Cymulate: who they are, what they sell and what CISOs should ask

What Cymulate sells

Cymulate sells a cloud-based security validation platform that simulates attacks against an organization's own security controls and then helps tune those controls. Its platform FAQ says it is built for security teams "including security operations, detection engineering, red teams and exposure management teams" and serves organizations "from mid-market to enterprise" (Cymulate platform). Co-founders Eyal Wachsman, the CEO, and Avihai Ben-Yossef, the CTO, started the company in 2016, and Multiples lists it as headquartered in Holon, Israel, and as a private, VC-backed company. Its about page gives the Israeli office address in Holon. In September 2022 it raised a $70 million Series D led by One Peak (TechCrunch) and said it had raised $141M to date (Cymulate press release). In January 2025 CTech reported that it served over 1,000 customers in more than 50 countries.

The product lines, in plain terms:

• Exposure Validation, the breach and attack simulation core. The company says it tests prevention and detection "for EDR, SIEM, web/email, WAF, DLP and more" (Cymulate), with a daily threat feed and a 24-hour SLA for new US Cert advisories (Cymulate platform).
• Mitigation: the platform pushes vendor-specific mitigation and behaviour rules to controls (Cymulate platform), and a Mitigation Hub groups validated exposures into tasks teams can track (Cymulate BAS page).
• Detection engineering: its homepage says Vero AI, its AI layer, maps SIEM rules to attack scenarios and helps create and tune detection logic (Cymulate).
• CTEM: the company says this product validates exploitability, prioritizes by what is already mitigated and applies mitigation to controls (Cymulate).

On delivery, the company states the platform is cloud-based, with some assessments launched from the cloud and others using "a lightweight agent to act as a test point inside the environment" (Cymulate BAS page). It says it integrates with SIEM, SOAR, EDR, cloud security, firewalls and email security tools, and that simulations are designed to run in production without disruption (Cymulate platform).

The company also says what it is not. It positions itself against "traditional point-in-time testing tools" (Cymulate platform). It argues that automated penetration testing tools "do not integrate with exposure management platforms" in the way it does, and says it complements existing investments rather than replacing them (Cymulate). Its pages separate exposure validation from exposure management, calling validation "a key component within that strategy" (Cymulate). CISO Tribune files it under breach simulation and automated pen-testing on our vendor record.

Figure: Cymulate's home page, captured 2026-11-05. Source: New Home Page.

The founders

Cymulate's two co-founders on our record are Eyal Wachsman, the chief executive, and Avihai Ben-Yossef, the chief technology officer. The company's about page says Cymulate was founded by "former IDF intelligence officers and leading cyber researchers". When TechCrunch covered the 2022 funding round, it reported that Wachsman co-founded the company with Avihai Ben-Yossef and a third partner, Eyal Gruner.

Wachsman came from the sales side of security services. The company's leadership page says he brings more than 20 years of experience in information security. It says that before Cymulate he was vice president of sales and business development at Avnet Cyber & Information Security, a firm the page describes as providing IT security counseling across the globe.

Ben-Yossef's background, as the company tells it, is technical and military. The same page says he served in an Intelligence Unit of the IDF in a technological role, and was later head of the Cyber Research Team at Avnet Cyber & Information Security, where he worked on several projects for the Israeli Ministry of Defense. On the company's own account, then, both founders worked at Avnet before starting Cymulate.

On why they started the company, the clearest account came from Wachsman in the TechCrunch interview. He said he first thought of building a platform to continuously test an organization's threat posture in 2016, after years of cybersecurity consulting for other companies. TechCrunch reported that he had found the work customers and outside consultants put into security architecture each year or half-year could be lost each time an attacker made an unexpected move. In an earlier conversation with the same reporter, Wachsman had described the approach as "the largest cybersecurity consulting firm without consultants". A distributor's profile of the company gives a different emphasis. It says the founding team was frustrated by the inefficiencies of time and resources they experienced while conducting offensive cyber security operations in the field.

Wachsman has since tied that founding idea to exposure management. When Cymulate bought CYNC Secure in January 2025, he told CTech that security teams were increasingly recognizing that validating vulnerabilities, threats and security controls was the key to effective exposure management. Both founders remain listed in their founding roles on the company's leadership page.

