CISO Tribune

Vendor comparison · 2 companies

Detectify vs Red Sift

Detectify is an application security platform that combines Dynamic Application Security Testing (DAST) and Attack Surface Management (ASM). Red Sift helps security and IT teams embrace the security protocols that keep the internet safe, such as DMARC, SPF, DKIM and TLS. CISO Tribune files both under External attack surface management. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Detectify
  • Red Sift
Detectify vs Red Sift: Products, Customers and Funding Compared
DetectifyDetectify is an application security platform that combines Dynamic Application Security Testing (DAST) and Attack Surface Management (ASM).detectify.comRed SiftRed Sift helps security and IT teams embrace the security protocols that keep the internet safe, such as DMARC, SPF, DKIM and TLS.redsift.com
What it sells
  • Application Scanning[9][10]Crawls and fuzzes custom web apps, including the parts behind login.
  • API Scanning[10]Tests every operation in an OpenAPI spec or GraphQL schema with payload-based tests.
  • Alfred AI[13]Turns published CVEs into payload-based tests that a Detectify security researcher reviews before they go live.
  • Red Sift OnDMARC[2][9]Email authentication product for DMARC enforcement.
Categories
Headquarters
Stockholm, SwedenLondon, United Kingdom[5][6]
Founded
2013[1]2015[3]
Ownership and funding
Owned by Insight Partners since 2024[2][5][6][13]Privately held[2][4][15]
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • October 29, 2026Detectify announced that it is one of the vendors featured in KuppingerCole's 2026 Leadership Compass on Attack Surface Management.[17]
  • May 26, 2026Detectify unveiled an MCP Server, an integration layer that brings its security testing engines into AI.[4]
  • March 24, 2026Detectify launched IP Range Scanning, which enables continuous discovery and monitoring of entire IP address blocks.[18]
  • February 3, 2026Detectify launched Internal Scanning, which brings its crawling and fuzzing engine behind the customer's firewall.[3]
  • October 21, 2026Red Sift notified customers with potentially affected hosts after scanning the Hardenize customer base for PHP-backed hosts, following the PHP security fixes.[18]
G2 and Gartner Peer Insights
  • G2: listed, seen November 4, 2026[5]
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 4, 2026[15]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Not written yetFrom its own pages, the company sells mainly to security and IT teams that want to adopt protocols such as DMARC, SPF, DKIM and TLS. Save the Children also appears as a customer story for OnDMARC. The about page says the company works across EMEA, APAC and the US.
Last verified
November 2, 2026September 27, 2026

Where they overlap

  • Detectify and Red Sift are both filed under External attack surface management.

Where they differ, field by field

  • Detectify's primary category is Dynamic application security testing; Red Sift's is Email authentication and DMARC.
  • Red Sift is also filed under Digital risk protection and Machine identity and PKI.
  • Detectify lists Application Scanning, API Scanning and Alfred AI. Red Sift lists Red Sift OnDMARC.
  • Detectify is headquartered in Stockholm, Sweden. Red Sift is headquartered in London, United Kingdom.
  • Detectify was founded in 2013. Red Sift was founded in 2015.
  • Detectify is owned by Insight Partners, since 2024. Red Sift is privately held.

What it sells: Detectify

What Application Scanning does[9][10]
Application Scanning crawls apps in a real browser, so it renders JavaScript and handles single-page apps. It tests with payloads from 1,765+ modules built by ethical hackers in the Crowdsource community. A recorded login lets it test areas behind sign-in.
What API Scanning does[10]
API Scanning builds the scan from an uploaded OpenAPI spec or GraphQL schema. Findings are confirmed by running the payload, not by matching a signature.
What Alfred AI does[13]
Alfred AI monitors public CVE disclosures to find CVEs with a working public proof of concept. It builds a payload-based test from the proof of concept. A Detectify security researcher reviews every test before it goes live.

What it sells: Red Sift

What Red Sift OnDMARC does[2][9]
Red Sift OnDMARC gives instant visibility into a domain's email security posture and a clear path to DMARC enforcement. It lets customers configure SPF, DKIM, DMARC, BIMI and MTA-STS in one place. Red Sift says it helps organizations reach full DMARC enforcement in just 6 to 8 weeks.

Questions about Detectify and Red Sift

What do Detectify and Red Sift sell?
Detectify sells Application Scanning, API Scanning and Alfred AI. Red Sift sells Red Sift OnDMARC.
Are Detectify and Red Sift in the same category?
They share External attack surface management. Detectify's primary category is Dynamic application security testing and Red Sift's is Email authentication and DMARC.
Where are Detectify and Red Sift headquartered?
Detectify is headquartered in Stockholm, Sweden. Red Sift is headquartered in London, United Kingdom.
When were Detectify and Red Sift founded?
Detectify was founded in 2013. Red Sift was founded in 2015.
Who owns Detectify and Red Sift?
Detectify is owned by Insight Partners, since 2024. Red Sift is privately held.
Who are Detectify and Red Sift sold to?
From its own pages, the company sells mainly to security and IT teams that want to adopt protocols such as DMARC, SPF, DKIM and TLS.
What have Detectify and Red Sift announced recently?
October 29, 2026: Detectify announced that it is one of the vendors featured in KuppingerCole's 2026 Leadership Compass on Attack Surface Management. October 21, 2026: Red Sift notified customers with potentially affected hosts after scanning the Hardenize customer base for PHP-backed hosts, following the PHP security fixes.

About Detectify

Detectify is an application security platform that combines Dynamic Application Security Testing (DAST) and Attack Surface Management (ASM). Detectify says it discovers a full attack surface, including assets an organization may not know exist, and tests every asset for exploitable vulnerabilities using payload-based techniques developed by more than 400 ethical hackers.

