cybersecdirectory

Breach and attack simulation vendors

We list 26 companies active in breach and attack simulation, and 7 of them have it as their main focus. 3 are owned by another company and 23 are private. Most are based in the United States (15). The oldest, NetSPI, was founded in 2001. Of the 4 companies here with staff numbers, the largest is NetSPI (201-500 staff).

By countryUnited States 15

Companies focused on breach and attack simulation

7 companies
CompanyBased inFoundedSizeOwnership
AttackIQ

AttackIQ provides a platform for continuous threat exposure management and adversarial exposure validation.

Los Altos, United States2014Private
Cymulate

Cymulate provides a platform for validating security controls against threats and exposures.

Holon, Israel2016Private
Picus Security

Picus Security provides a platform that validates exposures and security controls by simulating cyber attacks.

Wilmington, United States2013Private
RemoteThreat

RemoteThreat provides an offensive cyber operations platform for red teams and government mission teams.

Fulton, United StatesPrivate
SafeBreach

SafeBreach provides a platform that validates security controls and manages cyber exposure for enterprises.

Sunnyvale, United StatesPrivate
SCYTHE

SCYTHE provides a platform for continuous adversarial exposure validation across IT, cloud, and OT environments.

Columbia, United States2018Private
Pentera

Pentera provides an exposure validation platform that tests security controls against real attacks.

Tel Aviv, Israel2015Private

Also active in breach and attack simulation

19 companies
CompanyBased inFoundedSizeOwnership
NetSPI

Penetration testing firm trusted by nine of the top ten US banks, with the Resolve platform for continuous attack surface management.

Minneapolis, United States2001201-500 staffOwned by KKR
BreachLock

Cloud-based Penetration Testing as a Service platform combining AI-driven automation with expert manual testing at accessible price points.

New York, United States201951-200 staffPrivate
Praetorian

Offensive security firm founded by former DoD professionals. Combines deep offensive testing with the Chariot attack surface management platform and its Exploit validation engine.

Austin, United States201051-200 staffPrivate
TrustedSec

Offensive security firm founded by former NSA operator David Kennedy, delivering CREST-accredited penetration testing, red teaming, and adversary simulation to Fortune 500 and government clients.

Fairlawn, United States201251-200 staffPrivate
Canima

Canima provides an AI-powered penetration testing platform.

Dover, United States2025Private
Capsule Security

Capsule Security provides a runtime security platform that monitors and intervenes in AI agent behavior.

Tel Aviv, IsraelPrivate
CyCognito

CyCognito provides a platform that discovers and tests external attack surfaces to identify security exposures.

Palo Alto, United StatesPrivate
Forefront IT Security Services

Forefront IT Security Services presents itself as a virtual cyber security team for organisations in the United Kingdom.

United Kingdom2021Private
HiddenLayer

HiddenLayer provides a security platform for AI applications, protecting against adversarial threats.

Austin, United States2022Private
Horizon3

Horizon3 runs autonomous attack testing to find and verify exploitable weaknesses in production environments.

San Francisco, United States2019Private
Lasso Security

Lasso Security provides a platform to secure AI agents and applications at enterprise scale.

Tel Aviv, Israel2023Private
MazeBolt Technologies

MazeBolt provides continuous, non-disruptive DDoS testing to validate enterprise DDoS defences.

Ramat Gan, Israel2013Private
Nuvol Cybersecurity

Nuvol Cybersecurity is a boutique cybersecurity firm founded in 2017 in Panama.

Mexico City, Panama2017Private
Revelion

Revelion provides an autonomous AI pentester that simulates attacks to validate exploitability across estates.

London, United Kingdom2026Private
RiskRecon by Mastercard

RiskRecon provides cybersecurity ratings and assessments to help organisations manage third-party and supply chain risk.

Murray, United StatesPrivate
RoboShadow

RoboShadow provides daily vulnerability scanning and automated remediation for internal and external networks.

London, United Kingdom2017Private
Virtue AI

Virtue AI provides an enterprise AI safety platform for securing AI agents and applications.

San Francisco, United StatesPart of Fortinet
XM Cyber

XM Cyber provides a platform for continuous exposure management across hybrid environments.

Neckarsulm, GermanyOwned by Schwarz Group
CodeWall

CodeWall builds autonomous attack agents that test enterprise security from the outside.

London, United KingdomPrivate

Recent deals in breach and attack simulation

All breach and attack simulation deals
DateDealAmountSource
September 2026NetSPI acquired SynackSource for NetSPI buying Synack, opens in a new tabUndisclosedSource for NetSPI buying Synack, opens in a new tab
18 Aug 2026Fortinet acquired Virtue AISource for Fortinet buying Virtue AI, opens in a new tabUndisclosedSource for Fortinet buying Virtue AI, opens in a new tab
July 2026CrowdStrike acquired XM CyberSource for CrowdStrike buying XM Cyber, opens in a new tabUndisclosedSource for CrowdStrike buying XM Cyber, opens in a new tab
November 2025Pentera acquired EVA Information SecuritySource for Pentera buying EVA Information Security, opens in a new tabUndisclosedSource for Pentera buying EVA Information Security, opens in a new tab
October 2025Pentera acquired DevOceanSource for Pentera buying DevOcean, opens in a new tab$30mSource for Pentera buying DevOcean, opens in a new tab
March 2025TrustedSec acquired TrimarcSource for TrustedSec buying Trimarc, opens in a new tabUndisclosedSource for TrustedSec buying Trimarc, opens in a new tab
February 2025AttackIQ acquired DeepSurfaceSource for AttackIQ buying DeepSurface, opens in a new tabUndisclosedSource for AttackIQ buying DeepSurface, opens in a new tab
January 2025Cymulate acquired CYNC SecureSource for Cymulate buying CYNC Secure, opens in a new tabUndisclosedSource for Cymulate buying CYNC Secure, opens in a new tab
June 2024NetSPI acquired Hubble TechnologySource for NetSPI buying Hubble Technology, opens in a new tabUndisclosedSource for NetSPI buying Hubble Technology, opens in a new tab
March 2023XM Cyber acquired ConflueraSource for XM Cyber buying Confluera, opens in a new tabUndisclosedSource for XM Cyber buying Confluera, opens in a new tab

Acquisitions come from SecurityWeek's monthly M&A round-ups from 2021 onwards, from Cybersecurity Ventures' quarterly M&A reports for 2020, and a few from Wikipedia lists. These are dated to the month. A few deals added from the news are dated to the day. Smaller deals may be missing. Amounts are in US dollars.

See every category

Often listed alongside breach and attack simulation