Attack surface management vendors

Microsoft sells software, cloud services, hardware, and gaming products.

Palo Alto Networks provides cybersecurity platforms and services to protect organizations from cyber threats.

CrowdStrike provides AI-native cybersecurity solutions to stop breaches.

Tenable provides an exposure management platform that unifies security visibility, insight, and action across the attack surface.

Qualys provides an enterprise cyber risk and security platform.

Tempe, Arizona-headquartered offensive security firm and Black Hat / DEF CON regulars, makers of the Cosmos continuous attack surface management platform.

Crowdsourced bug bounty pioneer founded in 2012 by Casey Ellis, offering managed programs and crowd-powered penetration testing from hundreds of thousands of ethical hackers.

Penetration testing firm trusted by nine of the top ten US banks, with the Resolve platform for continuous attack surface management.

FedRAMP-authorized crowdsourced penetration testing platform combining the vetted SRT researcher community with AI-powered Hydra technology for continuous security testing.

Cloud-based Penetration Testing as a Service platform combining AI-driven automation with expert manual testing at accessible price points.

Pioneer of Pentest as a Service, delivering fast, platform-based penetration testing with a vetted global community of security researchers.

Subscription-based offensive cybersecurity firm delivering continuous cyber attack services with CREST STAR and CBEST accreditations from its London headquarters.

Cardiff-based CREST and CHECK-accredited cyber security company delivering penetration testing, red teaming, and OT security assessments as part of the Chess Group.

Offensive security firm founded by former DoD professionals. Combines deep offensive testing with the Chariot attack surface management platform and its Exploit validation engine.

Full-service London-based cybersecurity consultancy with CREST, CHECK, and NCSC accreditations delivering offensive testing, managed detection, and strategic advisory services.

US penetration testing firm founded in 2011, running 600+ engagements a year with a fully remote, US-based team. Manual, expert-led testing across web, network, cloud, mobile, wireless, OT/ICS, and AI/LLM. Gartner Sample Vendor for PTaaS.

AgentRidge provides autonomous AI software for penetration testing on local machines.

Armis provides cyber exposure management and security for connected devices and operational technology.

Asimily provides a platform to discover, assess, and mitigate risks for IoT, OT, and IoMT devices.

AttackIQ provides a platform for continuous threat exposure management and adversarial exposure validation.

BitScore Cybertech LLP is a delivery partner for Bitsight security ratings in India.

Bitsight provides a cyber risk intelligence platform.

Canima provides an AI-powered penetration testing platform.

Codename Sonar provides defensive reconnaissance for blue-team testing, including host discovery and network exposure assessment.

Criminal IP provides threat intelligence solutions for uncovering exposed assets and detecting malicious infrastructure.

CyberVadis provides a managed service and platform for third-party cyber risk management.

Cyble provides AI-native threat intelligence and cybersecurity platforms for enterprises and governments.

Cyderes provides managed cybersecurity services including identity, threat detection, and exposure management.

Cymulate provides a platform for validating security controls against threats and exposures.

DDactic maps attack surfaces and tests DDoS resilience for enterprise infrastructure.

Forescout provides a platform for managing cyber risk and mitigating threats across IT, OT, IoT, and IoMT devices.

Group-IB provides cybersecurity products and services to prevent digital crime.

Hackrate runs crowdsourced security testing and bug bounty programmes for companies.

HiddenLayer provides a security platform for AI applications, protecting against adversarial threats.

Horizon3 runs autonomous attack testing to find and verify exploitable weaknesses in production environments.

Infoblox provides networking and security software for DNS, DHCP and IP address management.

Intel 471 provides cyber threat intelligence focused on adversary tracking, malware intelligence and underground marketplace coverage.

Intigriti runs a crowdsourced security platform connecting organisations with ethical hackers for bug bounties and testing.

Laucked is a French cybersecurity firm based in Toulouse that provides penetration testing and continuous security monitoring for small and medium-sized businesses.

Offensive360 provides application security testing and risk management tools for enterprises.

Picus Security provides a platform that validates exposures and security controls by simulating cyber attacks.

Pillar Security provides a platform to discover, test, secure and govern AI agents across organisations.

ProjectDiscovery builds open-source security tools and infrastructure for mapping, probing, crawling, and detecting vulnerabilities.

Red Sift provides email, domain and web security services to help organisations implement security protocols.

ReliaQuest provides an AI security operations platform for enterprises to detect and respond to threats.

RiskRecon provides cybersecurity ratings and assessments to help organisations manage third-party and supply chain risk.

RoboShadow provides daily vulnerability scanning and automated remediation for internal and external networks.

SafeBreach provides a platform that validates security controls and manages cyber exposure for enterprises.

Sekoia provides an AI-driven security operations platform for detecting, investigating and responding to cyber threats.

Siemba provides autonomous and expert-led penetration testing for security teams.

Tanium provides a platform for managing and securing endpoints across large networks.

Team Cymru provides global threat intelligence from internet traffic for proactive defence.

UpGuard provides a platform for managing cyber risk across vendors, attack surface, and workforce.

Upwind provides a runtime-powered cloud security platform that uses live workload behaviour to prioritise posture findings.

Zerocopter provides security testing services including pentesting, bug bounty, and vulnerability disclosure.

CodeWall builds autonomous attack agents that test enterprise security from the outside.

HackRisk monitors external cyber risks for UK SMEs and provides a security score.

Holm Security provides a platform for vulnerability management and attack surface management.

Intruder provides continuous vulnerability scanning and attack surface management for cloud and web assets.

Invicti provides web application and API security testing software for enterprises.

KELA provides cyber threat intelligence and external threat exposure management from underground sources.

Monarc provides a unified security platform that scans websites for vulnerabilities and explains fixes in plain language.

Exposure management platform with vulnerability management, external attack surface management, application security testing, pen testing as a service and digital risk protection.

Third-party cyber risk management platform with vendor security questionnaires, external attack surface ratings, continuous monitoring and remediation workflows for suppliers.

Pentera provides an exposure validation platform that tests security controls against real attacks.

Recorded Future provides a threat intelligence platform that indexes open, dark and technical sources. Acquired by Mastercard for $2.65bn.

SecurityScorecard provides a platform for managing third-party and supply chain cyber risk.

ZeroFox provides external cybersecurity services to discover, validate, and disrupt digital threats.