How is the market for continuous threat exposure management evolving, and which vendors show material change in capabilities, commercial traction, workforce, funding, partnerships, customer adoption, positioning or risk?
Products that map, score, prioritise and test an organisation's attack surface and vulnerabilities on a continuing basis, as Gartner's CTEM cycle describes: scoping, discovery, prioritisation, validation and mobilisation. It covers startups built for this, vendors acquired by others whose product still ships, and the exposure management lines of large security vendors. 102 vendors, 7 October–6 November 2026.
Vendors placed by size and by growth, from public data we collect: headcount, followers, funding, customers, open roles, launches and mentions. It does not rate product quality, customer satisfaction or strategy. Computed 2026-11-05 over the last 90 days.
Marks after a name: ◌ innovating · ⚒ hiring · $ raised in the last year · "(was …)" moved stage since the previous map. Each mark belongs to the name before it.
Axonius ◌, Horizon3.ai ◌ ⚒, SecurityScorecard, Pentera ◌, Bitsight, XBOW
UpGuard, Cymulate, Censys ◌ ⚒, Securin, Picus Security, Zafran Security ⚒, Filigran ◌, SecPod, Outpost24 ◌ $, AttackIQ ◌, SafeBreach, BreachLock ⚒, RedSeal, Nucleus Security, CyCognito, Ethiack ◌, Brinqa, Novee ◌, Strobes Security ◌, Panorays, Hive Pro, JupiterOne, Greenbone, Hadrian ⚒, Seemplicity, Vicarius, Cogent Security ⚒, Black Kite, IONIX
Tenzai $, Searchlight Cyber, Terra Security ◌, Intruder, Empirical Security ⚒, Holm Security ◌, Astelia $, watchTowr, Ridge Security ◌, Attaxion ◌, Cyberwatch, Board of Cyber, ProjectDiscovery ◌, Saporo $, RiskProfiler, RunSybil ⚒ $, Hackuity, ThreatAware ◌ $, CyberMindr, Patrowl, Defense.com, Sprocket Security ⚒, Halo Security, NopSec, SCYTHE
FourCore, ThingsRecon (was established), Nanitor (was established), Mitigant, Fleuret AI, Phoenix Security ◌, Onit Security $, ThreatNG Security, Northstar Security $, FortifyData, VORNAC ◌, ONYPHE ◌, FullHunt
Censys, Horizon3.ai, Axonius, Filigran, Ridge Security, Terra Security
Pentera, ThreatAware, BreachLock, Cogent Security, ProjectDiscovery, Outpost24, Ethiack, RunSybil, Novee, Northstar Security, Picus Security, AttackIQ, Holm Security, Phoenix Security, watchTowr, Sprocket Security, Empirical Security, Zafran Security, Hadrian, Greenbone, Cymulate, Strobes Security, ONYPHE, Nucleus Security, VORNAC, Brinqa, Hackuity, UpGuard, Vicarius, SCYTHE, Black Kite, Searchlight Cyber, Tenzai, RiskProfiler, Attaxion, SecurityScorecard, Panorays, Bitsight, CyberMindr, FourCore, SafeBreach, Seemplicity, IONIX, Patrowl, Saporo, XBOW, Board of Cyber, ThingsRecon, Mitigant, FortifyData, CyCognito, Astelia, Cyberwatch, Nanitor, SecPod, ThreatNG Security, FullHunt, Onit Security, Intruder, Defense.com, Securin, RedSeal, Halo Security, Fleuret AI, JupiterOne, NopSec, Hive Pro
none
Horizon3.ai, Axonius, Censys, Pentera, Filigran, Outpost24, AttackIQ, Ethiack, Novee, Terra Security, Ridge Security, Strobes Security, Holm Security, ProjectDiscovery, ThreatAware, Attaxion, Phoenix Security, ONYPHE, VORNAC
Cogent Security (52 open roles, 46 per 100 staff), Horizon3.ai (179 open roles, 28 per 100 staff), Zafran Security (33 open roles, 15 per 100 staff), Empirical Security (4 open roles, 11 per 100 staff), RunSybil (4 open roles, 10 per 100 staff), Sprocket Security (5 open roles, 9 per 100 staff), BreachLock (10 open roles, 7 per 100 staff), Hadrian (7 open roles, 6 per 100 staff), Censys (12 open roles, 6 per 100 staff)
Northstar Security (round not stated, 2026-11), Onit Security (Seed, 2026-03), RunSybil (Seed, 2026-03), ThreatAware (Series A, 2026-02), Astelia (round not stated, 2026-02), Outpost24 (Strategic, 2025-12), Saporo (Series A, 2025-12), Tenzai (Seed, 2025-11)
Axonius (+19.9 scale, +16.5 momentum), AttackIQ (+3.3 scale, +16.2 momentum), Terra Security (+11.6 momentum)
Expanse — by Palo Alto Networks, 2020-01-01; Heimdal — by Marlin Equity Partners, 2020-01-01; RiskRecon — by Mastercard, 2020-01-01; Intrigue — by Mandiant, 2021-01-01; RiskIQ — by Microsoft, 2021-01-01; Bit Discovery — by Tenable, 2022-01-01; Digital Shadows — by ReliaQuest (US), 2022-01-01; Randori — by IBM, 2022-01-01; Reposify — by CrowdStrike, 2022-01-01; Vonahi Security — by Kaseya, 2023-01-01; Yogosha — by Groupe Créative, 2023-01-01; Avalor — by Zscaler, 2024-01-01; Cyberint — by Check Point Software Technologies, 2024-01-01; Dazz — by Wiz, 2024-01-01; Detectify — by Insight Partners (majority stake), 2024-01-01; Noetic Cyber — by Rapid7, 2024-01-01; Probely — by Snyk, 2024-01-01; Recorded Future — by Mastercard, 2024-01-01; Runecast — by Dynatrace (US), 2024-01-01; ZeroFox — by Haveli Investments, 2024-01-01; Balbix — by SAFE Security, 2025-01-01; Vulcan Cyber — by Tenable, 2025-01-01; Armis — by ServiceNow, 2026-01-01; Axur — by Infoblox, 2026-01-01; Pentest People — by WorkNest Group, 2026-01-01; Sevco Security — by Arctic Wolf, 2026-01-01; Synack — by Merged with NetSPI (KKR-backed), 2026-01-01; runZero — by Accenture (operated under Dragos), 2026-01-01
Check Point Software; CrowdStrike; CybelAngel; Ivanti; Microsoft; Palo Alto Networks; Panaseer; Rapid7; Red Sift; ServiceNow; Tenable; Trend Micro; WithSecure; Zscaler
Acronis, Aikido Security, Aleph Index, Arctic Security, ArmorCode, Bishop Fox, Bitdefender, Citalid, CloudSEK, Cobalt, CovertSwarm, Criminal IP, CyberDart, CyberVadis, Cyble, CYFIRMA, Cyjax, cysmo, Cyver, DynaRisk, EBRAND, Enginsight, ESET, Flare, Flashpoint, FortiRecon, G DATA CyberDefense, GObugfree, Group-IB, Hackrate, Hackrfi, Hacktify, Hexway, Hudson Rock, Identeco, Intigriti, Kaduu, KYND, Lansweeper, Lupasafe, Lupovis, Nagomi Security, Netcraft, NetSPI, Nordic Defender, OnSecurity, Ordr, Praetorian, Prelude Security, Raynet, Risk Ledger, Rootshell Security, SAFE Security, SecPoint, Siemba, SignalFisher, Silobreaker, SOCRadar, SOS Intelligence, SpyCloud, turingpoint, XMCO, YesWeHack, Zerocopter
A vendor is rated only when we have every input. 15 lack linkedin followers; 3 lack linkedin headcount (latest count); 3 lack open roles per 100 staff.
