Attack surface management vendors in the United States

Microsoft sells software, cloud services, hardware, and gaming products.

Palo Alto Networks provides cybersecurity platforms and services to protect organizations from cyber threats.

CrowdStrike provides AI-native cybersecurity solutions to stop breaches.

Tenable provides an exposure management platform that unifies security visibility, insight, and action across the attack surface.

Qualys provides an enterprise cyber risk and security platform.

Tempe, Arizona-headquartered offensive security firm and Black Hat / DEF CON regulars, makers of the Cosmos continuous attack surface management platform.

Crowdsourced bug bounty pioneer founded in 2012 by Casey Ellis, offering managed programs and crowd-powered penetration testing from hundreds of thousands of ethical hackers.

Penetration testing firm trusted by nine of the top ten US banks, with the Resolve platform for continuous attack surface management.

FedRAMP-authorized crowdsourced penetration testing platform combining the vetted SRT researcher community with AI-powered Hydra technology for continuous security testing.

Cloud-based Penetration Testing as a Service platform combining AI-driven automation with expert manual testing at accessible price points.

Pioneer of Pentest as a Service, delivering fast, platform-based penetration testing with a vetted global community of security researchers.

Offensive security firm founded by former DoD professionals. Combines deep offensive testing with the Chariot attack surface management platform and its Exploit validation engine.

US penetration testing firm founded in 2011, running 600+ engagements a year with a fully remote, US-based team. Manual, expert-led testing across web, network, cloud, mobile, wireless, OT/ICS, and AI/LLM. Gartner Sample Vendor for PTaaS.

Armis provides cyber exposure management and security for connected devices and operational technology.

Asimily provides a platform to discover, assess, and mitigate risks for IoT, OT, and IoMT devices.

AttackIQ provides a platform for continuous threat exposure management and adversarial exposure validation.

Bitsight provides a cyber risk intelligence platform.

Canima provides an AI-powered penetration testing platform.

Codename Sonar provides defensive reconnaissance for blue-team testing, including host discovery and network exposure assessment.

Cyble provides AI-native threat intelligence and cybersecurity platforms for enterprises and governments.

Cyderes provides managed cybersecurity services including identity, threat detection, and exposure management.

Forescout provides a platform for managing cyber risk and mitigating threats across IT, OT, IoT, and IoMT devices.

HiddenLayer provides a security platform for AI applications, protecting against adversarial threats.

Horizon3 runs autonomous attack testing to find and verify exploitable weaknesses in production environments.

Infoblox provides networking and security software for DNS, DHCP and IP address management.

Intel 471 provides cyber threat intelligence focused on adversary tracking, malware intelligence and underground marketplace coverage.

Picus Security provides a platform that validates exposures and security controls by simulating cyber attacks.

ProjectDiscovery builds open-source security tools and infrastructure for mapping, probing, crawling, and detecting vulnerabilities.

ReliaQuest provides an AI security operations platform for enterprises to detect and respond to threats.

RiskRecon provides cybersecurity ratings and assessments to help organisations manage third-party and supply chain risk.

SafeBreach provides a platform that validates security controls and manages cyber exposure for enterprises.

Siemba provides autonomous and expert-led penetration testing for security teams.

Tanium provides a platform for managing and securing endpoints across large networks.

Team Cymru provides global threat intelligence from internet traffic for proactive defence.

UpGuard provides a platform for managing cyber risk across vendors, attack surface, and workforce.

Invicti provides web application and API security testing software for enterprises.

Third-party cyber risk management platform with vendor security questionnaires, external attack surface ratings, continuous monitoring and remediation workflows for suppliers.

Recorded Future provides a threat intelligence platform that indexes open, dark and technical sources. Acquired by Mastercard for $2.65bn.

SecurityScorecard provides a platform for managing third-party and supply chain cyber risk.

ZeroFox provides external cybersecurity services to discover, validate, and disrupt digital threats.