Validin

Validin ships frequent, named feature releases (Open Directories search, advanced YARA/live-scan improvements, bulk search) on a visible changelog, and publishes original threat-infrastructure research, but as a small bootstrapped-looking team its pace trails well-funded EASM competitors.

Gives threat hunters and SOC analysts a way to pivot from a single indicator to a full infrastructure cluster quickly, which is operationally useful for incident triage and brand/phishing monitoring, though it is a specialist investigation tool rather than a full ASM workflow platform.

Displays named customer logos including SentinelOne, Wiz, PwC, Merck, and a documented case-study integration with PacketWatch — credible adoption signals among sophisticated security buyers — but there is no disclosed funding round or independent market-share data to corroborate scale.

Passive-DNS and infrastructure-intelligence tooling is a crowded, established niche (DomainTools, Censys, SecurityTrails and others already cover similar ground); Validin is a well-regarded alternative on data depth, not a structurally different approach.

The company publishes its own named threat research (e.g., tracking Russian espionage infrastructure clusters) and a case study with PacketWatch, giving some real-world evidence of the data being used in actual investigations, though the SentinelOne endorsement comes from a named advisor to the company rather than a fully independent customer.

Historical DNS/certificate/infrastructure intelligence is foundational to both attack-surface mapping and threat attribution, and that need persists regardless of how the broader ASM market consolidates.