Attack surface mgmt (ASM)

Aggregate findings from security scanners+11

ArmorCode is redefining security governance in the AI era as the agentic control plane for Unified Exposure Management.

ArmorPoint

Managed Detection & Response (MDR)

24x7x365 professional SOC team performing continuous monitoring, alert investigation, validation, and escalation to incident with SANS-based incident response protocols

ArmorPoint is a cloud-native managed security operations platform built for midsize enterprises and the partners who serve them. The platform brings detection, response, risk, and compliance together within a shared operations environment where customers, partners, and ArmorPoint's 24/7 U.S.-based SOC work side by side.

Astelia

Reachability-based exposure analysisExploitability and technical-requirements analysisAttack path visualization+6

Proof-Based Exposure Security

Attaxion

Internet-facing asset discovery+11

Attaxion builds on decades of joint cybersecurity expertise from our founders, team members, and advisors. We stand at the forefront of cybersecurity innovation and offer attack surface management solutions with #1 asset coverage and laser-focused, actionable intelligence.

Axur

Digital Risk & Executive Protection

AI-driven threat intelligence mapping+11

Axur focuses on External Threat Protection (ETP) and brand protection by monitoring the digital landscape for brand abuse, data leaks, and fraudulent activities. The platform automates the detection and takedown of phishing sites, unauthorized apps, and leaked credentials across the deep, dark, and open web. It complements internal security controls by mitigating risks that originate outside the traditional network perimeter.

Backline AI

Autonomous vulnerability remediation+8

Backline is an agentic security platform, built for Autonomous Exposure Remediation, Gartner's newly named category for fixing vulnerabilities, not just finding them. It ingests multi-scanner findings and delivers verified, production-ready fixes – closing the gap between detection and resolution safely, reliably, and at scale. Built by veteran enterprise security founders.

Beazley Security

Security Operations

Managed extended detection and response+10

Beazley Security is a cyber risk management vendor whose Security Operations offering centers on managed detection and response plus exposure management. Its MXDR service provides always-on monitoring, threat identification, and containment across endpoints, networks, cloud services, identity, and email, while exposure management continuously inventories external assets and prioritizes known-exploited vulnerabilities. The company is positioned for organizations that want operational security support from a team that combines incident response, forensics, and risk intelligence with insurance heritage. It is best suited for buyers seeking a managed SOC-style service rather than a standalone software tool.

Bishop Fox (CAST)

Continuous external attack surface discovery+11

Staying ahead of attackers requires thinking like one. Our offensive security approach adapts to today's evolving threats, helping you find and fix vulnerabilities before they become incidents. From mission-critical systems to AI applications, we simulate real-world attacks across your apps, cloud, devices, and infrastructure.

Bitdefender

Endpoint Detection & Response (EDR)

11 products

At Bitdefender, cybersecurity isn't just what we do, it's who we are. For over two decades, we've been at the forefront of protecting individuals, businesses, and governments against sophisticated cyber threats and attacks. Our AI-driven technologies and world class security expertise make us a trusted partner in safeguarding what matters most.

Automated cross-endpoint attack correlation+10

BitSight

Compliance & GRC

12 products

Risk now moves across enterprises, supply chains, cloud environments, and digital identities, and AI is accelerating how quickly vulnerabilities can be exploited. Bitsight continuously maps assets and vulnerabilities, prioritizing them with real-time threat intelligence so teams can see where risk is building, focus on what matters, and act before exposure becomes disruption.

Third-party risk monitoring and onboarding+10

BreachLock

Penetration testing as a service+9

8 products

BreachLock offers a unified offensive security platform that provides Penetration Testing as a Service (PTaaS) and Continuous Threat Exposure Management (CTEM). It combines human-led expertise with AI-driven automated scanning to provide real-time visibility into vulnerabilities across web, cloud, and network environments. The platform facilitates rapid remediation through direct integration with developer workflows and provides verifiable evidence of security posture for compliance audits.

Breeze Security

External asset discoveryAttack path analysis+8

Breeze Security is a cyber asset attack surface management vendor focused on consolidating exposure data from existing security tools and mapping how misconfigurations chain into attack paths. In the ASM scope, it emphasizes continuous gap discovery, exposure correlation, and remediation prioritization across an organization’s security stack rather than standalone internet scanning. The product is best suited for security teams that already have multiple controls in place and need a single view of exposed weaknesses, asset gaps, and remediation order. Breeze also offers attack-path analysis and tailored playbooks as adjacent capabilities.

