Are Pentesting and Attack Surface Management Becoming One Category?

In the space of five weeks, an offensive security platform raised $40 million to pair attack surface mapping with AI-driven pentesting, two of the best-known pentesting firms agreed to merge, an OT security leader folded an exposure management platform into its own, and a compliance auditor bought a red team.

Each deal makes sense on its own. Together, they raise a question security buyers will run into soon: are pentesting and attack surface management (ASM) turning into a single category, or are vendors simply filling gaps?

What happened

Hadrian raised a $40 million Series B on 6 October. Forgepoint Capital International and SmartFin led the round, bringing the Amsterdam-based company's total funding to $65 million. Hadrian sells two products side by side: Atlas, which continuously maps an organisation's external exposure, and Nova, an on-demand agentic pentesting tool. The company describes itself as an "offensive security platform", while also using the language of continuous threat exposure management (CTEM). It says it will use the funding to expand across EMEA and the US and to invest in engineering and research.

NetSPI and Synack agreed to merge on 2 September. NetSPI is known for penetration testing as a service and also lists attack surface management among its capabilities. Synack combines its AI pentesting agent with a vetted community of security researchers. SecurityWeek reported the combined company will have more than $200 million in revenue. The deal is expected to close in October 2026, subject to regulatory approvals, and the companies say nothing changes for existing customers before then.

Dragos completed its acquisitions of runZero and NetRise, announced on 21 September. runZero provides exposure management across IT, IoT and OT environments; NetRise analyses the software running on OT devices. Dragos says both will be integrated into the Dragos Platform over the coming months. The deals follow Accenture's majority investment in Dragos, announced in June, which SecurityWeek reported valued the company at $3.25 billion.

A-LIGN acquired Pathfynder on 1 September. A-LIGN is best known as a compliance audit firm; Pathfynder provides penetration testing, red teaming and incident response. Pathfynder will keep its brand as "Pathfynder by A-LIGN" and operate separately from A-LIGN's audit teams. Financial terms were not disclosed.

The case for "yes, they're merging"

Buyers don't wake up wanting EASM or a pentest. They want to find weaknesses before attackers do, and to know which ones matter. Discovery tells you what's exposed; testing tells you what's exploitable. Selling both together is a natural pitch, and Hadrian is built around exactly that pairing.

The direction of travel is similar elsewhere. NetSPI already offers ASM alongside pentesting. Dragos is pulling exposure management into a broader platform rather than keeping it as a separate tool. And both NetSPI–Synack and Hadrian lean on AI agents to test continuously, which narrows the gap between "always-on discovery" and "point-in-time testing".

The case for "not yet"

Look closer and most of these deals don't cross the line at all.

NetSPI–Synack is consolidation within offensive security: two testing providers combining scale and talent. A-LIGN–Pathfynder adds a pentesting unit to an audit firm, and deliberately keeps the two apart. Dragos is building an OT platform, where exposure management is one layer among several.

More importantly, buyers still evaluate these differently. A continuous discovery tool is usually a platform subscription owned by vulnerability management or security operations. A pentest is often a scoped engagement, judged on the quality of the testers and the report, and frequently tied to compliance requirements. Different owners, budgets and proof points. Until buyers start shortlisting and evaluating them together, two categories that sell well together are still two categories.

What buyers should ask

If a vendor claims both discovery and testing, evaluate each on its own merits:

• Coverage: what does discovery actually find in your environment, compared with what you already know about?
• Validation: does testing show that a finding is exploitable, or just that it exists?
• Depth: where does automated or agentic testing stop and human testers take over?
• Integration: if part of the product came from an acquisition, is it integrated today, or on a roadmap?
• Continuity: for customers of NetSPI, Synack, runZero or NetRise, what changes to contacts, scope or pricing after the deal closes? So far, the companies say nothing changes in the short term.

What we'll be watching

So is it one category or two? Not yet, in our view. The deals point one way and buying behaviour still points the other. The signals that would change that are buyers briefing for discovery and testing in a single evaluation, more vendors selling both as one product, and the merged NetSPI–Synack moving beyond testing.

We'll keep tracking which vendors move, who buys whom, and how buyers on Picari search for and evaluate these tools.

Sources

• Hadrian, "Hadrian raises $40M to tackle the AI hacking cyber security crisis", 6 Oct 2026
• Synack, "NetSPI and Synack", 2 Sept 2026
• Dragos, "Dragos acquires NetRise and runZero", 21 Sept 2026
• A-LIGN, "A-LIGN acquires Pathfynder", 1 Sept 2026
• SecurityWeek, "Dragos completes NetRise and runZero acquisitions following Accenture deal", Sept 2026
• SecurityWeek, "Cybersecurity M&A Roundup: 39 deals announced in September 2026", 6 Oct 2026