Breach and attack simulation vendors
We list 26 companies active in breach and attack simulation, and 7 of them have it as their main focus. 3 are owned by another company and 23 are private. Most are based in the United States (15). The oldest, NetSPI, was founded in 2001. Of the 4 companies here with staff numbers, the largest is NetSPI (201-500 staff).
By countryUnited States 15
Companies focused on breach and attack simulation
7 companies| Company | Based in | Founded | Size | Ownership |
|---|---|---|---|---|
AttackIQ AttackIQ provides a platform for continuous threat exposure management and adversarial exposure validation. | Los Altos, United States | 2014 | Private | |
Cymulate Cymulate provides a platform for validating security controls against threats and exposures. | Holon, Israel | 2016 | Private | |
Picus Security Picus Security provides a platform that validates exposures and security controls by simulating cyber attacks. | Wilmington, United States | 2013 | Private | |
RemoteThreat RemoteThreat provides an offensive cyber operations platform for red teams and government mission teams. | Fulton, United States | Private | ||
SafeBreach SafeBreach provides a platform that validates security controls and manages cyber exposure for enterprises. | Sunnyvale, United States | Private | ||
SCYTHE SCYTHE provides a platform for continuous adversarial exposure validation across IT, cloud, and OT environments. | Columbia, United States | 2018 | Private | |
Pentera Pentera provides an exposure validation platform that tests security controls against real attacks. | Tel Aviv, Israel | 2015 | Private |
Also active in breach and attack simulation
19 companies| Company | Based in | Founded | Size | Ownership |
|---|---|---|---|---|
N NetSPI Penetration testing firm trusted by nine of the top ten US banks, with the Resolve platform for continuous attack surface management. | Minneapolis, United States | 2001 | 201-500 staff | Owned by KKR |
B BreachLock Cloud-based Penetration Testing as a Service platform combining AI-driven automation with expert manual testing at accessible price points. | New York, United States | 2019 | 51-200 staff | Private |
Praetorian Offensive security firm founded by former DoD professionals. Combines deep offensive testing with the Chariot attack surface management platform and its Exploit validation engine. | Austin, United States | 2010 | 51-200 staff | Private |
TrustedSec Offensive security firm founded by former NSA operator David Kennedy, delivering CREST-accredited penetration testing, red teaming, and adversary simulation to Fortune 500 and government clients. | Fairlawn, United States | 2012 | 51-200 staff | Private |
Canima Canima provides an AI-powered penetration testing platform. | Dover, United States | 2025 | Private | |
Capsule Security Capsule Security provides a runtime security platform that monitors and intervenes in AI agent behavior. | Tel Aviv, Israel | Private | ||
CyCognito CyCognito provides a platform that discovers and tests external attack surfaces to identify security exposures. | Palo Alto, United States | Private | ||
Forefront IT Security Services Forefront IT Security Services presents itself as a virtual cyber security team for organisations in the United Kingdom. | United Kingdom | 2021 | Private | |
HiddenLayer HiddenLayer provides a security platform for AI applications, protecting against adversarial threats. | Austin, United States | 2022 | Private | |
Horizon3 Horizon3 runs autonomous attack testing to find and verify exploitable weaknesses in production environments. | San Francisco, United States | 2019 | Private | |
Lasso Security Lasso Security provides a platform to secure AI agents and applications at enterprise scale. | Tel Aviv, Israel | 2023 | Private | |
M MazeBolt Technologies MazeBolt provides continuous, non-disruptive DDoS testing to validate enterprise DDoS defences. | Ramat Gan, Israel | 2013 | Private | |
Nuvol Cybersecurity Nuvol Cybersecurity is a boutique cybersecurity firm founded in 2017 in Panama. | Mexico City, Panama | 2017 | Private | |
Revelion Revelion provides an autonomous AI pentester that simulates attacks to validate exploitability across estates. | London, United Kingdom | 2026 | Private | |
RiskRecon by Mastercard RiskRecon provides cybersecurity ratings and assessments to help organisations manage third-party and supply chain risk. | Murray, United States | Private | ||
RoboShadow RoboShadow provides daily vulnerability scanning and automated remediation for internal and external networks. | London, United Kingdom | 2017 | Private | |
Virtue AI Virtue AI provides an enterprise AI safety platform for securing AI agents and applications. | San Francisco, United States | Part of Fortinet | ||
XM Cyber XM Cyber provides a platform for continuous exposure management across hybrid environments. | Neckarsulm, Germany | Owned by Schwarz Group | ||
CodeWall CodeWall builds autonomous attack agents that test enterprise security from the outside. | London, United Kingdom | Private |
Recent deals in breach and attack simulation
All breach and attack simulation dealsAcquisitions come from SecurityWeek's monthly M&A round-ups from 2021 onwards, from Cybersecurity Ventures' quarterly M&A reports for 2020, and a few from Wikipedia lists. These are dated to the month. A few deals added from the news are dated to the day. Smaller deals may be missing. Amounts are in US dollars.
More in Security Operations
See every category- SIEM vendors 37 companies
- SOAR vendors 37 companies
- Agentic SOC tools 20 companies
- Vulnerability management vendors 113 companies
- Attack surface management vendors 81 companies