Vulnerability management vendors

Microsoft sells software, cloud services, hardware, and gaming products.

CrowdStrike provides AI-native cybersecurity solutions to stop breaches.

Bitdefender provides cybersecurity software and services for consumers, businesses, and governments.

FedRAMP-authorized crowdsourced penetration testing platform combining the vetted SRT researcher community with AI-powered Hydra technology for continuous security testing.

Frankfurt-based European payment security specialist holding the full set of PCI credentials (QSA, PFI, ASV, P2PE). Manual-first penetration testing for fintechs, acquirers, and regulated enterprises.

CREST and CHECK-accredited UK penetration testing and managed security provider formed in 2026 from Pentest People, Bulletproof, and Target Defense, with CREST STAR/TLPT-FS capability and the GuardNest vulnerability management platform.

Cloud-based Penetration Testing as a Service platform combining AI-driven automation with expert manual testing at accessible price points.

Cardiff-based CREST and CHECK-accredited cyber security company delivering penetration testing, red teaming, and OT security assessments as part of the Chess Group.

CREST-accredited, platform-driven penetration testing vendor in Bristol offering AI-augmented testing with rapid self-service booking for over 400 global customers.

Offensive security firm founded by former DoD professionals. Combines deep offensive testing with the Chariot attack surface management platform and its Exploit validation engine.

London-based cybersecurity firm offering unlimited, fixed-price penetration testing and red teaming services with ISO 27001 certification and a unique subscription model.

Vulnerability intelligence-driven penetration testing firm providing contextual security assessments informed by threat actor exploitation data and ransomware tracking.

Denver-based boutique pen testing firm with senior-only testers. Personalised engagements across penetration testing, red teaming, and vulnerability management.

Johannesburg-based infosec consultancy operating since 2002. One of Africa's oldest pen testing firms with deep technical expertise.

Italian cybersecurity group that absorbed Swascan, offering offensive security and vulnerability assessment through its Cyber Competence Center.

Boutique UK penetration testing consultancy in Milton Keynes specialising in manual, expert-led security assessments across web applications, APIs, cloud, and mobile platforms.

CREST-accredited North East England penetration testing specialist founded in 2019, offering accessible and transparent security testing with free retests and a strong focus on social engineering.

CREST-accredited UK penetration testing consultancy based in Shropshire, delivering web application, API, infrastructure, cloud, mobile, and AI/LLM testing. A small specialist team, with a retest included in every engagement.

AgentRidge provides autonomous AI software for penetration testing on local machines.

Aqua Security provides cloud native security covering containers, Kubernetes and serverless workloads from build through runtime.

Armis provides cyber exposure management and security for connected devices and operational technology.

Asimily provides a platform to discover, assess, and mitigate risks for IoT, OT, and IoMT devices.

AttackIQ provides a platform for continuous threat exposure management and adversarial exposure validation.

Automiq is an automation strategy and transformation partner.

BackBox provides a cyber resilience platform for automating network security, compliance, and lifecycle management.

Bitsight provides a cyber risk intelligence platform.

Critical Start provides managed detection and response services to monitor, investigate, and resolve security threats for organisations.

CybaVerse provides a unified cyber security operations platform called CybaOps.

Software platform for building SBOMs, tracking vulnerabilities and producing ISO 21434 and R155 evidence for vehicle firmware.

Cybertrust is a Japanese company that provides trust services and security products.

Cyble provides AI-native threat intelligence and cybersecurity platforms for enterprises and governments.

CyCognito provides a platform that discovers and tests external attack surfaces to identify security exposures.

Provides cybersecurity protection and risk management for maritime vessels, offshore facilities and ports.

Cylus provides cybersecurity solutions for railway operators to protect rail operational technology.

Israeli firm selling in-vehicle intrusion detection, vulnerability tools, compliance software and vehicle SOC services to carmakers.

Cymulate provides a platform for validating security controls against threats and exposures.

Cyware provides a platform for threat intelligence management, security orchestration, and collective defense.

D3 Security provides an agentic SOC platform that autonomously triages, investigates, and responds to security alerts.

Eclypsium provides continuous assurance of critical hardware, firmware, and software across enterprise infrastructure.

Elementrica is a cybersecurity company based in Kraków with an office in Oslo.

Exein provides runtime cybersecurity for firmware and physical AI systems across connected devices.

Finite State provides a product security platform for connected devices, automating SBOM generation, vulnerability analysis, and compliance evidence.

