Zafran

CTEM that proves which CVEs are exploitable, then mitigates with the controls you already own.

Proof of life. Raised $60M Series C led by Menlo Ventures, December 2025

About Zafran

Zafran unifies scanner output, then scores runtime presence, internet reachability, and whether a compensating control already blocks the path. The useful trick is mitigation before the patch window: tweak an EDR or WAF policy today, patch later.

RemOps collapses overlapping CVEs into one ticket so vuln management is not 130 new CVEs a day.

Investors

Menlo VenturesSequoia CapitalCyberstarts

Work at Zafran? Link to this listing

Optional badge for your site or README. It changes nothing about the listing, its order or its review. Other formats and a dark version: press kit.

<a href="https://securitystartups.com/companies/zafran"><img src="https://securitystartups.com/badge/listed.svg" alt="Listed on Security Startups" width="184" height="44"></a>