Bugcrowd

Crowdsourced red team engagements+10

Bugcrowd provides penetration testing and red-team services through a managed crowdsourced platform that matches customers with vetted ethical hackers and curated tester teams. In the penetration-testing scope, it supports standard and customized tests with real-time visibility into progress and prioritized findings; in the red-team scope, it offers RTaaS that simulates attacker kill chains and produces debrief reports for validation and remediation. It is best suited for security teams that need external testers, fast engagement start, and evidence for compliance or control-effectiveness review. Bugcrowd also has adjacent bug bounty and vulnerability disclosure offerings, but those are outside this profile.

Censys

Continuous internet exposure discovery+11

Censys provides Attack Surface Management focused on external internet visibility: it continuously scans the public Internet, attributes discovered assets to an organization, and tracks changes in hosts, ports, certificates, services, and exposures. In this category it is known for its Internet-scale dataset, near-real-time exposure monitoring, and evidence-based prioritization of externally reachable risks. It is best suited for security teams that need to discover unknown internet-facing assets, confirm what attackers can actually reach, and route remediation into existing workflows. Censys also sells adjacent products, but this profile is limited to ASM capabilities.

CloudSEK Research Pte. Ltd.

Real-time threat intelligence monitoring+8

CloudSEK is a digital risk protection platform (DRPP) that utilizes AI to monitor the deep, dark, and open web for external threats. It provides automated detection of leaked credentials, brand impersonation, and exposed infrastructure to quantify digital risk. The platform complements internal SOC operations by providing an external-facing view of an organization's attack surface and supply chain vulnerabilities.

Criminal IP

IP address threat analysisReal-time global IP and domain intelligence+7

Criminal IP delivers Decision-Ready Intelligence powered by AI and OSINT, enabling precise threat analysis and deep investigations into IPs, domains, and URLs with reputation data, threat scoring, along with real-time detection of malicious indicators such as C2, IOCs, and other critical threats. Its API is designed to integrate seamlessly with workflows SIEM, SOAR, and XDR for enhanced visibility and automation.

CyberProof

Managed Detection & Response (MDR)

24/7 security alert monitoring with automated enrichment and human-led triage to reduce false positives and accelerate incident validationDeep incident investigation and response activities including sandbox analysis of suspicious files, IOC validation, and extraction for containment

CyberProof is a cloud first security operations company, enabled through key cloud partners, to help deliver the most cutting edge security services to help protect your enterprise.

CyCognito

Seedless external asset discovery+8

CyCognito empowers companies to take full control over their attack surface by taking the attacker's view to uncover and fix critical security risks.

CYE

Identify external digital assets+10

CYE provides an AI-driven exposure management platform that quantifies cyber risk into financial terms to help CISOs prioritize remediation. By combining automated scanning with expert analysis, it maps attack paths and evaluates the business impact of exploited vulnerabilities. The solution replaces qualitative risk assessments with ROI-led mitigation strategies, aligning security operations with business goals.

Cynerio

IoT Security

Discover connected medical and IoT devices+11

Cynerio provides healthcare-focused IoT security for hospitals and other healthcare delivery organizations. Its platform discovers connected medical and IoT devices, classifies them, learns normal communication patterns, and identifies anomalous or malicious activity on the network. The product is strongest in clinical environments where device criticality, patient-care workflows, and uptime constraints matter. It is best suited for healthcare security teams that need device visibility, risk context, and policy enforcement for medical devices without relying on endpoint agents.

Dataminr

Multi-Modal Threat Detection+8

DarkInvader is a modern cyber security company specialising in External Attack Surface Management (EASM). For over three years, we've been developing a cutting-edge SaaS solution that empowers organisations to discover and monitor their assets, identify infrastructure and Web application vulnerabilities, and monitor surface Web and Dark Web OSINT.

Detectify

Continuously monitor external attack surface+10

Detectify is the application security platform that gives modern security teams ultimate control over their actual attack surface, delivering proprietary vulnerability data designed for both humans and agents.

