Skip to content

Rezilion

Vulnerability management platform that uses runtime reachability analysis and a dynamic SBOM to prioritize which open-source CVEs actually matter.

Visit Website ↗ + Add to Compare Claim This Company
53/100Incremental Innovator

Overview

Rezilion is an Israeli vulnerability-management vendor, founded in 2018 by Liran Tancman and Shlomi Boutnaru (previously founders of CyActive, acquired by PayPal) and headquartered in Be’er Sheva. Its core pitch is reducing the volume of vulnerabilities security teams must triage by determining which detected CVEs are actually reachable and executed at runtime, rather than scoring every finding by static CVSS severity alone. The company calls its asset inventory a ‘Dynamic SBOM’ — a software bill of materials that reflects what is actually loaded and running in an environment, not just what is statically present in a container image or manifest.

In June 2023 the company released an agentless runtime-monitoring capability, extending a prior agent-based approach, to reduce the operational overhead of continuous monitoring. The platform integrates with ticketing and workflow tools such as Jira and ServiceNow so that prioritized findings route directly into existing remediation processes. Rezilion markets claims that its approach lets teams de-prioritize the large majority of flagged vulnerabilities as non-exploitable in a given environment; these are vendor-stated efficiency figures, not independently measured.

Rezilion raised a $30 million Series A in 2021 led by Guggenheim Partners-affiliated investors, bringing disclosed total funding to roughly $38 million; no newer funding round was found in this research, and headcount estimates are inconsistent across sources (roughly 50-150 employees). This is a real, currently operating company with a technically credible approach, but publicly available evidence of fast-growing adoption or named enterprise case studies is limited.

Innovation Matrix Assessment

Innovation Velocity 6/10

Moved from agent-based to agentless runtime monitoring (2023) and built a dynamic, runtime-reflective SBOM — real, if incremental, technical progress on a focused problem.

Operational Value 7/10

Directly addresses a well-known CISO pain point — overwhelming CVE backlogs — by filtering for runtime-reachable vulnerabilities and routing them into existing Jira/ServiceNow workflows, a sound and recognized technique (reachability-based prioritization).

Market Momentum 4/10

Disclosed funding has not grown since its 2021 Series A (total ~$38M); no newer round, named enterprise customer, or partnership announcement was found in this research, suggesting modest recent momentum.

Category Disruption 5/10

Runtime/reachability-based vulnerability prioritization is a meaningful shift from static CVSS-only scoring and is increasingly recognized industry-wide, but Rezilion is one of several vendors pursuing this approach, not the sole innovator.

Real-World Efficacy 4/10

No independently verified case study, named customer, or third-party test was found; the vendor's own claims of reducing patching workload by up to ~85-95% are self-reported and unverified.

Enduring Relevance 6/10

Reachability- and runtime-based vulnerability prioritization is increasingly seen as a necessary complement to CVSS-only vulnerability management, suggesting the underlying approach will stay relevant even if the vendor's own growth is uncertain.

Why CISOs Should Care

Helps vulnerability-management teams cut through CVE noise by distinguishing theoretically present vulnerabilities from ones that are actually loaded and reachable at runtime, focusing patching effort where it matters.

What Makes It Different

Its 'Dynamic SBOM' reflects live runtime composition rather than a static build-time manifest, and its 2023 agentless monitoring option reduces deployment friction compared to agent-based runtime tools.

The Matrix Verdict

53/100 — INCREMENTAL INNOVATOR

Incremental: a technically sound, real company addressing a genuine prioritization problem, but publicly visible funding and customer momentum have plateaued since 2021, and efficacy evidence remains vendor-sourced.

Editorial Note: Claims vs. Verified Findings

Vendor marketing claims of 85-95% reduction in vulnerabilities requiring action are self-reported performance figures, not independently benchmarked; no named customer case study was located.

Sources