Autobahn Security: linkedin followers; Cyrating: linkedin followers; Edgescan: linkedin followers; ImmuniWeb: linkedin followers; LocateRisk: linkedin followers; Orpheus Cyber: linkedin followers; Pentest-Tools.com: linkedin followers; Pikered: linkedin followers; RCE Security: linkedin followers; RiskXchange: linkedin followers; Validato: linkedin followers; XRATOR: linkedin followers; LEET Security: linkedin headcount (latest count), linkedin followers, open roles per 100 staff; Tonic Security: linkedin headcount (latest count), linkedin followers, open roles per 100 staff; Uncovery: linkedin headcount (latest count), linkedin followers, open roles per 100 staff
| Input | Axis | Weight |
|---|---|---|
| LinkedIn headcount (latest count) | scale | 0.35 |
| Disclosed funding total (optional) | scale | 0.30 |
| Customer evidence, weighted, last 12 months named customer in their own words 3, named in the vendor's words 2, unnamed 1 | scale | 0.25 |
| LinkedIn followers | scale | 0.10 |
| Headcount change in the period (optional) | momentum | 0.30 |
| Launches and partnerships in the period | momentum | 0.25 |
| Earned mentions in the period | momentum | 0.15 |
| Open roles per 100 staff | momentum | 0.15 |
| Crunchbase growth score (secondary) (optional) | momentum | 0.10 |
| Own LinkedIn posts in the period | momentum | 0.05 |
Each input is a percentile rank among the rated vendors; an axis is the weighted mean of its inputs. On the map, the angle is the stage, by scale: Emerging under 25, Building from 25, Scaling from 50, Executing from 75, left to right. The distance from the base is momentum: holding under 33, growing from 33, accelerating from 67. A vendor moves right as it grows and outward as it speeds up.
Tenable raised a $400M round on 13 October. Enginsight raised a new round on 3 November.
3 customer or deployment announcements, 2 of them naming the customer.
52 developments in 30 days, plus 36 hiring or headcount signals. The 4 most active vendors account for 36% of them (Axonius 7, Aikido Security 4, Censys 4, Phoenix Security 4). 32 vendors were watched and had none. 51 are not fully collected yet.
| Vendor | Development | Evidence | Why it matters |
|---|---|---|---|
| Tenable | Tenable Announces Closing of New $400M Secured Revolving Credit Facility Funding · 13 Oct 2026 | manilatimes.net · 2 sources Also reported independently | A $400M round. |
| Tenable | Tenable Selected by Atos to Power Continuous Threat Exposure Management Program Customer evidence · 27 Oct 2026 | manilatimes.net · 4 sources Reported by multiple independent sources | |
| Axonius | Axonius launches Axonius Verified for AI-powered asset context Product expansion · 21 Oct 2026 | manilatimes.net · 3 sources Reported by multiple independent sources | |
| Palo Alto Networks | Palo Alto Networks discloses critical RCE vulnerability CVE-2026-0322 in PAN-OS Incident · 14 Oct 2026 | the company's website · 1 source Vendor sources only | A change at one vendor. |
| Enginsight | Enginsight secures double-digit million-euro investment from Verdane Funding · 3 Nov 2026 | the company's website · 1 source Vendor sources only | |
| Axonius | Axonius launches Security for AI to discover and govern AI assets Product expansion · 20 Oct 2026 | enidnews.com · 2 sources Also reported independently | |
| Axonius | Axonius launches AI Workforce virtual workers as AI Companion and MCP Server go live Product expansion · 19 Oct 2026 | siliconangle.com · 2 sources Also reported independently | |
| ProjectDiscovery | ProjectDiscovery adds Neo Triage to confirm which vulnerabilities are exploitable Product expansion · 26 Oct 2026 | siliconangle.com · 1 source Also reported independently | ProjectDiscovery, a security vulnerability detection company, has launched Neo Triage, a new feature designed to verify which identified… |
| Horizon3.ai | Horizon3.ai: Horizon3 links NodeZero findings with Cortex XSOAR | Partnership · 27 Oct 2026 | 1 source · Also reported independently |
| Tenable | Tenable Expands Open Security Ecosystem to Extend Exposure Intelligence and Accelerate AI… | Product launch · 20 Oct 2026 | 7 sources · Reported by multiple independent sources |
| Bitdefender | Bitdefender’s new tool maps how attackers could reach critical systems | Product launch · 27 Oct 2026 | 3 sources · Reported by multiple independent sources |
| Terra Security | Terra Security Launches AI Native Cybersecurity Podcast With Inaugural Guest Amazon CISO… | Product launch · 20 Oct 2026 | 2 sources · Reported by multiple independent sources |
| Criminal IP | Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management | Product launch · 10 Oct 2026 | 2 sources · Reported by multiple independent sources |
| Novee | Novee launches External Surface Testing cybersecurity service | Product launch · 2 Nov 2026 | 2 sources · Also reported independently |
| Pentera | Pentera: The Harness Is the Hard Part of Agentic Pentesting | Product launch · 21 Oct 2026 | 1 source · Also reported independently |
| Edgescan | Edgescan Atomic validates attack paths with controlled AI testing | Product launch · 7 Oct 2026 | 1 source · Also reported independently |
| Ethiack | Bondalti engages Ethiack for industrial penetration testing | Customer evidence · 2 Nov 2026 | 1 source · Vendor sources only |
| Yogosha | Yogosha tests French hosting provider with Augmented Pentest | Customer evidence · 27 Oct 2026 | 1 source · Vendor sources only |
| Enginsight | Enginsight releases platform version 4.9.1 with full Alarm-Route release | Product expansion · 3 Nov 2026 | 1 source · Vendor sources only |
| Axonius | Axonius expands PQC readiness across AWS and multi-cloud | Product expansion · 26 Oct 2026 | 1 source · Vendor sources only |
| AttackIQ | AttackIQ expands AWS security assessment capabilities | Product expansion · 7 Oct 2026 | 1 source · Vendor sources only |
| Novee | Novee launches MCP Assets and Novee Prompt Library for testing attack surfaces | Product expansion · 7 Oct 2026 | 1 source · Vendor sources only |
| Filigran | Filigran integrates OpenCTI with Google Threat Intelligence | Partnership · 2 Nov 2026 | 1 source · Vendor sources only |
| Aikido Security | Aikido Security partners with Drata on compliance-integrated pentesting | Partnership · 19 Oct 2026 | 1 source · Vendor sources only |
| Attaxion | Attaxion partners with Idextrus for SMB attack surface visibility | Partnership · 19 Oct 2026 | 1 source · Vendor sources only |
| VORNAC | VORNAC partners with Protforce GmbH on remediation services | Partnership · 13 Oct 2026 | 1 source · Vendor sources only |
| Phoenix Security | Phoenix Security releases Green AI Remedy for security remediation | Product launch · 4 Nov 2026 | 2 sources · Vendor sources only |
| Phoenix Security | Phoenix Security launches Purple Hook for live AI coding security | Product launch · 29 Oct 2026 | 2 sources · Vendor sources only |
| Filigran | Filigran adds saved filters to OpenCTI | Product launch · 8 Oct 2026 | 2 sources · Vendor sources only |
| Phoenix Security | Phoenix Security releases Purple Hook for AI coding assistants | Product launch · 4 Nov 2026 | 1 source · Vendor sources only |
| Aleph Index | Aleph launches Aleph Intelligence Platform for dark web investigation | Product launch · 3 Nov 2026 | 1 source · Vendor sources only |
| Censys | Censys introduces new credit pricing for Free and Starter Plans | Product launch · 30 Oct 2026 | 1 source · Vendor sources only |
| Aikido Security | Aikido Security launches external network pentesting | Product launch · 28 Oct 2026 | 1 source · Vendor sources only |
| ONYPHE | ONYPHE publishes 14 skills for AI agents | Product launch · 28 Oct 2026 | 1 source · Vendor sources only |
