runZero

runZero offers a total attack surface and exposure management platform that combines active scanning, passive traffic sampling and API integrations to inventory managed and unmanaged assets across IT, OT, IoT, cloud, mobile and remote environments. The platform performs high-fidelity asset fingerprinting without requiring agents or credentials, and delivers attack surface visibility, exposure detection, risk prioritization, compliance reporting and KPIs. It can be consumed as a hosted SaaS service or run self-hosted on premises.

The product stack consists of one or more Consoles, lightweight Explorers deployed at network points-of-presence, and a command-line tool for offline data collection; it is managed through a web interface, an API, or the command line for self-hosted deployments. The live inventory covers assets, services, web-service screenshots, software, vulnerabilities and SSL/TLS certificates, with search query syntax, dashboards, findings, alerting and rules, analysis reports (including network maps, RFC 1918 coverage and external asset reports) and data export. Inbound integrations include AWS, Azure, Google Cloud, Microsoft Entra ID/Intune/Defender, CrowdStrike, SentinelOne, Tenable, Qualys, Rapid7, Wiz, Censys, Shodan, VMware and Dragos; outbound integrations include ServiceNow, Splunk, Jira, Sumo Logic, Tines and Thinkst Canary. Version 5.1 added AI workflows such as natural-language search, dashboard and report generation, autonomous discovery and AI-assisted custom integrations, plus a native Dragos integration for OT context.

Founding story

runZero was founded in 2018 by HD Moore, known as the creator of the open-source Metasploit Framework. Moore had spent roughly 25 years leading penetration testing teams and helping build three security products, and observed that organizations were repeatedly compromised through assets they did not know about and exposures their existing security stacks could not detect. He founded the company to address that visibility gap; the product and company were originally named Rumble.

Business model

runZero sells a commercial exposure management platform, offered as a hosted SaaS service or self-hosted deployment with managed licenses, alongside a free Community Edition intended for home use and environments with fewer than 100 assets. It also runs the Infinity Partner Program, a partner-first channel program with a partner directory and partner portal.

Licensed software platform with paid tiers and a free Community Edition; the company reported growth in annual recurring revenue (ARR) as a headline metric in 2022.

Traction

The company states it is trusted by hundreds of leading global organizations. At the time of its March 2022 Series A, runZero reported growing its user base 3x, its customer base 4x and its ARR 5x. Its platform underpins an exposure management program across 343 North Carolina Public School Units.

Latest developments

runZero 5.1 introduced AI workflows including natural language search, dashboard and report creation, autonomous discovery and AI-assisted custom integrations, together with a native Dragos integration providing OT context. The company announced that runZero is to join Dragos to create a combined security platform backed by a $4 billion Accenture investment. It continues to publish the runZero Hour research webcast series and analyst-cited material such as the GigaOm CxO Decision Brief and GigaOm Radar for Operational Technology Security.