What the product does

Cymulate presents its product as an exposure validation platform built around a repeating loop: choose threats, simulate them against a customer's own controls, read the results, push fixes, then test again. The company calls that loop "agentic cyber defense engineering" on its platform page, which says the product is built for security operations, detection engineering, red teams and exposure management teams.

Choosing what to test. The company says Vero AI reads current threat intelligence to tailor tests, alongside pre-built templates and best-practice assessments. Teams can also write their own scenarios, and the same page states these can validate both individual techniques and multi-stage attack paths. Beyond the gateway, endpoint and SIEM controls covered earlier, Cymulate says testing reaches cloud workloads, containers, Kubernetes and cloud infrastructure.

Running the tests. Besides control tests, the company says it runs live-data exercises to test your security operations response. For purple teaming, its exposure validation page describes the product validating whether the blue team detects and responds to attacks in real-time.

Reading the results. Results produce scorecards and benchmarks for security controls, MITRE ATT&CK coverage and specific threats, and coverage gaps show up as MITRE ATT&CK heatmaps and alignment to frameworks like CIS. Cymulate says Vero AI automatically generates reports and summarizes validation results. In 2022, TechCrunch reported that output also included an executive summary that can be presented to financial teams and management auditing security spend.

Fixing gaps. The vendor-specific rules mentioned above are written for SIEM, EDR, XDR, WAF and Snort. Mitigation Hub groups related exposures into tasks by control, mitigation type, severity and status, and the company says the platform can detect and correct security control drift. On the CTEM side, Cymulate says it pulls in findings through connectors to vulnerability scanners and more, then validates exploitability and ranks exposures based on risk.

What a person decides. Cymulate's FAQ says its automation can recommend or execute remediation actions. One customer quoted by the company described the closing step: "After following the platform's remediation guidance, we can immediately retest to validate that our efforts were effective," per its customers page.

Figure: Cymulate's product page, captured 2026-11-05. Source: Exposure Validation.

How it works and what it connects to

Cymulate runs as a hosted service with an optional on-site component. Its breach and attack simulation FAQ states that "The platform is cloud-based and continuously updated," and that some assessments start from the cloud while "others use a lightweight agent to act as a test point inside the environment" (Cymulate). A company blog post updated in 2025 called it a cloud-based SaaS solution that "deploys in minutes" (Cymulate blog).

On integrations, the platform FAQ lists SIEM, SOAR, EDR, cloud security, firewalls and email security platforms. The company says these connections let customers check how their existing controls perform and automate response and remediation workflows (Cymulate). The same page says simulations run across endpoints, networks, email, web gateways and cloud environments "with integrations to the controls and SIEM to prove both prevention and detection" (Cymulate). Cymulate calls this connecting layer a defense engineering control plane and states that its "engineering-native integrations create a closed-loop system" (Cymulate). The CYNC Secure deal mentioned earlier brought in technology that, as CTech reported, integrated with multiple tools, standardizing security data to prioritize vulnerabilities by risk and impact (CTech).

The AI layer is Vero AI. The company says it uses AI to analyze new threats and tailor validation to a customer's "assets, applications, exposures, industry and more," with agents that prioritize findings and create mitigations (Cymulate). On the detection side, its home page states that Vero AI maps SIEM rules to attack scenarios to check coverage and create new detection logic (Cymulate). The sources do not name the models or techniques underneath Vero AI. Threat content arrives through a daily feed, and the company claims a 24-hour SLA for updated simulations after new US Cert threat advisories (Cymulate).

On safety, the company states that "All simulations are controlled, non-destructive" and are built to avoid affecting business operations or data integrity (Cymulate). Its blog said its experts test simulations to make sure they are safe and non-disruptive (Cymulate blog). A distributor profile from 2025 described how two test vectors were scoped: the DLP test used "regulatory, company-sensitive, and custom synthetic datasets," and the lateral movement test started from an adversary in control of a single workstation (Ingecom Ignition).

The sources do not say where customer data or test results are stored, or in which regions the service runs. As for limits the company itself set out, TechCrunch reported in 2022 that Cymulate focused on network security, and Wachsman said application security was "something on our roadmap" (TechCrunch). The sources given state no other limits.