| Censys | Censys releases API for Censys Investigator agentic framework | Product launch · 27 Oct 2026 | 1 source · Vendor sources only |
| Aikido Security | Aikido Security releases free patched container images for PHP2Shell | Product launch · 26 Oct 2026 | 1 source · Vendor sources only |
| Strobes Security | Strobes Security releases open-source MCP servers for Claude Code | Product launch · 26 Oct 2026 | 1 source · Vendor sources only |
| Ethiack | Ethiack launches Zero database tracking exploitable vulnerabilities | Product launch · 23 Oct 2026 | 1 source · Vendor sources only |
| Horizon3.ai | Horizon3.ai: Horizon3 releases NodeZero Rapid Response check for PHP2Shell CVEs | Product launch · 23 Oct 2026 | 1 source · Vendor sources only |
| Aleph Index | Aleph launches Aleph Open Search with ten free daily searches | Product launch · 22 Oct 2026 | 1 source · Vendor sources only |
| Strobes Security | Strobes Security launches Red Loop continuous offensive testing | Product launch · 22 Oct 2026 | 1 source · Vendor sources only |
| Axonius | Axonius launches asset intelligence capabilities | Product launch · 21 Oct 2026 | 1 source · Vendor sources only |
| Axonius | Axonius launches unified asset management platform | Product launch · 21 Oct 2026 | 1 source · Vendor sources only |
| Novee | Novee launches Novee Workflows automation feature | Product launch · 21 Oct 2026 | 1 source · Vendor sources only |
| Aikido Security | Aikido Security launches Noon workforce security platform | Product launch · 20 Oct 2026 | 1 source · Vendor sources only |
| Digital Shadows | Digital Shadows: ReliaQuest launches GreyMatter SIEM-Less security data indexing | Product launch · 20 Oct 2026 | 1 source · Vendor sources only |
| Axonius | Axonius AI now generally available | Product launch · 19 Oct 2026 | 1 source · Vendor sources only |
| Phoenix Security | Phoenix Security launches platform update with new remediation features | Product launch · 19 Oct 2026 | 1 source · Vendor sources only |
| Censys | Censys enhances web scanning in Censys ASM | Product launch · 16 Oct 2026 | 1 source · Vendor sources only |
| Outpost24 | Outpost24 launches self-service PCI ASV scanning platform | Product launch · 16 Oct 2026 | 1 source · Vendor sources only |
| Bishop Fox | Bishop Fox launches Attack Surface Discovery service | Product launch · 13 Oct 2026 | 1 source · Vendor sources only |
| Censys | Censys adds 22 new protocol and endpoint scanners | Product launch · 8 Oct 2026 | 1 source · Vendor sources only |
| Acronis | Acronis: 38 open roles | Hiring · this period | 1 source · Vendor sources only |
| Aikido Security | Aikido Security: 75 open roles | Hiring · this period | 1 source · Vendor sources only |
| Armis | Armis: 5 open roles | Hiring · this period | 1 source · Vendor sources only |
| ArmorCode | ArmorCode: 8 open roles | Hiring · this period | 1 source · Vendor sources only |
| Axonius | Axonius: 8 open roles | Hiring · this period | 1 source · Vendor sources only |
| Balbix | Balbix: 20 open roles | Hiring · this period | 1 source · Vendor sources only |
| Bishop Fox | Bishop Fox: 11 open roles | Hiring · this period | 1 source · Vendor sources only |
| Bitdefender | Bitdefender: 22 open roles | Hiring · this period | 1 source · Vendor sources only |
| Bitsight | Bitsight: 19 open roles | Hiring · this period | 1 source · Vendor sources only |
| Black Kite | Black Kite: 8 open roles | Hiring · this period | 1 source · Vendor sources only |
| BreachLock | BreachLock: 10 open roles | Hiring · this period | 1 source · Vendor sources only |
| Censys | Censys: 12 open roles | Hiring · this period | 1 source · Vendor sources only |
| CloudSEK | CloudSEK: 22 open roles | Hiring · this period | 1 source · Vendor sources only |
| Cobalt | Cobalt: 7 open roles | Hiring · this period | 1 source · Vendor sources only |
| Cogent Security | Cogent Security: 52 open roles | Hiring · this period | 1 source · Vendor sources only |
| Detectify | Detectify: 5 open roles | Hiring · this period | 1 source · Vendor sources only |
| Digital Shadows | Digital Shadows: 35 open roles | Hiring · this period | 1 source · Vendor sources only |
| ESET | ESET: 17 open roles | Hiring · this period | 1 source · Vendor sources only |
| Filigran | Filigran: 8 open roles | Hiring · this period | 1 source · Vendor sources only |
| Flare | Flare: 7 open roles | Hiring · this period | 1 source · Vendor sources only |
| Flashpoint | Flashpoint: 8 open roles | Hiring · this period | 1 source · Vendor sources only |
| Hadrian | Hadrian: 10 open roles | Hiring · this period | 1 source · Vendor sources only |
| Horizon3.ai | Horizon3.ai: 187 open roles | Hiring · this period | 1 source · Vendor sources only |
| Lansweeper | Lansweeper: 13 open roles | Hiring · this period | 1 source · Vendor sources only |
| Nucleus Security | Nucleus Security: 6 open roles | Hiring · this period | 1 source · Vendor sources only |
| Pentera | Pentera: 7 open roles | Hiring · this period | 1 source · Vendor sources only |
| Picus Security | Picus Security: 10 open roles | Hiring · this period | 1 source · Vendor sources only |
| Recorded Future | Recorded Future: 18 open roles | Hiring · this period | 1 source · Vendor sources only |
| Risk Ledger | Risk Ledger: 7 open roles | Hiring · this period | 1 source · Vendor sources only |
| SecurityScorecard | SecurityScorecard: 11 open roles | Hiring · this period | 1 source · Vendor sources only |
| Sprocket Security | Sprocket Security: 5 open roles | Hiring · this period | 1 source · Vendor sources only |
| SpyCloud | SpyCloud: 9 open roles | Hiring · this period | 1 source · Vendor sources only |
| Synack | Synack: 6 open roles | Hiring · this period | 1 source · Vendor sources only |
| UpGuard | UpGuard: 19 open roles | Hiring · this period | 1 source · Vendor sources only |
| XMCO | XMCO: 8 open roles | Hiring · this period | 1 source · Vendor sources only |
| Zafran Security | Zafran Security: 33 open roles | Hiring · this period | 1 source · Vendor sources only |
Most of the market is established: only 13 of the 96 vendors with a known founding year were founded in 2023 or later.
Product news outweighs customer announcements. Of 52 developments, 41 were product launches or expansions, 5 partnerships and 3 customer or deployment announcements.
Activity is spread rather than concentrated: the three vendors hiring most hold 38% of 825 open roles (Horizon3.ai alone 23%); the three most active accounts published 4% of 1008 vendor posts; the three best-funded vendors hold 23% of disclosed funding; three vendors account for 36% of 52 developments.
1,741 records collected → 88 developments
Tenterable Holdings completed a $400 million senior secured revolving credit facility, replacing its prior Term Loan B facility and matured revolving credit. The new undrawn facility provides additional capital allocation flexibility alongside September's convertible note financing.
Cybersecurity firm Tenable has been chosen by IT services company Atos to provide technology for a continuous threat exposure management program, enabling organizations to adopt proactive security approaches with enhanced visibility into vulnerabilities.
Uses AI to combine data from multiple sources for reliable ground truth in security asset management.
Authenticated attackers with valid credentials can execute arbitrary code in management interface.
Funding will expand Enginsight's European cybersecurity platform emphasizing German-made solutions.
New capability inventories and governs AI models, agents, and providers across environments.
New features enable automated threat response, natural language queries, and enhanced asset intelligence.
