Cymulate

• The last disclosed round closed in September 2022 and no reviewed source records funding since, so a buyer weighing whether Cymulate can keep investing at its current pace has a four-year-old capital picture and has to ask for a current one.
• The customer and headcount figures published outside the company, roughly 500 customers and 200 employees in September 2022 and more than 1,000 customers and nearly 300 staff at the January 2025 acquisition, are published figures the record does not show as audited, so a buyer sizing the business has to ask for a current count and its basis under diligence.
• One hands-on third-party test appears in the reviewed record, an SC Media product test of version 3.30.16 dated November 2019, so a buyer who wants an outside read on the platform sold today, including its AI-driven workflows, has to validate it hands-on, because the cited record cannot establish the current platform's performance.
• The efficacy figures in the reviewed record, including a 50 percent gain in threat prevention and 60 hours saved testing new threats, appear on Cymulate's own pages and carry no neutral benchmark there, so a buyer cannot compare those outcomes against an outside baseline.
• Cymulate has led with a different positioning label in each of the last three periods, extended security posture management in 2022, an announced continuous threat exposure management platform in 2025 and agentic cyber defense engineering today, so a buyer comparing quotes across years has to work out by hand which parts of the offering changed and which were renamed.

Cymulate sells to the security team that already owns a large stack of controls and cannot tell which of them work. Its homepage puts the question plainly, asking how a company's 40 or more security tools keep up as threats and attack surface change daily. The buyers it addresses are executives, security operations teams and detection engineers, and its platform promises to prove, prioritise and adapt security for a specific environment.

The sizing of that pain comes from Cymulate's own pages. The reviewed independent coverage describes the market rather than measuring the gap, with a SecurityWeek page stating that Cymulate sits in the breach and attack simulation space and an SC Media product test covering the category in 2019, so Cymulate alone sizes the urgency it sells against.

The visible timeline is specific. Cymulate was founded in 2016, SC Media reviewed a shipping version in 2019, and by 2022 a TechCrunch article stated around 500 paying customers, so buyers had been purchasing the product for years before its current positioning. [s1, s2, s8, s13, s17]

The platform runs attacks and then acts on what they reveal. Cymulate Exposure Validation tests threats and MITRE ATT&CK techniques against endpoint, logging, web and email gateway, firewall and data-loss controls. Cymulate Auto Mitigation generates vendor-specific detection rules and indicators and pushes them to those controls through native interfaces. Cymulate Detection Studio maps existing logging rules to attack techniques and flags drops in coverage.

Two claims carry the depth. Cymulate states that its threat library covers MITRE ATT&CK in full and that new US-CERT advisories get updated attack simulations within 24 hours. The SC Media product test from 2019 describes the same shape from the outside, stating seven attack vectors, a single lightweight agent and hundreds of thousands of customisable simulations, plus a benchmark view comparing a customer against other anonymous Cymulate clients in the same industry.

What the record does not contain is a current outside check. That SC Media product test covers version 3.30.16 and is dated November 2019. The newer parts of the product, including the software agents in Cymulate Cowork and the AI that tailors validation to an environment, are described only by Cymulate, so a buyer cannot assess them from public independent evidence. [s4, s22, s15, s2, s13, s14]

Cymulate competes on the breadth of what it tests and on what it does after the test. Its platform page ties adversarial exposure validation and breach and attack simulation to direct integrations with security controls, states integrations spanning SIEM, SOAR, EDR, cloud security, firewalls and email security, and its integration catalogue names endpoint and threat-intelligence products from other vendors. Writing rules back into another vendor's control is the part that turns a report into a change.

The company sits beside the tools a buyer already runs rather than replacing them. Cymulate CTEM takes findings from vulnerability scanners through connectors and adds proof of exploitability and prioritisation on top. That position leaves Cymulate maintaining an integration per control, and a control vendor can change the interface Cymulate writes back through.

Its positioning language has changed faster than outside coverage of it, so a buyer comparing materials across years has to map the labels by hand. Cymulate led with extended security posture management in 2022, with continuous threat exposure management when it announced the CYNC Secure acquisition in 2025, and with agentic cyber defense engineering today. Sources outside the company have used breach and attack simulation and threat exposure validation throughout. [s2, s4, s20, s16, s10, s11, s8, s9]

Cymulate publishes named references with job titles. A group cybersecurity head at Globeleq, a chief information security officer at Persistent, an information security manager at Setur and a head of information technology at Saffron Building Society are quoted by name on its pages. Its customer advisory board names a chief information security and data officer at LV= and a global cybersecurity manager at Hitachi Energy, which is an advisory relationship rather than evidence of deployment.

