All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
ZEST Security sells security and DevOps teams a platform for fixing vulnerabilities their cloud and application scanners report. Its AI agents dismiss findings attackers cannot exploit, mark those existing controls already protect against, and fix the rest at the root cause. Founded in 2023, ZEST raised a $5 million seed in 2024 from Hanaco Ventures, Silvertech Ventures and angel investors. It names CAVA, Agoda, Weave, Mercor and Odyssey Therapeutics among its customers. Its CEO was previously security chief at Cider Security, which Palo Alto Networks acquired. ZEST works from the findings of security tools such as Wiz, Tenable and Qualys. Any of those vendors could add remediation for its own findings, but would also need to handle its rivals’ findings to replace ZEST.
| Description | ZEST Security sells a vulnerability remediation platform that checks which reported vulnerabilities attackers could exploit, credits protection from controls already in place, and has AI agents fix the remaining exposures at their root cause. | [f1] |
|---|---|---|
| Founded | 2023 | [f2] |
| HQ | New York City and Tel Aviv (offices) | [f3] |
| Funding | $5M total | [f4] |
| Latest funding | Seed, $5M (July 2024) | [f4] |
| Product | What it does |
|---|---|
| ZEST Multi-Agent AI System | AI agents that unify scanner findings, test exploitability, confirm protection from existing controls, and simulate root-cause fixes for cloud and application environments. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
The Multi-Agent AI System ingests vulnerability and misconfiguration findings across cloud applications, infrastructure, and data stores, finds the root cause, and generates remediation paths, so it applies AI to defend conventional cloud assets and is mapped to the Cyber Defense Matrix. [f5]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | ZEST names a clear buyer: security and DevOps teams with more cloud and application vulnerabilities than they can fix. Its own materials quantify the pain, citing 62 percent of incidents from backlogged risks and 30 to 60 days to remediate a single cloud risk. No independent measurement of that pain appears in the cited sources, so the problem statement is clear but vendor-asserted. [s1, s5, s20] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | ZEST describes specialist agents for data unification, prioritization, impact simulation and code generation. It also describes exploitability testing before dismissal and fix simulation in a model of the customer’s environment. SiliconANGLE reported in 2024 that ZEST offers open-source validation tools, but no third-party evaluation, benchmark or customer technical write-up of the agents appears in the cited sources, so the detail stays vendor-sourced. [s7, s12, s17, s20] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | In 2024, ZEST’s CEO attributed the product’s feasibility to GenAI developments and DevOps adoption. In 2026, ZEST linked demand to faster AI-assisted vulnerability discovery. ZEST reports one analyst placement, as a September 2026 Gartner sample vendor. SC Media and TechCrunch selected it for editorial features, so buyer demand remains indirect. [s13, s20, s7, s16, s18] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | Calcalist Ctech reports that Shimol served as CSO at Cider Security, where the team built its first AppSec product, and that Aronovici spent more than ten years in cloud and product security at Akamai and Check Point. SiliconANGLE describes both founders as former Israeli intelligence officers with Akamai and Varonis experience. That is verifiable in-domain experience with one prior build. The Cider acquisition role is described in ZEST's own materials and not independently corroborated, so no independently recorded exit or sustained recognition reaches the next rung. [s13, s12, s2] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 3/5 | ZEST names CAVA, Agoda, Weave, Mercor and Odyssey Therapeutics under a trusted-by heading on its homepage, quotes a Best Buy application security director in its launch release, and sells through an AWS Marketplace listing. Its customer outcomes, such as over 11 million vulnerabilities dismissed in 2025, are the company’s own figures. No independent source in the cited record reports customer count, revenue or scale, so the score stays at 3. [s1, s5, s6, s11] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | Calcalist and SiliconANGLE reported a $5 million seed in July 2024 from Hanaco Ventures, Silvertech Ventures and angel investors, and the cited sources show no later round. With that seed funding, ZEST shipped mitigation and remediation products, listed prices on AWS Marketplace and named customers. No revenue, margin or growth-efficiency figure appears, so efficiency stays unconfirmed. [s12, s13, s11, s1] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | ZEST presents itself as agentic exposure management and remediation, and its blog reports that Gartner named it a sample vendor for Preemptive Exposure Management and Autonomous Exposure Remediation in September 2026. TechCrunch described it as an enterprise platform that helps teams detect and solve cloud security issues. Those categories are still emerging. No cited source other than ZEST’s own page reports the Gartner placement. [s1, s7, s18] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | ZEST works across tools from many vendors: its integrations page lists cloud security products such as Wiz, Orca and Palo Alto Networks, scanners from Tenable, Qualys and Rapid7, and Terraform, Pulumi and ticketing systems. A single platform vendor absorbing ZEST’s function would have to unify rival vendors’ findings and wire fixes into each customer’s deployment and ticketing workflow, which is friction to absorption. No data flywheel or procurement lock that bundling could not replicate appears in the cited sources. [s4, s1, s7] |
ZEST sells to security and DevOps teams that know about more cloud and application vulnerabilities than they can fix. By ZEST’s own figures on its homepage, 62 percent of incidents originate from backlogged risks that were not remediated in time, and its July 2024 launch release put the average time to remediate a single cloud risk at 30 to 60 days.
