Capture The Bug
A New Zealand-founded penetration-testing-as-a-service platform expanding into North America with continuous, on-demand security testing.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
Capture The Bug is a Penetration Testing as a Service (PTaaS) company founded by Ankita Dhakar, headquartered in Hamilton, New Zealand. The company grew out of several years running cybersecurity consultancy work for CTOs and CISOs across New Zealand and Australia before commercially launching its PTaaS platform in 2024, positioning continuous, on-demand testing as an alternative to traditional point-in-time penetration tests.
In January 2026 the company added three US-based technology leaders — based in San Francisco, Silicon Valley, and Greater Philadelphia — to an Executive Advisory Board, including a dedicated US commercial lead, signaling an active push into the North American market. The company describes its customer base as including startups, scale-ups, and listed ASX/NZX enterprises, though these claims have not been independently corroborated with named case studies.
PTaaS itself is an established and growing category rather than a new one, with larger platforms (Cobalt, Synack, HackerOne) already offering similar continuous-testing models; Capture The Bug’s differentiation rests on its ANZ-market origin and now its deliberate North American expansion rather than a structurally different testing methodology.
Innovation Matrix Assessment
Moved from a multi-year consultancy model to a commercially launched PTaaS platform in 2024 and is now actively building out US go-to-market infrastructure in 2026, a reasonably quick build-out pace for an early-stage company.
Continuous, on-demand testing addresses a genuine CISO pain point — stale point-in-time pentest results — though the underlying methodology is similar to other established PTaaS vendors.
Early-stage/angel funding per CB Insights, with a January 2026 US advisory board addition as the clearest momentum signal; no disclosed institutional funding round or named enterprise logos found independently.
PTaaS is already a well-established model offered by larger, better-funded platforms; Capture The Bug applies the model rather than changing it.
Customer claims (ASX/NZX-listed clients) are self-reported on the company's own marketplace profile with no named case studies or independent verification found.
Continuous security testing models are likely to keep gaining ground over static annual pentests as attack surfaces grow, supporting durable relevance for the category generally.
Why CISOs Should Care
Offers continuous testing coverage instead of a once-a-year pentest snapshot, useful for CISOs who need up-to-date assurance between compliance cycles.
What Makes It Different
Primary differentiation is market focus — an ANZ-born PTaaS provider now actively expanding into North America — rather than a distinct technical approach to testing.
The Matrix Verdict
45/100 — EMERGING / UNRANKED
An Emerging/Unranked entry: a real, operating PTaaS company with credible expansion momentum, but thin independent evidence of customer outcomes and a non-differentiated testing model relative to larger incumbents.
Editorial Note: Claims vs. Verified Findings
Customer base claims (ASX/NZX-listed clients) and funding stage come from the company's own marketplace profile and CB Insights respectively; no independent press coverage of named customers was found.
Sources
Alternatives to Capture The Bug
Synack Inc
A penetration-testing-as-a-service platform pairing a vetted researcher community with AI-driven attack surface discovery for continuous security validation.
Horizon3.ai
Autonomous penetration testing company whose NodeZero platform self-attacks networks without persistent agents, aiming to replace annual manual pentests…
Unknown Cyber Inc.
CISO ReviewedMalware genomics platform using automated deep static analysis and code-lineage comparison to identify unseen malware, variants, and supply-chain…
Airlock Digital
Application allowlisting (deny-by-default) platform that blocks unapproved executables, scripts, and processes to prevent ransomware and malware execution.
Cogent Security
Agentic AI platform that autonomously triages, investigates, and remediates vulnerabilities as a force multiplier for security teams.
Strider
A DataTribe-backed DC firm tracking nation-state talent-recruitment programs, IP theft, and supply-chain infiltration — a strategic-risk category conventional…