Attack Surface Management
Discovering, monitoring, and reducing external attack vectors.
CyCognito
Agentless attack surface management platform that maps organizations' entire external footprint, including subsidiaries and shadow assets, using graph-based…
watchTowr
Singapore-based platform combining external attack surface management with continuous automated red teaming to validate whether exposures are actually…
Armis (a ServiceNow company)
Agentless asset intelligence platform discovering and assessing every connected IT, OT, IoT and medical device, now part of…
CybelAngel
External attack surface management and digital risk protection platform that scans the open, deep, and dark web for…
Axonius
New York-based CAASM pioneer that aggregates data from hundreds of existing tools to build a unified, agentless asset…
IONIX
EASM vendor, formerly Cyberpion, that maps not just an organization's own internet-facing assets but the chain of third-party…
Doppel
San Francisco AI-native digital risk protection platform that detects and automatically takes down phishing sites, impersonation accounts, and…
Detectify
Stockholm-based EASM and DAST platform that feeds its scanner with vulnerability research crowdsourced from a network of ethical…
Assetnote (Searchlight Cyber)
Offensive-security-researcher-built EASM platform from Brisbane, profitable and self-funded until its 2025 acquisition by dark-web intelligence firm Searchlight Cyber.
Lansweeper
IT asset discovery and attack surface visibility platform that inventories on-prem, cloud, OT, and remote devices to expose…
Frenos
Autonomous OT and ICS security assessment platform that runs digital-twin-based simulated penetration tests to continuously validate attack paths…
runZero
An agentless, credential-less asset discovery and exposure management platform — formerly Rumble Network Discovery — built by Metasploit…
Absolute Security
Firmware-embedded endpoint resilience platform that detects and automatically restores security agents and device configurations across a device fleet,…
Axonius
Cyber asset attack surface management platform that aggregates data from existing tools through API integrations to build a…
NetSPI
Penetration-testing-as-a-service and attack surface management platform pairing human-led offensive security testing with continuous tracking.
Cylera
Cylera provides a healthcare IoT and IoMT security platform that discovers and risk-scores connected medical devices using a…
Asimily
IoT and Internet of Medical Things (IoMT) risk management platform that inventories, classifies, and continuously monitors connected devices…
CyCognito
External exposure management platform that discovers, tests and prioritizes internet-facing security issues from an attacker's perspective.
Flare
Threat exposure management platform monitoring clear and dark web, stealer logs and illicit channels for exposed credentials and…
JupiterOne
Graph-based cyber asset attack surface management (CAASM) platform that continuously maps assets, identities, and their relationships across cloud,…
Reflectiz
Agentless web exposure management platform that monitors third-party scripts, pixels, and open-source components on live websites to catch…
Allure Security
AI-native digital brand protection with active decoy defense against phishing and impersonation.
Recorded Future Attack Surface Intelligence
Attack surface visibility module from Recorded Future's broader threat intelligence platform, correlating discovered assets with real-time threat-actor and…
ETHIACK
A Portuguese vendor running continuous, AI-driven autonomous pentesting alongside human ethical hackers to validate exploitable vulnerabilities across an…
Netcraft
Long-established UK cybersecurity firm providing phishing and brand impersonation takedown, digital footprint monitoring and internet infrastructure intelligence.
Censys
Internet intelligence and attack surface management platform built on continuous scanning of internet-facing hosts and certificates.
NetRise
An Austin binary-level firmware and software supply-chain security specialist acquired by Accenture in 2026.
Tenable
Exposure management platform, Tenable One, unifying vulnerability scanning, cloud, identity and attack surface risk.
The Media Trust
A McLean, Virginia-based digital trust and safety vendor that continuously scans the ad-tech and website supply chain for…
ThreatAware
London-based cyber asset management platform that continuously verifies device inventory and security control coverage, reaching profitability and 100+…
ProjectDiscovery
Security company behind the widely used open-source Nuclei vulnerability scanner, now offering a commercial cloud platform for AI-assisted…
CloudEagle.ai
Y Combinator-backed SaaS and AI governance platform that jumped to Leader status in Gartner's 2026 Magic Quadrant for…
Cyesec
A PE-backed Israeli exposure-management vendor combining attack-path automation with human-led pen testing.
