If your malware lab or product security team runs IDA Pro, the AI part of your reverse-engineering stack is about to become a second purchase. Hex-Rays, the Belgian company behind IDA, has agreed to buy HexAI (formerly Ventris), a six-person Israeli startup that builds workflows for AI agents doing vulnerability and malware research, in a deal valued at $30 million to $35 million, according to CTech. The same report says new research tools built on Hex-Rays' reverse-engineering expertise "are currently available exclusively through HexAI, according to the company." So the AI capability you may have expected inside your next IDA renewal is, for now, a separate product with no published price.
Hex-Rays had not posted the deal on its own blog when this was written; the latest entry there is an October 8 note on IDA 9.5 licence management. Every term below rests on CTech's October 18 report and a RuntimeWire follow-up the same day, which adds no new terms of its own.
What Hex-Rays Is Actually Buying
Hex-Rays is buying a six-person team and an agent-orchestration layer that rides on other companies' models. CTech describes HexAI as an operating system for security-research agents: it analyses source code and binaries for known CVEs, zero-days, malware and backdoors, and it lets researchers build, run, measure and validate agent workflows. It also ships prebuilt workflows that HexAI's own researchers keep testing against benchmarks.
Founder and CEO Elon Gliksberg, 25, started the company in 2025 with CTO Amit Schendel, a former Unit 8200 colleague. It never raised outside capital, and all six employees are joining Hex-Rays. Gliksberg's pitch, as CTech quotes it: "Instead of relying on generic agents operating on their own, which are expensive and unreliable, our users can focus on what they want to research, measure performance and validate findings."
Two properties matter most to a security buyer. CTech says the platform "is not tied to a specific AI model" and "can operate in air-gapped environments, where systems are isolated from external networks." It also reports that HexAI's customers, government and commercial in Israel and abroad, saw large cuts in model spend, and that "those gains can be achieved using open models." Treat that as a vendor claim. RuntimeWire notes that the customer-reported gains come with no named customers and no public benchmark results.
Why the Free MCP Server Changes the Math
You can already wire an LLM into IDA without paying Hex-Rays anything extra, and that sets the bar HexAI has to clear. On September 25, Hex-Rays published its official IDA MCP server, described as "free and open source software that connects your IDA installation with AI agents." The post says it "is model agnostic and runs fully locally," that it "fits well in an airgapped environment," and that it works with IDA Pro, Home, Classroom and OEM, though not IDA Free. It installs into Claude Code, Codex and GitHub Copilot with one command, and the post's benchmarks include open-weight families such as DeepSeek, Kimi and GLM.
An MCP server is a connector: it exposes a tool's functions (decompile, list cross-references, rename) so that any compatible AI agent can call them. It does not decide what the agent should look for, check whether a finding is real, or score one workflow against another. That orchestration and measurement layer is what Gliksberg is selling, and it is where, per CTech, the new AI tooling lives.
So the deal splits the stack in two. The connector is free, open and air-gappable today. The workflows, benchmarks and validation that make agent findings trustworthy sit inside HexAI, which you will license separately on terms nobody has published.
What IDA Customers Pay Today
IDA's price list gives you no AI line to anchor a negotiation. Per the Hex-Rays pricing page, checked October 19, 2026, IDA Pro Essential is €1,099 a year, Expert €4,999 and Ultimate €8,599, with IDA Home at $365. Teams costs from $999 a year and Private Lumina $299. Subscriptions are annual only, with discounts for two- or three-year terms and volume discounts of up to 30%. IDA MCP appears under Tools with no price attached.
The roadmap tells the same story. The IDA 9.5 release post on October 6 lists three new decompilers (Android DEX to Java, Infineon TriCore and Qualcomm Hexagon to C) and no built-in AI features. The October 8 licence post adds an API that lets headless pipelines check out a floating seat and return it, which is the plumbing an agent fleet needs, and nothing more.
That leaves two plausible paths. HexAI could stay a standalone platform sold beside IDA, or it could become a paid add-on in the Teams and Lumina mould. CTech's word "currently" leaves room for either, and Hex-Rays has said nothing about bundling. If you renew a multi-year IDA term now to lock the discount, you lock it without any AI component in it.