Forescout provides a platform for managing cyber risk and mitigating threats across IT, OT, IoT, and IoMT devices.

Hackrate runs crowdsourced security testing and bug bounty programmes for companies.

Heelr is a marketplace connecting organisations with verified cybersecurity professionals and providers.

Horizon3 runs autonomous attack testing to find and verify exploitable weaknesses in production environments.

IONIX provides a platform for managing external attack surface exposures.

Iru is a software company that sells a unified platform for managing devices, identity and compliance.

Software supply chain security and artifact management platform that blocks risky open source packages, scans for exploitable vulnerabilities and governs releases and AI models.

LDL Security is a Brazilian cybersecurity company that specialises in penetration testing, red team exercises and compliance.

LegacyMind GmbH provides a firmware security platform that analyses firmware at the binary level.

ManageEngine provides IT operations, cybersecurity, and service management software for businesses.

MazeBolt provides continuous, non-disruptive DDoS testing to validate enterprise DDoS defences.

Morphisec sells endpoint security software that blocks ransomware and governs AI tools on devices.

NetRise analyses compiled software to create an inventory of components and identify supply chain risks.

Nozomi Networks provides OT and IoT security solutions for critical infrastructure, offering asset visibility and threat detection.

Paramount Defenses provides software to assess privileged access and identify privilege escalation paths in Microsoft Active Directory.

Penumbral Labs helps manufacturers prepare connected products for EU Cyber Resilience Act compliance through testing and support.

Picus Security provides a platform that validates exposures and security controls by simulating cyber attacks.

Quantara AI provides an AI-native platform for cyber risk quantification and prioritization.

Open source software company whose Advanced Cluster Security product protects Kubernetes and container workloads, alongside Red Hat Enterprise Linux and OpenShift.

Revelion provides an autonomous AI pentester that simulates attacks to validate exploitability across estates.

SafeBreach provides a platform that validates security controls and manages cyber exposure for enterprises.

ScanTitan provides website security scanning, malware removal, and external attack surface management for businesses.

Senteon automates endpoint hardening and CIS benchmark compliance for audits.

Siemba provides autonomous and expert-led penetration testing for security teams.

Sonatype provides tools to manage and secure open source components and AI models in software development.

Provides managed IT services, cybersecurity, compliance support and AI adoption guidance to businesses.

SyntaAI sells Syntasec, an on-premise security and compliance platform for SAP systems.

Provides an AI security engineer that finds and fixes software risks using coding agents.

VicOne provides cybersecurity for vehicles and robots, protecting their digital systems from development to operation.

VulnCheck sells a cyber threat intelligence platform built around exploit and vulnerability data.

Web-based software that automates vehicle threat analysis and risk assessment, plus vulnerability tracking and consulting.

Wazuh provides an open source platform for security monitoring and threat detection.

WYKYK is an offensive cybersecurity company.

XM Cyber provides a platform for continuous exposure management across hybrid environments.

Zerocopter provides security testing services including pentesting, bug bounty, and vulnerability disclosure.

Builds internet-scale intelligence datasets and security products for vulnerability, subdomain, and physical reconnaissance.

Asset intelligence platform that builds one inventory of every asset from connected IT and security tools to find coverage gaps and prioritise exposures.

Product security platform for vehicle makers covering TARA, SBOM-based vulnerability management and R155 and ISO 21434 compliance.

Chainguard builds hardened, verified open source container images, libraries and packages to reduce vulnerabilities.

Provides penetration testing, PCI ASV scanning, and managed security services for compliance and threat detection.

Resells security products and provides assessment, testing and advisory services with a data platform.

Invicti provides web application and API security testing software for enterprises.

SBOM and vulnerability management platform that helps carmakers and suppliers track risk in vehicle software.

ONEKEY provides a platform for product cybersecurity and compliance, automating SBOM analysis, vulnerability detection, and regulatory compliance.

Panop provides a platform for autonomous exposure management across cloud environments and attack surfaces.

Pentera provides an exposure validation platform that tests security controls against real attacks.

Browser-based tool that automates threat analysis and risk assessment, mainly for vehicle makers and their suppliers.

runZero provides exposure management software that discovers and profiles assets across IT, OT, IoT, cloud and mobile networks.

Jinan company providing connected-vehicle test tools, cyber ranges, vulnerability research and compliance services for carmakers.

VxLabs provides an AI-powered platform for automotive cybersecurity compliance and risk management.