Where it sits in the market

CISO Tribune's record files Cymulate under one category, breach simulation and automated pen-testing: platforms that safely emulate attacker techniques against live environments to validate whether controls work. The other companies on the record in that category are, in alphabetical order, Armadin, Assail, AttackIQ, Filigran, Fleuret AI, Hadrian, Horizon3.ai, Pentera, Picus Security, Promptfoo, SafeBreach, Skyhawk Security and XM Cyber. Their profiles are on the vendors pages. The list is alphabetical and carries no ranking.

Cymulate's own label for its place in this category has changed over time. Its 2022 Series D release described an Extended Security Posture Management platform with four pillars: "Attack Surface Management, Continuous Automated Red Teaming, Breach & Attack Simulation, and Advanced Purple Teaming". By 2026 its pages used the terms exposure validation and agentic cyber defense engineering, and its BAS page said Cymulate "evolves breach and attack simulation into continuous, adaptive validation".

The company's pages drew several lines between its product and adjacent tools. These are the company's claims:

• Periodic testing. The platform FAQ said that, "Unlike traditional point-in-time testing tools, Cymulate provides continuous, automated validation", and that it put breach and attack simulation, exposure validation and remediation guidance in one platform.
• Other BAS products. The BAS page said that "Instead of only showing whether a control passed or failed a test", Cymulate shows teams which gaps matter most and whether fixes worked. It tied this to the AI-tailored testing and automated mitigation covered earlier.
• Vulnerability scanners. The same page said scanners "identify known vulnerabilities and typically prioritize them using severity scores such as CVSS". In the company's view, those scores do not show whether a flaw is exploitable in a given environment.
• Exposure management. The exposure validation page treated validation as one component of exposure management. It said that "exposure validation is tactical and evidence-based", while exposure management is the broader strategy.
• Automated pen-testing. A Cymulate guide aimed at XM Cyber customers said automated penetration testing tools "do not integrate with exposure management platforms" to map results for exposures found by other tools.

That guide also places Cymulate against one of its record neighbours. It was written for XM Cyber customers after news that CrowdStrike would acquire XM Cyber's intellectual property, a deal the page said was expected to close before January 2027. The guide said Cymulate "complements your CTEM strategy" rather than replacing existing investments, and it pointed buyers to scanning and attack surface vendors for discovery. Our reading is that the company presents itself as a validation layer that sits on top of discovery tools, not as a replacement for them.

Funding, investors and growth

Cymulate raised four priced rounds between 2017 and 2022. After the last of them, the company's Series D announcement put the total raised to date at $141 million. The same small group of investors returned round after round, and One Peak led the last two.

The chart shows the amount of each priced round in millions of US dollars, from the 2017 Series A to the 2022 Series D.

Chart data: multiples.vc; TechCrunch.

The first round was a $3 million Series A in March 2017. According to Multiples, Susquehanna Growth Equity led it, and it followed a seed round from Eyal Gruner. A $15 million Series B came on November 26, 2019, led by Vertex Growth Fund, with Vertex Ventures Israel, Dell Technologies Capital and Susquehanna Growth Equity participating. The $45 million Series C closed on May 5, 2021, led by One Peak, with the same four earlier backers. That summary says the Series C money was earmarked to accelerate growth, expand across the US, EMEA, APAC and LATAM, invest in platform development and scale operations.

The $70 million Series D was announced on September 6, 2022. One Peak led it, with Susquehanna Growth Equity, Vertex Ventures Israel, Vertex Growth and Dell Technologies Capital taking part, the company said. TechCrunch noted that all five had also backed the Series C. The company said the money would extend its technological capabilities and accelerate global growth. TechCrunch reported it would go into technology "both organically and potentially through acquisitions".

At the time, the company said it had more than doubled its ARR in 2021 and grown more than 200% in North America. It also said it had more than 500 customers and planned to expand its staff by 75% by the end of that year. TechCrunch put the company at more than 200 employees and some 500 paying customers, up from 300 a year earlier. Cymulate did not disclose a valuation. TechCrunch reported, citing sources, that it was around $500 million.

None of the sources records a round after the Series D. In January 2025, CTech still gave the total raised as $141 million. The same report covered Cymulate's purchase of CYNC Secure, which it said was undisclosed in value but estimated at about $10 million. CTech also reported that Cymulate employed nearly 300 people across Israel, the U.S., Europe, South America, India, Africa and Singapore. It put the customer base at over 1,000 in more than 50 countries.

