The Story
A defense company that thinks offense
Here is a fact that keeps chief information security officers awake: the asset most likely to get you breached is one you don't know you own. A marketing microsite spun up for a campaign in 2019. A test server a contractor forgot to decommission. A subsidiary in another country running its own web stack. Attackers don't care which of your assets are on the official inventory. They scan the entire internet, find the weak one, and walk in through it. CyCognito is a company organized entirely around that fact.
Founded in 2017 and headquartered in Palo Alto, CyCognito sells what the industry now calls external exposure management - or, in the older phrasing, attack surface management. The product does three things in a loop: it discovers all of an organization's internet-facing assets (including the unknown and unmanaged ones), it tests those assets the way an attacker would probe them, and it ranks what it finds so a security team knows what to fix first. The interesting part is what it does not require. No agents to install. No integration project. No configuration. CyCognito looks at your organization from the outside, because that is exactly where an attacker stands.
The founders came to this honestly. CEO Rob Gurzeev was CTO of the product department of Israel's Unit 8200, the elite military intelligence corps, and ran offensive security for both intelligence agencies and the private sector before flipping to defense. CTO Dima Potekhin is a self-taught engineer who started coding at nine, holds patents in internet-scale infrastructure, and received the Israel Defense Prize. The premise of the company is essentially their old day job, pointed in the opposite direction: do the reconnaissance an attacker would do, but deliver the results to the target instead of exploiting them.