ProjectDiscovery, a security vulnerability detection company, has launched Neo Triage, a new feature designed to verify which identified vulnerabilities are actually exploitable, helping security teams prioritize remediation efforts more effectively.
Horizon3 has integrated its NodeZero autonomous security testing platform with Palo Alto Networks' Cortex XSOAR, enabling security teams to automatically push validated vulnerabilities into response workflows for prioritized remediation and retesting.
Bitdefender's GravityZone Exposure Management maps how hackers could chain weak spots to reach key systems and limits tools like PowerShell for each user.
Terra Security launched an AI-native cybersecurity podcast featuring Amazon CISO CJ Moses as its first guest, discussing AI-driven cyberattacks, faster threat response, and reducing mean time to defense.
Criminal IP launches AITEM, an advanced attack surface management solution that moves beyond traditional asset visibility to actively address cybersecurity threats. The product represents evolution in ASM capabilities.
Discovers unknown internet-facing assets, validates CVEs and EASM findings, and demonstrates actual exploitability by attackers.
Edgescan has launched Atomic, an AI-driven penetration testing platform that validates attack paths while operating within defined scope and policy controls.
The chemical manufacturer tested detection and response capabilities across multiple attack vectors without disrupting operations.
In 3 days, Yogosha evaluated 7 systems, ran 42 test categories, found 9 security issues.
Update adds notification templates, expands import/export, continues UI unification, and enables direct email server and SMS gateway configuration.
New capabilities identify cryptographic assets to prepare for quantum computing threats.
New adversary emulations target IAM persistence, credential access, defense evasion, data exfiltration, and S3 ransomware.
MCP servers added as new asset type; Prompt Library helps security teams test emerging attack surfaces.
Converts raw threat data into prioritized, contextualized security actions.
Integration offers verified findings, auditor-ready reports, and up to $4,000 in free pentest credits.
Idextrus provides security services with human-reviewed, plain-language scored reports on public-facing asset risks.
Protforce will provide vulnerability remediation, system hardening and ISMS consulting to VORNAC customers.
Tool creates remediation plans from prioritized findings and shows costs in USD before processing.
Purple Hook runs security checks within live AI coding sessions to prevent wasted tokens on already-found vulnerabilities.
Users can create filter definitions once and share across team members and dashboard widgets.
Tool runs locally inside AI coding assistants to deliver security findings with file, line, severity and fix information.
Sovereign AI-augmented platform draws on dark web archives collected since 2012, keeping data in France.
Basic lookups, standard searches, and advanced regex queries now cost fewer credits, up to four times more efficient.
AI agents attack internet-facing systems and report only actually exploited vulnerabilities.
Plugin for Code gives agents ability to exploit ONYPHE APIs without writing OQL queries.
The API enables automated threat intelligence investigations via scripts, SOAR playbooks, or AI agents.
Backported patches support PHP versions 5.5 through 8.5 without requiring version upgrades.
MCP servers enable agentic pentesting, validation, and re-testing directly from Claude Code or MCP-compatible applications.
The live public database benchmarks validation speed against CVE publication timelines.
Advisory covers CVE-2026-109618 and CVE-2026-109619 with affected PHP versions, fixed releases, mitigations and monitoring guidance.
No registration required; queries index of clear, deep, and dark web.
Red Loop adds continuous offensive testing to the Attack Surface Management platform, using AI agents to attack and validate findings.
Axonius released asset intelligence capabilities as part of its October 2026 product launch week.
The platform consolidates visibility across devices, users, cloud resources, and SaaS applications with verification.
Automates manual processes surrounding penetration tests including routing issues, alerting, compliance summaries, and remediation tickets.
Offers AI governance, device and email protection, and employee training against AI-powered threats.
GreyMatter SIEM-Less searches data directly in customer-owned object storage, eliminating SIEM costs while maintaining fast search performance.
The AI-powered cybersecurity asset management solution is released to all customers.
New features address unverified findings, restrictive firewalls, and incomplete remediation in AI security tools.
The enhancement detects more deeply rendered web content including JavaScript-driven elements.
Outpost24 launched an online platform letting organizations purchase and start PCI ASV vulnerability scanning within minutes.
The service continuously finds, validates, and attributes internet-facing perimeter assets for security teams.
The scanners help discover internet-facing assets like routers, cameras, and access controllers.
Everything matched to this market in the period, including general discussion and anything that did not become a development.
Products that map, score, prioritise and test an organisation's attack surface and vulnerabilities on a continuing basis, as Gartner's CTEM cycle describes: scoping, discovery, prioritisation, validation and mobilisation. It covers startups built for this, vendors acquired by others whose product still ships, and the exposure management lines of large security vendors.
Included: Vulnerability scanning and risk-based vulnerability management; exposure assessment platforms; external attack surface management; cyber asset attack surface management and controls monitoring; digital risk protection (leaked credentials, data leaks, dark web exposure); breach and attack simulation; automated and autonomous penetration testing; attack path analysis; penetration testing as a service and crowdsourced continuous testing platforms; security ratings and third-party exposure scoring.
Excluded: detection and response (SIEM, XDR, EDR, SOAR); identity and access management; application security testing without an exposure view (SAST, SCA); security awareness training and cyber ranges; managed services and consultancies without a product; brand protection without a security exposure product; a vendor's business outside exposure management. Darktrace and Qualys are on the blocked list and are not covered, including products they own.
Collection began 3 November 2026, so figures for this period are a floor. A comparison with the 30 days before will be available from 2 Jan 2027.
13 of the 96 vendors with a known founding year were founded in 2023 or later.
| Tenable Announces Closing of New $400M Secured Revolving Credit Facility Funding · 13 Oct 2026 · Also reported independently |
| Enginsight secures double-digit million-euro investment from Verdane Funding · 3 Nov 2026 · Vendor sources only |
67 of 194 vendors have a published total, adding to $5.295B. The best-funded of them:
| Vendor | Disclosed total | Last round |
|---|---|---|
| NetSPI | $500M | Private Equity |
| Horizon3.ai | $428M | Series E |
| SecurityScorecard | $292M | — |
| XBOW | $270M | Series C |
| Pentera | $250M | — |
| SpyCloud | $168M | Undisclosed round |
| Lansweeper | $158M | Private Equity |
| Bishop Fox | $154M | Series B |
| CyCognito | $153M | Series C |
| Censys | $149M | Series D |
| Insight Partners | Acronis, Brinqa, Detectify, Filigran, Lansweeper, Recorded Future, Tenable |
| Accel | Axonius, CrowdStrike, CyCognito, Filigran, RiskRecon, Tenable |
| Employee Stock Option Fund | CrowdStrike, Expanse, Recorded Future, Tenable, Zscaler |
| Forgepoint Capital | Bishop Fox, CybelAngel, Hackuity, Panaseer, ZeroFox |
| Bpifrance | CybelAngel, Hackuity, Patrowl, YesWeHack |
| Dell Technologies Capital | Cymulate, RiskRecon, Terra Security, Zscaler |
| Greylock | Censys, Cogent Security, Palo Alto Networks, Synack |
| Intel Capital | Censys, JupiterOne, Synack, ZeroFox |
| Singtel Innov8 | Balbix, Bitsight, Cyble, Synack |
| Ten Eleven Ventures | Digital Shadows, NetSPI, Noetic Cyber, Vulcan Cyber |
| Accomplice | Randori, Recorded Future, Sevco Security |
| AllegisCyber | Panaseer, Synack, Vicarius |
| Bain Capital Ventures | Cogent Security, JupiterOne, Rapid7 |
| Bossa Invest | AttackIQ, CYFIRMA, Picus Security |
| Bright Pixel Capital | Hackuity, SafeBreach, Vicarius |
| CyLon Ventures | DynaRisk, Intruder, Risk Ledger |
| First Citizens Innovation Banking | Censys, Vicarius, ZeroFox |
| Google Ventures | Censys, Recorded Future, Synack |
| IQT | Nucleus Security, Recorded Future, Tenable |
| Lightspeed Venture Partners | Axonius, CyCognito, Zscaler |
| MassMutual Ventures | CloudSEK, Recorded Future, RiskIQ |
| New Enterprise Associates | Expanse, Horizon3.ai, ZeroFox |
| Paladin Capital Group | Digital Shadows, Panaseer, SCYTHE |
| Sequoia Capital | Palo Alto Networks, SafeBreach, XBOW |
| .406 Ventures | Randori, Sevco Security |
Crunchbase's own Growth and Attention (Heat) scores, 0 to 100, for reference.