Customers, partners and public evidence

Most of the customer evidence Cymulate publishes is its own material, and most of its case studies do not name the customer. Its customers page sorts studies by industry, from finance and insurance to critical infrastructure. One is titled "How a Retail Organization Became 12x Faster at Assessing Security Controls with Cymulate". The same page does attribute quotes to named people: an information security manager at Setur, and the Head of Information Technology at Saffron Building Society.

The product pages carry more named endorsements. A cybersecurity engineer at Darling Ingredients is quoted on the home page as saying "Cymulate Exposure Validation makes advanced security testing fast and easy." The group cybersecurity head at Globeleq is quoted saying the platform's reporting makes it easier to give "management and the board" a view of the company's posture.

Earlier coverage named larger accounts. In 2022 TechCrunch reported NTT, Telit and Euronext among the company's customers. The Series D press release listed Optiv and Wipro as strategic partners.

On partnerships, the company's newsroom lists a press release on a partnership with Bitsight to help security teams validate defenses. When Cymulate bought CYNC Secure, CTech reported that CYNC's chief executive, Meir Abergel, joined as vice president of business development and alliances, with a remit to build partnerships with brands. In Europe, the distributor Ingecom Ignition lists Cymulate in its alliances section and describes it as a SaaS attack simulation platform.

For analyst recognition, Cymulate states on its home page that it was named a 2026 Gartner Peer Insights Customers' Choice. Its platform page says it was recognised as a Gartner representative vendor for adversarial exposure validation. Both claims come from Cymulate's own pages.

The outcome figures are also the company's own. The 2022 release said customers saw cyber risk fall by nearly 50% in the first three months of use. Cymulate's 2020 usage report said its financial-sector customers saw their average risk score drop from 70 to 18 over the year, on a scale where lower is better. The same report said 96% of customers ran Sunburst backdoor tests. None of these figures was independently measured.

Other vendors in the same category appear on our vendors pages.

Research, open source and public work

Cymulate's public research, as these sources show it, sits close to the product. TechCrunch reported in September 2022 that the company had a large in-house team of researchers and white-hat hackers looking for new bugs, zero days and other vulnerabilities to feed its platform. The company's home page stated that Cymulate Research Labs provided daily updates for new threats. Its platform page set out a 24-hour SLA for updated attack simulations after new US Cert threat advisories. These are the company's own commitments, and the sources offer no outside measure of them.

The most detailed published piece is the 2020 Yearly Platform Usage Report, which the company described as an annual review of customer usage and scores. Beyond the financial-sector and Sunburst figures noted earlier, the report said the average customer ran at least one comprehensive assessment per attack vector per week. It also said the financial sector made up over 51% of all scans done in 2020. The report's scores were an aggregate compared against four frameworks: MITRE ATT&CK, NIST 800-30, CVSS 3 and Microsoft's version of DREAD. It reported that employee scores fell from 66.3 in 2019 to 18.4 by the end of 2020. On our reading, these numbers come from the vendor's own customer base. They describe Cymulate users, not organisations in general. The blog post presenting the report was last updated in January 2025. Other vendor studies are collected under reports.

The company's more recent material is position-taking more than data. Its site listed:

• an e-book that explores the six stages of agentic cyber defense engineering;
• a blog post on how attackers chain AI agent vulnerabilities to compromise cloud identities;
• a guide arguing that automated pen testing can't stack up to exposure validation, which is the company's view of a neighbouring category;
• a recap of a Triangle InfoSeCon panel where security leaders discussed proving controls to the board.

Conference appearances by vendor staff are tracked under speaking.

On vulnerability work, Cymulate's newsroom linked to an outside article headlined "Windows Admin Center Vulnerability Allows Attackers to Escalate Privileges". The newsroom page does not say what part Cymulate played, and none of the sources contain an advisory or CVE credited to the company. Our disclosures page holds the advisories we track.

The sources show no open-source tools, public code repositories or independent benchmarks published by Cymulate.

What a CISO should ask before buying

The questions below are our reading of what a CISO should test in a Cymulate proof of concept. Each one points at something the company says about its own product.

