Detectify

What the company sells

Detectify is an application security platform that combines Dynamic Application Security Testing (DAST) and Attack Surface Management (ASM). Detectify says it discovers a full attack surface, including assets an organization may not know exist, and tests every asset for exploitable vulnerabilities using payload-based techniques developed by more than 400 ethical hackers.

Detectify describes a problem with legacy application security: scanners only test the assets they are told about, so shadow IT stays invisible. Detectify also says fingerprint-based checks flag versions instead of real exploitability. Detectify positions its platform as SaaS-only with nothing to install.

Every Detectify product starts with Discovery, a single inventory of assets that becomes the source of truth for every scan, integration and finding across the platform. Surface Monitoring finds the domains, subdomains, IPs and open ports a customer has on the internet, and keeps testing them with payload-based tests. Surface Monitoring also checks subdomains for takeover every 8 hours.

Application Scanning crawls and fuzzes custom web apps, including single-page apps and the parts behind login. API Scanning takes an OpenAPI spec or GraphQL schema and tests every operation in it with payload-based tests, including prompt injection on AI endpoints. Both use the same fuzzing engine.

Detectify also offers tools for AI. Alfred AI turns published CVEs into payload-based tests, and a Detectify security researcher reviews each one before it goes live. The MCP Server lets Claude Code, Cursor and other AI tools query Detectify findings, scans and assets in plain language, and it is included in every Detectify plan.

Detectify says its research comes from Crowdsource, a community of 400+ ethical hackers, and that 99% of the vulnerabilities it finds have no CVE assigned, based on its own data over the past three years. Detectify says it is used by more than 2,100 organizations, from high-growth SaaS companies to large enterprises and public institutions.^{[7][8][9][10][11][12][14][15][16]}

Categories

• Dynamic application security testing (primary category)
• External attack surface management
• Compare Detectify with companies in the same categoryside by side

Headquarters

Stockholm, Sweden

Founded

2013^[1]

Ownership

Owned by Insight Partners since 2024^{[2][5][6][13]}

CISO on record

Not yet on our record. Send a verified source

Website

detectify.com

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

• Application Scanning^[9][10]

  Crawls and fuzzes custom web apps, including the parts behind login.

  Application Scanning crawls apps in a real browser, so it renders JavaScript and handles single-page apps. It tests with payloads from 1,765+ modules built by ethical hackers in the Crowdsource community. A recorded login lets it test areas behind sign-in.

• API Scanning^[10]

  Tests every operation in an OpenAPI spec or GraphQL schema with payload-based tests.

  API Scanning builds the scan from an uploaded OpenAPI spec or GraphQL schema. Findings are confirmed by running the payload, not by matching a signature.

• Alfred AI^[13]

  Turns published CVEs into payload-based tests that a Detectify security researcher reviews before they go live.

  Alfred AI monitors public CVE disclosures to find CVEs with a working public proof of concept. It builds a payload-based test from the proof of concept. A Detectify security researcher reviews every test before it goes live.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of Detectify's categories, then alphabetical. A list from the record, never a ranking.

• On dynamic application security testing, Detectify competes with Beagle Security, Invicti, StackHawk, Attaxion, Escape, Outpost24, 42Crunch, Astra Security, Black Duck, Checkmarx and 7 more.

• On external attack surface management, Detectify competes with Attaxion, Censys, CyCognito, Hadrian, IONIX, Escape, Outpost24, Arctic Wolf, Bishop Fox, Bitsight and 25 more.

What review platforms show

The headline rating and review count each platform showed in public search results on the day we looked, with the link. We do not read or reproduce the reviews, and a rating is the platform's, not ours.

• G2 · 4.5 out of 5^[5]seen November 4, 2026

Recent news

Dated company events from the last twelve months, each in one sentence of ours with its source. Newest first.

• October 29, 2026

  Detectify announced that it is one of the vendors featured in KuppingerCole's 2026 Leadership Compass on Attack Surface Management. Detectify^[17]

• May 26, 2026

  Detectify unveiled an MCP Server, an integration layer that brings its security testing engines into AI. Help Net Security^[4]

• March 24, 2026

  Detectify launched IP Range Scanning, which enables continuous discovery and monitoring of entire IP address blocks. Help Net Security^[18]

• February 3, 2026

  Detectify launched Internal Scanning, which brings its crawling and fuzzing engine behind the customer's firewall. Detectify^[3]

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

1. [1]AboutDetectify · detectify.com · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
2. [2]Insight partners acquires majority stake in detectifyDetectify · newsroom.detectify.com · published October 29, 2024 · Tier A: the company, a regulator or a filing
3. [3]Introducing Detectify Internal Scanning for internal scanning behind the firewallDetectify · published February 3, 2026 · Tier A: the company, a regulator or a filing
4. [4]Detectify brings AppSec automation to AI agents with MCP Server and continuous testingHelp Net Security · published May 26, 2026 · Tier B: trade or business press
5. [5]Detectify Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 24, 2026 · Tier C
6. [6]Detectify - Application security built and trusted by hackersDetectify · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
7. [7]Application security built on hacker researchDetectify · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
8. [8]Surface Monitoring | Attack Surface Management | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
9. [9]Application Scanning | DAST for Web Apps | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
10. [10]API Scanning | API Security Testing | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
11. [11]Internal Scanning | DAST for Internal Apps | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
12. [12]PCI ASV Scanning | Approved PCI DSS Scans | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
13. [13]Alfred AI | CVE Tests Built by AI | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
14. [14]MCP Server | Claude Code, Cursor and more | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
15. [15]Agentic Tooling | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
16. [16]Integrations | Jira, Slack, Teams and More | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
17. [17]Detectify featured in KuppingerCole's Analysts 2026 Leadership Compass on Attack Surface ManagementDetectify · published October 29, 2026 · Tier A: the company, a regulator or a filing
18. [18]Detectify uncovers hidden assets and risks across entire IP rangesHelp Net Security · published March 24, 2026 · Tier B: trade or business press

Last verified November 2, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded September 27, 2026, expanded November 4, 2026 from the references above.

Work for Detectify? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.