{
  "source": "https://ctee.org/vendors",
  "updated": "2026-10-27",
  "license": "CC BY 4.0",
  "count": 17,
  "vendors": [
    {
      "name": "Armis Centrix",
      "slug": "armis-centrix",
      "company": "Armis (a ServiceNow company)",
      "url": "https://www.armis.com/platform/armis-centrix/",
      "tier": "editorial",
      "categories": [
        "Exposure platform",
        "Asset intelligence",
        "OT and IoT security"
      ],
      "stages": {
        "scoping": 1,
        "discovery": 2,
        "prioritisation": 2,
        "validation": 0,
        "mobilisation": 2
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "San Francisco, USA",
      "founded": 2015,
      "pricing": "not published",
      "bestFor": [
        "Enterprise",
        "Regulated"
      ],
      "summary": "Asset-intelligence platform that grew into exposure management, strongest where the estate includes OT, medical devices and unmanaged IoT. Prioritisation and remediation workflow are mature; adversarial validation is not native.",
      "detail": [
        "Armis built its reputation on passive network discovery of devices that agents never see: industrial controllers, medical equipment, building systems, unmanaged IoT. Armis Centrix wraps that asset intelligence in exposure management, adding ingestion from what the vendor describes as hundreds of third-party tools so scanner, cloud and application findings land in the same place as the passive inventory.",
        "Discovery is the standout. The passive engine plus selective safe active queries covers device classes that most exposure platforms treat as blind spots, and the vendor claims a device knowledge base numbering in the billions. If your risk sits in operational technology rather than servers, this is a different conversation from the scanner-first platforms.",
        "Prioritisation and mobilisation come largely from the Silk Security acquisition in April 2024, now sold as VIPR Pro. It deduplicates findings across tools, assigns owners, pushes bidirectional tickets to Jira and ServiceNow, and tracks remediation against service level agreements. This is the part most vulnerability management teams will feel immediately.",
        "Validation is the gap. The vulnerability management module launched in March 2026 actively queries devices to confirm a vulnerability is present, and threat intelligence shows whether an exploit exists in the wild, but neither tests exploitability in your environment. There is no breach and attack simulation or automated penetration testing module. Pair it with a validation tool if that stage matters.",
        "Check in a demo: how VIPR Pro and the newer vulnerability management module overlap and which one your team would actually live in, since ServiceNow closed its acquisition of Armis in April 2026 and the roadmap for both products under ServiceNow SecOps is not yet public."
      ],
      "sources": [
        {
          "label": "SecurityWeek: Armis acquires Silk Security (17 April 2024)",
          "url": "https://www.securityweek.com/armis-acquires-silk-security-for-150-million/"
        },
        {
          "label": "Help Net Security: Armis Centrix for Vulnerability Management (11 March 2026)",
          "url": "https://www.helpnetsecurity.com/2026/03/11/armis-centrix-vulnerability-management-detection-and-response/"
        },
        {
          "label": "Security MEA: ServiceNow completes Armis acquisition (21 April 2026)",
          "url": "https://securitymea.com/2026/04/21/servicenow-completes-armis-acquisition/"
        },
        {
          "label": "Armis: FAQ (hundreds of pre-built integrations)",
          "url": "https://www.armis.com/faq/"
        },
        {
          "label": "Armis: contact (San Francisco headquarters)",
          "url": "https://www.armis.com/contact-us/"
        },
        {
          "label": "ServiceNow newsroom: to acquire Armis (founded 2015)",
          "url": "https://newsroom.servicenow.com/press-releases/details/2025/ServiceNow-to-acquire-Armis-to-expand-cyber-exposure-and-security-across-the-full-attack-surface-in-IT-OT-and-medical-devices-for-companies-governments-and-critical-infrastructure-worldwide/default.aspx"
        }
      ]
    },
    {
      "name": "CyCognito",
      "slug": "cycognito",
      "company": "CyCognito",
      "url": "https://www.cycognito.com/",
      "tier": "editorial",
      "categories": [
        "Attack surface management",
        "Validation",
        "Application security"
      ],
      "stages": {
        "scoping": 1,
        "discovery": 2,
        "prioritisation": 2,
        "validation": 2,
        "mobilisation": 1
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "Palo Alto, USA",
      "founded": 2017,
      "pricing": "not published",
      "bestFor": [
        "Enterprise",
        "Mid-market"
      ],
      "summary": "External attack surface management with genuine active testing rather than inference. Discovery and validation of internet-facing assets are strong; there is no internal, identity or endpoint coverage at all.",
      "detail": [
        "CyCognito starts with no seed list. It attributes assets to your organisation from the outside, mapping subsidiaries, acquisitions and forgotten infrastructure the way an attacker would, then tests what it finds. That attribution step is the reason it surfaces assets that seeded scanners never reach.",
        "Validation is real testing, not modelled reachability. The vendor cites more than 100,000 automated tests across 35 or more threat categories, including unauthenticated dynamic application testing with payloads and defined success criteria, so a finding comes with evidence of exploitability. Tests are single-step and non-disruptive, avoiding brute force and state changes; there is no exploit chaining, credential reuse or lateral movement of the kind Pentera performs.",
        "The scope is the trade-off. Everything here is external. There is no internal network discovery, no identity graph and no native cloud configuration posture; integrations with scanners and cloud security tools such as Tenable, Qualys and Wiz exchange context rather than making it a findings aggregator. It is a specialist, not a system of record, and it should sit alongside an exposure platform rather than replace one.",
        "Mobilisation is competent rather than deep: findings link to owners, integrate with Jira and ServiceNow, carry remediation guidance, and are automatically retested after a fix. The automatic revalidation is worth more than it sounds, because it closes the loop that most programs leave open.",
        "Check in a demo: how attribution handles your subsidiary and acquisition structure, and ask for the false-positive rate on attribution specifically, since a directory of assets you do not own wastes more time than it saves."
