Hive Pro, Outpost24, Reach Security and Zafran Security

About Outpost24

Outpost24 sells security products and services delivered through its cloud platform with automation supported by its cyber security experts. Outpost24 services include expert support, manual penetration testing, and red teaming from certified specialists. Classic penetration testing on networks, web, and mobile applications is one of the Outpost24 services.^[5]

Outpost24 offers External Attack Surface Management combined with PTaaS or DRP for discovery and insights on known and unknown applications. CompassDRP integrates External Attack Surface Management (EASM) with threat intelligence to provide real-time visibility into a digital footprint. CompassDRP is a single cloud-based Digital Risk Protection solution that combines asset discovery with threat intelligence. CompassDRP detects known and unknown internet-facing assets, shadow IT, and external exposures across a digital footprint, including the open, deep, and dark web. CompassDRP monitors for compromised credentials, leaked data, phishing domains, and brand threats across social media and external channels.^{[1][6][8][10]}

External Attack Surface Management provides deep and proactive discovery of all internet-facing assets and identifies vulnerabilities and misconfigurations. Digital Risk Protection from Outpost24 is a modular cyber threat intelligence solution to detect and deter external threats to a business. Digital Risk Protection monitors known and unknown public-facing assets, and threats from external channels across the open, deep, and dark web.^[6][8]

Outpost24 vulnerability management integrates with tools such as Jira, ServiceNow, Slack, and SIEM platforms through automated workflows and notifications.^[10]

Outpost24 offers a Machine Readable Threat Intelligence (MRTI) feed to power proactive cyber defense. Outpost24 offers a strategic threat intelligence solution focused on threat actors, context, and behaviors. Outpost24 offers a free Credential Checker that checks whether an organization's email domain is linked to credentials exposed on the dark web.^[12]

Specops is the identity and access management division of Outpost24. Specops Device Trust authenticates and verifies users and devices at every access point, and continuously throughout every session. Specops password tools block weak passwords at creation and continuously scan AD for over 5.5 billion breached credentials. Every Specops product is designed to integrate natively with an existing Active Directory infrastructure.^[13][14]

Outpost24 red team simulated attacks combine internal and external network exploitation, social engineering, phishing, and physical intrusion attempts. Outpost24 red team specialists conduct open-source intelligence (OSINT) and threat intelligence analysis to map a digital footprint, identify exposed assets, and uncover potential attack paths. Landsbankinn has collaborated with Outpost24 over the past ten years.^{[1][6][8][10][11][12][13][15]}

About Reach Security

Reach Security is an AI-native security company focused on giving customers a single interface to understand and operate security controls at scale. Reach delivers a platform that uncovers misconfigurations, control weaknesses, and other exposures, then drives prioritized, guided remediation at scale. Reach is an exposure management platform designed to identify and close configuration gaps in security tools before AI-powered attacks can exploit them. Reach is an AI-Native Security Controls Operating System that integrates with an existing security product stack to reveal and remediate defensive blind spots, and activate underutilized capabilities across the security control plane.^{[1][3][4][5][11]}

Reach uncovers misconfigured, incomplete, and underused controls across existing identity, endpoint security, SASE, network security, and other deployments. Reach prioritizes action to close defensive gaps based on the severity of exposure, attack behaviors, and configuration context. Reach automatically pushes recommended configuration changes into a staged environment for verification, then executes tailored remediation workflows across the security ecosystem via integrations with ticketing systems. Reach continuously monitors configurations to detect drift and validates that controls are working as intended. Reach uses cybersecurity domain-specific AI models to surface and prioritize reachable risks.^[4]

Reach integrates with the security stack already owned across identity, endpoint, email, and network security. Reach connects with existing security technology stacks using read-only APIs to give operational visibility across every security control. Reach identifies and prioritizes exposure risks across email, network, endpoint, SaaS applications, and identity access management. Reach provides visibility into defensive weaknesses like misconfigured security controls, configuration drift, unused security capabilities, and vulnerabilities across the entire IT and security stack. Reach automates remediation with context-driven recommendations, deployment guides, and change tickets tailored to tools and environment.^[4][6][7]

Reach continuously monitors security control configurations across IAM, EDR, email security, firewalls, SASE, and more, and alerts teams to changes that affect security posture. Reach keeps a full audit trail, prioritizes fixes, and provides guided remediation of drift events. Reach shows what changed, where and how it happened, and the impact. Reach analyzes the environment to identify unpatched vulnerabilities that are still reachable and then recommends and applies compensating controls across the existing stack. Reach connects directly to existing security tools to provide a consolidated view of how defenses are configured across people, assets, and systems. Reach identifies misconfigurations and underutilized capabilities across a Microsoft security stack, then deploys fixes to optimize tooling and eliminate exposures. Reach continuously evaluates E3/E5/E7 environments to identify gaps and improvement opportunities.^{[4][5][7][8][9]}

