Zafran

CTEM that proves which CVEs are exploitable, then mitigates with the controls you already own.

Proof of life. Raised $60M Series C led by Menlo Ventures, December 2025

Zafran unifies scanner output, then scores runtime presence, internet reachability, and whether a compensating control already blocks the path. The useful trick is mitigation before the patch window: tweak an EDR or WAF policy today, patch later. RemOps collapses overlapping CVEs into one ticket so vuln management is not 130 new CVEs a day.

Category: Offensive and exposure
Headquarters: New York, USA
Country: USA
Founded: 2022
Funding stage: Series C
Total funding: $130M
Website: https://www.zafran.io

Investors

Menlo VenturesSequoia CapitalCyberstarts