      ],
      "sources": [
        {
          "label": "CyCognito: automated security testing",
          "url": "https://www.cycognito.com/platform/automated-security-testing.php"
        },
        {
          "label": "CyCognito: platform (founding date 2017)",
          "url": "https://www.cycognito.com/platform/"
        },
        {
          "label": "CyCognito press release: 2025 momentum (Palo Alto dateline, 16 December 2025)",
          "url": "https://www.cycognito.com/news/press-releases/cycognito-accelerates-2025-momentum-with-enterprise-customer-growth-expanded-partnerships-and-innovation-leadership.php"
        }
      ]
    },
    {
      "name": "Cymulate",
      "slug": "cymulate",
      "company": "Cymulate",
      "url": "https://cymulate.com",
      "tier": "editorial",
      "categories": [
        "Breach and attack simulation",
        "Validation",
        "Exposure platform"
      ],
      "stages": {
        "scoping": 0,
        "discovery": 1,
        "prioritisation": 1,
        "validation": 2,
        "mobilisation": 1
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "Holon, Israel",
      "founded": 2016,
      "pricing": "not published",
      "bestFor": [
        "Enterprise",
        "Mid-market"
      ],
      "summary": "Breach and attack simulation vendor that repositioned as an exposure management platform in August 2025. Validation is the core and the strongest stage; discovery is lighter than scanner-first platforms.",
      "detail": [
        "Cymulate is a validation company first. Exposure Validation combines breach and attack simulation with continuous automated red teaming, and Threat Studio and Detection Studio let a team build custom scenarios and test whether their detection rules actually fire. If the question is whether your controls would catch a given technique, this answers it directly. This is simulation rather than automated penetration testing, a distinction Cymulate draws itself: attacks are production-safe simulations, including lateral movement and attack path scenarios, but it does not chain real exploits the way Pentera does.",
        "The exposure management platform launched in August 2025 ingests third-party scanner and discovery data alongside Cymulate's own external attack surface module, then correlates those findings with proof of exploitability from the simulation engine. That correlation is the useful part: it downgrades scanner noise that your controls already block.",
        "Discovery remains the weaker stage. The external module is real but the platform is not trying to be your asset inventory, and there is no internal passive discovery. Expect to feed it from an existing scanner or platform rather than expecting it to find what you own.",
        "Mobilisation goes further than most validation tools. Auto Mitigation pushes vendor-specific control updates rather than just filing a ticket, which shortens the loop between finding a control gap and closing it.",
        "Check in a demo: how many of your actual security controls it has native mitigation content for, since the value of Auto Mitigation depends entirely on whether your stack is covered."
      ],
      "sources": [
        {
          "label": "Cymulate press release: new Exposure Management platform (5 August 2025)",
          "url": "https://cymulate.com/press-releases/cymulate-reveals-new-exposure-management-platform/"
        },
        {
          "label": "Cymulate: about us",
          "url": "https://cymulate.com/about-us/"
        }
      ]
    },
    {
      "name": "Detectify",
      "slug": "detectify",
      "company": "Detectify",
      "url": "https://detectify.com",
      "tier": "editorial",
      "categories": [
        "Attack surface management",
        "Application security"
      ],
      "stages": {
        "scoping": 0,
        "discovery": 1,
        "prioritisation": 1,
        "validation": 1,
        "mobilisation": 1
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "Stockholm, Sweden",
      "founded": 2013,
      "pricing": "per-asset",
      "bestFor": [
        "Mid-market",
        "SMB",
        "Cloud-native"
      ],
      "summary": "External attack surface monitoring for web applications, powered by crowdsourced security research. Narrow by design, strong on internet-facing apps, and one of the few vendors publishing at least its platform-tier prices.",
      "detail": [
        "Detectify's differentiator is its crowdsource programme: a network of several hundred ethical hackers submits real payload-based tests that become automated checks for every customer. Findings therefore carry proof at the application layer rather than a version-number guess.",
        "Coverage is web and API centric. Surface Monitoring discovers subdomains and internet-facing assets, Application and API Scanning test them, and Internal Scanning extends to networks behind the perimeter. There is no identity graph, no cloud configuration posture and no attack path analysis.",
        "It is one of the few vendors in this directory with published pricing: annual platform tiers by user count plus unpublished per-domain and per-target charges. Note the entry tier lists a zero platform fee, but assets are still charged, so it is not a free product.",
        "Prioritisation is severity scoring. Mobilisation is integration-level: bidirectional Jira sync plus ServiceNow, Slack, Teams, PagerDuty and Splunk through a workflow integration layer. There is no cross-domain correlation, no dedup across other scanners and no remediation orchestration.",
        "Check in a demo: the total cost once your real domain and target counts are entered, because the platform tier is the smaller half of the bill. Insight Partners took a majority stake in October 2024."