Equixly srl

API Security

No verifiable AI-SPM claims foundContinuous AI model inventory discovery+5

Continuous Offensive Security for APIs and Applications

Ermetic

CIEM

10 products

Ermetic provides a CIEM platform that discovers and analyzes human and machine identities, entitlements, and access risks across AWS, Azure, and Google Cloud. Acquired by Tenable in 2023 and rebranded as Tenable CIEM, it combines CIEM with CSPM for contextual visibility into IAM policies, network configurations, storage, and secrets. It exposes overprivileged entitlements, toxic combinations, and enforces least privilege via automated remediation and anomaly detection. Best for multi-cloud enterprises needing unified CNAPP capabilities to manage complex entitlement sprawl without agents.

Discover cloud identities and entitlements+11

Fencer

Application Security (DAST/SAST)

Continuous DAST scanningBlack-box runtime probingExact finding location+8

Fencer is the platform we wish we had.

FireCompass

Continuous external asset monitoringInternet-facing asset discovery+10

Agentic AI Penetration Testing for Web Apps and APIs

FireMon

Firewall / NGFW

Firewall policy visibility and control+10

FireMon is a network security company focused on firewall policy control for the hybrid enterprise. FireMon helps organizations manage and analyze security policy across multi-vendor firewalls, cloud networks, and microsegmentation environments with real-time change visibility, risk analysis, automation, and continuous compliance.

Flashpoint

Deep and dark web search+10

Harness the power of data, human expertise, and automated analysis with Flashpoint's threat intelligence platform. Identify and remediate risk and take rapid, decisive action against cyber threats, fraud, vulnerability, physical, and national security threats.

Hadrian

Continuous cloud misconfiguration scanning+8

Hadrian is modernizing offensive security practices with automation, making security teams faster and more scalable. Continuously equipped with the hacker's perspective, companies make themselves harder to hack.

Intrigue.io

External asset discovery+9

Intrigue.io is an external attack surface management vendor focused on discovering, mapping, and continuously monitoring internet-exposed assets. Its ASM product is built to identify owned assets and exposures across domains, subdomains, certificates, S3 buckets, and DNS-related misconfigurations, then keep that inventory current as the environment changes. Public materials position it for mid-to-large enterprises that need continuous external reconnaissance without doing manual asset discovery. Intrigue was later acquired by Mandiant, but the ASM product itself remains the relevant scope here.

IONIX

Internet-facing asset discovery+11

IONIX (formerly Reflectiz) is an External Attack Surface Management (EASM) platform that maps the entire digital ecosystem, including shadow IT and supply chain dependencies. It identifies exploitable entry points, misconfigured cloud assets, and 'digital cousins' that pose a threat to the organization. It complements vulnerability scanners by providing an attacker's-eye view of the perimeter and prioritizing fixes based on true reachability and risk.

JupiterOne

Discover and map cloud resources+10

JupiterOne started with one goal in mind, to simplify security and make it attainable for all individuals and organizations as a basic right.

Mandiant (Google Cloud)

Automated threat triage and indicator scoring+11

Mandiant Threat Intelligence, now part of Google Cloud Security, is a SaaS threat intelligence platform combining Google's detection telemetry, Mandiant's frontline incident response intelligence, and VirusTotal's malware database. It delivers unified threat scoring, vulnerability tracking, and threat actor attribution to mid-market and enterprise security teams. Best for organizations requiring operationalized threat intelligence with low false-positive rates and integration into existing SOC workflows.

Mesh Security

Cloud Security / CSPM

Agentless multi-cloud posture scanningInfrastructure as Code scanning+9

Mesh Security provides a Cybersecurity Mesh Architecture (CSMA) platform that serves as a horizontal execution layer across the security stack. It connects siloed security tools (IAM, SaaS, Cloud, Core) to provide visibility into cross-domain attack paths. The platform maps identities to sensitive assets to identify and eliminate high-risk lateral movement paths that point products often miss.

Microsoft

Cloud Security / CSPM

15 products

Microsoft Defender for Cloud is a multicloud CSPM platform that provides continuous security posture assessment across Azure, AWS, and GCP. It delivers agentless vulnerability scanning, misconfiguration detection, and compliance monitoring against industry benchmarks (CIS, NIST, ISO, PCI-DSS). The platform generates hardening recommendations ranked by risk and includes attack path analysis to identify exploitable chains. Defender for Cloud serves enterprises managing hybrid and multicloud infrastructure seeking unified posture visibility and compliance reporting.