Read for 160 of 102 vendors. Changes appear once the scores have been collected for a full period.
We found 825 open roles across 67 vendors.
Horizon3.ai accounts for 187 of the 825 open roles, with Aikido Security accounting for another 75.
| Acronis | +0.0% | 1881 → 1881 |
| Aikido Security | +0.0% | 351 → 351 |
| Aleph Index | +0.0% | 15 → 15 |
| Arctic Security | +0.0% | 24 → 24 |
| ArmorCode | +0.0% | 218 → 218 |
We have 1 week of headcount data so far: the week of 2 Nov 2026 at -0.0% against where these vendors started. A chart needs three.
161 of 588 collected vendor posts contained a concrete company claim or announcement. The rest were commentary, event promotion or other non-company updates.
launch 75 research 53 award 22 other 8 partnership 7 incident 6 customer 5 funding 5 hiring 1
Coverage in the week of 19 Oct 2026, the latest complete week, was mixed (+5%).
Share of articles classed positive minus share classed negative, by week. Weeks with too few classified articles are left blank.
Ranked on LinkedIn posts, open roles and outside articles in the last 30 days; the score averages the three ranks. Only vendors measured on all three are scored.
| Vendor | Score | Own posts | Open roles | Written about |
|---|---|---|---|---|
| Acronis | 98 | 13 | 38 | 6 |
| Bitdefender | 97 | 10 | 22 | 19 |
| Aikido Security | 95 | 9 | 75 | 8 |
| Horizon3.ai | 94 | 9 | 187 | 4 |
| Censys | 92 | 9 | 12 | 5 |
| Picus Security | 89 | 11 | 10 | 1 |
| Axonius | 88 | 8 | 8 | 5 |
| YesWeHack | 87 | 11 | 3 | 3 |
| Flashpoint | 86 | 7 | 8 | 17 |
| Bitsight | 84 | 7 | 19 | 2 |
How 229 mentions by people outside these companies were split between them. The vendors' own posts are counted separately.
Vendors with fewer than five posts are left out.
| Vendor | Posts | Reactions/post | Mentions by others |
|---|---|---|---|
| Acronis | 13 | 85.5 | 5 |
| SOCRadar | 13 | 21.1 | 0 |
| Vicarius | 13 | 12.6 | 0 |
| CrowdStrike | 12 | 145.7 | 0 |
| YesWeHack | 11 | 30.0 | 3 |
| Picus Security | 11 | 29.9 | 1 |
| Ethiack | 11 | 16.7 | 0 |
| Bitdefender | 10 | 30.4 | 19 |
| Zscaler | 10 | 46.3 | 0 |
| G DATA CyberDefense | 10 | 41.6 | 0 |
| ESET | 10 | 50.9 | 0 |
| Cyjax | 10 | 5.5 | 0 |
| Aikido Security | 9 | 74.1 | 8 |
| Censys | 9 | 12.1 | 5 |
| Horizon3.ai | 9 | 67.1 | 4 |
| Ridge Security | 9 | 5.1 | 3 |
| ProjectDiscovery | 9 | 16.2 | 1 |
| Palo Alto Networks | 9 | 153.7 | 0 |
| Kaduu | 9 | 5.6 | 0 |
| Flare | 9 | 20.6 | 0 |
Accounts with at least 3 posts in the period. Vendors' LinkedIn company posts are counted elsewhere; a vendor's own account here is marked as one.
| Account | Who | Platform | Posts | Reactions | Latest post |
|---|---|---|---|---|---|
| @undercode.bsky.social | Undercode Testing · 673 followers Undercode Testing is a cybersecurity content platform focused on monitoring hacking techniques, bug bounties, vulnerability management, and emerging threats in… | bluesky | 25 | 9 | 2026-11-05 |
| @opsmatters.com | OpsMatters · 454 followers OpsMatters is a technology news and updates aggregation platform that curates and publishes the latest developments, product updates, and security news from… | bluesky | 4 | 2 | 2026-11-05 |
| @pullrepo.bsky.social | Pull Repo · 65 followers Pull Repo is an automated feed account that publishes weekly radar updates highlighting the fastest-growing AI tools and repositories. The account aggregates… | bluesky | 3 | 0 | 2026-10-29 |
@Shelter_Appropriate · reddit · 24 reactions, comments and reposts
“Building an agentic CVE watcher, tell me what's wrong with this idea”
@Artilas_Digital · reddit · 9 reactions, comments and reposts
“Shannon: an autonomous, AI pentester for web applications and APIs (50k stars)”
@rahultyagihacks · twitter · 3 reactions, comments and reposts
Practitioner and analyst discussion of the market, not vendor news.
Sorted by collection state, then by the date of each vendor's latest development, then by name.
| Vendor | Status | Country | Founded | LinkedIn headcount | Disclosed funding | Developments, 30d | Open roles | Latest development |
|---|---|---|---|---|---|---|---|---|
| Phoenix Security | Changed | United Kingdom | 2021 | 28 | $0M | 4 | 0 | 2026-11-04 |
| Ethiack | Changed | Portugal | 2022 | 56 | Undisclosed | 2 | 2 | 2026-11-02 |
| Filigran | Changed | France | 2022 | 281 | Undisclosed | 3 | 8 | 2026-11-02 |
| Novee | Changed | Israel | 2025 | 75 | $52M | 3 | 0 | 2026-11-02 |
| Censys | Changed | United States | 2017 | 196 | $149M | 5 | 12 | 2026-10-30 |
| ONYPHE | Changed | France | 2017 | 4 | Undisclosed | 1 | 0 | 2026-10-28 |
| Horizon3.ai | Changed | United States | 2019 | 645 | $428M | 3 | 187 | 2026-10-27 |
| Tenable | Changed | United States | 2002 | 2398 | Undisclosed | 3 | 0 | 2026-10-27 |
| Axonius | Changed | United States | 2017 | 706 | Undisclosed | 8 | 8 | 2026-10-26 |
| ProjectDiscovery | Changed | United States | 2020 | 51 | $25M | 1 | 0 | 2026-10-26 |
| Strobes Security | Changed | United States | 2019 | 106 | Undisclosed | 2 | 0 | 2026-10-26 |
| Pentera | Changed | United States | 2015 | 434 | $250M | 2 | 7 | 2026-10-21 |
| Terra Security | Changed | Israel | 2024 | 84 | $38M | 1 | 4 | 2026-10-20 |
| Attaxion | Changed | United States | 2023 | 8 | Undisclosed | 1 | 0 | 2026-10-19 |
| Outpost24 | Changed | Sweden | 2001 | 281 | Undisclosed | 1 | 2 | 2026-10-16 |
| Palo Alto Networks | Changed | United States | 2005 | 23805 | Undisclosed | 1 | 0 | 2026-10-14 |
| VORNAC | Changed | Germany | 2026 | 5 | Undisclosed | 1 | 0 | 2026-10-13 |
| AttackIQ | Changed | United States | 2014 | 197 | $79M | 1 | 0 | 2026-10-07 |
| Edgescan | Changed | Ireland | 2017 | 88 | Undisclosed | 1 | 0 | 2026-10-07 |
| Autobahn Security | No change | Germany | 2019 | 29 | Undisclosed | 0 | 0 | — |
| CyCognito | No change | United States | 2017 | 96 | $153M | 0 | 0 | — |
| Cyrating | No change | France | 2016 | 2 | Undisclosed | 0 | 0 | — |
| Defense.com | No change | United Kingdom | — | 37 | Undisclosed | 0 | 0 | — |
| Fleuret AI | No change | France | 2026 | 12 | Undisclosed | 0 | 0 | — |
| FullHunt | No change | United Arab Emirates | 2018 | 2 | Undisclosed | 0 | 0 | — |
