CISO Tribune

Vendor comparison · 2 companies

Detectify vs runZero

Detectify is an application security platform that combines Dynamic Application Security Testing (DAST) and Attack Surface Management (ASM). runZero is a security company that sells the runZero Platform, which provides security visibility across IT, OT, IoT, cloud, mobile and remote assets. CISO Tribune files both under External attack surface management. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Detectify
  • runZero
Detectify vs runZero: Products, Customers and Funding Compared
DetectifyDetectify is an application security platform that combines Dynamic Application Security Testing (DAST) and Attack Surface Management (ASM).detectify.comrunZerorunZero is a security company that sells the runZero Platform, which provides security visibility across IT, OT, IoT, cloud, mobile and remote assets.runzero.com
What it sells
  • Application Scanning[9][10]Crawls and fuzzes custom web apps, including the parts behind login.
  • API Scanning[10]Tests every operation in an OpenAPI spec or GraphQL schema with payload-based tests.
  • Alfred AI[13]Turns published CVEs into payload-based tests that a Detectify security researcher reviews before they go live.
  • runZero Platform[3][4][6]An exposure management platform that combines active scanning, passive discovery and integrations with advanced fingerprinting.
  • runZero 5.1[3]A runZero release that adds AI workflows.
Categories
Headquarters
Stockholm, SwedenNot stated on its pages
Founded
2013[1]Not stated on its pages
Ownership and funding
Owned by Insight Partners since 2024[2][5][6][13]Owned by Dragos since 2026[2][3][5]
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • October 29, 2026Detectify announced that it is one of the vendors featured in KuppingerCole's 2026 Leadership Compass on Attack Surface Management.[17]
  • May 26, 2026Detectify unveiled an MCP Server, an integration layer that brings its security testing engines into AI.[4]
  • March 24, 2026Detectify launched IP Range Scanning, which enables continuous discovery and monitoring of entire IP address blocks.[18]
  • February 3, 2026Detectify launched Internal Scanning, which brings its crawling and fuzzing engine behind the customer's firewall.[3]
Not stated on its pages
G2 and Gartner Peer Insights
  • G2: listed, seen November 4, 2026[5]
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 5, 2026[5]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Not written yetNot written yet
Last verified
November 2, 2026November 2, 2026

Where they overlap

  • Detectify and runZero are both filed under External attack surface management.

Where they differ, field by field

  • Detectify's primary category is Dynamic application security testing; runZero's is Cyber asset inventory (CAASM).
  • Detectify lists Application Scanning, API Scanning and Alfred AI. runZero lists runZero Platform and runZero 5.1.
  • Detectify is headquartered in Stockholm, Sweden.
  • Detectify was founded in 2013.
  • Detectify is owned by Insight Partners, since 2024. runZero is owned by Dragos, since 2026.

What it sells: Detectify

What Application Scanning does[9][10]
Application Scanning crawls apps in a real browser, so it renders JavaScript and handles single-page apps. It tests with payloads from 1,765+ modules built by ethical hackers in the Crowdsource community. A recorded login lets it test areas behind sign-in.
What API Scanning does[10]
API Scanning builds the scan from an uploaded OpenAPI spec or GraphQL schema. Findings are confirmed by running the payload, not by matching a signature.
What Alfred AI does[13]
Alfred AI monitors public CVE disclosures to find CVEs with a working public proof of concept. It builds a payload-based test from the proof of concept. A Detectify security researcher reviews every test before it goes live.

What it sells: runZero

What runZero 5.1 does[3]
runZero 5.1 introduces AI workflows, including natural language searches, dashboard and report creation, autonomous discovery and AI-assisted custom integrations. It also adds a native Dragos integration that brings deep OT context into the platform.

Questions about Detectify and runZero

What do Detectify and runZero sell?
Detectify sells Application Scanning, API Scanning and Alfred AI. runZero sells runZero Platform and runZero 5.1.
Are Detectify and runZero in the same category?
They share External attack surface management. Detectify's primary category is Dynamic application security testing and runZero's is Cyber asset inventory (CAASM).
Where are Detectify and runZero headquartered?
Detectify is headquartered in Stockholm, Sweden.
When were Detectify and runZero founded?
Detectify was founded in 2013.
Who owns Detectify and runZero?
Detectify is owned by Insight Partners, since 2024. runZero is owned by Dragos, since 2026.
What have Detectify and runZero announced recently?
October 29, 2026: Detectify announced that it is one of the vendors featured in KuppingerCole's 2026 Leadership Compass on Attack Surface Management.

