Exposure management

Breach simulation and automated pen-testing

Platforms that safely emulate attacker techniques against live environments to validate whether controls work.

27 vendors · alphabetical

• ABIR NetworksABIR Networks sells penetration testing, cloud security, risk consulting and compliance services.Ownership not established
• ArmadinArmadin is a cybersecurity company providing an agentic AI, continuous offensive security platform that identifies and proves exploitable risk across the entire attack surface.Ownership not established · primary category
• AssailAssail sells Ares, an autonomous offensive security platform that tests applications, APIs, mobile apps and AI systems and shows what an attacker could actually reach.Privately held · primary category
• AttackIQAttackIQ sells a platform that connects exposure signals, attack paths, and controls into a single decision layer.Ownership not established
• BreachLockBreachLock sells human-delivered, AI-powered and automated testing for attack surface management, penetration testing as a service, and automated pentesting and red teaming, integrated into the BreachLock Platform.Ownership not established
• CymulateCymulate sells the Cymulate Platform, which turns validation into a continuous, adaptive process of agentic cyber defense engineering.Ownership not established · primary category
• DreadnodeDreadnode sells an infrastructure platform that gives security teams the means to own, operationalize, and improve agentic cyber capabilities.Ownership not established
• FiligranFiligran sells the XTM Platform, an eXtended Threat Management suite in which threat intelligence, adversarial exposure validation and agentic AI orchestration work together in one threat-informed defense loop, open source at the core.Privately held
• Fleuret AIFleuret AI sells pentesting that combines artificial intelligence and offensive expertise.Privately held · primary category
• HadrianHadrian is an agentic AI offensive security platform that continuously discovers an organization's external attack surface and tests it for exploitable exposures.Privately held
• Horizon3.aiHorizon3.ai sells NodeZero, a platform that autonomously executes real attack techniques in production environments so organizations can find exploitable weaknesses, fix them and verify the fixes.Privately held · primary category
• NetSPINetSPI sells pentesting as a service (PTaaS), attack surface management (ASM), and breach and attack simulation (BAS) as a service.Ownership not established
• PenteraPentera sells a platform that combines AI-powered adversarial testing, risk-based prioritization, and automated remediation into one workflow.Privately held · primary category
• Picus SecurityPicus Security sells a platform that proves what attackers can exploit and what defenses stop.Ownership not established · primary category
• Prime SecurityPrime Security sells an AI security review platform designed for software development lifecycles.Ownership not established
• ProficioProficio sells managed detection and response (MDR) services.Ownership not established
• PromptfooPromptfoo builds open-source tools for secure, reliable AI applications.Owned by OpenAI
• Red SentryRed Sentry sells offensive security services, from one-off penetration tests to ongoing PTaaS (Penetration Testing as a Service) partnerships.Ownership not established
• Reflex SecurityReflex Security says a breach cannot be controlled, and that a team cannot pick the day, the attacker or the exploit.Ownership not established · primary category
• SafeBreachSafeBreach sells the SafeBreach Exposure Validation Platform, which combines the SafeBreach Validate breach and attack simulation product with the attack path validation capabilities of SafeBreach Propagate.Ownership not established · primary category
• Skyhawk SecuritySkyhawk Security sells an agentless AI purple team platform that uses the same tools adversaries do.Privately held
• TenzaiTenzai sells an AI agentic penetration testing platform that hacks, exploits and fixes vulnerabilities across enterprise software.Privately held · primary category
• Terra SecurityTerra Platform™ covers web, API, AI, external network, and internal network pentesting.Ownership not established · primary category
• Threat IntelligenceThreat Intelligence delivers cyber security products and services.Ownership not established · primary category
• Vonahi SecurityVonahi Security sells vPenTest, an automated network penetration testing SaaS platform. vPenTest is a scripted network penetration testing platform that runs the exact same steps and processes performed by a security consultant doing a live pentest. vPenTest is a full-scale penetration testing platform that incorporates the knowledge, methodologies, techniques and commonly used tools of multiple consultants into a single platform. vPenTest covers host discovery, service enumeration, vulnerability analysis, exploitation, post-exploitation, privilege escalation and lateral movement, as well as documentation and reporting.Owned by Kaseya
• XM CyberXM Cyber sells a platform that continuously surfaces every validated exposure that forms real attack paths.Owned by Schwarz Group since 2021
• YesWeHackYesWeHack sells a Continuous Offensive Security and Exposure Management platform.Ownership not established