Scale is published outside the company. A TechCrunch article from September 2022 states around 500 paying customers and more than 200 employees, naming NTT, Telit and Euronext. A Calcalist page on the announced CYNC Secure acquisition states more than 1,000 customers in over 50 countries and nearly 300 staff, and Cymulate's own pages carry the same customer figure.

Cymulate names strategic partners and a visible integration ecosystem: its 2022 announcement named Optiv and Wipro as strategic partners, and its integration page is organised for buyers who want the platform to fit an existing stack. [s1, s20, s6, s3, s17, s9, s10]

The founding story is corroborated outside the company. A TechCrunch article states that Eyal Wachsman co-founded Cymulate with Avihai Ben-Yossef and Eyal Gruner, and that Wachsman came to the idea in 2016 after years of cybersecurity consulting. One Calcalist page states the same 2016 founding and names the chief executive and chief technology officer, and a second names all three founders. Cymulate describes its founders as former Israeli military intelligence officers and cyber researchers.

The bench around them is named on Cymulate's own pages. The leadership list carries a general counsel, chief financial officer, chief of staff and chief human resources officer alongside the two founders. No reviewed independent source covers those appointments, so the bench beyond the founders is described only by the company.

Research output gives the team a visible technical record. Cymulate Research Labs publishes dated findings, including an August 2026 write-up of a stored cross-site scripting flaw in Microsoft Purview that exposed reviewer tokens. [s17, s12, s9, s3, s24, s10]

Cymulate publishes a detailed account of its own controls. Its trust and security page lists ISO 27001, ISO 27701, ISO 27017, SOC 2 Type II, SOC 3, CSA STAR Level 1 and GDPR, states that the public SOC 3 report covers May 2024 to April 2025, and says an independent auditor attested security, availability, confidentiality and privacy criteria.

The page also describes practice rather than only certificates. Cymulate states that qualified third parties test the platform against the OWASP Top 10 periodically and that independent penetration testing and risk assessment run at least annually, with critical findings addressed promptly. It states that no reportable system incidents were identified during the SOC 2 examination period.

Cymulate states that every agent action requires a token generated for that customer alone, that any passwords kept on the client's agent are stored encrypted rather than in clear text, and that all agent activity is recorded where the client can read it. [s5]

Add analyzed competitors to compare them side by side with Cymulate.

Cymulate aims at companies large enough to run many security products at once. Its homepage frames the problem as keeping 40 or more security tools current, and it addresses executives, security operations teams and detection engineers separately. The named references include Globeleq, Persistent, Setur and Saffron Building Society.

The buyer tier is mixed by the company's own account. A TechCrunch article from September 2022 states that around 500 paying customers sat across the enterprise and mid-market, naming NTT, Telit and Euronext, and a Calcalist page on the announced CYNC Secure acquisition states more than 1,000 customers in over 50 countries including Fortune 500 companies. Cymulate's customer advisory board names people at LV= and Hitachi Energy. Both halves of that range appear in the reviewed record, so the segment is broad rather than concentrated at the top.

Geography is wide for a company of this size. Cymulate reports customers in 50 countries and a Calcalist page states staff across Israel, the United States, Europe, South America, India, Africa and Singapore. A UK entity has been registered with Companies House since October 2020.

The core capability is safe attack execution at scale. An SC Media product test from 2019 states seven attack vectors, a single lightweight agent and hundreds of thousands of customisable simulations across the kill chain. Cymulate now describes its current platform with full MITRE ATT&CK coverage and a 24-hour commitment to ship simulations for new US-CERT advisories, which is a content operation as much as a software one.

AI is the method here rather than the thing being protected. Cymulate states that its Vero AI component analyses new threats and tailors validation to a customer's assets, applications and industry, that it maps existing logging rules to attack techniques, and that software agents in Cymulate Cowork run repeatable workflows across other vendors' tools. What the product defends is a conventional security stack.

The mitigation side is what separates the product from a testing tool. Cymulate Auto Mitigation generates vendor-specific detection rules and indicators and pushes them into controls through native interfaces. No reviewed independent source examines how well that closed loop works, so a buyer has to test the mitigation loop directly.