Detectify describes a problem with legacy application security: scanners only test the assets they are told about, so shadow IT stays invisible. Detectify also says fingerprint-based checks flag versions instead of real exploitability. Detectify positions its platform as SaaS-only with nothing to install.[7][14]

Every Detectify product starts with Discovery, a single inventory of assets that becomes the source of truth for every scan, integration and finding across the platform. Surface Monitoring finds the domains, subdomains, IPs and open ports a customer has on the internet, and keeps testing them with payload-based tests. Surface Monitoring also checks subdomains for takeover every 8 hours.[7][8]

Application Scanning crawls and fuzzes custom web apps, including single-page apps and the parts behind login. API Scanning takes an OpenAPI spec or GraphQL schema and tests every operation in it with payload-based tests, including prompt injection on AI endpoints. Both use the same fuzzing engine.[9][10]

Detectify also offers tools for AI. Alfred AI turns published CVEs into payload-based tests, and a Detectify security researcher reviews each one before it goes live. The MCP Server lets Claude Code, Cursor and other AI tools query Detectify findings, scans and assets in plain language, and it is included in every Detectify plan.[14]

Detectify says its research comes from Crowdsource, a community of 400+ ethical hackers, and that 99% of the vulnerabilities it finds have no CVE assigned, based on its own data over the past three years. Detectify says it is used by more than 2,100 organizations, from high-growth SaaS companies to large enterprises and public institutions.[7][8][9][10][11][12][14][15][16]

Detectify on the record

Sources

Detectify full record

  1. [1]AboutDetectify · detectify.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Insight partners acquires majority stake in detectifyDetectify · newsroom.detectify.com · published October 29, 2024 · Tier A
  3. [3]Introducing Detectify Internal Scanning for internal scanning behind the firewallDetectify · published February 3, 2026 · Tier A
  4. [4]Detectify brings AppSec automation to AI agents with MCP Server and continuous testingHelp Net Security · published May 26, 2026 · Tier B
  5. [5]Detectify Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 24, 2026 · Tier C
  6. [6]Detectify - Application security built and trusted by hackersDetectify · undated page, accessed November 4, 2026 · Tier A
  7. [7]Application security built on hacker researchDetectify · undated page, accessed November 4, 2026 · Tier A
  8. [8]Surface Monitoring | Attack Surface Management | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  9. [9]Application Scanning | DAST for Web Apps | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  10. [10]API Scanning | API Security Testing | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  11. [11]Internal Scanning | DAST for Internal Apps | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  12. [12]PCI ASV Scanning | Approved PCI DSS Scans | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  13. [13]Alfred AI | CVE Tests Built by AI | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  14. [14]MCP Server | Claude Code, Cursor and more | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  15. [15]Agentic Tooling | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  16. [16]Integrations | Jira, Slack, Teams and More | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  17. [17]Detectify featured in KuppingerCole's Analysts 2026 Leadership Compass on Attack Surface ManagementDetectify · published October 29, 2026 · Tier A
  18. [18]Detectify uncovers hidden assets and risks across entire IP rangesHelp Net Security · published March 24, 2026 · Tier B

Red Sift full record

  1. [1]redsift.comRed Sift · redsift.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]The Red Sift Pulse PlatformRed Sift · undated page, accessed September 27, 2026 · Tier A
  3. [3]Cloud email security brand protection startup red sift rises 54mSiliconANGLE · siliconangle.com · published February 24, 2022 · Tier B
  4. [4]6977295001Austin American-Statesman · statesman.com · published March 4, 2022 · Tier B
  5. [5]Red sift joins future fifty 2026 cohort unveiled by chancellor at downing streetRed Sift via EIN Presswire · thestarpress.com · published March 19, 2026 · Tier B
  6. [6]Red siftThe Wealth Mosaic · thewealthmosaic.com · undated page, accessed September 27, 2026 · Tier C
  7. [7]Red Sift | Creating a Fundamentally Safer Internet with Proactive SecurityRed Sift · undated page, accessed October 27, 2026 · Tier A
  8. [8]Proactive, intelligent security for every organization.Red Sift · undated page, accessed October 27, 2026 · Tier A
  9. [9]Red Sift OnDMARC | Stop Email Spoofing FastRed Sift · undated page, accessed October 27, 2026 · Tier A
  10. [10]OnDMARC Pricing | Plans for SMB to Enterprise + Free TrialRed Sift · undated page, accessed October 27, 2026 · Tier A
  11. [11]Stop lookalike domains before they damage your brandRed Sift · undated page, accessed October 27, 2026 · Tier A
  12. [12]Bird & Bird strengthens trust in legal communications with layered email and domain protectionRed Sift · undated page, accessed October 27, 2026 · Tier A
  13. [13]Find and fix issues 10x faster with Red Sift RadarRed Sift · undated page, accessed October 27, 2026 · Tier A
  14. [14]Red Sift Certificates Lite | Free Certificate MonitoringRed Sift · undated page, accessed October 27, 2026 · Tier A
  15. [15]Red Sift OnDMARC Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed October 27, 2026 · Tier C
  16. [16]How to Price and Package DMARC Services for Your MSP | Red SiftRed Sift · undated page, accessed November 4, 2026 · Tier A
  17. [17]DMARC solutions for healthcare organizationsRed Sift · undated page, accessed November 4, 2026 · Tier A
  18. [18]Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 | Red SiftRed Sift · published October 21, 2026 · Tier A

Spot a factual error? Request a correction.