XBOW
A Seattle autonomous AI pentesting platform that topped HackerOne's public leaderboard in 2025.
ZeroFox
A publicly traded external cybersecurity platform combining threat intelligence, brand protection, and attack surface intelligence to disrupt threats…
SynerComm
SynerComm combines proprietary Continuous Attack Surface Management (CASM) technology with human-led penetration testing playbooks for ongoing, rather than…
Redinent
Redinent is a Bengaluru-based deep-tech startup that discovers and secures unmanaged IoT and OT devices, such as CCTV…
Edgescan
A Dublin-based, Series B-funded continuous exposure validation platform combining external attack surface management, risk-based vulnerability management, and penetration-testing-as-a-service…
Zynap
A Barcelona-based, well-funded early-stage vendor combining stolen-credential monitoring, attack surface visibility, and AI-driven automated response into a single…
Mandiant Attack Surface Management (Google Cloud)
Google Cloud's attack surface management product, drawing on Mandiant's incident-response and threat-intelligence pedigree to prioritize exposures by real-world…
UpGuard
Cyber risk posture management platform combining external attack surface scanning with vendor/third-party risk ratings in one product.
Bugcrowd
AI-assisted crowdsourced security platform spanning bug bounty, vulnerability disclosure, pentest-as-a-service and attack surface management.
Axur
Axur is a digital risk protection platform, originally built in Brazil and operating from a Miami, Florida base,…
SecurityScorecard
New York-based security ratings pioneer providing outside-in cyber risk scores and third-party/supply-chain risk management for enterprise vendor portfolios.
AI SPERA
South Korean cybersecurity firm behind Criminal IP, an OSINT search engine and attack surface management platform for external…
SixMap
Attack surface management startup using computational internet mapping to discover an organization's internet-facing assets across all 65,535 ports…
Hadrian
Amsterdam-based attack surface management platform that uses autonomous, AI-driven "hacker" agents to continuously discover, exploit-test and prioritize internet-facing…
Balbix (a SAFE Security company)
AI-driven cyber asset attack surface management and risk-based vulnerability management platform, acquired by SAFE Security in November 2025.
Sevco Security (an Arctic Wolf company)
Cyber asset attack surface management (CAASM) platform that evolved into a broader exposure assessment platform, acquired by Arctic…
Phosphorus Cybersecurity
An xIoT security specialist that remediates vulnerabilities across unmanaged connected devices, acquired by Dragos.
Queue-it
Queue-it is a global provider of online traffic orchestration technology, best known for its virtual waiting room product…
Rapid7 Surface Command
Rapid7's unified asset and attack surface visibility product, combining external attack surface monitoring with internal cyber asset management…
RapidFort
A Sunnyvale software-supply-chain security company that closed a $42M Series A and claims 60-90% attack-surface reduction.
Detectify
Stockholm-based web application scanning and external attack surface monitoring platform powered by research from ethical hackers.
LocateRisk
LocateRisk is a German external attack surface management and vendor risk management platform that combines automated asset discovery…
Viakoo
IoT and cyber-physical systems security platform that discovers and automates remediation of firmware, password, and certificate vulnerabilities on…
Element Security
Tel Aviv-based external attack surface management platform, formerly known as Ovalsec, that combines continuous exposure discovery with active…
Reveald
Reveald orchestrates continuous threat exposure management, correlating findings from an organization's existing security tools into a prioritized, attack-path-based…
RedSeal
Network exposure management platform that models hybrid network topology to compute attack paths and prioritize exposures across IT,…
Patrowl
French SaaS platform combining external attack surface management with pentest-as-a-service, built by former auditors to continuously discover and…
Cybersixgill (a BitSight company)
Deep and dark web threat intelligence platform providing automated, real-time monitoring of criminal forums and marketplaces, acquired by…
Tonic Security
Israeli startup founded by Sygnia and Unit 8200 veterans, building an AI-driven exposure management platform to prioritize what…
Microsoft Defender External Attack Surface Management
Microsoft's EASM product, built on acquired RiskIQ technology, that maps internet-facing assets for organizations already using the Microsoft…
FireCompass
A Boston-based SaaS platform for Continuous Automated Red Teaming and external attack surface management, continuously indexing an organization's…
GreyScout
A Dublin-based digital risk protection platform that automates detection, verification, and takedown of counterfeit listings and brand impersonation…
RiskRecon
Salt Lake City-founded, Mastercard-owned continuous cyber risk rating platform for third-party and supply-chain risk management.