      ],
      "sources": [
        {
          "label": "Detectify: about (founded 2013, Stockholm)",
          "url": "https://detectify.com/about"
        },
        {
          "label": "Detectify: pricing",
          "url": "https://detectify.com/pricing"
        },
        {
          "label": "Detectify: Crowdsource",
          "url": "https://detectify.com/crowdsource"
        },
        {
          "label": "Detectify newsroom: Insight Partners majority stake (28 October 2024)",
          "url": "https://newsroom.detectify.com/insight-partners-acquires-majority-stake-in-detectify"
        }
      ]
    },
    {
      "name": "Falcon Exposure Management",
      "slug": "falcon-exposure-management",
      "company": "CrowdStrike",
      "url": "https://www.crowdstrike.com/en-us/platform/exposure-management/",
      "tier": "editorial",
      "categories": [
        "Exposure platform",
        "Attack surface management",
        "Endpoint security"
      ],
      "stages": {
        "scoping": 2,
        "discovery": 2,
        "prioritisation": 2,
        "validation": 1,
        "mobilisation": 2
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "Austin, USA",
      "founded": 2011,
      "pricing": "not published",
      "bestFor": [
        "Enterprise",
        "Regulated"
      ],
      "summary": "Exposure management inside the Falcon platform, most compelling if you already run Falcon sensors, though since June 2026 it is also sold for third-party endpoint environments. Four stages are well covered; adversarial validation is a services offering rather than a product.",
      "detail": [
        "If Falcon agents are already deployed, this is the lowest-friction path to exposure management: the sensor telemetry that powers detection also powers discovery, and asset criticality, prioritisation and remediation all run in a console your team already uses.",
        "Scoping is better than most, with an asset criticality engine rather than a spreadsheet of crown jewels. Discovery combines agent telemetry, agentless cloud inventory, external attack surface management, identity and software as a service posture, and network vulnerability assessment for unmanaged devices.",
        "Prioritisation uses CrowdStrike's exploit prediction scoring plus attack path context, and mobilisation runs through Falcon Fusion for workflow automation and Falcon for IT for the fix itself. That end-to-end loop inside one platform is the real argument for it.",
        "Validation is the qualified stage. CrowdStrike confirms exploitability from telemetry, adversary intelligence, attack paths and network reachability, which is inference from strong signals rather than simulation. Adversary emulation is sold as a professional service. The company agreed in July 2026 to acquire XM Cyber's intellectual property, which may change this after close.",
        "Check in a demo: coverage of assets where no Falcon sensor can be installed, because the discovery story is strongest exactly where the agent already runs. A June 2026 release opened the product to non-Falcon endpoint estates by ingesting third-party asset and vulnerability data; ask what is lost without the sensor."
      ],
      "sources": [
        {
          "label": "CrowdStrike blog: Falcon Exposure Management for third-party environments (16 June 2026)",
          "url": "https://www.crowdstrike.com/en-us/blog/falcon-exposure-management-now-available-for-third-party-environments/"
        },
        {
          "label": "CrowdStrike press release: XM Cyber intellectual property (16 July 2026)",
          "url": "https://www.crowdstrike.com/en-us/press-releases/crowdstrike-and-schwarz-digits-expand-strategic-partnership-to-deliver-sovereign-cybersecurity-across-europe/"
        },
        {
          "label": "CrowdStrike S-1 filing (incorporated August 2011)",
          "url": "https://www.sec.gov/Archives/edgar/data/1535527/000104746919003095/a2238800zs-1.htm"
        }
      ]
    },
    {
      "name": "IONIX",
      "slug": "ionix",
      "company": "IONIX",
      "url": "https://www.ionix.io",
      "tier": "editorial",
      "categories": [
        "Attack surface management",
        "Validation",
        "Third-party risk"
      ],
      "stages": {
        "scoping": 1,
        "discovery": 2,
        "prioritisation": 2,
        "validation": 2,
        "mobilisation": 1
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "Tel Aviv, Israel",
      "founded": 2016,
      "pricing": "not published",
      "bestFor": [
        "Mid-market",
        "Enterprise",
        "Cloud-native"
      ],
      "summary": "External exposure management that follows the digital supply chain into vendor-managed and third-party dependencies, with safe exploit simulation to confirm what is really exploitable.",
      "detail": [
        "IONIX, formerly Cyberpion, discovers not only what you own but what you depend on: vendor-managed assets, third-party and fourth-party connections, and the dangling references those relationships leave behind. That supply-chain angle is its clearest differentiator from other external attack surface tools.",
        "Automated Exposure Validation converts published proof-of-concept exploits into non-intrusive payloads and runs them against production assets across network, cloud, domain name system, email, certificate and web modules. The result is a confirmed exposure rather than a version match, without the risk profile of full exploitation; equally, it is a single-step check with no chaining, credential reuse or lateral movement, so it is not a substitute for automated penetration testing.",
        "Prioritisation combines attack path and blast radius with threat intelligence such as leaked credentials and evidence of active exploitation. Action Items give step-by-step fixes, and Active Protection can automatically neutralise a dangling asset that is vulnerable to takeover.",
        "The scope is external-first. There is no internal discovery, identity graph or endpoint coverage. The Cloud Exposure Validator, launched in November 2024, ingests findings from cloud security platforms such as Wiz and Prisma Cloud to confirm which are externally exploitable, but IONIX is not a general findings aggregator, so it complements an exposure platform rather than replacing one.",
        "Check in a demo: how many third-party dependencies it finds for your own domains that your current tooling misses, since that count is the whole business case."