Agentless vulnerability scanningAPI-connected app governanceAPI security+19

Nagomi Security

Unify assets and exposures from read-only APIs+11

Nagomi Security provides a threat exposure management platform that bridges the gap between identification and remediation within a Continuous Threat Exposure Management (CTEM) framework. It provides an 'execution layer' that unifies security asset visibility with contextual prioritization and guided remediation, ensuring that exposure gaps are closed based on actual threat actor behavior and internal security controls. It complements existing EDR and XDR investments by identifying where defenses are misconfigured or failing.

Nord Security

Zero Trust / SASE / SSE

Cloud-delivered secure access architecture+10

Nord Security offers a suite of business tools including NordLayer for network access and NordPass for credential management, focused on the SMB and mid-market segments. It provides a secure service edge (SSE) approach to remote access, replacing legacy VPNs with a Zero Trust Network Access (ZTNA) model. The platform integrates identity-centric access control with password security and threat exposure monitoring.

Palo Alto Networks

Firewall / NGFW

21 products

Palo Alto Networks is a major vendor in the Firewall / NGFW market, best known for PAN-OS-based next-generation firewalls and Cloud NGFW. Its firewalls combine application-aware policy, user-based controls, and threat prevention to inspect traffic, including encrypted sessions, and block known and unknown threats. It fits enterprises that need granular segmentation, internet edge protection, and consistent policy across physical and cloud deployments. Adjacent offerings exist, but the core firewall line remains centered on network traffic control, inspection, and prevention.

Active-passive firewall high availability+22

Panorays

Compliance & GRC

Automated third-party security questionnaires with configurable workflows to collect vendor responses and supporting evidence during onboarding and periodic reviews.Risk scoring based on questionnaire answers, attestations, and external security posture data to prioritize vendors for review and remediation.

Panorays is a third-party risk and vendor compliance platform used by security and procurement teams to collect evidence, run security questionnaires, and document risk decisions across supplier relationships. Within Compliance & GRC, it centers on vendor onboarding, assessment workflows, remediation tracking, and audit-ready records rather than enterprise-wide policy management. The platform is best suited for organizations that need repeatable third-party due diligence, especially where security, legal, and compliance teams must review SOC 2, ISO 27001, and similar attestations. It can also synchronize third-party risk data into Archer for broader GRC workflows.

ProjectDiscovery (Nuclei)

Continuously monitor exposed assets+9

ProjectDiscovery (Nuclei) is an open-source, template-driven vulnerability scanning engine that is used in attack surface management to discover exposed assets, identify internet-facing services, and detect weaknesses across web applications, APIs, DNS, cloud infrastructure, and networks. In the ASM scope, it is strongest as a scanner and validation layer rather than a broad asset inventory platform, giving security teams attacker-style visibility into exposed hosts and services. It is a fit for practitioners who want programmable, repeatable scanning with a large community template ecosystem and minimal vendor lock-in. ProjectDiscovery also offers adjacent SaaS and agentic products, but Nuclei itself remains the core scanning engine.

Pulse Secure Pulse Policy Secure

Network Access Control (NAC)

Context-aware access controlAutomated BYOD onboarding+10

Secure Access Made Easy, Comprehensive, and Flexible

Qualys

Continuous vulnerability scanning+10

Qualys provides Vulnerability Management, Detection and Response (VMDR), a cloud-based platform that automatically discovers assets across on-premises, cloud, and mobile environments, including unmanaged devices. It scans for vulnerabilities using over 20,000 checks from its Vulnerability KnowledgeBase, correlates findings with threat intelligence and machine learning to prioritize risks on critical assets, and detects indicators of compromise. VMDR supports hybrid IT scanning from a single console, generates role-based reports for compliance, and integrates with ticketing systems for automated remediation workflows. Best for enterprises needing continuous visibility and prioritization in complex, distributed networks.