| Greenbone | No change | Germany | 2008 | 118 | Undisclosed | 0 | 3 | — |
| Hackuity | No change | France | 2018 | 42 | $32M | 0 | 2 | — |
| Hadrian | No change | Netherlands | 2021 | 110 | $65M | 1 | 10 | — |
| Halo Security | No change | United States | 2013 | 35 | Undisclosed | 0 | 0 | — |
| Holm Security | No change | Sweden | 2015 | 62 | Undisclosed | 0 | 0 | — |
| Intruder | No change | United Kingdom | 2015 | 80 | Undisclosed | 0 | 0 | — |
| LEET Security | No change | Spain | — | — | Undisclosed | 0 | 0 | — |
| LocateRisk | No change | Germany | 2018 | 23 | Undisclosed | 0 | 0 | — |
| Mitigant | No change | Germany | 2021 | 12 | Undisclosed | 0 | 0 | — |
| Nanitor | No change | Iceland | 2014 | 15 | Undisclosed | 0 | 0 | — |
| Orpheus Cyber | No change | United Kingdom | — | 29 | Undisclosed | 0 | 0 | — |
| Panaseer | No change | United Kingdom | 2014 | 81 | $43M | 0 | 0 | — |
| Patrowl | No change | France | 2020 | 49 | $14M | 0 | 0 | — |
| Pentest-Tools.com | No change | Romania | 2017 | 66 | Undisclosed | 0 | 0 | — |
| Pikered | No change | Italy | 2020 | 11 | Undisclosed | 0 | 0 | — |
| RCE Security | No change | Germany | 2012 | 1 | Undisclosed | 0 | 0 | — |
| Red Sift | No change | United Kingdom | 2015 | 103 | Undisclosed | 0 | 0 | — |
| RiskXchange | No change | United Kingdom | 2020 | 7 | Undisclosed | 0 | 0 | — |
| Saporo | No change | Switzerland | 2021 | 47 | Undisclosed | 0 | 0 | — |
| Searchlight Cyber | No change | United Kingdom | 2017 | 84 | Undisclosed | 0 | 0 | — |
| ThingsRecon | No change | Netherlands | 2022 | 16 | Undisclosed | 0 | 0 | — |
| ThreatAware | No change | United Kingdom | 2019 | 53 | $25M | 0 | 0 | — |
| Uncovery | No change | France | 2021 | — | Undisclosed | 0 | 0 | — |
| Validato | No change | United Kingdom | 2021 | 5 | Undisclosed | 0 | 0 | — |
| WithSecure | No change | Finland | 1988 | 529 | Undisclosed | 0 | 0 | — |
| XRATOR | No change | France | 2021 | 11 | Undisclosed | 0 | 0 | — |
| Astelia | Incomplete | United States | — | 64 | $35M | 0 | 2 | — |
| Bitsight | Incomplete | United States | 2011 | 659 | Undisclosed | 1 | 19 | — |
| Black Kite | Incomplete | United States | 2016 | 179 | $33M | 1 | 8 | — |
| Board of Cyber | Incomplete | France | 2019 | 50 | Undisclosed | 0 | 0 | — |
| BreachLock | Incomplete | United States | 2019 | 139 | Undisclosed | 1 | 10 | — |
| Brinqa | Incomplete | United States | 2009 | 101 | $110M | 0 | 1 | — |
| Check Point Software | Incomplete | Israel | 1993 | 8646 | Undisclosed | 0 | 0 | — |
| Cogent Security | Incomplete | United States | 2024 | 112 | $53M | 1 | 52 | — |
| CrowdStrike | Incomplete | United States | 2011 | 11979 | Undisclosed | 0 | 0 | — |
| CybelAngel | Incomplete | France | 2013 | 154 | $52M | 0 | 0 | — |
| CyberMindr | Incomplete | United States | 2023 | 38 | Undisclosed | 0 | 0 | — |
| Cyberwatch | Incomplete | France | — | 43 | Undisclosed | 0 | 0 | — |
| Cymulate | Incomplete | Israel | 2016 | 201 | $141M | 0 | 4 | — |
| Empirical Security | Incomplete | United States | 2024 | 35 | $37M | 0 | 4 | — |
| FortifyData | Incomplete | United States | 2015 | 21 | $7M | 0 | 0 | — |
| FourCore | Incomplete | India | 2021 | 14 | Undisclosed | 0 | 0 | — |
| Hive Pro | Incomplete | United States | 2019 | 108 | Undisclosed | 0 | 0 | — |
| IONIX | Incomplete | Israel | 2016 | 118 | $50M | 0 | 3 | — |
| ImmuniWeb | Incomplete | Switzerland | 2014 | 30 | Undisclosed | 0 | 0 | — |
| Ivanti | Incomplete | United States | 2017 | 2892 | Undisclosed | 0 | 0 | — |
| JupiterOne | Incomplete | United States | 2020 | 77 | $119M | 0 | 0 | — |
| Microsoft | Incomplete | United States | 1975 | 231116 | Undisclosed | 0 | 0 | — |
| NopSec | Incomplete | United States | 2011 | 28 | Undisclosed | 0 | 0 | — |
| Northstar Security | Incomplete | United States | 2026 | 11-50 employees | $7M | 0 | 1 | — |
| Nucleus Security | Incomplete | United States | 2018 | 131 | $86M | 1 | 6 | — |
| Onit Security | Incomplete | Israel | — | 22 | $11M | 0 | 0 | — |
| Panorays | Incomplete | United States | 2016 | 121 | Undisclosed | 0 | 2 | — |
| Picus Security | Incomplete | United States | 2013 | 313 | $80M | 1 | 10 | — |
| Rapid7 | Incomplete | United States | 2000 | 3313 | Undisclosed | 0 | 0 | — |
| RedSeal | Incomplete | United States | 2004 | 151 | Undisclosed | 0 | 0 | — |
| Ridge Security | Incomplete | United States | 2020 | 48 | Undisclosed | 0 | 0 | — |
| RiskProfiler | Incomplete | United States | 2019 | 34 | Undisclosed | 0 | 0 | — |
| RunSybil | Incomplete | United States | 2023 | 41 | $40M | 0 | 4 | — |
| SCYTHE | Incomplete | United States | 2018 | 27 | $13M | 0 | 0 | — |
| SafeBreach | Incomplete | United States | 2014 | 142 | $106M | 0 | 3 | — |
| SecPod | Incomplete | India | 2008 | 182 | Undisclosed | 0 | 0 | — |
| Securin | Incomplete | United States | 2021 | 236 | Undisclosed | 0 | 0 | — |
| SecurityScorecard | Incomplete | United States | 2013 | 589 | $292M | 1 | 11 | — |
| Seemplicity | Incomplete | Israel | 2020 | 87 | $82M | 0 | 0 | — |
| ServiceNow | Incomplete | United States | 2004 | 34842 | Undisclosed | 0 | 0 | — |
| Sprocket Security | Incomplete | United States | 2017 | 54 | $8M | 1 | 5 | — |
| Tenzai | Incomplete | Israel | 2025 | 73 | $75M | 0 | 4 | — |
| ThreatNG Security | Incomplete | United States | 2020 | 10 | Undisclosed | 0 | 0 | — |
| Tonic Security | Incomplete | Israel | 2024 | — | $7M | 0 | 0 | — |
| Trend Micro | Incomplete | Japan | 1988 | 7979 | Undisclosed | 0 | 0 | — |
| UpGuard | Incomplete | United States | 2012 | 401 | Undisclosed | 1 | 19 | — |
| Vicarius | Incomplete | United States | 2016 | 98 | $59M | 0 | 0 | — |
| XBOW | Incomplete | United States | 2024 | 304 | $270M | 0 | 3 | — |
| Zafran Security | Incomplete | United States | 2022 | 222 | $130M | 1 | 33 | — |
| Zscaler | Incomplete | United States | 2007 | 9663 | Undisclosed | 0 | 0 | — |
| watchTowr | Incomplete | Singapore | 2021 | 73 | $29M | 0 | 2 | — |
| Aleph Index | — | France | 2012 | 15 | Undisclosed | 2 | 0 | 2026-11-03 |
| Enginsight | — | Germany | 2017 | 80 | Undisclosed | 2 | 0 | 2026-11-03 |
| Aikido Security | — | Belgium | 2022 | 351 | $85M | 5 | 75 | 2026-10-28 |