Insurity automates analysis across its ZTNA tools with Reach and uncovered risky access and misconfigurations. Reach has been integrated in the Autodesk environment. Reach is not a Security Incident Event Management (SIEM) product. Reach handles data in three categories: identity service data, security event logs, and security product configurations. Data retention is set to 15 months by default for all security event and identity data processed by Reach. Reach AI relies on verified, domain-specific data to power its configuration engine, with third-party LLMs kept out of the mix. Reach encrypts data at rest using AES-256 encryption.^[10][11]

Reach Security announced a Series B round of more than $50M. Reach Security makes staff available for Application Administration between 9:00 am and 5:00 pm Pacific Time, Monday through Friday.^{[1][2][3][5][12]}

About Zafran Security

Zafran Security sells a platform that brings vulnerability findings together across existing tools into a unified view of exposure across the hybrid enterprise.^[1][2]

Zafran unifies cloud, on-prem, and AppSec findings into one record, collapses the duplicates, and maps each asset to the controls protecting it. Zafran takes cloud and AppSec findings from Wiz, Palo Alto Networks, Upwind, AWS and Snyk, and on-prem findings from Tenable, Qualys and Rapid7. Zafran aggregates, normalizes and deduplicates findings from every source, including Zafran Discover, Tenable, Rapid7, Wiz, AWS, Snyk, and 100+ more integrations. Tenable.io, Wiz, CrowdStrike, Snyk, ServiceNow, Palo Alto and Qualys VMDR connect to Zafran over their APIs and sync their records, with no agent deployed. Zafran connects to the security stack a customer already runs, with no new agent to deploy.^[2][5][6]

Zafran applies a customer's own risk context to reveal which vulnerabilities are exploitable in its environment. Zafran's Exposure Graph weighs what's running and reachable, exploited in the wild, unprotected by controls, and critical to the business. Zafran confirms whether vulnerable code is actually loaded to memory across every asset in a hybrid stack. Zafran models the real path to each asset, outside-in and inside-out, through NAT, load balancers, WAFs, and firewalls. Zafran flags what attackers are exploiting in the wild, with threat intelligence from multiple sources. Zafran lets customers set business criticality with their own rules and has an AI agent suggest levels for assets they have not classified. Zafran combines every signal into one score, with each weight configurable by the customer's team.^{[1][2][3][7][8][10]}

Zafran flags where existing controls are missing, misconfigured, or bypassable, so policy-driven mitigations close the window on validated exposures before an exploit happens. Zafran assesses firewall, WAF, cloud security group, and EDR configurations to show which vulnerabilities are already blocked. Zafran protects end-of-life systems, OT, and business-critical apps that can't be patched or taken offline.^[2][8]

RemOps uses generative AI to consolidate overlapping remediation tasks, create a clear get-well plan, and route work to the right owners through existing ticketing platforms. Zafran auto-assigns fixes to the right owner in Jira, Slack and ServiceNow, and delivers mitigations ahead of patch cycles to existing network defenses. Zafran sends IT one consolidated ticket per fix, with the risk evidence attached and the right owner assigned.^[1][2][9]

Zafran surfaces new assets, control configuration changes, and disclosed vulnerabilities as they happen. Zafran detects vulnerabilities from a customer's software components the moment a threat surfaces. Zafran's Zero Day Agent matches a flaw to a customer's live software inventory, showing which assets run the vulnerable version, which are reachable from the internet, and which are blocked by a live control. Zafran helps security teams proactively hunt for exposures tied to new CVEs, zero-days, threat actors, and control gaps across the hybrid enterprise.^[2][6][10]

Zafran builds audit-ready and board-ready reports from live data, with templates for SLA compliance, MTTR, and control efficacy. Zafran AI creates on-demand reports from natural-language queries. Zafran generates context-aware reports with AI agents on a schedule of hourly, daily, weekly, or monthly. Zafran lets teams set SLAs and track them alongside built-in SSVC timelines aligned to CISA BOD 26-04. Zafran turns findings, assets, mitigations, or remediations into views that can be exported to PDF.^[11]

Zafran offers a five-stage maturity model for banks, insurers and payment processors that need to move fast and prove every risk call to auditors. Zafran compiles the detection and remediation metrics regulators ask for from live platform data. For healthcare, Zafran pulls findings from every scanner into one deduplicated record through agentless APIs, so nothing new touches clinical systems or slows down patient care. Zafran shows which EDR, firewall, and segmentation controls already protect medical devices and end-of-life systems that cannot be patched.^{[1][5][8][9][10][12]}