In 2026 ZEST tied the problem to faster AI-assisted discovery, writing in its Mythos report that AI made finding vulnerabilities cheap and measuring remediation across 77 million vulnerabilities in its customers’ environments. [s1, s5, s20]
ZEST’s platform takes the vulnerabilities a customer’s scanners report and sorts each into dismissed, mitigated or remediated. ZEST says its agents test each finding for reachability and exploitability and dismiss the ones that fail with evidence. It also says ZEST Preemptive Mitigation checks whether a control the customer already runs, such as a cloud guardrail, protects against it.
For the remaining findings, ZEST’s agents trace exposures to a root cause and generate the fix, including infrastructure-as-code changes from a Security as Code agent. ZEST writes that each fix is simulated on a model of the customer’s environment before it is applied through the customer’s deployment system. A customer quoted on its homepage describes reviewing and approving the Terraform fixes ZEST generates.
ZEST also says its agents can resolve findings without humans in the loop. The cited sources do not describe how a customer chooses between that mode and a review step, so a buyer cannot tell from them how much ZEST changes without approval. [s1, s6, s7, s17, s20]
ZEST competes for the vulnerability remediation budget and frames its product as agentic exposure management. According to ZEST’s blog, Gartner’s September 2026 Emerging Tech Impact Radar named ZEST a sample vendor for both Preemptive Exposure Management and Autonomous Exposure Remediation.
ZEST’s product ingests findings from the scanners and cloud security tools it integrates with, including Wiz, Orca, Palo Alto Networks and Upwind. Any of those vendors could add remediation features for its own findings. To match ZEST outright, a single vendor would also have to unify findings from rival tools and wire fixes into each customer’s deployment and ticketing systems, which ZEST already does through its integrations. [s7, s4, s19]
ZEST names its customers on its own pages. Its homepage lists CAVA, Agoda, Weave, Mercor and Odyssey Therapeutics under a trusted-by heading, and its 2024 launch release quotes Matthew Hurewitz, Director of Platforms and Application Security at Best Buy. ZEST also sells through an AWS Marketplace listing.
ZEST reports its results in aggregate. It says that across its customers in 2025 its AI agents dismissed over 11 million vulnerabilities and saved more than 600,000 hours, while customers fully remediated more than 386,000 vulnerabilities. These figures are the company’s own. No independent count of customers or revenue appears in the cited sources.
Two publications selected ZEST for editorial features. SC Media included ZEST in a February 2025 feature on seven cloud security startups, and TechCrunch listed it among cybersecurity startups from Disrupt Startup Battlefield in December 2025. [s1, s5, s6, s11, s16, s18]
ZEST’s co-founders held senior security roles before founding the company, and the CEO’s previous company ended in an acquisition. CEO Snir Ben Shimol was CSO at Cider Security, which ZEST says he helped take from $0 ARR to an exit to Palo Alto Networks in two years. He earlier built the global cybersecurity platform and services organization at Varonis, and Calcalist reported both roles when ZEST raised its seed.
CTO Uri Aronovici led security architecture at Akamai, where he oversaw global vulnerability management and the company’s cloud security risk remediation strategy, and Calcalist adds Check Point Software to his background. The leadership team also includes Tom Hanetz, Vice President of R&D, who led data science at Armis. [s2, s5, s13, s12]
ZEST offers a 14-day free trial that includes a written risk exposure assessment, listed on its pricing page. The product connects through integrations, with agentless cloud exposure identification and a connector that uses API credentials from tools such as Upwind.