Styx Intelligence
Vancouver-based digital risk protection platform that detects and takes down brand impersonation, phishing sites, and data leaks for…
CSC (DomainSec)
Enterprise-class domain security and DNS threat-intelligence platform from a 125-year-old corporate services firm trusted by 90% of the…
Ceeyu
A Belgian attack surface management and third-party risk platform combining continuous external scanning with compliance questionnaires, built around…
CTM360
Bahrain-based external attack surface management and digital risk protection platform combining EASM, brand/phishing takedowns, dark web monitoring, and…
Shodan
The original internet-connected-device search engine, widely used by security researchers and enterprise teams to discover exposed systems and…
Armadin
An AI red-teaming startup led by former Mandiant CEO Kevin Mandia, with a record-setting combined seed and Series…
MarqVision
A West Hollywood, YC-backed brand-protection startup using generative AI to detect counterfeits and draft takedowns across 1,500+ marketplaces.
OctoXLabs
OctoXLabs is a cyber asset attack surface management (CAASM) platform that aggregates data from IT, cloud, and security…
Halo Security
Small, San Francisco-originated EASM platform combining external asset discovery with penetration-testing services, descended from the earlier ScanAlert/TrustedSite lineage.
Intruder
Continuous vulnerability scanning and attack-surface monitoring platform built for lean security teams without dedicated SOC staff.
Sola Security
Builds a vendor-agnostic 'Security Brain' context layer that unifies data across security tools so human analysts and AI…
Cavelo
Channel-first data security posture management (DSPM) and attack surface management platform built for MSPs and MSSPs to discover,…
Accenture
A global systems integrator buying scaled security capability via CyberCX, a $4.175B Dragos stake, runZero, and NetRise.
Tenable Attack Surface Management
Tenable's EASM capability, built from its 2022 acquisition of Bit Discovery, now integrated into the broader Tenable One…
Qualys CyberSecurity Asset Management (EASM)
Qualys's EASM capability, integrated into its CyberSecurity Asset Management product, that unifies internal and external asset visibility on…
Astelia
A Tel Aviv exposure-management platform founded by former leaders of Israel's National Red Team, backed by Index Ventures…
DeviceTotal
Tel Aviv-based agentless device risk intelligence platform, positioned as 'VirusTotal for devices,' scoring IoT, OT, and network device…
BRANDEFENSE
BRANDEFENSE is a Turkey-based AI-driven Digital Risk Protection Services (DRPS) platform that monitors the surface, deep, and dark…
Bug Bounty Switzerland
A profitable Lucerne ethical-hacker orchestration platform trusted by Switzerland's Federal Office for Cybersecurity.
ThingsRecon
An Amsterdam startup mapping external attack surface and multi-tier supplier risk from a single starting domain using a…
Strobes Security
Continuous threat exposure management platform unifying attack surface management, penetration-testing-as-a-service and risk-based vulnerability management.
RedHunt Labs
A London-founded external attack surface and continuous threat exposure management platform used by Indian fintech and consumer tech…
WiseBee
A New York/Sofia-based pre-seed startup building AI agents that combine attack surface monitoring, threat intelligence and vendor risk…
Randori (IBM)
Hacker-founded attack surface management and continuous automated red-teaming platform acquired by IBM in 2022 and folded into its…
K2 Integrity
A New York risk advisory firm that added offensive-security capability by acquiring Leviathan Security Group in March 2026.
Sedara
Buffalo-based managed security provider built on Elasticsearch, delivering attack surface visibility and threat detection/response as a hands-on 'cybersecurity…
FoxTech Cyber
UK-based cybersecurity services firm combining OSINT-driven attack surface discovery with managed SIEM and human-led penetration testing.
