Zafran Security
New York and Tel Aviv-founded exposure management company that maps attack paths across existing security tools to focus remediation on real risk.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
Zafran Security, founded around 2022 by CEO Sanaz Yashar, builds an AI-native “Exposure Graph” that ingests data from an organization’s existing security controls — EDR, cloud security, identity and vulnerability management tools — to map assets, weaknesses and attack paths rather than requiring a new scanning layer. The platform is built to identify choke points where multiple attack paths converge, letting security teams focus remediation effort on the small fraction of vulnerabilities that are actually exploitable in their specific environment instead of trying to patch everything a scanner flags.
The company has raised more than $130 million in total disclosed funding from investors including Sequoia Capital, Cyberstarts, Menlo Ventures, PSP Growth, Vintage Investment Partners and American Express Ventures. In July 2026, Cisco Investments made a strategic investment in the company, explicitly framing the deal around the market problem of coordinating remediation across existing tools rather than simply finding more vulnerabilities — a notable independent endorsement from a major infrastructure vendor. Zafran’s differentiator is working on top of what customers already own rather than replacing it, positioning the company as a remediation-orchestration layer rather than another scanner.
Innovation Matrix Assessment
Scaled from founding to over $130M in disclosed funding and a strategic Cisco investment within roughly four years, a fast trajectory for an exposure-management startup.
Directly addresses remediation fatigue by prioritizing the small set of exploitable, high-impact exposures across tools a security team already runs, rather than adding another alert source.
A strategic investment from Cisco Investments, alongside Sequoia, Menlo Ventures and American Express Ventures, is strong independently-verifiable evidence of market confidence beyond typical VC rounds.
Reframes exposure management around cross-tool remediation orchestration and attack-path choke points rather than vulnerability counting, a genuine shift from scan-and-list vendors, though exposure management itself is now a crowded, consolidating category.
The company's claim that 99% of flagged vulnerabilities are not actually exploitable is vendor-stated; no independent third-party validation of this figure was found, though the Cisco strategic investment lends indirect credibility.
As attack surfaces and tool sprawl grow, cross-tool exposure correlation is likely to remain a core CISO need for years, especially as vulnerability volume continues to outpace remediation capacity.
Why CISOs Should Care
Cuts through alert fatigue by telling security teams which of thousands of flagged vulnerabilities are actually exploitable and where to remediate first, using data from tools already deployed.
What Makes It Different
Builds an exposure graph on top of existing security tools rather than deploying a new scanner, focusing on remediation orchestration instead of vulnerability discovery.
The Matrix Verdict
77/100 — MEANINGFUL INNOVATOR
A Meaningful Innovator: strong, independently verifiable financial backing including a strategic Cisco investment and a genuinely different remediation-first framing, tempered by unverified vendor efficacy claims and a consolidating competitive field.
Editorial Note: Claims vs. Verified Findings
Funding totals and the Cisco strategic investment are independently reported (Dealroom, MSSP Alert, company press release). The "99% not exploitable" efficacy figure is a vendor claim without independent verification.
Sources
Alternatives to Zafran Security
CybelAngel
External attack surface management and digital risk protection platform that scans the open, deep, and dark web for…
watchTowr
Singapore-based platform combining external attack surface management with continuous automated red teaming to validate whether exposures are actually…
CyCognito
Agentless attack surface management platform that maps organizations' entire external footprint, including subsidiaries and shadow assets, using graph-based…
Armis (a ServiceNow company)
Agentless asset intelligence platform discovering and assessing every connected IT, OT, IoT and medical device, now part of…
Axonius
New York-based CAASM pioneer that aggregates data from hundreds of existing tools to build a unified, agentless asset…
Doppel
San Francisco AI-native digital risk protection platform that detects and automatically takes down phishing sites, impersonation accounts, and…