X80 Security

X80 Security is a Paris, France cybersecurity company that provides attack surface management from an "attacker's-eye" perspective. Its platform maps an organization's exposure across three axes: people (leaked credentials, infostealer logs, exposed staff data used in social engineering), systems (exposed services, misconfigurations, vulnerable software and forgotten assets) and third parties (vendors, sub-processors and supply-chain partners). Rather than ranking findings by a generic severity score, the company orders them by attacker economics — which weaknesses are cheapest to exploit and most profitable to monetize — and presents the full kill chain from initial entry through escalation to the attacker's objective, such as data theft, extortion or fraud.

The product is delivered outside-in with no agents or integrations required, drawing on a dark-net scanner and intelligence about people and companies. Prospects can run a free systems-axis scan that produces a preview report in minutes, with the complete report — adding the people and third-party axes, remediation steps for each finding and the full kill chain — delivered by email. Alongside the self-serve platform, X80 operates an offensive-security team that performs penetration tests for SOC 2 and ISO 27001, code audits and red-team engagements; the company frames compliance as a by-product of the work rather than its purpose.

Earlier public directory descriptions characterize the company in terms of a simulation environment generating large volumes of synthetic threats to automatically produce defenses for fast-growing startups, positioning it as a substitute for hiring in-house cyber threat analysts. A Gust profile describes the company as "Automated Cyber Defence creation through Self-Learning from Generation of Threats in a Simulation Environment," at prototype-ready stage with three employees and an LLC incorporation type in Paris (postcode 75000)."]

Founding story

Company materials state X80 Security was founded on the question "what's in it for the attacker?", reasoning that both criminal crews and state-backed operators behave like a business — investing time, money and tooling and acting only when the payoff justifies the effort — and that security should therefore be analyzed as an economic decision. Public directories give conflicting founding years: EU-Startups lists 2020.

Business model

Two complementary lines: a self-serve subscription platform sold for a stated "accessible monthly price" that continuously surfaces an organization's exposure, and human-delivered offensive-security services including penetration testing (for SOC 2 and ISO 27001 needs), code audits and red-team engagements. A free, no-access attack surface report serves as the entry point.

Recurring monthly subscription for the continuous exposure-monitoring platform, plus project-based fees for offensive-security engagements (pen tests, code audits, red teaming). Specific pricing is not disclosed in the sources.

Traction

Limited public traction data. Sources indicate three employees, prototype-ready stage and no announced funding. No customer counts, revenue figures or named references are disclosed.

Latest developments

The current website markets a live free "attacker's-eye" report with a systems-axis scanner preview and an email-delivered full report covering people and third-party axes, remediation steps and the kill chain, alongside a services offering covering SOC 2/ISO 27001 pen testing, code audits and red-team engagements.