External attack surface monitoring for web applications, powered by crowdsourced security research. Narrow by design, strong on internet-facing apps, and one of the few vendors publishing at least its platform-tier prices.
Stage-coverage score: 4 of 10. Sum of the five 0-2 stage scores below; see the rubric for what each number means.
01Scoping□noneAgree what is in play
02Discovery◪partialFind every exposure, not just CVEs
03Prioritisation◪partialRank by attack path and impact
04Validation◪partialProve it is exploitable
05Mobilisation◪partialGet it fixed, and show it
Not a primary tool for any single stage. Contributes to: Discovery, Prioritisation, Validation, Mobilisation. Compiled from public vendor documentation.
Detectify's differentiator is its crowdsource programme: a network of several hundred ethical hackers submits real payload-based tests that become automated checks for every customer. Findings therefore carry proof at the application layer rather than a version-number guess.
Coverage is web and API centric. Surface Monitoring discovers subdomains and internet-facing assets, Application and API Scanning test them, and Internal Scanning extends to networks behind the perimeter. There is no identity graph, no cloud configuration posture and no attack path analysis.
It is one of the few vendors in this directory with published pricing: annual platform tiers by user count plus unpublished per-domain and per-target charges. Note the entry tier lists a zero platform fee, but assets are still charged, so it is not a free product.
Prioritisation is severity scoring. Mobilisation is integration-level: bidirectional Jira sync plus ServiceNow, Slack, Teams, PagerDuty and Splunk through a workflow integration layer. There is no cross-domain correlation, no dedup across other scanners and no remediation orchestration.
Check in a demo: the total cost once your real domain and target counts are entered, because the platform tier is the smaller half of the bill. Insight Partners took a majority stake in October 2024.
Weak in one of these stages? The self-assessment tells you which stage to shop for first, and the directory shows who covers it.
Claim or correct this listing
Tell us what is wrong or what you want to confirm, and link a public source we can check. The owner reviews every claim. Nothing changes on the site until it has been reviewed, and a claim never changes a score or placement.
Get vendor updates monthly
One email a month: what changed in exposure management, which vendors moved, and one thing worth doing. No spam, unsubscribe any time.