ProjectDiscovery

• Tenable, Qualys or a cloud-security platform could bundle exploitable-vulnerability detection and attack surface management, taking the conventional half of the offer.
• Nuclei and its template library are MIT-licensed with thousands of forks on record, so a rival could ship a competing scanner built on the same public detection content.
• Neo's results are vendor-reported, and a buyer evaluation that failed to reproduce them would undercut the product the company now leads with.
• The cited record carries no priced round after the 2023 Series A and does not establish the company's current capital, so a new raise or its continued absence would change what it can sustain in the autonomous-testing contest.
• The template trust model already failed once, as CVE-2024-43405, and a further bypass would land on the open-source asset the commercial platform is built on.
• Contribution to the public template library could slow as attention moves to Neo, weakening the participation that raises a rival's effort.

ProjectDiscovery names the buyer and the pain in one line: security teams that chase noise from version-checking scanners instead of the issues an attacker can actually reach. Its chief operating officer argued that case from the RSAC stage, naming Tenable and Qualys as scanners built more than twenty years ago that overwhelm teams with false positives.

That framing comes from the company. The cited non-vendor sources confirm that RSA Conference selected ProjectDiscovery as its 2025 Innovation Sandbox winner for open-source vulnerability tooling, and an NSFOCUS analysis files the company under attack surface management, but neither quantifies the false-positive burden it sells against.

The market itself is established. The cited record names Tenable and Qualys as the incumbents the company sells against, so the company competes on how findings are produced rather than on opening a category. [s17, s8, s13]

Nuclei is the foundation and it is readable by anyone. The scanner runs YAML templates with conditional logic that emulate how an attacker probes a target, its repository carries 30,900 stars under the MIT license, and the separate template repository holds more than 10,000 community-curated detections across applications, APIs, networks, DNS and cloud configuration.

Neo is the commercial layer the company now leads with. It reached general availability in August 2026 and runs autonomous offensive testing across code, web applications, APIs, networks and cloud, validates which findings can be reached and abused, and connects to GitHub, Jira, Slack and Linear. The homepage adds that each run carries context forward, so dismissed false positives stay dismissed.

Outside parties work on the open half directly, which is the strongest capability evidence here. Wiz engineers found a signature-verification bypass in Nuclei's template trust model, recorded on the National Vulnerability Database as CVE-2024-43405 at high severity and fixed in version 3.3.2. Neo's own results are vendor-reported, and the cited sources carry no independent evaluation of the agents, so a buyer cannot check the agent claims against an outside test. [s1, s2, s3, s6, s11, s12, s17]

The company positions against legacy scanners by name, and its own case study records that comparison going its way: ProjectDiscovery writes that ConnectWise selected it over Tenable Cloud for community-driven agility. Buyers can place the product in the vulnerability management and attack surface management budget line without coaching.

The community template library is what a competitor would have to match, and it is public. Both the engine and the template collection carry the MIT license and thousands of forks, so a rival could build on the same detection content. What it could not immediately obtain is the 900-plus contributors advancing its open-source coverage.

Neo moves the contest to autonomous testing, a newer market for the company, and the cited sources evidence no vendor-retained asset behind it. The scanning ground the company already holds is where its evidence is strongest. [s15, s3, s2, s6, s1]

Adoption starts free and wide. The company counts more than 100,000 security professionals in its community, 900-plus contributors advancing its open-source coverage, and more than two billion monthly scans across its open-source tools, and the Neo launch release repeats the 100,000 figure for the toolchain overall.

The paid motion now carries named references. A published case study quotes Clement Fouque, Principal Information Security Analyst at Elastic, describing ProjectDiscovery Cloud as the piece that let the team scale Nuclei across its environment, and a second quotes Jason Ferguson, Senior Director of Security Operations at ConnectWise, whose team runs the Enterprise tier across 63 AWS accounts. The homepage carries a third customer account, Paddle, without naming the plan it runs.

All three accounts are the company's own. No independent source in the cited record confirms customer count, revenue or deployment scale. The five million dollar investment that came with the 2025 RSAC contest went to each of the ten finalists rather than to the winner alone, so it sizes the contest rather than this company's traction. [s1, s16, s15, s6, s8]

The founders' credential is the toolchain they shipped. Rishiraj Sharma is named as co-founder and chief executive in the Series A announcement, an interview records seven years as a security engineer before he started the company, and the Series A release describes ProjectDiscovery as the work of four cybersecurity engineers who wanted asset discovery and scanning automated.

That standing is visible outside the company's own pages. Articles at BleepingComputer and The Hacker News introduce Nuclei as a popular and widely used open-source vulnerability scanner, the engine repository carries 30,900 stars, and an outside security firm spent engineering time auditing the template trust model.

What the cited record does not show is a prior exit or a sustained research-publication record. The credibility on file is sustained open-source standing in exactly the domain the company sells into. [s7, s14, s9, s10, s2]

The company publishes a trust center on SafeBase at security.projectdiscovery.io. It lists a SOC 2 Type 2 attestation and the UK extension to the EU-US Data Privacy Framework, and keeps the SOC 2 Type 2 report and a penetration-test report behind an access request. A bug bounty program is listed alongside them.

The enterprise plan lists the controls a regulated buyer asks for, including single sign-on and SAML provisioning, bring-your-own-key, dedicated network isolation with static egress addresses, and organization-level spend caps. Those are features the company sells rather than attestations it holds.

Inspectability is the other half of the trust story and it runs both ways. A practitioner can read exactly how a detection works, and the same openness let Wiz engineers show that the check meant to prove a template was untampered could be bypassed before version 3.3.2 closed it. [s5, s4, s12]

Add analyzed competitors to compare them side by side with ProjectDiscovery.