C2SEC
C2SEC offers an Extended Security Posture Management (XSPM) SaaS platform combining external attack surface management, cloud posture, and…
Faraday Security
Offensive security platform that orchestrates over 80 third-party security tools into a single vulnerability management and external attack…
EBRAND
Luxembourg-based digital risk protection provider specializing in domain, brand-abuse, and phishing-site monitoring and takedown across a global external…
FortifyData
Cyber risk management platform combining attack surface management, third-party risk ratings, and compliance management, using active weekly scanning…
Bleach Cyber
A Techstars-backed platform that continuously scans a small business's connected tools and cloud accounts for exposure and automates…
Guardian360
Dutch, self-funded external attack surface management platform combining continuous asset discovery, vulnerability scanning, and NCSC threat-intel feeds for…
Trickest
Offensive security automation platform that lets security teams build, automate and run reconnaissance and attack-surface workflows without heavy…
ThreatMate
MSP-focused platform combining attack surface discovery, automated penetration testing, and CISA-aligned configuration auditing into one risk-identification tool.
Menaya
Menaya (the rebranded GamaSec) runs an AI-powered external attack surface management platform that discovers and continuously scores an…
FYEO
A Denver-based threat intelligence and exposure monitoring vendor that pairs conventional dark-web/credential monitoring with blockchain and DeFi security…
Apexa iQ
An agentless asset assurance and attack surface management platform that unifies IT asset visibility with vulnerability, compliance, and…
Crosslayer Labs
A Princeton-spinout startup that monitors DNS, BGP, TLS certificates, and JavaScript dependencies to detect website and API impersonation…
Sweepatic
Belgian external attack surface management vendor that has quietly run continuous internet-facing asset discovery for enterprise clients since…
AgenticSec
A Tokyo autonomous AI penetration-testing startup that became LayerX's first acquisition.
Attaxion
External attack surface management vendor focused on agentless, wide-coverage asset discovery and continuous exposure monitoring for mid-market security…
ThreatNG Security
Agentless external attack surface management platform combining EASM, digital risk protection and security ratings in a single unauthenticated-discovery…
Driftnet
A UK internet-scanning pioneer founded by a former government researcher, acquired by SecurityScorecard.
RedMimicry
Berlin startup building a breach-and-attack-simulation platform that emulates real adversary malware and TTPs to validate detection and response.
Indurex
An Amsterdam startup from the founder of Applied Risk, unifying safety, process, and cybersecurity data into one view…
CyberCyte
A Reading, UK-based exposure management platform combining CAASM-style asset visibility, GRC automation and forensic threat hunting for enterprise…
Bridgepoint
A listed London private equity firm with majority stakes in Lansweeper and iC Consult and a stake in…
Zero Point Security
A bootstrapped UK red-team and C2 training brand acquired by Fortra in April 2026.
Buguard
Buguard is an Egypt-founded offensive security startup offering continuous attack surface and dark web monitoring (Dark Atlas) alongside…
Arcane Security
A Phoenix AI-driven offensive-security firm with mandatory human validation, acquired by SafeHill in March 2026.
Rotate
An MSP-native security platform acquired by Check Point in February 2026 to anchor its Workspace Security division.
BreachBits
BreachBits runs automated, outside-in reconnaissance to quantify an organization's breach risk, marketing its scored assessments to security teams,…
Kaduu
Swiss dark web and deep web monitoring provider that alerts organizations when their credentials, data or brand assets…
TIKAJ
US/India-based platform combining external attack surface management, phishing simulation, brand monitoring and dark web takedown services in one…
Intelligence X
European OSINT search engine and data archive indexing darknet sources, document leaks, WHOIS records and public data leaks…
Leviathan Security Group
An 80-person Seattle-area offensive-security firm acquired by K2 Integrity in March 2026.
Bank of America
A major bank acquiring UK offensive-security consultancy MDSec to build in-house red-team capability.
Emulated Criminals
A London operator-led adversary-emulation and red-team boutique acquired by Suzu Labs.
ImagineX Cybersecurity
ImagineX's Atlanta cybersecurity advisory arm, carved out and acquired by TekStream.
BeyGoo
A Madrid-based digital risk protection platform that monitors external digital assets for brand impersonation, fraud, and early-stage incident…