      ],
      "sources": [
        {
          "label": "IONIX press release: Cloud Exposure Validator (19 November 2024)",
          "url": "https://www.ionix.io/news-and-events/press-releases/ionix-cloud-exposure-validator/"
        },
        {
          "label": "IONIX: history of Cyberpion (founded 2016, Tel Aviv)",
          "url": "https://www.ionix.io/what-is-cyberpion/"
        }
      ]
    },
    {
      "name": "Intruder",
      "slug": "intruder",
      "company": "Intruder",
      "url": "https://www.intruder.io",
      "tier": "editorial",
      "categories": [
        "Attack surface management",
        "Vulnerability management"
      ],
      "stages": {
        "scoping": 0,
        "discovery": 1,
        "prioritisation": 1,
        "validation": 1,
        "mobilisation": 1
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "London, UK",
      "founded": 2015,
      "pricing": "per-asset",
      "bestFor": [
        "SMB",
        "Mid-market",
        "Cloud-native"
      ],
      "summary": "Lightweight external and internal scanning for small and mid-size teams, with published prices and a free tier. A realistic entry point to exposure management without an enterprise budget.",
      "detail": [
        "Intruder is deliberately smaller in scope than the platforms above. Attack surface discovery and monitoring, external and internal scanning, cloud posture and container scanning cover the ground a team of two or three actually needs, without a deployment project.",
        "Pricing is published, which is rare here: a base fee plus per-target licensing, with a permanent free plan launched in July 2026 covering a handful of web applications and one cloud account. For an organisation deciding whether exposure management is worth a budget line, that removes the first obstacle.",
        "Prioritisation of scan output was the founding premise: results are filtered down to what is worth acting on rather than exported as a wall of findings, though there is no attack path or business-context scoring. Fifteen or more ticketing and workflow integrations cover mobilisation adequately.",
        "Validation is limited. Remediation rescans confirm a fix worked, and an add-on artificial intelligence penetration testing service is available per test, but there is no breach and attack simulation or control efficacy testing.",
        "Check in a demo: whether the free or entry tier covers enough of your real asset count to be a genuine starting point, and what the per-target charges look like at your full scope."
      ],
      "sources": [
        {
          "label": "Intruder: introducing the Free plan (1 July 2026)",
          "url": "https://www.intruder.io/blog/introducing-our-free-plan--making-security-accessible-for-the-99"
        },
        {
          "label": "Intruder: pricing",
          "url": "https://www.intruder.io/pricing"
        },
        {
          "label": "Intruder: about us (founded 2015)",
          "url": "https://www.intruder.io/about-us"
        }
      ]
    },
    {
      "name": "Microsoft Security Exposure Management",
      "slug": "microsoft-security-exposure-management",
      "company": "Microsoft",
      "url": "https://learn.microsoft.com/en-us/security-exposure-management/microsoft-security-exposure-management",
      "tier": "editorial",
      "categories": [
        "Exposure platform",
        "Attack path analysis"
      ],
      "stages": {
        "scoping": 2,
        "discovery": 2,
        "prioritisation": 2,
        "validation": 1,
        "mobilisation": 1
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "Redmond, USA",
      "founded": 1975,
      "pricing": "bundled with licence suites",
      "bestFor": [
        "Enterprise",
        "Regulated"
      ],
      "summary": "Exposure management built into the Defender portal, drawing on whatever Microsoft security products you already license. Strong scoping and attack paths; no native adversarial validation.",
      "detail": [
        "This is likely the lowest-cost route to an exposure platform for an organisation already standardised on Microsoft security, because it arrives with licences you hold rather than as a new purchase. It runs inside the Defender portal with nothing to install, and became generally available in November 2024.",
        "Scoping is among the strongest in this directory. Critical asset management ships predefined classifiers for devices, identities, cloud resources, software as a service applications and artificial intelligence agents, plus custom query-based rules and criticality levels, so crown jewels are a maintained data set rather than a spreadsheet.",
        "Discovery is aggregation, not native scanning. The enterprise exposure graph pulls from Defender for Endpoint, Vulnerability Management, Identity, Cloud and Cloud Apps, plus preview connectors to Tenable, Qualys, Rapid7, Wiz, Palo Alto Prisma, ServiceNow and operational technology tools including Armis, Dragos and Forescout. Coverage therefore tracks exactly which Microsoft products you own, and the non-Microsoft connectors move to consumption-based pricing after preview.",
        "Prioritisation through attack paths, choke points and blast radius is genuinely good, including hybrid on-premises to cloud paths. Validation is not native: Microsoft's own material describes it as visualising and querying attack vectors, with active reachability scans for cloud paths, and there is no simulation module.",
        "Check in a demo: data latency, which the documentation puts at up to 72 hours, and the retention model, since only the latest snapshot is kept. Also confirm availability, because it is not offered in sovereign or government clouds."
      ],
      "sources": [
        {
          "label": "Microsoft Learn: what is new (general availability, November 2024)",
          "url": "https://learn.microsoft.com/en-us/security-exposure-management/whats-new"
        },
        {
          "label": "Microsoft Learn: prerequisites (licensing, latency, cloud availability)",
          "url": "https://learn.microsoft.com/en-us/security-exposure-management/prerequisites"
        }
      ]
    },
    {
      "name": "Nucleus Security",
      "slug": "nucleus-security",
      "company": "Nucleus Security",
      "url": "https://nucleussec.com/platform/",
      "tier": "editorial",
      "categories": [
        "Exposure platform",
        "Vulnerability management",
        "Remediation orchestration"
      ],
      "stages": {
        "scoping": 1,
        "discovery": 1,
        "prioritisation": 2,
        "validation": 0,
        "mobilisation": 2
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "Sarasota, USA",
      "founded": 2019,
      "pricing": "not published",
      "bestFor": [
        "Enterprise",
        "Regulated"
      ],
      "summary": "Aggregation and remediation layer over the scanners you already run. Prioritisation and mobilisation are among the strongest in this directory; it does no scanning or testing of its own, and discovery is limited to the inventory and intelligence-led detection it derives from connected tools.",
      "detail": [
        "Nucleus is not a scanner. It connects to more than 200 tools, normalises and deduplicates their output, applies your risk logic, and drives the remediation workflow. For an organisation drowning in findings from six scanners, that is the actual problem.",
        "Prioritisation is the core competence: custom risk scoring with threat intelligence, asset and business context, and support for decision frameworks such as stakeholder-specific vulnerability categorisation. Deduplication across overlapping scanners alone typically removes a large share of the queue.",
        "Mobilisation matches it. Automation rules, ownership assignment, bidirectional ServiceNow and Jira ticketing, service level tracking, exception management and reporting are all first-class rather than bolted on. FedRAMP Moderate authorisation matters for public sector buyers.",
        "The honest limitation is that it inherits the coverage and quality of whatever you connect. No connected scanner means no data, and validation results only appear if you feed in penetration test or adversarial validation output from elsewhere. Nucleus Discover correlates software inventory with threat intelligence to flag likely-affected systems early, but confirmation still comes from your scanners.",
        "Check in a demo: whether connectors exist for every tool you run, and how the pricing unit, which counts anything that can carry a finding, maps to your estate."
