Vulnerability management vendors in the United States

Microsoft sells software, cloud services, hardware, and gaming products.

CrowdStrike provides AI-native cybersecurity solutions to stop breaches.

FedRAMP-authorized crowdsourced penetration testing platform combining the vetted SRT researcher community with AI-powered Hydra technology for continuous security testing.

Cloud-based Penetration Testing as a Service platform combining AI-driven automation with expert manual testing at accessible price points.

Offensive security firm founded by former DoD professionals. Combines deep offensive testing with the Chariot attack surface management platform and its Exploit validation engine.

Vulnerability intelligence-driven penetration testing firm providing contextual security assessments informed by threat actor exploitation data and ransomware tracking.

Denver-based boutique pen testing firm with senior-only testers. Personalised engagements across penetration testing, red teaming, and vulnerability management.

Armis provides cyber exposure management and security for connected devices and operational technology.

Asimily provides a platform to discover, assess, and mitigate risks for IoT, OT, and IoMT devices.

AttackIQ provides a platform for continuous threat exposure management and adversarial exposure validation.

BackBox provides a cyber resilience platform for automating network security, compliance, and lifecycle management.

Bitsight provides a cyber risk intelligence platform.

Critical Start provides managed detection and response services to monitor, investigate, and resolve security threats for organisations.

Cyble provides AI-native threat intelligence and cybersecurity platforms for enterprises and governments.

CyCognito provides a platform that discovers and tests external attack surfaces to identify security exposures.

Cyware provides a platform for threat intelligence management, security orchestration, and collective defense.

Eclypsium provides continuous assurance of critical hardware, firmware, and software across enterprise infrastructure.

Finite State provides a product security platform for connected devices, automating SBOM generation, vulnerability analysis, and compliance evidence.

Forescout provides a platform for managing cyber risk and mitigating threats across IT, OT, IoT, and IoMT devices.

Horizon3 runs autonomous attack testing to find and verify exploitable weaknesses in production environments.

Iru is a software company that sells a unified platform for managing devices, identity and compliance.

Software supply chain security and artifact management platform that blocks risky open source packages, scans for exploitable vulnerabilities and governs releases and AI models.

Morphisec sells endpoint security software that blocks ransomware and governs AI tools on devices.

NetRise analyses compiled software to create an inventory of components and identify supply chain risks.

Nozomi Networks provides OT and IoT security solutions for critical infrastructure, offering asset visibility and threat detection.

Paramount Defenses provides software to assess privileged access and identify privilege escalation paths in Microsoft Active Directory.

Picus Security provides a platform that validates exposures and security controls by simulating cyber attacks.

Quantara AI provides an AI-native platform for cyber risk quantification and prioritization.

Open source software company whose Advanced Cluster Security product protects Kubernetes and container workloads, alongside Red Hat Enterprise Linux and OpenShift.

SafeBreach provides a platform that validates security controls and manages cyber exposure for enterprises.

Senteon automates endpoint hardening and CIS benchmark compliance for audits.

Siemba provides autonomous and expert-led penetration testing for security teams.

Sonatype provides tools to manage and secure open source components and AI models in software development.

Provides managed IT services, cybersecurity, compliance support and AI adoption guidance to businesses.

VulnCheck sells a cyber threat intelligence platform built around exploit and vulnerability data.

Web-based software that automates vehicle threat analysis and risk assessment, plus vulnerability tracking and consulting.

Wazuh provides an open source platform for security monitoring and threat detection.

Asset intelligence platform that builds one inventory of every asset from connected IT and security tools to find coverage gaps and prioritise exposures.

Chainguard builds hardened, verified open source container images, libraries and packages to reduce vulnerabilities.

Provides penetration testing, PCI ASV scanning, and managed security services for compliance and threat detection.

Resells security products and provides assessment, testing and advisory services with a data platform.

Invicti provides web application and API security testing software for enterprises.

SBOM and vulnerability management platform that helps carmakers and suppliers track risk in vehicle software.

runZero provides exposure management software that discovers and profiles assets across IT, OT, IoT, cloud and mobile networks.

VxLabs provides an AI-powered platform for automotive cybersecurity compliance and risk management.