Rapid7

Asset discovery and vulnerability scanning+11

11 products

Rapid7 is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations' cyber resilience. Open and extensible, the Rapid7 Command Platform integrates security data, enriching it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risk and disrupt attackers.

Raxis

Point-in-time penetration testing+11

Raxis is a U.S.-based offensive security provider focused on human-led penetration testing, red teaming, and PTaaS. In the Penetration Testing & Red Team category, it is positioned as a services-led vendor that combines manual exploitation with a web portal for scoping, live findings, retesting, and reporting. It is best suited for buyers that want recurring or full-scope assessments across web, API, network, cloud, mobile, wireless, and physical attack paths, rather than only automated scanning. Adjacent offerings include social engineering and purple team engagements.

RedSeal

Map external and internal attack surfaces+10

RedSeal provides a network modeling and risk prioritization platform that maps complex hybrid-cloud environments to visualize the complete attack surface. It calculates all possible communication paths to identify hidden risks, validates that network configurations comply with security policies, and prioritizes vulnerabilities based on their reachability. The platform complements vulnerability scanners (like Nessus or Qualys) by providing the network context needed to understand which exposures are actually exploitable.

Reflectiz

Continuously monitor web exposure+11

Reflectiz is the AI-powered web exposure platform that continuously monitors and protects what executes on your websites. It detects and remediates security threats, privacy violations, compliance gaps, and AI-generated attacks in real time.

ReliaQuest

Agentic SOC & Investigations

10 products

ReliaQuest delivers an Agentic AI Security Operations platform, GreyMatter, that unifies detection, investigation, and response across SIEM, EDR, and Cloud environments. It utilizes AI agents to automate data collection and the standard diagnostic workflows typically handled by Tier 1 and Tier 2 analysts. The platform provides a centralized console to orchestrate response actions without the need for constant data migration to a single lake.

Autonomous alert investigation and triage+10

SafeBreach

Runs automated breach-and-attack simulation (BAS) scenarios that emulate attacker TTPs mapped to the MITRE ATT&CK framework for repeatable red team testing.

Reduce risk with certainty and at scale with SafeBreach, the only enterprise-grade CTEM platform.

SecurityScorecard

Continuously rates external-facing vendor security posture using an A-F score derived from ten risk-factor groups, helping GRC teams maintain an always-current control view for third-party due diligence.

A swarm of agents. An army of risk engineers. One threat-informed TPRM platform to stop risk before it spreads across your supply chain.

SpartanX

Autonomous AI red-team agents+5

SpartanX is an autonomous exposure management platform that runs continuous, AI-driven red teaming across an organization's attack surface. The platform combines automated agents with exploit validation to test web applications, APIs, networks, cloud infrastructure, mobile assets and AI systems, then confirms which weaknesses are actually exploitable rather than relying on theoretical scan findings. It ingests findings from third-party scanners such as Tenable, Rapid7 and Qualys and layers evidence-backed prioritization on top. SpartanX covers discovery, prioritization, validation and mobilization stages of the continuous threat exposure management lifecycle, and its agents can be deployed both externally and inside a customer's perimeter. It is aimed at security teams that need to validate which exposures pose real risk rather than triage every alert manually.

Spektion

Continuously discover exposed assets+5

Spektion provides a runtime exposure management platform that goes beyond static vulnerability scanning by analyzing the actual execution behavior of assets. By monitoring runtime interactions, it identifies which vulnerabilities (CVEs) are actually reachable and exploitable in the specific environment, significantly reducing false positives. It complements traditional vulnerability management by adding a behavioral layer of visibility across on-prem and cloud workloads.

Sprocket Security

Continuous penetration testing across attack surfaceAdvanced change detection triggers testing

We help businesses improve security and reduce IT risk by prioritizing offensive security.

Spyse

Continuously discover internet-facing assets+11

Spyse is an external attack surface management platform focused on discovering and monitoring internet-exposed assets, mapping them to domains and organizations, and surfacing reachable services and exposures. Its core fit is for security teams that need continuous visibility into unknown or shadow assets without running intrusive credentialed scans. Spyse sits in the EASM/ASM market alongside tools that emphasize internet-wide reconnaissance, asset correlation, and exposure tracking. It is best suited for teams that want a searchable, continuously updated view of external footprint, especially for domain-heavy environments and third-party exposure monitoring.