ZEST displays an AICPA SOC badge image in its site footer, and the image links to no report. No SOC report, trust portal or other inspectable attestation appears in the reviewed sources. [s3, s19, s1, s21]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Tamnoon | competes with | Competes for the cloud security team’s remediation budget. | |
| Seemplicity | competes with | Competes for the buyer that consolidates findings from many scanners into remediation work. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Circumvent | competes with | Competes for cloud and application security teams triaging scanner findings. |
Add analyzed competitors to compare them side by side with ZEST Security.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
ZEST sells software that its customers operate. It turns findings from scanners such as Wiz, Tenable and Qualys into validated mitigations and infrastructure-as-code fixes, which it applies through the customer’s deployment system. A customer that wires ZEST into those tools would have to rebuild that coordination to leave. ZEST also uses data on 77 million vulnerabilities across its customers’ environments, which it calls its platform data, in its published research. The cloud security vendors whose findings it consumes could add remediation of their own.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | ZEST’s customers operate the product: its agents produce validated dismissals, mitigations and generated fixes, and the customer’s security team oversees those decisions. ZEST sells yearly software subscriptions sized by cloud projects or accounts, which places it at the software-product level. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | A customer that connects ZEST to its scanners, cloud accounts, code repositories and ticketing tools would have to rewire those integrations and rebuild its triage workflow to leave. The cited record does not size the migration or show non-portable state, a network effect or a regulatory lock. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | ZEST displays an AICPA SOC badge on its site without a linked report. No regulatory authorization, product-specific mandate or retained liability for its product appears in the cited sources. A SOC attestation is an entry requirement a funded rival could also obtain, so it blocks no replacement. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | ZEST describes an impact simulator agent that simulates patches, package updates, IaC and code fixes to find the resolution paths that close the most vulnerabilities at once, agents that compare remediation pathways by blast radius and effectiveness, and fixes simulated on a Digital Twin of cloud and on-prem environments. Optimizing across interdependent changes takes sustained specialized expertise beyond integration work, although these are vendor descriptions and the implementation is not public. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | ZEST publishes a testimonial from the Head of Cybersecurity at Odyssey Therapeutics crediting it with aligning compliance requirements to vulnerability management and remediation, which places a regulated therapeutics buyer among its customers. The evidence is vendor-published and narrow. ZEST also sells a package for lean teams and lists buyers such as CAVA and Agoda whose regulatory status is not established, but establishing regulated-enterprise buyers suffices for this rung. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | ZEST ingests findings from other tools and applies fixes through the customer’s deployment system. It is a platform with workflow and application features spanning cloud and code environments. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | ZEST describes agents that work on customer-specific inputs, such as a data fabric agent that builds a single data fabric representing each organization's technical DNA. Its Mythos report draws on 77 million vulnerabilities in customer environments combined with public research, but the captured sources show no retained cross-customer corpus, accumulated model asset, granted patent or exclusive license, so ZEST competes on engineering and integration breadth. |
ZEST sells to enterprise security teams that run vulnerability management across cloud and application environments, and to the DevOps teams that apply the fixes. Its homepage organizes its solutions around AI for vulnerability management, cloud risk prioritization and remediation, unified vulnerability management, preemptive mitigation and application vulnerability remediation.
ZEST names its customers on its own pages. It lists CAVA, Agoda, Weave, Mercor and Odyssey Therapeutics under a trusted-by heading and quotes a Best Buy application security director in its 2024 launch release. Its enterprise packaging, with yearly subscriptions covering up to 300 cloud projects or accounts and an AWS Marketplace Enterprise contract at $400,000 a year, is built for organizations with large cloud estates.
ZEST’s AI work is a set of specialist agents, each handling one remediation task. Its blog describes a data fabric agent that normalizes findings and a risk prioritization agent that ranks them. An impact simulator agent tests patches and code fixes to find the paths that resolve the most vulnerabilities at once. A Security as Code agent generates replacement code, and a resolution builder agent selects the path.
ZEST’s current materials describe evidence and simulation steps around those agents. ZEST writes that its agents test reachability and exploitability before dismissing a vulnerability. ZEST also says its Preemptive Mitigation product validates protection from existing controls. Its agents simulate fixes in a model of the customer’s environment before applying them through the customer’s deployment system.
The description of the agents comes from ZEST itself. No third-party evaluation or benchmark of their behavior appears in the cited sources.