No price and no sign-up path appears on any reviewed Cymulate page, and the reviewed pages route a prospect to a demo request. The one price in the reviewed record comes from an SC Media product test dated November 2019, which puts the platform at $40,000 to $500,000 depending on company size and number of attack vectors.

Partnerships appear in the stated go-to-market structure. Cymulate named Optiv and Wipro as strategic partners in its 2022 funding announcement, and its technology alliances page organises integrations by product and technology type for buyers assembling a stack. The reviewed sources name no reseller transaction, no marketplace listing, and no measure of what the channel contributes, so the named partnerships establish relationships rather than measured distribution.

The published evidence is names and recognitions. Cymulate publishes customer quotes with names and job titles, and an awards page citing a Gartner 2025 Customers' Choice recognition and a comparison link to a software review site. Dated customer counts from TechCrunch in 2022 and Calcalist at the acquisition sit outside the company's own pages.

No price appears on any reviewed Cymulate page, so a buyer cannot estimate cost from the public pages.

The one price in the reviewed record comes from outside the company and is dated. An SC Media product test dated November 2019 puts the platform at $40,000 to $500,000 depending on company size and the number of attack vectors, so the 2019 price varied by company size and attack-vector count.

Cymulate presents the platform as six named modules covering validation, exposure management, mitigation, detection engineering, custom attack building and workflow automation. The reviewed pages do not say whether those modules are sold separately or on what basis any of them is priced, so how the platform is packaged commercially is not established by this record.

The product is customer-operated software rather than a managed service. Cymulate describes a lightweight agent that a customer deploys in its own network, a per-customer token for every agent action, encrypted credential storage and activity logs the client can read directly.

Cymulate states that qualified third parties test the platform against the OWASP Top 10 periodically, that independent penetration testing and risk assessment run at least annually or after significant changes, and that it uses an outside vendor, OX Security, for application and software supply chain risk.

Cymulate states that no reportable system incidents were identified during its SOC 2 examination period. That statement, like the rest of the operational account, is the company's own and the reviewed record contains no outside report against it.

The certification package is broad, and Cymulate's own page separates what an outside auditor attested from what the company assessed itself. It lists ISO 27001, ISO 27701, ISO 27017, SOC 2 Type II, SOC 3, CSA STAR Level 1 and GDPR, describes the SOC attestation as an independent external auditor's work across security, availability, confidentiality and privacy criteria, and labels CSA STAR Level 1 a self-assessed cloud security posture. It states that the public SOC 3 report covers May 2024 to April 2025.

Testing practice is described alongside the certificates. Cymulate states that qualified third parties test the platform against the OWASP Top 10 periodically, and that independent penetration testing and risk assessment happen at least annually. It names an outside vendor, OX Security, for application and supply chain risk.

The trust surface is Cymulate's own page. Every one of these statements is the company's account of its own controls, including its statement that the SOC 3 report is public, and the reviewed record does not include the report itself.

Cymulate positions itself between a customer's controls rather than above them. Its platform page describes a cyber defense control plane that integrates across an existing security stack to validate threats, find exploitable gaps and deploy mitigation directly to controls.

The integration catalogue is the ecosystem asset. It names endpoint, cloud and threat-intelligence products from other vendors, including CrowdStrike Falcon, Check Point Harmony Endpoint and Bitsight. Each of those connections is written against another vendor's interface, which is work Cymulate has to maintain as those products change.

The relationship runs both ways. Cymulate CTEM pulls findings from vulnerability scanners through connectors, and Cymulate Auto Mitigation writes rules back into controls, work that rides on interfaces other vendors can change.

Outside sources name the founding team. A TechCrunch article states that Eyal Wachsman co-founded Cymulate with Avihai Ben-Yossef and Eyal Gruner, and that Wachsman conceived the product in 2016 after years of cybersecurity consulting. One Calcalist page states the same 2016 founding and names the chief executive and chief technology officer, and a second names all three founders.

The company hired senior go-to-market leaders alongside the 2022 round, naming a chief operating officer and a chief marketing officer in the same announcement. Those appointments and the current leadership list appear on Cymulate's own pages, and no reviewed independent source corroborates the 2022 appointments or the full current roster, so the bench beyond the founders is described only by the company.

Research capacity is visible and dated. Cymulate Research Labs publishes findings under its own name, including an August 2026 write-up of a stored cross-site scripting flaw in Microsoft Purview that exposed reviewer tokens. A TechCrunch article from 2022 states that the company has its own large in-house team of cybersecurity researchers.