| Bitdefender | — | Romania | 2001 | 2345 | Undisclosed | 2 | 22 | 2026-10-27 |
| Yogosha | — | France | 2015 | 194 | Undisclosed | 1 | 0 | 2026-10-27 |
| Digital Shadows | — | United Kingdom | 2011 | — | Undisclosed | 2 | 35 | 2026-10-20 |
| Bishop Fox | — | United States | 2005 | 383 | $154M | 2 | 11 | 2026-10-13 |
| Criminal IP | — | South Korea | 2017 | 28 | $18M | 1 | 0 | 2026-10-10 |
| Acronis | — | Switzerland | 2003 | 1881 | Undisclosed | 1 | 38 | — |
| Arctic Security | — | Finland | 2017 | 24 | Undisclosed | 0 | 0 | — |
| Armis | — | United States | 2015 | 904 | Undisclosed | 1 | 5 | — |
| ArmorCode | — | United States | 2020 | 218 | $81M | 1 | 8 | — |
| Avalor | — | Israel | 2022 | 57 | $30M | 0 | 0 | — |
| Axur | — | Brazil | 2010 | 69 | Undisclosed | 0 | 0 | — |
| Balbix | — | United States | 2015 | 26 | $100M | 1 | 20 | — |
| Bit Discovery | — | United States | 2018 | 2-10 employees | $7M | 0 | 0 | — |
| CYFIRMA | — | Singapore | 2017 | 136 | Undisclosed | 0 | 0 | — |
| Citalid | — | France | 2017 | 52 | Undisclosed | 0 | 0 | — |
| CloudSEK | — | India | 2015 | 239 | $28M | 1 | 22 | — |
| Cobalt | — | United States | 2013 | 602 | $37M | 1 | 7 | — |
| CovertSwarm | — | United Kingdom | 2020 | 82 | Undisclosed | 0 | 3 | — |
| CyberDart | — | Italy | 2023 | 6 | Undisclosed | 0 | 0 | — |
| CyberVadis | — | France | 2018 | 102 | Undisclosed | 0 | 2 | — |
| Cyberint | — | Israel | 2010 | 180 | Undisclosed | 0 | 0 | — |
| Cyble | — | United States | 2019 | 230 | $44M | 0 | 4 | — |
| Cyjax | — | United Kingdom | 2012 | 40 | Undisclosed | 0 | 0 | — |
| Cyver | — | Netherlands | 2020 | 10 | Undisclosed | 0 | 0 | — |
| Dazz | — | Israel | 2021 | 58 | Undisclosed | 0 | 0 | — |
| Detectify | — | Sweden | 2013 | 92 | $42M | 1 | 5 | — |
| DynaRisk | — | United Kingdom | 2016 | 22 | Undisclosed | 0 | 0 | — |
| EBRAND | — | Luxembourg | 2007 | 131 | Undisclosed | 0 | 0 | — |
| ESET | — | Slovakia | 1992 | 2041 | Bootstrapped | 1 | 17 | — |
| Expanse | — | United States | 2012 | 15 | $136M | 0 | 0 | — |
| Flare | — | Canada | 2017 | 195 | Undisclosed | 1 | 7 | — |
| Flashpoint | — | United States | 2010 | 364 | Undisclosed | 1 | 8 | — |
| FortiRecon | — | United States | 2000 | 16738 | Undisclosed | 0 | 0 | — |
| G DATA CyberDefense | — | Germany | 1985 | 400 | Undisclosed | 0 | 2 | — |
| GObugfree | — | Switzerland | 2020 | 17 | Undisclosed | 0 | 0 | — |
| Group-IB | — | Singapore | 2003 | 599 | Undisclosed | 0 | 1 | — |
| Hackrate | — | Hungary | 2020 | 13 | Undisclosed | 0 | 0 | — |
| Hackrfi | — | Finland | 2016 | 3 | Undisclosed | 0 | 0 | — |
| Hacktify | — | Hungary | 2020 | 5 | Undisclosed | 0 | 0 | — |
| Heimdal | — | Denmark | 2014 | 285 | Undisclosed | 0 | 0 | — |
| Hexway | — | Cyprus | — | — | Undisclosed | 0 | 0 | — |
| Hudson Rock | — | Israel | 2020 | 14 | Undisclosed | 0 | 0 | — |
| Identeco | — | Germany | 2020 | 12 | Undisclosed | 0 | 0 | — |
| Intigriti | — | Belgium | 2016 | 858 | Undisclosed | 0 | 1 | — |
| Intrigue | — | United States | 2019 | 11-50 employees | $2M | 0 | 0 | — |
| KYND | — | United Kingdom | 2018 | 68 | Undisclosed | 0 | 0 | — |
| Kaduu | — | Switzerland | 2018 | 16 | Undisclosed | 0 | 0 | — |
| Lansweeper | — | Belgium | 2004 | 415 | $158M | 1 | 13 | — |
| Lupasafe | — | Netherlands | 2019 | 11 | Undisclosed | 0 | 0 | — |
| Lupovis | — | United Kingdom | 2021 | 18 | Undisclosed | 0 | 0 | — |
| Nagomi Security | — | United States | 2023 | 73 | Undisclosed | 0 | 1 | — |
| NetSPI | — | United States | 2001 | 604 | $500M | 0 | 3 | — |
| Netcraft | — | United Kingdom | 1995 | 296 | Undisclosed | 0 | 2 | — |
| Noetic Cyber | — | United States | 2019 | 8 | $20M | 0 | 0 | — |
| Nordic Defender | — | Sweden | 2019 | 14 | Undisclosed | 0 | 0 | — |
| OnSecurity | — | United Kingdom | 2018 | 65 | Undisclosed | 0 | 0 | — |
| Ordr | — | United States | 2015 | 91 | Undisclosed | 0 | 3 | — |
| Pentest People | — | United Kingdom | 2018 | 42 | Undisclosed | 0 | 0 | — |
| Praetorian | — | United States | 2010 | 113 | Undisclosed | 0 | 3 | — |
| Prelude Security | — | United States | 2025 | 38 | $45M | 0 | 0 | — |
| Probely | — | Portugal | — | 3 | Undisclosed | 0 | 0 | — |
| Randori | — | United States | 2018 | 11 | $30M | 0 | 0 | — |
| Raynet | — | Germany | 1999 | 162 | Undisclosed | 0 | 0 | — |
| Recorded Future | — | United States | 2009 | 1141 | Undisclosed | 1 | 18 | — |
| Reposify | — | United States | 2016 | 13 | $8M | 0 | 0 | — |
| Risk Ledger | — | United Kingdom | 2018 | 99 | $32M | 1 | 7 | — |
| RiskIQ | — | United States | 2009 | 27 | $83M | 0 | 0 | — |
| RiskRecon | — | United States | 2015 | 77 | Undisclosed | 0 | 0 | — |
| Rootshell Security | — | United Kingdom | 2019 | 53 | Undisclosed | 0 | 1 | — |
| Runecast | — | United Kingdom | 2014 | 14 | Undisclosed | 0 | 0 | — |
| SAFE Security | — | United States | 2012 | — | Undisclosed | 0 | 0 | — |
| SOCRadar | — | United States | 2018 | 292 | $30M | 0 | 0 | — |
| SOS Intelligence | — | United Kingdom | 2020 | 5 | Undisclosed | 0 | 0 | — |
| SecPoint | — | Denmark | 1998 | 14 | Undisclosed | 0 | 0 | — |
| Sevco Security | — | United States | 2020 | 19 | $38M | 0 | 0 | — |
| Siemba | — | United States | 2018 | 37 | $1M | 0 | 0 | — |
| SignalFisher | — | Switzerland | 2020 | 67 | Undisclosed | 0 | 0 | — |
| Silobreaker | — | United Kingdom | 2005 | 58 | Undisclosed | 0 | 0 | — |
| SpyCloud | — | United States | 2016 | 283 | $168M | 1 | 9 | — |
| Synack | — | United States | 2013 | 228 | $112M | 1 | 6 | — |
| Vonahi Security | — | United States | 2018 | 22 | Undisclosed | 0 | 0 | — |
| Vulcan Cyber | — | Israel | 2018 | 23 | Undisclosed | 0 | 0 | — |
| XMCO | — | France | 2002 | 115 | Bootstrapped | 1 | 8 | — |
| YesWeHack | — | France | 2015 | 804 | Undisclosed | 0 | 3 | — |
| ZeroFox | — | United States | 2013 | 853 | Undisclosed | 0 | 4 | — |
| Zerocopter | — | Netherlands | 2015 | 38 | Undisclosed | 0 | 0 | — |
| cysmo | — | Germany | 2017 | 9 | Undisclosed | 0 | 0 | — |
| runZero | — | United States | 2018 | 68 | $20M | 0 | 0 | — |
| turingpoint | — | Germany | 2019 | 10 | Undisclosed | 0 | 0 | — |
A dash under developments or open roles means collection is paused for that vendor.
