CyCognito

CyCognito operates a preemptive exposure management platform built around external attack surface management (EASM). Starting from a company's name rather than a supplied asset list — described by the company as "seedless discovery" — the platform autonomously builds a graph data model of an organization's business structure, including departments, subsidiaries, acquisitions and brands, using machine learning and natural language understanding. It then scans billions of servers, websites, cloud applications and APIs across the internet to attribute internet-exposed and unmanaged assets to the organization and to classify them by business and technical context.

On top of discovery, the platform performs continuous automated security testing of exposed assets, which the company markets as autonomous or AI-driven pentesting. It cites more than 100,000 testing modules/scenarios spanning 35+ threat categories, including DAST and vulnerability scanning, plus attack-path simulation and validation of security controls such as WAF, API security and CSPM coverage. Findings are prioritized by combining validated exploitability, exploit intelligence and business impact, and are routed through owner-linked remediation workflows with guided remediation steps, integrations with security, IT and business systems such as ServiceNow, and automated re-testing to confirm fixes. Daily scans keep the inventory and risk profile current.

The company positions its capabilities against adjacent categories, including CAASM (unmanaged asset gaps), unified vulnerability management, CNAPP/cloud security coverage and application security, and frames the whole platform as an operating model for continuous threat exposure management (CTEM).

Founding story

CyCognito was founded in 2017 by Rob Gurzeev (CEO) and Dima Potekhin (CTO). Gurzeev describes the founding question as whether an attacker's reconnaissance plan could be simulated starting only from a target company's name, reflecting the premise that attackers exploit unknown or unmanaged assets that legacy tools miss. Gurzeev previously served as Director of Offensive Security and head of R&D at C4 Security (acquired by Elbit Systems) and as CTO of the Product Department of Unit 8200 of the Israeli Intelligence Corps. Potekhin, a self-taught engineer who holds four patents covering large CDN and internet-scale infrastructure processes, previously founded Epicycle Technologies and Metaqube and worked as a software engineer and security researcher in the Israel Defense Forces.

Business model

CyCognito sells its exposure management platform to enterprise and public-sector organizations as a vendor-operated SaaS product requiring no asset lists or customer-side setup; customer testimonials reference paid subscriptions to the platform. It also maintains a self-hosted affiliate program.

Paid enterprise software subscriptions to the CyCognito platform; the company reported 400 percent year-over-year revenue growth in the 12 months preceding its December 2021 Series C.

Traction

By the December 2021 Series C, the company reported 400 percent year-over-year revenue growth over the prior 12 months and a 3x increase in its Fortune 500 customer roster. Named or referenced users include Colgate-Palmolive, Emerson, Tesco, Scientific Games Corporation, Berlitz and the State of California. A third-party directory lists approximately 116 employees. Peer reviews average 4.7 out of 5; one customer reported roughly 140 critical issues requiring remediation in the first full year of platform use.

Latest developments

CyCognito was named a Leader and Outperformer out of 32 vendors in the 2026 GigaOm Radar for Attack Surface Management. The platform's current positioning centers on adversarial validation and continuous AI-driven penetration testing across all exposed assets, using its Target Graph to orchestrate testing campaigns spanning web applications, cloud environments, AI services and APIs.