Find the flaws, rank them, prove them

First find every known flaw, then decide which ones matter, then prove what an attacker could really do.

1Vulnerabilityscanners ↓Checking every machine and appagainst the public list of knownflaws.QualysRapid7SecPod2Ranking the flaws ↓Deciding which flaws an attacker canreach, and how much each onematters.RedSeal Inc.Forward NetworksSafe SecuritySecurin Inc.3Testing byattacking ↓Hackers and tools that attack thecompany, with permission, to provewhat is possible.HackerOneBugcrowdNetSPINeova Solutions1Vulnerability scanners ↓Checking every machine and app against thepublic list of known flaws.QualysRapid7SecPod2Ranking the flaws ↓Deciding which flaws an attacker canreach, and how much each one matters.RedSeal Inc.Forward NetworksSafe SecuritySecurin Inc.3Testing by attacking ↓Hackers and tools that attack the company,with permission, to prove what ispossible.HackerOneBugcrowdNetSPINeova Solutions

Box 1 finds the known flaws on every machine. Box 2 decides which flaws an attacker can reach and how much they matter. Box 3 attacks the company to prove it. Tap a title in the diagram to jump to its companies.

1

Vulnerability scanners 3 companies

A scanner lists every machine and application a company has, and checks each one against the public list of known flaws, called CVEs. Some scanners also install the fix.

Qualys logoQualysQualys sells its scanner as a cloud service, and has engineers in Pune. It has grown into device lists, installing fixes, cloud setting checks and attack detection, all using the same agent on each machine.PuneHiring now
Rapid7 logoRapid7Rapid7, also with engineers in Pune, sells a scanner called InsightVM, cloud setting checks and attack detection. It also owns Metasploit, the free toolkit that testers use to attack systems.PuneHired recently
SecPod logoSecPodSecPod, a Bengaluru company, sells a version for smaller companies. Its Saner platform finds the flaws on each device and installs the fix in the same product.
The tech, explainedVulnerability scanner
2

Ranking the flaws 4 companies

A large company can have tens of thousands of known flaws, and cannot fix them all at once. This software decides which ones to fix first: whether an attacker can reach the flaw, whether attackers are using it right now, and what the company would lose.

Can an attacker reach it?

Mapping the network to see whether a path to the flaw exists.

RedSeal Inc. logoRedSeal Inc.RedSeal, a US company with engineers in Pune, reads the settings of every firewall, router and cloud network, builds a map of what can reach what, and traces an attacker's possible path from the internet to the company's most valuable systems.
Forward Networks logoForward NetworksForward Networks builds a complete software copy of a network for network engineers. The same copy shows whether an attacker has a path to a flaw. It has engineers in Bengaluru.BengaluruSee alsoNetwork testing, visibility and monitoring

Which flaws matter most?

Scoring flaws by how likely and how costly an attack would be.

Safe Security logoBalbix logoSafe SecurityIncludes BalbixSafe Security, an Indian-founded company with teams in Bengaluru and Delhi, turns a company's flaws, its protections and current threats into one figure: how likely a breach is, and what it would cost. It now includes Balbix, which built a similar product.Bengaluru · Delhi NCRHiring now
Securin Inc. logoSecurin Inc.Securin, from Albuquerque with engineers in Chennai, tracks which known flaws attackers are using right now, and combines that with finding the company's own exposed systems.Chennai
The tech, explainedAttack path analysis↗ Observability and monitoringCyber risk quantificationExternal attack surface management (EASM)
3

Testing by attacking 4 companies

The surest test is to attack the company with its permission. Some companies invite outside hackers and pay them for each flaw they find, which is called a bug bounty. Others hire testers, or use software that attacks automatically.

Bug bounty platforms

Platforms that connect a company with trusted outside hackers.

HackerOne logoHackerOneHackerOne runs the other large platform that connects companies with trusted hackers and pays them for the flaws they find. It has engineers in Pune.Pune
Bugcrowd logoBugcrowdBugcrowd connects companies with a crowd of checked, trusted hackers, and pays the hackers for each flaw they find. It has engineers in Bengaluru.

Attack testing services

Testers and tools that attack the company on request.

NetSPI logoNetSPINetSPI, a US company with engineers in Pune, sells testing by attacking as its main business. It also runs known attacker methods against a company automatically, to check whether its defences catch them.Pune
Neova Solutions logoNeova SolutionsNeova Solutions, from Santa Clara with its development centre in Pune, sells an AI agent that plans and runs attacks on a company by itself, the way an internal attack team would.
The tech, explainedOffensive security testing
How it all worksVulnerability and exposure managementThe company as an attacker maps it.
See how it works →

What's changing

From yearly tests to constant checking.

Companies used to test their defences once or twice a year. Their systems now change every day, so a yearly test is out of date within weeks. The aim now is constant checking: every new server found the day it appears, every new flaw ranked the day it is published, and automated attacks run every week.

Read moreExternal attack surface management (EASM)Offensive security testing
← Previous in CybersecurityManaged security services (MDR and MSSP)Next in Cybersecurity →Threat intelligence and attack surface management
Elsewhere in Cybersecurity:Email security and anti-phishingIdentity and access management (IAM)KYC, identity verification and fraud preventionEndpoint security and device managementNetwork security, firewalls and SASECloud and SaaS securityApplication and API securityData security and privacySIEM and security operations (SOC)AI securityGovernance, risk and compliance (GRC)Physical security, surveillance and trust and safety

Companies: ingrid's company map. Hiring signals: postings feed of 5 Nov 2026.