attack-surface-management
(25)
The Security Scanner That Let Everyone Write the Alarm
ProjectDiscovery made vulnerability checks readable, remixable and free. Then it discovered the harder problem: somebody still had to run the machinery, judge the evidence and carry the fix across the company.
Intel 471 Knows What Cybercriminals Are Shopping For
Stolen logins. Network access. A reliable accomplice. Intel 471 follows the business of cybercrime - and turns what it learns into work a security team can actually do.
Solutions II Learned the Expensive Value of Saying No - Then Built a Security Business Around It
The Colorado IT provider survived a culture-clash acquisition, turned security into a major line of business, and now sells a practical idea: the data center is no longer a place. It is a promise that critical systems keep working.
Panorays Turns the Spreadsheet Nobody Wants Into a Risk Decision You Can Defend
The vendor questionnaire was built for a slower internet. Panorays is betting that a live map of suppliers, attack surfaces and business impact can turn weeks of cyber due diligence into a decision made in days.
Axonius Bet Every Security Team Had the Same Blind Spot - Then Turned Inventory Into a $200 Million ARR Business
The clever part was not finding one more signal. It was making hundreds of tools compare notes - and turning the discrepancies into a product security teams could act on.
Bugcrowd Built a Switchboard for Hackers - Now It Wants to Put AI on the Line
Bugcrowd turned an awkward corporate question - how do you invite strangers to attack your software safely? - into a managed marketplace. Its next wager is that machines should cover the map while human hackers chase the strange paths through it.
Hive Pro Wants Security Teams to Fix the 1% That Matters - Not Admire the Other 99%
Most security teams do not suffer from too little vulnerability data. They suffer from a queue that never ends. Hive Pro is selling a way to turn that backlog into a short, defensible list of fixes.
Liongard’s Bet: The MSP Tool That Turned Stale Documentation Into a Living Map
MSPs used to document a client’s network and watch the truth expire. Liongard built a business by turning that slow leak of accuracy into a continuously updated asset-intelligence layer - useful when the rollout discipline is as good as the software.
FireMon Built a Business Cleaning Up the Firewall Rules Nobody Wants to Touch
Every enterprise wants zero trust. First, someone has to explain the 10-year-old firewall rule labeled “temporary.” FireMon sells the control plane for that unglamorous, expensive job.
UpGuard Turned a Month-Long Vendor Security Review Into One Week
Its pitch to lean security teams is refreshingly practical: stop chasing questionnaires and disconnected alerts, then turn outside-in evidence into a decision someone can defend.
Bishop Fox Built a $154 Million Business by Breaking Into Companies Before the Bad Guys Do
The 20-year-old security firm turned pentesting from a periodic fire drill into a managed, continuous service. Its wager is simple: machines can scan the internet, but humans still decide what is actually dangerous.
Recorded Future Spent Three Years Lost - Then Turned Internet Noise Into a $2.65 Billion Signal
The founders tried to organize the future, wandered for years, then found a sharper business: tell defenders which threats matter before the damage begins. The result is a useful lesson in focus, patient category-building and making expensive software earn its keep.
The Pentest That Never Clocks Out
A solo hacker in Madison got tired of writing the same annual report twice. So he built software to run the test all year - and turned continuous penetration testing into a business.
Blackpanda
Top-tier incident response, proactive readiness intelligence, and seamless access to cyber insurance - all in one platform. Delivered at less than 10% of the cost of traditional IR.
Cyble
Cyble is an AI-native threat intelligence company that continuously monitors the surface, deep, and dark web to help enterprises and governments detect, predict, and disrupt cyber threats before they cause damage. Founded in 2019 by Beenu Arora and Manish Chachada, the company packages dark web monitoring, digital risk protection, attack surface management, and agentic AI analysis into a unified platform used by organizations ranging from agile startups to Fortune 50 companies and national agencies.
CYRISMA
CYRISMA is a Rochester, New York-based cybersecurity company that builds a unified, cloud-hosted cyber risk management platform for Managed Service Providers (MSPs), MSSPs, and internal IT teams. It consolidates vulnerability and patch management, sensitive data discovery, secure configuration scanning, attack surface visibility, dark web monitoring, compliance tracking, and risk monetization into a single multi-tenant dashboard - replacing a stack of point tools with one affordable, per-endpoint-priced product. Founded in 2018, the company raised a $7M Series A in 2024 and serves thousands of organizations through partners.
