AI SPERA
South Korean cybersecurity firm behind Criminal IP, an OSINT search engine and attack surface management platform for external exposure and threat intelligence.
Visit Website ↗ + Add to CompareOverview
AI SPERA develops Criminal IP, a platform that combines an open-source-intelligence search engine for malicious IP addresses, domains, and URLs with a full attack surface management (ASM) and digital risk protection (DRP) offering. In practice this means security teams can both run ad hoc lookups on suspicious infrastructure and continuously monitor their own external footprint for exposed assets, similar in spirit to tools like Shodan or Censys but packaged as a more complete enterprise ASM product.
Founded in 2017 as a spin-off from Korea University’s hacking and countermeasure research center by CEO Byungtak Kang, AI SPERA is headquartered in Seoul. The company closed a Series B round of roughly $8.5–9 million in November 2024, bringing total disclosed funding to about $17.5 million, and has used that capital to push international distribution through channel partnerships in Europe (DotForce, covering Spain and Portugal), the Middle East (Devcons, Reconn), and technology integrations with Securonix’s ThreatQ platform, Cisco, and VirusTotal.
As a newer entrant competing against established attack surface management and threat intelligence vendors, AI SPERA’s strongest evidence is its expanding international partner and integration footprint rather than independently benchmarked detection performance. The academic pedigree and rapid geographic expansion are genuine differentiators, but most of the specific effectiveness and scale claims currently trace back to the company’s own announcements.
Innovation Matrix Assessment
Active international expansion with multiple new channel partnerships announced through 2025 and continued platform integrations (Securonix ThreatQ, VirusTotal, Cisco) show a steady release and partnership cadence.
The platform reportedly integrates with 40+ SIEM/SOAR/XDR environments and is used across a claimed 150 countries, a concrete signal of operational breadth even though the underlying usage figures are vendor-reported.
An $8.5-9M Series B closed in late 2024 plus a wave of new regional distribution partnerships through 2025 (Europe, Middle East) represent genuine, well-documented growth momentum.
Functionally similar to established OSINT/ASM tools (Shodan, Censys, Recorded Future); a strong regional and global challenger rather than a fundamentally new category or approach.
Evidence is mostly vendor announcements and partner-press releases; no independent, MITRE-style evaluation or named enterprise breach-prevention case study was found to substantiate detection or ASM accuracy claims.
Attack surface management and OSINT-driven threat intelligence remain core, high-demand categories for security teams managing sprawling external footprints.
Why CISOs Should Care
Gives security teams a single place to search and continuously monitor externally exposed IPs, domains, and infrastructure for compromise indicators, useful for both proactive attack surface management and reactive incident investigation.
What Makes It Different
Combines a public-facing OSINT search-engine model with a more complete enterprise ASM/DRP product, and carries an unusually academic pedigree as a spin-off of a university hacking-research lab rather than a typical commercial startup origin.
The Matrix Verdict
58/100 — INCREMENTAL INNOVATOR
A fast-growing, credibly funded regional challenger in attack surface management with genuine international expansion, though it is still early in building the kind of independent, third-party efficacy record that established category leaders have.
Editorial Note: Claims vs. Verified Findings
The '150 countries' usage figure, the '40+ integrations' count, and real-time detection performance claims are vendor-sourced. The funding amounts, founding history, and partnership announcements (Securonix, DotForce, Devcons) are independently reported in trade and business press.
Sources
Alternatives to AI SPERA
CybelAngel
External attack surface management and digital risk protection platform that scans the open, deep, and dark web for…
watchTowr
Singapore-based platform combining external attack surface management with continuous automated red teaming to validate whether exposures are actually…
CyCognito
Agentless attack surface management platform that maps organizations' entire external footprint, including subsidiaries and shadow assets, using graph-based…
Armis (a ServiceNow company)
Agentless asset intelligence platform discovering and assessing every connected IT, OT, IoT and medical device, now part of…
Axonius
New York-based CAASM pioneer that aggregates data from hundreds of existing tools to build a unified, agentless asset…
IONIX
EASM vendor, formerly Cyberpion, that maps not just an organization's own internet-facing assets but the chain of third-party…