ZEST sells directly and through AWS Marketplace, with a free trial as the entry point. It raised a $5 million seed from Hanaco Ventures, Silvertech Ventures and angel investors in July 2024, as Calcalist and SiliconANGLE reported.
ZEST’s traction evidence is the customer names it publishes, a Best Buy quote in ZEST’s launch release, and aggregate 2025 outcomes it reports, such as over 11 million vulnerabilities dismissed and more than 386,000 remediated. SC Media and TechCrunch selected ZEST for editorial features in February and December 2025, and ZEST reports a Gartner sample-vendor placement for September 2026.
ZEST publishes its packaging and lists prices for its paid tiers on AWS Marketplace. Its own pricing page lists a free 14-day trial with a written risk exposure assessment, a Security Teams package and an Enterprise package. The paid packages are yearly subscriptions covering 100 or 300 cloud projects or accounts, each with a talk-to-sales step.
On AWS Marketplace, ZEST lists 12-month contracts at $200,000 for its Base Subscription and $400,000 for ZEST Enterprise. At those prices the paid product is an enterprise purchase, and the cloud project or account is the unit the tiers scale by.
ZEST delivers software that the customer’s security and DevOps teams operate. The product connects to cloud accounts, scanners, code repositories and ticketing tools through integrations, and ZEST writes that its agents apply each fix through the customer’s own deployment system after simulating it on a model of the customer’s environment.
ZEST describes the security team’s role as oversight. Its customer results page says teams review a concise set of AI-generated decisions, each explaining why a vulnerability was dismissed, mitigated or prioritized, and a customer quoted on its homepage describes reviewing and approving the Terraform fixes ZEST generates. ZEST also says its agents can resolve findings without humans in the loop. The cited sources do not describe how a customer sets that level of autonomy, so a buyer cannot tell from them how much ZEST changes without approval.
The cited sources describe no managed service in which ZEST takes on responsibility for remediation outcomes.
ZEST lowers the commitment needed to evaluate it. On its pricing page ZEST offers a 14-day free trial with a written risk exposure assessment, and the product connects to cloud accounts through agentless integrations.
ZEST displays an AICPA SOC badge image in its site footer, and the image links to no report. No SOC report, trust portal or other inspectable attestation appears in the reviewed sources.
ZEST’s platform ingests findings from other vendors’ tools. Its integrations page lists cloud platforms, cloud security products such as Wiz, Orca, CrowdStrike and Upwind, scanners from Tenable, Qualys and Rapid7, infrastructure-as-code tools including Terraform and Pulumi, and ticketing systems such as Jira and ServiceNow. To connect Upwind, for example, a customer generates API credentials in Upwind and connects them to ZEST.
ZEST’s reliance on other vendors’ findings has two consequences. A single scanner vendor would have to match ZEST’s breadth across rival tools to replace it. Each of those vendors also produces findings ZEST works from and could add remediation for its own findings. No such feature from those vendors appears in the cited sources.
ZEST’s founders held senior security roles before starting it, and the CEO’s previous company ended in an acquisition. CEO Snir Ben Shimol was CSO at Cider Security, which ZEST says he and his co-founders took from $0 ARR to an exit to Palo Alto Networks in two years. Before that he built the global cybersecurity platform and services organization at Varonis. Calcalist reported both roles.
CTO Uri Aronovici led security architecture at Akamai, overseeing global vulnerability management and the company’s cloud security risk remediation strategy, and SiliconANGLE confirms the founders’ Akamai and Varonis experience. Tom Hanetz, Vice President of R&D, led data science at Armis before joining ZEST.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | https://www.zestsecurity.io/mythos-report | official | 2026-10-16 |
| f2 | SC Media: 7 cloud security startups not named Wiz (Wayback capture of the February 5, 2025 feature) | press | 2026-10-16 |
| f3 | https://www.zestsecurity.io/resources/news/zest-security-exits-stealth-to-resolve-not-just-flag-enterprise-cloud-risks-using-genai-e7cde | official | 2026-10-16 |
| f4 | https://www.calcalistech.com/ctechnews/article/sjcq0pcuc | press | 2026-10-16 |
| f5 | https://www.globenewswire.com/news-release/2025/04/22/3065533/0/en/ZEST-Security-Unveils-Multi-Agent-AI-System-to-Autonomously-Remediate-and-Mitigate-Cloud-Risks-at-RSAC-2025.html | press | 2026-06-21 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.