Praetorian
Praetorian is an Austin, Texas-based cybersecurity company that helps organizations prevent breaches by combining an adversarial, offensive-security mindset with automation and AI. Founded in 2010 by CEO Nathan Sportsman, the firm pairs elite red-team engineers with its flagship Chariot platform for Continuous Threat Exposure Management (CTEM) and attack surface management, plus services spanning penetration testing, cloud and product security, and adversarial emulation. Its clients include large technology, finance, healthcare, and automotive organizations, and it maintains open-source tools such as the Nosey Parker secrets scanner.
Rescana
Rescana is a cybersecurity company that builds autonomous, AI-agent-driven third-party risk management (TPRM) and external attack surface management software. Its platform discovers, classifies, assesses, monitors, and helps remediate risk across a company's vendor ecosystem - including vendors with no web presence - using agentic AI and open-source intelligence (OSINT). Founded by Guy Halfon and based between New York and Tel Aviv, Rescana targets regulated, vendor-heavy industries such as banking, telecom, healthcare, real estate and government, promising vendor-risk oversight that scales without a proportional increase in security headcount.
watchTowr
watchTowr is a Singapore-based cybersecurity company that builds a real-time attacker's view of an organization's external attack surface, then continuously discovers and validates exploitable vulnerabilities before adversaries can use them. Founded in 2021 by offensive-security specialist Benjamin Harris, its platform blends external attack surface management, continuous automated red teaming, AI-driven rapid reaction to emerging threats, and autonomous edge mitigation. watchTowr is also known for watchTowr Labs, a research team whose public disclosures on Citrix, Fortinet, Ivanti, SonicWall and other enterprise software regularly make headlines. The company serves Fortune 500 firms and critical-infrastructure operators and has raised roughly $29-30 million, including a $19M Series A led by Peak XV.
Censys
Censys is a cybersecurity company that runs one of the most comprehensive real-time maps of the public internet. Born from the ZMap internet-scanning project at the University of Michigan, its Internet Intelligence Platform scans billions of IP addresses and certificates to power attack surface management, threat hunting, and exposure management. Trusted by more than half of the Fortune 500 and by U.S. intelligence agencies, Censys helps defenders see what attackers can see - unknown assets, exposed services, and adversary infrastructure - so they can find and fix risk before it is exploited.
CyCognito
CyCognito is a cybersecurity company that builds an external exposure management platform. It maps an organization's internet-facing attack surface the way an attacker would - discovering unknown, unmanaged, and forgotten assets across cloud, web, and APIs, then testing and prioritizing the risks that actually matter. Founded in 2017 by former Israeli intelligence (Unit 8200) operators, CyCognito counts large enterprises like Tesco, Colgate-Palmolive, Panasonic and Hitachi among its customers, and raised a $100M Series C in 2021 at an $800M valuation.
Strike
Strike is a cybersecurity company that runs always-on, continuous penetration testing by combining AI-driven offensive emulations with validation from an elite network of human ethical hackers it calls Strikers. Its platform and proprietary engine, Strike360, continuously test web apps, APIs, mobile apps, cloud infrastructure and internal networks, then guide teams through remediation and compliance. Founded in 2021 by Santiago Rosenblatt - a hacker since age six - Strike protects 120+ enterprises across 20+ countries, including Santander, Mercado Libre and Okta.
BlueVoyant
BlueVoyant is a New York-based cyber defense company that combines a cloud-native technology platform with a 24x7 global security operations team to protect organizations from threats inside and outside their network. Its full-spectrum platform spans managed detection and response (MDR/MXDR), digital risk protection, and supply chain (third-party) cyber risk defense, drawing on global telemetry, dark web intelligence, and a deep partnership with Microsoft and Splunk. Founded in 2017 by James Rosenthal and Thomas Glocer, the company serves enterprises and governments worldwide and has raised roughly $695M to date.
Cobalt
Cobalt is the pioneer of Pentest as a Service (PtaaS), pairing a curated community of vetted offensive-security experts (the Cobalt Core) with a SaaS platform that turns penetration testing from a months-long procurement exercise into an on-demand, continuous program. Founded in 2013, the company now serves 1,500+ customers and is leaning hard into AI-augmented offensive security.
Forward Networks, Inc.
Forward Networks builds a vendor-agnostic network digital twin - a mathematically accurate model of cloud and on-prem networks that lets enterprises query, verify, and harden infrastructure that has long since outgrown human capacity to reason about.