Send us a story about Exposure Management Market that is not here, tell us your company belongs on the list. We read everything; what goes on the page is our call.
Everything here is open to read. If you want the data in your own tools, the intelligence feed starts at $139 a month, or ask about data access below.
Choosing a product in this market? Advisory helps buyers build a shortlist, test vendor claims and plan a proof of concept.
A product launch is a statement that something is available; it says nothing about adoption, which this report reads only from customer evidence. A funding round is capital raised, not revenue. A partnership is an agreement, not sales. An acquisition is a change of owner, not of product. The "why it matters" column therefore states only what the source itself says about the event — the product, the amount, the partner, the buyer — and is left empty when the source says nothing more than the headline.
Per source: vendors it could read, set up for it, attempted, and read successfully.
| Source | State | Eligible | Configured | Attempted | Collected | Notes |
|---|---|---|---|---|---|---|
| Company posts (LinkedIn) | checked | 194 / 102 | 194 | 194 | 194 | |
| Company profiles and headcount (LinkedIn) | checked | 194 / 102 | 194 | 194 | 194 | |
| Job listings (LinkedIn) | checked | 194 / 102 | 194 | 194 | 194 | |
| Funding stages, investors and scores (Crunchbase) | checked | 194 / 102 | 194 | 194 | 194 | |
| Vendor site updates (vendor website / RSS) | some vendors checked | 190 / 102 | 190 | 75 | 74 | we checked 74 of the 190 vendors we have a way to look up |
| Finding a vendor's feed (vendor website) | checked | 190 / 102 | 190 | 190 | 190 | |
| Job listings (the company's own hiring system) | checked | 31 / 102 | 31 | 31 | 31 | |
| Finding a vendor's hiring system (vendor website) | checked | 190 / 102 | 190 | 190 | 190 |
Not read for this market: Job listings (experimental) (Indeed) (we do not search Indeed on a schedule, so job counts here cover LinkedIn and the vendors' own careers pages only); Funding and ownership (PitchBook) (we do not track PitchBook for these vendors); Company profile and contacts (ZoomInfo) (we do not track ZoomInfo for these vendors).
| Coverage | Vendors | % |
|---|---|---|
| Being watched | 102 / 102 | 100% |
| We have seen something from | 102 / 102 | 100% |
| Posting on LinkedIn in the period | 89 / 102 | 87% |
| Crunchbase profile read | 160 / 194 | 82% |
| Have public job listings | 67 / 102 | 66% |
Of the 102 vendors, 19 had a development, 32 were watched and had none, 51 were only partly collected.
Aunoo matches everything it collects against the phrases that define this market and the names of its vendors. Company and funding details come from LinkedIn and Crunchbase.
Collection began 3 November 2026; anything dated earlier was collected afterwards as backlog.
A development is one event, however many records discuss it: records about the same vendor and the same kind of event, within two weeks of each other, sharing a name or subject, are merged and all stay linked under it. “Reported independently” means another source carried the same event, not that anyone verified it.
Each source, where it is published, and the provider we get it through.
| What | Published on | We get it from | Whose words |
|---|---|---|---|
| Company posts | Bright Data | vendor-owned | |
| Company profiles and headcount | Bright Data | vendor profile | |
| Job listings | Bright Data | vendor-associated | |
| Job listings (experimental) | Indeed | Bright Data | vendor-associated; we have not yet checked that every listing is the vendor's own |
| Practitioner discussion | X (Twitter), Reddit, TikTok and Instagram | Xpoz | third-party (earned) |
| Practitioner discussion | Bluesky | Bluesky (direct) | third-party (earned) |
| Employee reviews | Glassdoor | OpenWebNinja | third-party (current and former staff) |
| News | the publication itself | configured news/RSS feeds | third-party (earned) |
| Vendor site updates | vendor website / RSS | site and RSS collector | vendor-owned |
| Job listings | the company's own hiring system | the hiring system's public job board API | vendor-associated |
| Finding a vendor's hiring system | vendor website | site collector | vendor-owned |
| Finding a vendor's feed | vendor website | site and RSS collector | vendor-owned |
| Funding and ownership | PitchBook | Bright Data | third-party company data |
| Company profile and contacts | ZoomInfo | Bright Data | third-party company data |
| Funding stages, investors and scores | Crunchbase | Bright Data | third-party company data |
| Disclosed funding totals | imported workbook | operator import | third-party company data |
We add up the most recent employee count each vendor shows on LinkedIn. Some companies publish a range instead of a number, like 51-200. We leave those out rather than guess, and we leave out vendors we have no headcount for rather than count them as zero.
Counts the latest exact employee count for each vendor, out of vendors whose LinkedIn profile we have read recently.
Posts a vendor put out on its own LinkedIn account during the period. If a vendor reshared somebody else's post, we count that separately, because resharing is not the same as having something to say.
Counts posts from the vendors' own LinkedIn accounts, out of vendors whose posts we managed to collect, over the last 30 days.
Vendor posts are classed as announcement (a company event or verifiable update), commentary (interpretation or educational material), promotion (marketing with no event in it) or unreviewed.
A development is an acquisition, funding, product launch or expansion, partnership, customer or deployment, executive appointment, hiring above a floor, headcount change, or a market entry or exit. A vendor's own post counts when the review pass judged it a concrete announcement; a third-party page counts when its headline says so and it names a tracked vendor. Practitioner posts attach as evidence to a development or are listed as discussion. Job-seeking posts, course completions, adverts and market-size reports are filtered out.