1. Production safety. The platform FAQ says all simulations are "controlled, non-destructive" (Cymulate). Ask what stops a simulation mid-run. Start the trial on systems the business can afford to lose.
2. Footprint. Cymulate says some assessments launch from the cloud while others use "a lightweight agent to act as a test point" inside the environment (Cymulate). Ask which of your planned tests need the agent, what privileges it holds and how it is removed.
3. Tailoring. The company says Vero AI builds custom assessments from "the context of your industry and environment" (Cymulate). Ask what environment data the AI reads, where that data is stored, and whether you can see why it chose each test.
4. Autonomy. Cymulate describes its approach as able to "recommend or execute remediation actions" (Cymulate). Ask which actions run without a human approving them, and whether that can be switched off for each control.
5. Control updates. The platform page says it can push vendor-specific mitigation and behaviour rules (Cymulate). Name your own EDR, SIEM and WAF products. Ask for a pushed rule to each, and ask to see the rollback path.
6. Detection engineering. The home page says Vero AI maps SIEM rules to attack scenarios (Cymulate). Hand it a sample of your existing rules and check the mapping by hand.
7. Speed. The exposure validation page lists "Test new threats in <1 hour" as a benefit (Cymulate). Pick a recent advisory during the trial and time it from publication to a completed test. Check that result against the update commitment covered earlier.
8. Scoring. The company says testing results "create scorecards and benchmarks" (Cymulate). Ask how scores are calculated. Ask whether past scores are restated if the method changes.
9. Drift. Cymulate says it can detect and correct control drift (Cymulate). Change a policy on purpose during the trial and measure how long the platform takes to flag it.
10. Retesting. A customer quoted on the customers page says remediation can be retested immediately (Cymulate). Ask whether retests run automatically or by hand, and how before-and-after results are kept for audit.
11. Exposure data. For its CTEM module, the company says it aggregates exposures through connectors to vulnerability scanners (Cymulate). Ask which of your scanners have a native connector. Ask what happens to findings from tools that have none.

Timeline

The dates below come from Cymulate's own pages, its 2022 funding release, coverage by TechCrunch and CTech, and the funding history compiled by multiples.vc. In our reading, the record clusters around three periods: the funding rounds of 2019 to 2022, the January 2025 acquisition, and the outside recognition the company promoted on its site in 2026.

The chart counts the dated milestones in this timeline by year.

Chart data: Milestones cited in this profile; most from multiples.vc: Cymulate Valuation, Funding & Investors | Multiples.

• 2016: Cymulate was founded in 2016. Eyal Wachsman told TechCrunch that he first thought of a platform to continuously test threat posture that year, after years of consulting work for other companies.
• November 26, 2019: Cymulate raised $15 million in a Series B led by Vertex Growth Fund, with Vertex Ventures Israel, Dell Technologies Capital and Susquehanna Growth Equity participating.
• 2020: The company's usage report states that 96% of its customers tested against Sun Burst, the backdoor used in the SolarWinds supply chain attack.
• 2020: The multiples.vc summary of the next round says the company was scaling operations "after doubling revenue and staff by over 150% in 2020".
• May 5, 2021: Cymulate raised a $45 million Series C led by One Peak, which brought its total funding to $71 million.
• 2021: By the company's account, it more than doubled its ARR in 2021 and grew more than 200% in North America alone.
• September 6, 2022: Cymulate raised a $70 million Series D led by One Peak, the same investors from its Series C, bringing its total to $141 million.
• September 6, 2022: Alongside the Series D, the company appointed Maria Mastakas as Chief Operating Officer and Carolyn Crandall as Chief Marketing Officer and Chief Security Advocate.
• January 7, 2025: Cymulate agreed to acquire CYNC Secure, an Israeli startup focused on operational efficiency in exposure management. CTech reported that the value was not disclosed and estimated it at about $10 million.
• January 2025: CYNC Secure co-founder Meir Abergel joined Cymulate as vice president of Business Development and Alliances.
• January 2025: CTech reported that of CYNC Secure's 20 employees, about five would be laid off for lack of suitable positions at Cymulate.
• 2026: Cymulate's home page says the company was named a 2026 Gartner Peer Insights Customers' Choice.
• 2026: The company's platform page states that Cymulate was recognized as a Gartner representative vendor for adversarial exposure validation.