      ],
      "sources": [
        {
          "label": "Nucleus: platform (200+ connectors, FedRAMP Moderate)",
          "url": "https://nucleussec.com/platform/"
        },
        {
          "label": "Nucleus press release: FedRAMP Moderate authorization (18 March 2024)",
          "url": "https://nucleussec.com/news/nucleus-security-attains-fedramp-moderate-authorization/"
        }
      ]
    },
    {
      "name": "Orca Security",
      "slug": "orca-security",
      "company": "Orca Security",
      "url": "https://orca.security/platform/",
      "tier": "editorial",
      "categories": [
        "Cloud security",
        "Exposure platform",
        "Attack path analysis"
      ],
      "stages": {
        "scoping": 1,
        "discovery": 2,
        "prioritisation": 2,
        "validation": 1,
        "mobilisation": 2
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "Portland, USA",
      "founded": 2019,
      "pricing": "not published",
      "bestFor": [
        "Cloud-native",
        "Enterprise"
      ],
      "summary": "Agentless cloud security platform with strong attack path analysis and agentic remediation. Cloud only, and it markets exposure management less explicitly than its competitors.",
      "detail": [
        "Orca's patented side-scanning reads cloud workload storage out of band, so it inspects hosts, containers and functions without agents and without touching production performance. For cloud estates that resist agent rollout, this is the reason to look.",
        "The unified data model turns those findings into a graph, and attack path analysis surfaces toxic combinations across misconfiguration, vulnerability, identity and exposed data rather than ranking each finding alone. That is prioritisation done the way CTEM asks for.",
        "Mobilisation improved sharply after the Opus Security acquisition in May 2025: agentic remediation, automatic fixes, ownership routing and integration with Jira, ServiceNow, Slack and PagerDuty. An Attack Surface Red Agent, announced in August 2026, runs on-demand artificial intelligence penetration testing against public-facing assets; it is on-demand rather than continuous and the vendor does not yet state general availability, so treat validation as partial.",
        "Scope is the constraint. Everything is cloud. There is no on-premises, endpoint or operational technology coverage, and Orca does not position itself as an aggregator of third-party findings. Notably, its product pages barely use the term exposure management, which tells you where its centre of gravity sits.",
        "Check in a demo: how side-scanning handles your least standard workloads, and whether the graph ingests findings from tools outside the cloud estate you also need to prioritise."
      ],
      "sources": [
        {
          "label": "Orca press release: acquires Opus (13 May 2025)",
          "url": "https://orca.security/resources/press-releases/orca-security-acquires-opus-ai-cloud-remediation/"
        },
        {
          "label": "Orca blog: Attack Surface Red Agent (5 August 2026)",
          "url": "https://orca.security/resources/blog/attack-surface-red-agent/"
        }
      ]
    },
    {
      "name": "Pentera",
      "slug": "pentera",
      "company": "Pentera",
      "url": "https://pentera.io",
      "tier": "editorial",
      "categories": [
        "Automated penetration testing",
        "Validation",
        "Remediation orchestration"
      ],
      "stages": {
        "scoping": 0,
        "discovery": 1,
        "prioritisation": 2,
        "validation": 2,
        "mobilisation": 2
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "Boston, USA",
      "founded": 2015,
      "pricing": "not published",
      "bestFor": [
        "Enterprise",
        "Regulated"
      ],
      "summary": "Automated, safe-by-design penetration testing across internal, external and credential exposure. Among the deepest validation in this directory, and now with real remediation workflow too.",
      "detail": [
        "Pentera actually exploits. Rather than simulating an attack technique against a control, it chains real exploitation safely across your internal network, cloud and external surface, and reports the attack paths it achieved. A finding here is proof, not probability.",
        "Credential exposure testing is a particular strength and one that scanner-first platforms miss entirely: harvested and leaked credentials are tested for reuse across the estate, which is how a large share of real intrusions actually progress.",
        "Mobilisation changed in late 2025 with the DevOcean acquisition, now sold as Pentera Resolve: it triages and deduplicates findings across your other tools, enriches them with ownership and organisational context on top of Pentera's proof of exploitability, routes them with more than 100 integrations, and tracks service level agreements. That turns a validation product into something closer to a program tool. The context claims are the vendor's; ask to see how the ranking is weighted.",
        "Discovery is a by-product of the attack engine's own reconnaissance plus the Surface module for external assets, so it is not your asset inventory. There is no scoping module, and you will want an exposure platform or a scanner alongside it.",
        "Check in a demo: the change-control and blast-radius safeguards for running real exploitation in production, and who in your organisation has to sign that off, because that conversation is the usual blocker."