Who Else Sells This, and What It Costs
The alternatives are cheaper to try than HexAI is to evaluate, because most of them publish something. Binary Ninja's price list runs from $1,799 for Commercial to $3,499 for Ultimate, and its Sidekick assistant can "deploy fully on-premises when binaries can't leave your network," with the self-hosted tier listed at $5,000 per floating user a year, minimum three licences. On the free side, GhidraMCP connects the NSA's Ghidra to MCP clients under Apache-2.0 and had 11.4k GitHub stars when checked. The community ida-pro-mcp project (MIT, 13k stars) now points its own users to the official Hex-Rays server.
The case for HexAI is the part none of these offer out of the box: maintained research workflows, scored against benchmarks, with a validation step built in. Hex-Rays' own July essay on how LLMs have reshaped decompilation reports that in its early experiments most binaries on a system were "fully reversible by a single Codex agent," and argues that what still matters is knowing where agents are stuck and how far to trust their findings. If that is right, the measurement layer is the scarce piece, and Hex-Rays just bought it.
The same pattern ran through the Cohere move on AISLE two days earlier: a security-research agent company absorbed by a larger vendor, with existing deployment paths left unaddressed. Frontier labs are moving into the same ground, as with Anthropic's OSS scanner.
What Breaks If You Wait
The risk sits with existing HexAI customers and with any lab that can't send binaries outside its walls. HexAI sells to government customers, and CTech singles out its ability to run disconnected and on open models. Hex-Rays has made no statement on whether air-gapped delivery, bring-your-own-model support or current HexAI contract terms survive the change of control. The last time Hex-Rays changed owner, the 2022 Smartfin-led buyout, founder Ilfak Guilfanov called it a deal that "opens new horizons for Hex-Rays," and the stated plan was to grow the company and speed up automation of its software. The HexAI deal fits that plan, and so far it comes with no published customer terms.
There's a fair counter-argument. Six people and a year-old product are a small acquisition, and Hex-Rays may simply fold HexAI's workflows into IDA once they mature. The company has not said so, and nothing in your current IDA contract obliges it to.
If you run AI research in an isolated lab, keep the connector layer under your own control either way. Our guide to the air-gapped LLM stack covers serving open weights without a vendor fee, and IBM's air-gapped Bob shows what the model gap looks like once Claude is off the table.
What to Do Before Your IDA Renewal
This Week:
- Pull your IDA renewal dates and edition mix (Essential, Expert, Ultimate, floating seats). Any renewal in the next two quarters is your leverage point.
- Install the free IDA MCP server on a sandboxed VM, as Hex-Rays itself recommends for untrusted binaries, and run one real triage job through a model you already license. You need a baseline before HexAI pricing arrives.
- Ask your Hex-Rays account manager three written questions: will HexAI be sold as an IDA add-on or standalone, will it support customer-hosted open models, and will it ship an air-gapped build.
This Month:
- If you are an existing HexAI customer, request written confirmation that your current deployment mode and model choice continue after close, and ask for the change-of-control clause in your contract.
- Run the same binary set through Binary Ninja with Sidekick and through Ghidra with GhidraMCP. Record findings, false positives and analyst hours, so HexAI's eventual pitch gets compared against your own numbers.
Before Renewal:
- Don't sign a multi-year IDA term until Hex-Rays publishes HexAI pricing or confirms in writing that AI research tooling will reach your existing edition. A one-year renewal costs you the multi-year discount and keeps your options open.
The Bottom Line
Hex-Rays has given away the connector and kept the workflow layer for a separate product. For an IDA customer, the practical answer is to build your own baseline on the free MCP server now, so that when HexAI's price list appears you can compare it with measured results from your own lab.
Get the three answers in writing before you renew.
Continue Reading
- Cohere Moves to Buy AISLE, Silent on Users Running It in Bedrock
- Anthropic's OSS Scanner Skips Human Review and the Public Advisory
- Anthropic Lifts Cyber Blocks for Pen Testers Who Let It Keep Logs
- Best Air-Gapped LLM Stack: Apache Weights on vLLM Beat NVIDIA's Fee
- IBM's Air-Gapped Bob Drops Claude for Nemotron and Laguna
- Harness Buys Augment's Cosmos With No Word on Augment Contracts