Strike

External asset discovery and mapping+8

Strike is a Continuous Threat Exposure Management (CTEM) platform that automates threat emulations across an organization's external and internal attack surface. It combines automated vulnerability scanning with continuous security testing to identify exploitable paths before they are leveraged by adversaries. The solution replaces periodic manual penetration testing with a persistent, risk-based approach to vulnerability prioritization.

SubImage

Cloud Security / CSPM

Cloud posture checksAttack path analysis+9

SubImage is an open-core cloud security graph product that maps infrastructure across cloud and on-prem environments and presents CSPM-style posture checks through a queryable graph. In the CSPM scope, it focuses on agentless discovery, misconfiguration detection, compliance mapping, and attack-path analysis so teams can see which issues create real exposure. It appears best suited for security teams that want graph-based context and precise remediation guidance rather than a standalone checklist scanner. The vendor also references CNAPP and PAM capabilities, but its core CSPM value is posture visibility and path-based prioritization.

Synack

Penetration testing across multiple asset typesGlobal ethical hacker community for vulnerability discovery+9

AI Finds More. Humans Prove What Matters. Continuous Pentesting at Scale

Team Cymru

Real-time threat intelligence feedsMalicious infrastructure identificationIncident response optimization+6

Intelligence that moves first.

ThreatAware

Discover devices and users accessing data+9

ThreatAware transforms the way organisations secure their cyber assets globally.

ThreatDefence

Security Operations

SIEM with log management and data retention+8

ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.

Unisys Stealth

Microsegmentation

Identity-based micro-segmentation+11

Unisys Stealth is a zero-trust microsegmentation platform that uses identity-based access controls and cryptographic cloaking to transform networks into segmented environments. The suite includes Stealth(core) for enforcement via micro-segmentation and encryption, and Stealth(aware) for network discovery and policy automation. Deployed across on-premises, AWS, and Azure environments, Stealth holds NSA NIAP certification and serves government and enterprise customers requiring east-west traffic isolation and dynamic workload protection.

UpGuard

Compliance & GRC

Vendor risk assessment workflows+11

UpGuard is a cybersecurity vendor whose platform includes GRC-adjacent workflows, but it is primarily positioned around cyber risk posture and third-party risk rather than a full enterprise GRC suite. In a Compliance & GRC evaluation, it is best suited to teams that need continuous vendor risk monitoring, compliance tracking, and automated evidence-style workflows tied to security posture. UpGuard says it can track risk reduction against major compliance standards and support board-ready security ratings, making it useful for mid-market organizations and lean security teams that need ongoing assurance across suppliers and external exposure.

Vectra AI

Network Detection & Response (NDR)

Attack Signal Intelligence for NDR+11

Vectra AI is a dedicated **Network Detection & Response (NDR)** vendor that analyzes east-west and north-south traffic to detect attacker behavior across on-premises, cloud, identity, and IoT/OT environments. Its NDR offering is positioned around behavioral analytics, attack-path correlation, and high-fidelity alert reduction rather than signature-only detection. It is best suited for security teams that need continuous network visibility, encrypted-traffic-aware detection, and faster triage of in-progress attacks. Vectra AI also sells adjacent identity and cloud detection capabilities, but its NDR scope remains centered on network telemetry and response.

Veriti

Agentic Exposure Validation+3

Veriti is an exposure assessment and remediation vendor that sits near the vulnerability management market, but its focus is broader than traditional scanning. In vulnerability-management terms, it continuously identifies vulnerabilities, misconfigurations, and exploitability across on-prem and cloud environments, then helps teams prioritize and remediate them without disrupting operations. It is best suited for enterprises that already have multiple security tools and need to turn findings into safe, compensating controls rather than rely only on patch cycles. Veriti was founded in 2021 and is now part of Check Point.

XM Cyber

Continuous external asset discovery+11

XM Cyber is a leader in exposure management that uses attack path modeling to show how attackers can navigate hybrid cloud and on-prem environments. By combining vulnerability data, misconfigurations, and identity exposures, it prioritizes remediation based on the actual risk to critical assets. It replaces static vulnerability scanners with continuous, graph-based security validation to identify the 'choke points' that matter most to an attacker.

ZeroFox

Digital Risk & Executive Protection