      ],
      "sources": [
        {
          "label": "Pentera: acquires DevOcean (9 October 2025)",
          "url": "https://pentera.io/in-the-press/pentera-acquires-devocean-to-streamline-vulnerability-fixes/"
        },
        {
          "label": "Pentera: Resolve",
          "url": "https://pentera.io/pentera-resolve/"
        },
        {
          "label": "Pentera: about us",
          "url": "https://pentera.io/about-us/"
        }
      ]
    },
    {
      "name": "Picus Security",
      "slug": "picus-security",
      "company": "Picus Security",
      "url": "https://www.picussecurity.com",
      "tier": "editorial",
      "categories": [
        "Breach and attack simulation",
        "Validation",
        "Detection engineering"
      ],
      "stages": {
        "scoping": 0,
        "discovery": 1,
        "prioritisation": 1,
        "validation": 2,
        "mobilisation": 1
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "San Francisco, USA",
      "founded": 2013,
      "pricing": "not published",
      "bestFor": [
        "Enterprise",
        "Mid-market"
      ],
      "summary": "Security validation platform that tests controls against current attack techniques and maps the results to exposure. Among the strongest options for proving whether detection and prevention actually work.",
      "detail": [
        "Picus tests your controls, not just your assets. Security control validation runs current attack techniques against your prevention stack, and detection rule validation checks whether the corresponding alerts fired in your security information and event management system. Both answers are usually uncomfortable and both are actionable.",
        "In July 2026 Picus launched its Autonomous Exposure Validation Platform, built on agent technology, which combines the original breach and attack simulation core with autonomous penetration testing that executes real exploit chains and an exposure validation module that tests whether a given vulnerability is exploitable against your controls.",
        "The mitigation content is the practical payoff: when a control misses a technique, Picus supplies vendor-specific signatures and detection rules for your particular products rather than generic advice. That is the difference between a report and a fix.",
        "Discovery and scoping are thin. An attack surface validation module builds an inventory through integrations, but this is not your asset system of record, and prioritisation works by correlating scanner findings you supply with simulation results.",
        "Check in a demo: whether your exact security controls and detection platform are covered by the mitigation library, since the value collapses if your stack is not on the list."
      ],
      "sources": [
        {
          "label": "Picus press release: Autonomous Exposure Validation Platform (7 July 2026)",
          "url": "https://www.picussecurity.com/resource/press-release/picus-launches-autonomous-exposure-validation-platform-for-post-mythos-era"
        },
        {
          "label": "Picus: about us (founded 2013)",
          "url": "https://www.picussecurity.com/about-us"
        }
      ]
    },
    {
      "name": "Qualys Enterprise TruRisk",
      "slug": "qualys-enterprise-trurisk",
      "company": "Qualys",
      "url": "https://www.qualys.com/enterprise-trurisk-platform",
      "tier": "editorial",
      "categories": [
        "Exposure platform",
        "Vulnerability management",
        "Validation"
      ],
      "stages": {
        "scoping": 1,
        "discovery": 2,
        "prioritisation": 2,
        "validation": 2,
        "mobilisation": 2
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "Foster City, USA",
      "founded": 1999,
      "pricing": "not published",
      "bestFor": [
        "Enterprise",
        "Regulated"
      ],
      "summary": "Long-standing scanning platform that added native exploit validation in 2026, making it one of the few vendors that touches all five stages without a second product, though scoping is only partial.",
      "detail": [
        "Qualys has been scanning since 1999 and the depth shows: asset management, vulnerability management, web application scanning, external attack surface management, and ingestion of third-party findings from Microsoft, Wiz and Okta into Enterprise TruRisk Management.",
        "Validation moved from gap to strength during 2026. TruConfirm runs production-safe exploit validation inside the exposure management application, and Agent Val reached general availability in March 2026 covering more than 1,600 vulnerabilities, included with the Enterprise TruRisk Management subscription, which is itself a separately licensed module.",
        "Prioritisation uses the TruRisk score, combining asset criticality with what the vendor describes as more than twenty-five threat feeds, and mobilisation runs through TruRisk Eliminate and integrated patch management, so the fix can happen in the same platform that found the problem.",
        "The historic criticism is user experience and the sprawl of modules rather than capability. No price list is published, which makes comparison against per-asset competitors hard without a proposal.",
        "Check in a demo: which modules are actually included in the proposal, because the platform is broad and the exposure management story assumes several of them. Note the older product URL now returns an error; the current platform page is the one linked here."
      ],
      "sources": [
        {
          "label": "Security MEA: Qualys Agent Val generally available (26 March 2026)",
          "url": "https://securitymea.com/2026/03/26/qualys-unveils-industrys-first-ai-agent-for-safe-exploit-validation-and-autonomous-remediation/"
        },
        {
          "label": "Qualys blog: Cloud Threat Database (more than 25 threat intelligence feeds, 8 February 2023)",
          "url": "https://blog.qualys.com/product-tech/2023/02/08/introducing-qualys-ml-based-threat-intelligence"
        },
        {
          "label": "Qualys Form 10-K for 2025 (founded December 1999, Foster City)",
          "url": "https://www.sec.gov/Archives/edgar/data/1107843/000110784326000008/qlys-20251231.htm"
        }
      ]
    },
    {
      "name": "Rapid7 Exposure Command",
      "slug": "rapid7-exposure-command",
      "company": "Rapid7",
      "url": "https://www.rapid7.com/products/command/exposure-management/",
      "tier": "editorial",
      "categories": [
        "Exposure platform",
        "Vulnerability management",
        "Cloud security"
      ],
      "stages": {
        "scoping": 1,
        "discovery": 2,
        "prioritisation": 2,
        "validation": 1,
        "mobilisation": 2
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "Boston, USA",
      "founded": 2000,
      "pricing": "not published",
      "bestFor": [
        "Mid-market",
        "Enterprise"
      ],
      "summary": "Combines vulnerability management, external attack surface and cloud posture into one hybrid exposure view. Broad coverage for mixed estates; validation is a managed service rather than a product feature.",
      "detail": [
        "Exposure Command is the exposure layer of Rapid7's Command Platform, sitting on top of the long-standing InsightVM scanner and Surface Command, the combined cyber asset and external attack surface product built from the Noetic Cyber acquisition in 2024.",
        "The hybrid framing is the pitch and it is a fair one: many mid-market organisations have on-premises servers, several clouds and a scattering of internet-facing applications, and few products cover all three without stitching. Layered context and attack path analysis then rank across that estate.",
        "Remediation Hub, announced with Exposure Command in August 2024 and available since April 2025, handles mobilisation with grouped fixes and owner routing, which addresses the historic complaint that vulnerability management tools stop at the report.",
        "Validation is where the marketing needs reading carefully. Runtime validation announced in March 2026 uses runtime telemetry to confirm that a vulnerable component is actually running and reachable, which is strong evidence but not adversarial testing. Real red teaming is sold separately as the Vector Command managed service.",
        "Check in a demo: how billable asset counting works across cloud, on-premises and external assets, since the licensing unit is usage-based and the same asset can appear in several places. The older product URL now returns an error; use the one linked here."
