Zafran Security
A fast-growing threat exposure management and vulnerability prioritization platform founded by former Israeli intelligence veterans, having raised roughly $130-140M including a $60M Series C led by Menlo Ventures, with Cisco reportedly investing in mid-2026.
Visit Website ↗ + Add to CompareOverview
Zafran Security, founded in October 2022, builds an AI-native threat exposure management platform focused on vulnerability prioritization and remediation — correlating vulnerability data with actual compensating security controls already in place (firewalls, EDR, WAFs) to determine true exploitability and risk, rather than treating every unpatched CVE as equally urgent.
The company has raised roughly $130-140M across multiple rounds, including a $60M Series C in December 2025 led by Menlo Ventures that reportedly tripled the company’s ARR, and reporting in mid-2026 indicates Cisco invested in the company following a co-founder’s departure — notable given Cisco’s own exposure-management ambitions following its earlier acquisition of Kenna Security.
Innovation Matrix Assessment
Rapid, multi-round funding progression and a reported tripling of ARR within a compressed timeframe indicate exceptionally fast product-market iteration.
Correlating vulnerabilities against actual deployed compensating controls provides genuinely more actionable prioritization than severity-score-only approaches.
$130M+ raised, tripled ARR, and strategic investment interest from Cisco are strong, multiply-corroborated signals of significant market pull.
Reframing vulnerability prioritization around actual control-based exploitability is a meaningful shift from traditional severity-only vulnerability scoring.
Founded in 2022 with strong growth metrics reported by the company, but independent third-party efficacy validation was not found.
Control-aware vulnerability prioritization directly addresses the widely-acknowledged industry problem of remediation teams being overwhelmed by undifferentiated CVE volume.
Why CISOs Should Care
CISOs drowning in vulnerability findings get exploitability context based on their actual deployed compensating controls, helping teams focus limited patching capacity on vulnerabilities genuinely at risk rather than every theoretically-critical CVE.
What Makes It Different
Zafran correlates vulnerability data against an organization's actual existing security-control stack to assess real exploitability and prioritize remediation, rather than scoring vulnerabilities on severity alone.
The Matrix Verdict
67/100 — INCREMENTAL INNOVATOR
One of the best-capitalized and fastest-growing entrants in vulnerability prioritization and threat exposure management, with strategic investor interest (including Cisco) reinforcing strong momentum; still relatively young, moderating efficacy confidence.
Editorial Note: Claims vs. Verified Findings
Funding rounds, ARR growth claims (tripled ARR), and the Cisco investment are corroborated by CNBC, SecurityWeek, and Calcalist reporting; specific exploitability-scoring accuracy claims are vendor-stated and were not independently benchmarked.
Sources
Alternatives to Zafran Security
Unknown Cyber Inc.
Malware genomics platform using automated deep static analysis and code-lineage comparison to identify unseen malware, variants, and supply-chain…
Synack Inc
A penetration-testing-as-a-service platform pairing a vetted researcher community with AI-driven attack surface discovery for continuous security validation.
Horizon3.ai
Autonomous penetration testing company whose NodeZero platform self-attacks networks without persistent agents, aiming to replace annual manual pentests…
Airlock Digital
Application allowlisting (deny-by-default) platform that blocks unapproved executables, scripts, and processes to prevent ransomware and malware execution.
Cogent Security
Agentic AI platform that autonomously triages, investigates, and remediates vulnerabilities as a force multiplier for security teams.
Reality Defender
Deepfake and synthetic media detection company offering real-time detection across voice, video, image, and text for enterprises and…