One of the most established attack path analysis products: a digital twin of the environment that ranks choke points by how many paths to critical assets they cut. CrowdStrike agreed to buy its intellectual property in July 2026.
XM Cyber models your environment as an attack graph and continuously computes the routes from a foothold to a critical asset. The output that matters is the choke point: the single fix that severs the largest number of paths, which is a fundamentally different remediation list from a severity-sorted queue.
Discovery is native rather than borrowed, using a lightweight sensor plus agentless discovery, passive discovery for operational technology and legacy systems, and its own external attack surface capability, with integrations enriching rather than supplying the graph.
Validation is modelled, not live. The digital twin simulates exploitability and reachability and monitors security controls, which is more rigorous than a vulnerability score but is not real exploitation in the way Pentera performs it. Judge it as very strong prioritisation rather than stage four coverage.
The Remediation Operations module handles mobilisation with ranked, path-aware fix lists, which pairs naturally with the choke-point analysis.
Check in a demo: the roadmap, because CrowdStrike agreed in July 2026 to acquire XM Cyber's intellectual property including patents and source code, with close expected in the second half of the vendor's fiscal 2027. XM Cyber continues as a standalone business under a licence-back arrangement, but ask directly how long.
Weak in one of these stages? The self-assessment tells you which stage to shop for first, and the directory shows who covers it.
Claim or correct this listing
Tell us what is wrong or what you want to confirm, and link a public source we can check. The owner reviews every claim. Nothing changes on the site until it has been reviewed, and a claim never changes a score or placement.
Get vendor updates monthly
One email a month: what changed in exposure management, which vendors moved, and one thing worth doing. No spam, unsubscribe any time.