      ],
      "sources": [
        {
          "label": "Rapid7 press release: agrees to acquire Noetic Cyber (1 July 2024)",
          "url": "https://www.rapid7.com/about/press-releases/rapid7-acquires-cyber-asset-attack-surface-management-company-noetic-cyber/"
        },
        {
          "label": "Rapid7 blog: introducing Exposure Command (5 August 2024)",
          "url": "https://www.rapid7.com/blog/post/2024/08/05/rapid7-introduces-exposure-command-to-eliminate-the-security-visibility-gap/"
        },
        {
          "label": "Rapid7 press release: Remediation Hub (29 April 2025)",
          "url": "https://www.rapid7.com/about/press-releases/rapid7-s-command-platform-launches-unified-threat-informed-remediation/"
        },
        {
          "label": "Rapid7 press release: runtime validation (19 March 2026)",
          "url": "https://www.rapid7.com/about/press-releases/rapid7-advances-exposure-command-with-new-cloud-security-capabilities-for-runtime-validation-and-data-security-posture-management/"
        },
        {
          "label": "Rapid7 S-1 filing (incorporated July 2000)",
          "url": "https://www.sec.gov/Archives/edgar/data/1560327/000119312515220243/d908531ds1.htm"
        }
      ]
    },
    {
      "name": "Tenable One",
      "slug": "tenable-one",
      "company": "Tenable",
      "url": "https://www.tenable.com/products/tenable-one",
      "tier": "editorial",
      "categories": [
        "Exposure platform",
        "Vulnerability management",
        "Attack path analysis"
      ],
      "stages": {
        "scoping": 1,
        "discovery": 2,
        "prioritisation": 2,
        "validation": 1,
        "mobilisation": 2
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "Columbia, USA",
      "founded": 2002,
      "pricing": "enterprise quote",
      "bestFor": [
        "Enterprise",
        "Regulated"
      ],
      "summary": "One of the broadest discovery footprints in the directory, built on Tenable's scanning heritage and extended by the Vulcan Cyber acquisition. Validation is limited to security control status, not adversarial testing.",
      "detail": [
        "Tenable One aggregates an unusually wide range of asset types: traditional vulnerability management, web applications, cloud, operational technology, identity exposure, external attack surface and, more recently, artificial intelligence assets, plus third-party data connectors inherited from the Vulcan Cyber acquisition completed in February 2025.",
        "Prioritisation is mature. Exposure View gives leadership a business-aligned score, Exposure Signals let an analyst query for specific toxic combinations, and attack path analysis models more than 150 techniques, though that last capability sits only in the Advanced package under the pricing introduced in April 2026.",
        "Identity Exposure deserves separate mention: Active Directory and Entra ID weaknesses are where a large share of real attack paths run, and few exposure platforms treat identity as a first-class discovery domain. Scoping relies on an automatic asset criticality rating plus tags and business-aligned exposure cards, rather than a dedicated critical asset module.",
        "Validation is partial. In June 2026 Tenable added continuous security control validation for all Tenable One customers, which checks whether existing defences already block an exposure and feeds that into prioritisation. That is evidence from control status, not attack simulation or exploitation; for adversarial testing Tenable still points to integrations with breach and attack simulation tools, meaning a second product for full stage four coverage.",
        "Check in a demo: which capabilities fall in Foundation versus Advanced, because attack path analysis and the richer mobilisation workflow are the reason most buyers want the platform rather than the scanner."
