In 2025, before raising institutional capital, Beelzebub intercepted a live attack by TeamPCP — a group linked to breaches at GitHub and Microsoft — through its decoy system.

A single-investor seed

United Ventures is the sole institutional investor in this round. The Milan-based fund focuses on Italian DeepTech companies at the earliest stages; backing Beelzebub alone, without syndication, signals high conviction and a high-ownership position rather than a diversified seed strategy.

"The cybersecurity market is undergoing a structural reset: when offensive AI scales faster than any human team can respond, the only viable defence is one that operates at the same speed and intelligence," said Massimiliano Magrini, co-founder and Managing Partner at United Ventures. "In Mario's technical depth and the founding team's execution we found a genuinely distinctive approach to that problem, and backing them this early reflects our conviction that the next chapter of cybersecurity will be written by companies of this kind."

Beelzebub plans to open commercial offices in Rome and San Francisco by year-end — the US office targeting the larger enterprise security market, where NIS2 does not apply but the assumed-breach model has gained traction. The team will expand on the research side and begin developing technology specifically designed to protect AI agents, anticipating the next wave of attack surfaces as enterprises deploy autonomous systems inside their networks.