ProjectDiscovery reaches two buyers through one community. The free open-source tools serve security practitioners directly, and the paid platform is positioned to convert teams that already run the scanner.

The published price now defines the entry point rather than a sales conversation. Neo's pay-as-you-go plan starts at 250 dollars for 50 credits per seat with five-dollar top-ups and no minimum commitment, and the launch release frames that as removing the budget approvals and contract negotiation that kept advanced testing inside well-funded teams. The enterprise plan adds unlimited seats, invoiced billing and reseller routes.

The newest segment is the team that wants testing to run continuously. Neo extends the same security or engineering organization to whoever owns pull-request review and release testing, rather than cultivating a separate market.

The core capability is attacker-style detection. Nuclei runs a YAML template language that lets a team design detection scenarios mimicking real-world conditions, backed by a community-curated library of more than 10,000 detections across applications, APIs, networks, DNS and cloud configuration.

The AI layer is Neo, which runs autonomous offensive testing across code, web applications, APIs, networks and cloud, and validates which findings can be reached and abused before reporting them. The company reached general availability in August 2026 after more than six months of private beta with enterprise customers.

Outside attention has concentrated on the established engine. The open code and the public template library let a buyer inspect the detection logic, and independent researchers examined the engine closely enough to find and report a signing bypass recorded as CVE-2024-43405. The cited sources carry no independent evaluation of the agents.

Go-to-market runs bottom-up from the open-source community. The company counts more than 100,000 security professionals and 900-plus contributors, and more than two billion monthly scans run across its open-source tools, and the company positions the paid platform as the enterprise version of those same tools.

The paid motion now has named voices. Elastic's Principal Information Security Analyst is quoted describing ProjectDiscovery Cloud as the piece that let the team scale Nuclei across its environment, and ConnectWise's Senior Director of Security Operations is quoted on the Enterprise tier, where the account records scan times falling from two days to fifteen minutes for 10,000 assets.

The evidence stays inside the company's own publishing. Both accounts are vendor case studies, and no independent source in the cited record reports customer numbers, revenue or renewal behavior, so the free footprint is far better documented than the revenue it is meant to convert into.

ProjectDiscovery sells Neo by the credit. Pay-as-you-go starts at 250 dollars for 50 credits per seat with top-ups at five dollars a credit, and the pricing page publishes what workflows consume: a full application pentest runs 25 to 75 credits at standard reasoning and 50 to 300 at maximum.

Publishing both a starting price and a consumption table fits the open-source-first identity, and the cited record does not document how rival products price. The launch release makes the argument explicit, framing annual engagements and enterprise minimums as the gate the model removes.

The enterprise plan moves to a quote and adds volume credit discounts, unlimited seats, invoiced billing and marketplace or reseller purchase routes. The two-tier structure lets one product serve a self-serve practitioner and a negotiated enterprise deal without repricing the core.

Delivery spans an open-source command-line scanner, a hosted platform and an agent layer. A practitioner can install and run Nuclei locally from its repository, while the paid platform delivers attack surface management, pentesting and triage as a service, with a dedicated virtual private cloud and static egress addresses for buyers that need network isolation.

Neo adds an operating layer that runs on its own. It tests continuously across pull requests and releases, connects to GitHub, Jira, Confluence, Slack and Linear, and can reach internal applications over VPN or SSH with 1Password handling credentials.

The mixed model carries an operating tension. The open-source layer needs community maintenance of the template library, while the agent layer needs the reliability and safety controls of software acting against live systems under customer credentials, which are two different disciplines under one roof.

The clearest trust asset is inspectability. The engine and the detection templates are open source, so a practitioner can read exactly how a finding was produced before acting on it.

Formal assurance is published and gated. The trust center on SafeBase lists a SOC 2 Type 2 attestation and the UK extension to the EU-US Data Privacy Framework, runs a bug bounty program, and keeps the SOC 2 report and a penetration-test report behind an access request. The enterprise plan sells the controls a regulated buyer expects rather than attesting to them.

Openness cuts both ways, which matters more now that agents act against customer systems. The signing check meant to prove a template was untampered was bypassable until Nuclei 3.3.2, and it was outside researchers who found that and reported it.

The ecosystem is the company's strongest structural asset and its most public one. More than 900 contributors feed a library of over 10,000 detection templates, a participation loop the company did not ship as software.

The platform sits where security and engineering teams already work. The pricing page lists GitHub and Slack applications and integrations with AWS, GCP, Azure, Cloudflare and Vercel, and Neo adds Jira, Confluence, Linear, webhooks and Model Context Protocol connections.

The openness runs the other way too. Both the engine and the template repository are MIT-licensed and publicly forkable, with 3,800 and 3,600 forks recorded, so the same openness that built the community lets a rival reuse the format or fork the engine. The ecosystem holds while contributors keep choosing this home.

The founders built their reputation in offensive security through the tools they shipped. Rishiraj Sharma is named as co-founder and chief executive in the Series A announcement, an interview records seven years as a security engineer before he started the company, and the Series A release describes four cybersecurity engineers behind the original tools.

The distinctive credential is sustained open-source standing rather than a prior exit. Articles at BleepingComputer introduce Nuclei as a popular open-source vulnerability scanner, and the engine repository carries 30,900 stars under active maintenance.

The cited record shows no prior exit and no sustained research-publication record, and the investor roster behind the Series A adds an indirect endorsement rather than direct evidence of the team's depth.