About Detectify

Detectify is an application security platform that combines Dynamic Application Security Testing (DAST) and Attack Surface Management (ASM). Detectify says it discovers a full attack surface, including assets an organization may not know exist, and tests every asset for exploitable vulnerabilities using payload-based techniques developed by more than 400 ethical hackers.

Detectify describes a problem with legacy application security: scanners only test the assets they are told about, so shadow IT stays invisible. Detectify also says fingerprint-based checks flag versions instead of real exploitability. Detectify positions its platform as SaaS-only with nothing to install.[7][14]

Every Detectify product starts with Discovery, a single inventory of assets that becomes the source of truth for every scan, integration and finding across the platform. Surface Monitoring finds the domains, subdomains, IPs and open ports a customer has on the internet, and keeps testing them with payload-based tests. Surface Monitoring also checks subdomains for takeover every 8 hours.[7][8]

Application Scanning crawls and fuzzes custom web apps, including single-page apps and the parts behind login. API Scanning takes an OpenAPI spec or GraphQL schema and tests every operation in it with payload-based tests, including prompt injection on AI endpoints. Both use the same fuzzing engine.[9][10]

Detectify also offers tools for AI. Alfred AI turns published CVEs into payload-based tests, and a Detectify security researcher reviews each one before it goes live. The MCP Server lets Claude Code, Cursor and other AI tools query Detectify findings, scans and assets in plain language, and it is included in every Detectify plan.[14]

Detectify says its research comes from Crowdsource, a community of 400+ ethical hackers, and that 99% of the vulnerabilities it finds have no CVE assigned, based on its own data over the past three years. Detectify says it is used by more than 2,100 organizations, from high-growth SaaS companies to large enterprises and public institutions.[7][8][9][10][11][12][14][15][16]

Detectify on the record

Sources

Detectify full record

  1. [1]AboutDetectify · detectify.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Insight partners acquires majority stake in detectifyDetectify · newsroom.detectify.com · published October 29, 2024 · Tier A
  3. [3]Introducing Detectify Internal Scanning for internal scanning behind the firewallDetectify · published February 3, 2026 · Tier A
  4. [4]Detectify brings AppSec automation to AI agents with MCP Server and continuous testingHelp Net Security · published May 26, 2026 · Tier B
  5. [5]Detectify Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 24, 2026 · Tier C
  6. [6]Detectify - Application security built and trusted by hackersDetectify · undated page, accessed November 4, 2026 · Tier A
  7. [7]Application security built on hacker researchDetectify · undated page, accessed November 4, 2026 · Tier A
  8. [8]Surface Monitoring | Attack Surface Management | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  9. [9]Application Scanning | DAST for Web Apps | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  10. [10]API Scanning | API Security Testing | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  11. [11]Internal Scanning | DAST for Internal Apps | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  12. [12]PCI ASV Scanning | Approved PCI DSS Scans | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  13. [13]Alfred AI | CVE Tests Built by AI | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  14. [14]MCP Server | Claude Code, Cursor and more | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  15. [15]Agentic Tooling | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  16. [16]Integrations | Jira, Slack, Teams and More | DetectifyDetectify · undated page, accessed November 4, 2026 · Tier A
  17. [17]Detectify featured in KuppingerCole's Analysts 2026 Leadership Compass on Attack Surface ManagementDetectify · published October 29, 2026 · Tier A
  18. [18]Detectify uncovers hidden assets and risks across entire IP rangesHelp Net Security · published March 24, 2026 · Tier B

runZero full record

  1. [1]AboutrunZero · runzero.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Dragos completes netrise and runzero acquisitions following accenture dealSecurityWeek · securityweek.com · published September 21, 2026 · Tier B
  3. [3]runZero: Exposure Management for the AI-attack erarunZero · undated page, accessed October 28, 2026 · Tier A
  4. [4]Community Edition - runZerorunZero · undated page, accessed October 28, 2026 · Tier A
  5. [5]runZero Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 28, 2026 · Tier C
  6. [6]Exposure Management Platform - runZerorunZero · undated page, accessed November 5, 2026 · Tier A
  7. [7]Integrations - runZerorunZero · undated page, accessed November 5, 2026 · Tier A
  8. [8]Inbound integrationsrunZero · undated page, accessed November 5, 2026 · Tier A
  9. [9]runZero Pricing - Get Started in Minutes with a Free TrialrunZero · undated page, accessed November 5, 2026 · Tier A
  10. [10]About Us - runZerorunZero · undated page, accessed November 5, 2026 · Tier A
  11. [11]Careers - Join the team! - runZerorunZero · undated page, accessed November 5, 2026 · Tier A

Spot a factual error? Request a correction.