AttackIQ
Los Altos, USA
- Series C
- Founded 2013
Security control validation platform built around MITRE ATT&CK and purple-team testing.
Named among 2026 CTEM and BAS alternatives in independent vendor comparisons
Offensive and exposure
CTEM, attack-surface, pentest-platform, and continuous-exposure startups. Not a services firm with a PDF report.
14 companies · ordered by name · no paid placement · About this category
A
C
Censys
Ann Arbor, USA
- Series D
- $198M raised
- Founded 2017
Internet-wide map of exposed infrastructure used for ASM, threat hunting, and exposure management.
Raised $40M Series D plus $30M debt led by Morgan Stanley Expansion Capital, March 2026
Cymulate
Tel Aviv, Israel
- Series D
- $141M raised
- Founded 2016
BAS-born exposure validation that now pushes findings into automated control updates.
Shipped Vero AI for agentic cyber defense engineering on the live platform, 2026
D
Detectify
Stockholm, Sweden
- Series B
- Founded 2013
Hacker-powered surface monitoring for domains, apps, and APIs, now with an MCP server for AI workflows.
Launched a Detectify MCP server for AI security workflows, 2026
E
Empirical Security
Chicago, United States
- Series A
- $37M raised
Exposure management that predicts which vulnerabilities will be exploited, using a global model plus one trained on each customer's environment.
Raised a $25M Series A led by Brightmind Partners, July 2026
H
Hadrian
Amsterdam, Netherlands
- Seed
- $14M raised
- Founded 2021
Outside-in autonomous hacker that discovers, exploits, and validates external exposure continuously.
Shipped Sense, Plan, Attack AI agents to operationalize CTEM, November 2025
Horizon3.ai
San Francisco, USA
- Series E
- $429M raised
- Founded 2019
NodeZero autonomous pentest that exploits live networks the way an attacker would, continuously.
Raised $250M Series E at a $2B-plus valuation, August 2026
P
Pentera
Burlington, USA
- Series D
- $250M raised
- Founded 2015
Automated security validation that actually exploits attack paths inside the customer's network.
Raised $60M Series D led by Evolution Equity Partners, March 2025
Picus Security
San Francisco, USA
- Series C
- Founded 2013
Breach-and-attack simulation plus autonomous pentest that scores whether controls actually stop the attack.
Raised $45M Series C to lead adversarial exposure validation, September 2024
S
SAFE
Palo Alto, USA
- Series C
- $170M raised
- Founded 2012
Cyber risk quantification platform that added an agentic CTEM loop on top of CRQ and TPRM.
Raised $70M Series C and launched a fully autonomous CTEM offering, July 2025
SixMap
Columbia, USA
- Series A
- $24M raised
- Founded 2020
Internet-scale IPv4/IPv6 discovery that maps what an attacker can actually see of you.
Launched new product capabilities for AI-driven attack-surface change, December 2025
T
Terra Security
Tel Aviv, Israel
- Seed
- $8M raised
- Founded 2024
Agentic pentest platform with a human in the loop across web, API, network, and AI surfaces.
Raised $8M (Q2 2025) to scale agentic continuous pentesting
X
XM Cyber
Tel Aviv, Israel
- Series B
- $49M raised
- Founded 2016
Hybrid attack-path graph that shows how an identity, cloud, or on-prem foothold becomes a breach.
Named a Challenger in the first Gartner Magic Quadrant for Exposure Assessment Platforms, 2025
Z
Zafran
New York, USA
- Series C
- $130M raised
- Founded 2022
CTEM that proves which CVEs are exploitable, then mitigates with the controls you already own.
Raised $60M Series C led by Menlo Ventures, December 2025
About this category
About offensive and exposure
Offensive and exposure is the proof-of-work layer of this directory. The products here split the job: discovering what an attacker can actually reach, proving which controls hold, and ranking the exposure that matters.
This index maps every company whose primary product is continuous attack-surface discovery, breach-and-attack simulation, autonomous pentesting, attack-path analysis, or exposure and risk management.
Pentest consultancies that sell a week of labor and a slide deck are out, and public mega-cap scanner suites are out.
Every entry carries a 2024 to 2026 proof-of-life signal recorded with a source link, and membership is taxonomy from the research pass.
What they build
The products here cluster into four shapes. Autonomous pentest and continuous PTaaS agents repeatedly test or exploit live internal and external networks instead of relying only on an annual engagement.
Breach-and-attack simulation platforms fire ATT&CK-mapped tests at the stack you already bought to prove which controls actually hold. Outside-in discovery maps internet-exposed assets and tracks attack-surface changes continuously.
Attack-path and exposure-management platforms model or validate reachable paths, then prioritize findings by choke points, blast radius, exploitability, or risk. Several of the same platforms now push validated findings into tickets, mitigations, or agentic workflows rather than a slide deck.
Who this is for
Security leaders comparing autonomous pentesting against annual consultancy engagements, control owners who need evidence that EDR, WAF, or SIEM rules actually block a technique, and investors mapping the CTEM field by what each platform actually does rather than what it claims.
Who is listed
Included only when a live company has primary category offensive-exposure. Pentest consultancies with no product and public mega-cap vulnerability scanners live elsewhere. Inclusion is category-based and verification-gated, not paid placement and not an endorsement of outcomes.
How order works
Listings are the full live catalog slice for this primary category, sorted alphabetically by name. This is not a scored quality ranking and there is no paid placement. Aevral is a disclosed house listing under the same rules (live, no pin). See /transparency.
14 companies. Catalog last reviewed 2026-08-23. Page copy reviewed 2026-09-14. Next review by 2026-10-14. Ordered by name. No paid placement.