      ],
      "sources": [
        {
          "label": "Tenable press release: completes Vulcan Cyber acquisition (7 February 2025)",
          "url": "https://www.tenable.com/press-releases/tenable-completes-acquisition-of-vulcan-cyber"
        },
        {
          "label": "Tenable press release: Foundation and Advanced packages (28 April 2026)",
          "url": "https://www.tenable.com/press-releases/tenable-accelerates-exposure-management-adoption-with-new-flexible-pricing-for-the-ai-era"
        },
        {
          "label": "Tenable press release: continuous security control validation (16 June 2026)",
          "url": "https://www.tenable.com/press-releases/tenable-sharpens-exposure-management-risk-prioritization-with-continuous-security-validation"
        },
        {
          "label": "Tenable: about us (founded 2002)",
          "url": "https://www.tenable.com/about-tenable/about-us"
        },
        {
          "label": "Tenable: buy (Exposure Management by customised quote)",
          "url": "https://www.tenable.com/buy"
        }
      ]
    },
    {
      "name": "Wiz",
      "slug": "wiz",
      "company": "Wiz (Google Cloud)",
      "url": "https://www.wiz.io/solutions/exposure-management",
      "tier": "editorial",
      "categories": [
        "Cloud security",
        "Exposure platform",
        "Validation"
      ],
      "stages": {
        "scoping": 1,
        "discovery": 2,
        "prioritisation": 2,
        "validation": 2,
        "mobilisation": 2
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "New York, USA",
      "founded": 2020,
      "pricing": "enterprise quote",
      "bestFor": [
        "Cloud-native",
        "Enterprise"
      ],
      "summary": "Cloud security platform that extended convincingly into exposure management, with an outside-in attack surface module and an autonomous penetration testing agent. Cloud-first, now part of Google Cloud.",
      "detail": [
        "The Security Graph is the core of the product: agentless scanning builds a graph of workloads, identities, data and network paths, and toxic combinations are surfaced as single prioritised issues rather than thousands of separate findings.",
        "Exposure management is a genuine extension rather than a rebrand. Wiz attack surface management launched in November 2025 adds outside-in discovery, and Red Agent, generally available in July 2026, is an autonomous penetration tester for web applications, interfaces and artificial intelligence applications that returns proofs of execution with reproduction steps; testing is focused on externally reachable applications, not internal networks or security controls.",
        "Mobilisation is strong: workflows, owner assignment, service level tracking on a dedicated exposure dashboard, and an agent that performs root-cause investigation and can open fix pull requests through the code product.",
        "The limitation is the centre of gravity. On-premises, endpoint and operational technology coverage comes through ingestion and external scanning rather than native agents, and there is no security control efficacy testing. Google completed its acquisition of Wiz in March 2026; the company states it will remain multi-cloud.",
        "Check in a demo: how the licensing modules add up across workloads, developers, log ingestion and sensors, since the pricing page publishes no numbers and the unit mix is where quotes diverge."
      ],
      "sources": [
        {
          "label": "Wiz blog: introducing Wiz ASM (3 November 2025)",
          "url": "https://www.wiz.io/blog/introducing-wiz-asm"
        },
        {
          "label": "Wiz blog: Red Agent generally available (29 July 2026)",
          "url": "https://www.wiz.io/blog/wiz-red-agent-is-ga"
        },
        {
          "label": "Google Cloud press corner: Google completes acquisition of Wiz (11 March 2026)",
          "url": "https://www.googlecloudpresscorner.com/2026-03-11-Google-Completes-Acquisition-of-Wiz"
        },
        {
          "label": "Wiz: pricing",
          "url": "https://www.wiz.io/pricing"
        },
        {
          "label": "CNBC: Google to acquire Wiz (founded in 2020, 18 March 2025)",
          "url": "https://www.cnbc.com/2025/03/18/google-to-acquire-cloud-security-startup-wiz-for-32-billion.html"
        }
      ]
    },
    {
      "name": "XM Cyber",
      "slug": "xm-cyber",
      "company": "XM Cyber",
      "url": "https://xmcyber.com",
      "tier": "editorial",
      "categories": [
        "Attack path analysis",
        "Exposure platform",
        "Validation"
      ],
      "stages": {
        "scoping": 1,
        "discovery": 2,
        "prioritisation": 2,
        "validation": 1,
        "mobilisation": 2
      },
      "reviewed": "2026-09-20",
      "handsOn": false,
      "hq": "Tel Aviv, Israel",
      "founded": 2016,
      "pricing": "not published",
      "bestFor": [
        "Enterprise",
        "Regulated"
      ],
      "summary": "One of the most established attack path analysis products: a digital twin of the environment that ranks choke points by how many paths to critical assets they cut. CrowdStrike agreed to buy its intellectual property in July 2026.",
      "detail": [
        "XM Cyber models your environment as an attack graph and continuously computes the routes from a foothold to a critical asset. The output that matters is the choke point: the single fix that severs the largest number of paths, which is a fundamentally different remediation list from a severity-sorted queue.",
        "Discovery is native rather than borrowed, using a lightweight sensor plus agentless discovery, passive discovery for operational technology and legacy systems, and its own external attack surface capability, with integrations enriching rather than supplying the graph.",
        "Validation is modelled, not live. The digital twin simulates exploitability and reachability and monitors security controls, which is more rigorous than a vulnerability score but is not real exploitation in the way Pentera performs it. Judge it as very strong prioritisation rather than stage four coverage.",
        "The Remediation Operations module handles mobilisation with ranked, path-aware fix lists, which pairs naturally with the choke-point analysis.",
        "Check in a demo: the roadmap, because CrowdStrike agreed in July 2026 to acquire XM Cyber's intellectual property including patents and source code, with close expected in the second half of the vendor's fiscal 2027. XM Cyber continues as a standalone business under a licence-back arrangement, but ask directly how long."
      ],
      "sources": [
        {
          "label": "CrowdStrike press release: XM Cyber intellectual property (16 July 2026)",
          "url": "https://www.crowdstrike.com/en-us/press-releases/crowdstrike-and-schwarz-digits-expand-strategic-partnership-to-deliver-sovereign-cybersecurity-across-europe/"
        },
        {
          "label": "XM Cyber: platform",
          "url": "https://xmcyber.com/platform/"
        },
        {
          "label": "XM Cyber: company (since 2016)",
          "url": "https://xmcyber.com/company/"
        },
        {
          "label": "XM Cyber press release: identity exposure management (Tel Aviv dateline, 27 May 2026)",
          "url": "https://xmcyber.com/press-release/xm-cyber-expands-identity-exposure-management/"
        }
      ]
    }
  ]
}