attack-path-analysis
(8)
Astelia asks the $35 million question: can an attacker reach it?
A vulnerability can look dreadful on a spreadsheet and be useless to an attacker. Astelia maps the difference - then helps security teams close the paths that remain.
Miggo Security wants to buy you time before the patch
A vulnerability can become an attack before its fix reaches production. Miggo watches running applications and builds targeted defenses for the awkward interval in between.
Orchestra Group asks which security flaw deserves your Monday
A recruiting firm’s blocked scan reveals the practical idea behind Orchestra Group: map the routes to valuable assets, then give a busy IT team a shorter, better repair list.
Tenable Found 336,000 Ways In. Its Next Trick Is Telling Security Teams Which Door to Close First
Nessus made Tenable famous for finding weaknesses. Tenable One is the nearly $1 billion-revenue company’s bet that the real product is judgment: connecting IT, cloud, identity, OT and AI risk, then showing an overworked security team what to fix first.
Horizon3.ai Built an AI Hacker - Now 7,000 Companies Pay It to Break In
Annual pentests produce a report. NodeZero keeps coming back, proves which weaknesses actually lead somewhere, and checks the repair - a simple loop that helped Horizon3.ai reach 7,000 customers and a $2 billion valuation.
SubImage
SubImage is a San Francisco security startup building an open-core security graph that maps a company's cloud and SaaS infrastructure so teams can see who can access what, and why. Built by the original team behind Cartography, the open-source graph tool created at Lyft and now a CNCF project, SubImage sells a managed, agentless platform for attack path analysis, asset inventory, and misconfiguration detection. Backed by a $4.2M seed round, it positions itself as an open-core alternative to Wiz.
OX Security
OX Security is an application security company that built an Active Application Security Posture Management (ASPM) platform to give development and security teams a single, code-to-cloud view of software risk. Founded in 2021 by Check Point veterans Neatsun Ziv and Lior Arzi, OX consolidates scanning across the software development lifecycle - from source code and open-source dependencies to CI/CD pipelines and cloud - then uses context and attack-path analysis to surface the roughly 5% of vulnerabilities that are actually exploitable and reachable, so teams stop drowning in alerts. The company raised a $60M Series B in May 2025 (total funding around $94-101M) with backing from DTCP, IBM, Microsoft's M12, Evolution Equity, Team8 and others.
Sonrai Security
Sonrai Security is a New York-based enterprise cloud security company that helps large organizations lock down identity and access risk across AWS, Azure, Google Cloud and Kubernetes. Founded in 2017 by the team behind Q1 Labs, Sonrai built its reputation on a graph that maps every relationship between identities, permissions and data in the public cloud. Its flagship Cloud Permissions Firewall enforces least privilege by automatically blocking unused permissions with cloud-native, org-level policies, and its 2025 WALLy AI agent extends that to autonomously fix privilege risk across humans, machines and AI agents.