A security team can own the right tools and still miss the attack. Consider the arithmetic on UltraViolet Cyber’s Equinox product page: one customer assessment identified coverage of 59 out of 222 mapped attack techniques. The same environment offered a path to 136. The proposed improvement came from getting more out of the telemetry already there. Somewhere between collecting evidence and recognizing trouble, useful information had been left idle.
That is the interesting territory UltraViolet occupies. The company sells cybersecurity services, but its central proposition concerns how specialists exchange knowledge. The people paid to find weaknesses should help the people paid to detect attacks. Then the defenders should send their discoveries back. It sounds obvious until you look at how separately those jobs can be purchased, measured, and delivered.
- Offensive testing, round-the-clock defense, and detection engineering in one operation.
- UV Lens connects the work; Solstice assists application testers; Equinox maps detection gaps.
- Buy the service, extend your existing team, or commission a focused assessment.
01Four companies, one awkward handoff
UltraViolet launched publicly in April 2023 by combining Metmox, Mosaic451, Stage 2 Security, and W@tchTower, backed by investment firm Achieve Partners. George McKenzie was its launch CEO. This was an assembly of existing practices and experience, with an organizational problem to solve: testing and monitoring could sit on opposite sides of a wall.
In cybersecurity’s color scheme, red teams imitate attackers. Blue teams defend. Purple teaming brings them together to test what defenders actually see. UltraViolet built its business around keeping that conversation going beyond a single exercise. A penetration test can feed detection engineering; operational intelligence can influence the next attack simulation.
Its practitioners include people from the U.S. intelligence community. That background matters because the job demands more than finding a suspicious line in a log. Someone must understand how an adversary moves, what evidence that movement leaves, and which signals justify waking a customer.
02The report has somewhere to go
UV Lens is the connective software: a shared view across offensive testing, detection, and response. It brings together security data, investigation, reporting, and integrations with customer workflows. Its detection-as-code approach treats detection rules as material engineers can revise when new attack knowledge arrives.
For a customer, the practical choices are broad. Managed SOC supplies continuous monitoring and investigation. Managed Detection and Response adds threat hunting and response capabilities. Dedicated Defense embeds named senior professionals inside the customer’s tools and team. Penetration tests, red team engagements, and purple team exercises probe whether the defenses hold.
A purple team engagement can produce a detection heatmap, an attack timeline, a record of missed events, and prioritized recommendations. Customers can choose a lighter exercise with a collaborative review, live observation of the red team, or operators working onsite. The choice matters: a team buying an assessment and a team trying to train its analysts need different amounts of time together to make progress afterward.
The company says it serves more than 400 Global 2000 enterprises and federal agencies. Its market includes financial services, healthcare, software, and critical infrastructure. These are buyers with existing systems, internal teams, and an uncomfortable question: who owns the space between a test finding and a working defense?
03The machine proposes. A person decides.
In September 2025, UltraViolet acquired Black Duck’s Application Security Testing services business. The transaction brought penetration testing, threat modeling, cloud and container assessments, and secure development consulting into its portfolio. Black Duck retained its software business, and the two companies established a commercial partnership.
Then came Solstice, launched in June 2026. UltraViolet describes it as an AI platform built on knowledge from more than 30,000 engagements. Specialist agents work across vulnerability classes while practitioners retain judgment. Confirmed findings, dismissed false positives, and application context can carry into later assessments. The company projects engagements roughly 20% faster; that is its claim, rather than an independent benchmark.
“The AI proposes, and our expert decides.”Aravind Venkataraman, VP of Technology, on Solstice
The distinction is useful. Repetitive testing consumes time, while deciding whether a finding matters requires context. Solstice divides that labor. Its value depends on the quality of the accumulated knowledge and the practitioner reviewing its suggestions, as much as on the model doing the proposing.
04A rule is only useful if it can fire
Equinox applies the same division of labor to defensive engineering. Its product page describes an analysis of detections and available log fields against MITRE ATT&CK and MITRE ATLAS, the latter addressing threats to AI systems. The point is to establish whether the customer’s data can support a detection, rather than simply count rules.
The distinction explains the 59-to-136 example. UltraViolet’s product page calls it a potential increase in mapped coverage, with no expected increase in alert volume. It is one customer assessment, not a promised result for every buyer. Mapped technique coverage also measures something narrower than the probability of stopping a real attack.
Engineers review recommendations and backtest candidates against 30 days of historical data. Candidates producing more than 30 alerts require further review. The fussy detail is the revealing one: adding rules can make an overloaded analyst’s day worse. Improvement has to survive contact with the queue.
05Buy the connection, measure the result
UltraViolet sits between managed security providers, specialist offensive consultancies, and an enterprise’s own security department. Buyers can compare it with separate MDR and penetration-testing suppliers, or build the coordination internally. Its case rests on operating those functions together and working with existing SIEM, endpoint, and cloud investments.
The commercial model combines managed services and scoped engagements. Its MDR page offers fixed-cost or predictable user-based pricing models. Equinox is included with Managed SOC at no additional charge and is also available separately. The buyer’s calculation concerns staff capacity, existing tools, scope, and the cost of coordinating several suppliers.
There is a practice any security leader can copy: choose an attack relevant to the business, run it under agreed conditions, inspect the evidence, tune the detection, and test again. It requires usable logs, permission to act, and people with time to review results. Without those ingredients, connecting teams on an org chart accomplishes little. The useful test of UltraViolet’s idea is what the defender learns before the next attacker arrives.