Zafran Security
Zafran Security is an AI-native cybersecurity platform that operationalizes Continuous Threat Exposure Management (CTEM) for Fortune 500 enterprises and critical infrastructure operators, autonomously identifying exploitable vulnerabilities and mobilizing existing security controls to mitigate them.
- Company typePrivate
- Founded2022
- HeadquartersNew York, United States
- Headcount51–100
- GTM typeB2B
- OfferingSoftware
What Zafran Security does
Zafran Security is a privately held cybersecurity company founded in 2022 that operationalizes Continuous Threat Exposure Management (CTEM) for Fortune 500 enterprises and critical infrastructure operators. Headquartered in New York with engineering roots in Tel Aviv, the company is governed under Israeli law as Zafran Security Ltd. and serves CISOs at large organizations that need to triage overwhelming vulnerability backlogs across hybrid cloud, on-premises, and application security environments. The company's central thesis is that roughly 90% of flagged critical vulnerabilities are not actually exploitable in a given environment, and that existing security controls (EDR, firewalls, WAFs, identity, cloud security) can be mobilized to mitigate risk faster than patch cycles permit.
The platform is AI-native and agentless, delivered via API-based integrations that layer onto a customer's existing security stack. Core modules include Unify Findings (normalizes and de-duplicates vulnerability data across tools), Assess Risk (applies runtime, exploit-in-the-wild, asset criticality, and compensating-control context), Mitigate (maps exposures to existing controls for step-by-step risk reduction), and Remediate/RemOps (uses generative AI to consolidate tickets and route work via Jira, ServiceNow, and SOAR platforms). Additional products include Proactive Exposure Hunting, Zafran Detector for continuous discovery, Zafran AIR for rapid AI resilience, Zafran Zero Day Agent for autonomous zero-day response, and Zafran Exposure Gateway as a control plane for AI agents. Integrations span CrowdStrike, Palo Alto, Okta, Entra ID, Tenable, Qualys, Recorded Future, AWS Bedrock, and ITSM/identity platforms.
Zafran monetizes through annual SaaS subscriptions on a quote-based enterprise model, sold via a direct field-sales motion targeting CISOs and security leadership. Disclosed customer logos include Kraft Heinz, Chipotle, Netskope, Ashland, a Fortune 25 Healthcare Enterprise, Lumen Technologies, and American Express (the latter also a strategic investor via Amex Ventures). The company has raised $130 million across multiple rounds from Sequoia Capital, Menlo Ventures, Cyberstarts, PSP Growth, Vintage Investment Partners, Cerca Partners, Penny Jar, and Amex Ventures, with the most recent $60M Series C led by Menlo Ventures in December 2025. ARR tripled between the prior funding round and the Series C, and the company had approximately 150 employees as of March 2026.
Zafran Security firmographics
Firmographics- Name
- Zafran Security
- Legal name
- Zafran Security Ltd.
- Website
- https://zafran.io
- Company type
- Private
- Founded year
- 2022
- Operating status
- Operating
- Headcount range
- 51–100 employees
- Short description
- Zafran Security is an AI-native cybersecurity platform that operationalizes Continuous Threat Exposure Management (CTEM) for Fortune 500 enterprises and critical infrastructure operators, autonomously identifying exploitable vulnerabilities and mobilizing existing security controls to mitigate them.
- Ownership category
- akta.pro rank
Zafran Security industry classification
Industry- Product category
- Threat Exposure Management Software
- NAICS
- Security Systems Services (except Locksmiths) (561621)
- SIC
- Services-Computer Integrated Systems Design (7373)
- akta.pro primary industry
- Vulnerability Intelligence & Exploit Prediction (HDADAHAI)
- akta.pro secondary industries
- Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ), Bug Bounty, Vulnerability Disclosure & Security Services (FSAPAJAL)
Keywords
Where Zafran Security is headquartered
LocationHeadquarters
- HQ city
- New York
- HQ country
- United States
- HQ region
- North America
Offices2 records
Markets served
Zafran Security business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Marketing or Sales, Operations, Infrastructure
Revenue model
- SaaS Subscription: Annual recurring revenue (ARR) model through subscription-based access to the AI-native Threat Exposure Management platform. The company has reported tripling its ARR.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Enterprise platform with API-based, agentless deployment |
Go-to-market motion2 records
Distribution channels2 records
Marketing channels6 records
Zafran Security product offering
Product offeringCore offering
Zafran Security offers an AI-Native Threat Exposure Management platform that operationalizes Continuous Threat Exposure Management (CTEM) across hybrid cloud environments. The platform identifies which vulnerabilities are actually exploitable in a customer's environment and mobilizes existing security controls (EDR, firewalls, WAFs, cloud security, identity) to mitigate risk. It serves enterprise security teams with autonomous AI agents that automate vulnerability detection, risk assessment, and remediation workflows.
Product overview
Zafran Security offers an AI-Native Threat Exposure Management Platform that serves as a unified end-to-end solution for managing cyber exposure. The platform consists of integrated modules including Unify Findings (for aggregating vulnerability data across tools), Assess Risk (for exploitability analysis), Mitigate (for compensating control guidance), and Remediate via RemOps (for AI-powered remediation workflows). Key products include Agentic Exposure Management (autonomous AI agents for the vulnerability lifecycle), Proactive Exposure Hunting (for hunting CVEs and threat actor exposures), Zafran Detector (continuous vulnerability discovery), and Zafran AIR (rapid-response AI resilience offering). The platform addresses a $10 billion fragmented vulnerability management market by using AI to assess actual exploitability versus generic threat scores and enable autonomous remediation of vulnerabilities.
Differentiator
Problem solved
Functional benefit
Brands
- Agentic Exposure Management: AI-native system for automating threat exposure management with autonomous AI agents that automate vulnerability detection, risk assessment, and remediation workflows
- Zafran AIR
- Zafran AIR (Agentic Intelligence Resilience)
- RemOps (Remediation Operations)
- Proactive Exposure Hunting
- DifyTap
Products and services
- AI-Native Threat Exposure Management Platform The core unified platform that operationalizes Continuous Threat Exposure Management (CTEM) across hybrid-cloud environments. Coordinates existing security tools, assesses vulnerability exploitability, and enables autonomous remediation of vulnerabilities for enterprise security teams.
- Agentic Exposure Management AI-native system using autonomous AI agents to automate threat exposure management, including vulnerability detection, risk assessment, and remediation workflows. Provides the context layer to power autonomous actions across the vulnerability management lifecycle.
- Zafran AIR Lightweight, rapid-response offering for AI resilience. Agentless, API-based solution designed to help enterprises build AI resilience for the post-Mythos era, reducing exploitability by up to 90%. Includes the Project Glasswing Exposure Tracker for real-time variant tracking.
- Zafran Detector Product for continuous vulnerability discovery and detection capabilities across hybrid environments, providing continuous vulnerability data aggregation.
- Zafran Zero Day Agent Autonomous workflow product for the Post-Mythos Era, designed to respond to zero-day vulnerabilities and AI-generated threats.
- Zafran Exposure Gateway Secure control plane for AI agents to eliminate exposures at scale, enabling AI agents to interact securely with enterprise security systems.
Quantifiable outcome
- 90% of critical vulnerabilities are proven not exploitable through risk context analysis
- +5 more outcomes
Companies that use Zafran Security
Customer profileNamed customers7 records
Segments5 records
Ideal customer profiles4 records
Zafran Security technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration12 records
AI capability9 records
Feature8 records
Zafran Security partnerships and signals
Strategic signalPartnerships
Five partnerships are on record, tiered minor and core.
- Chainguard Athena CoalitionminorJoined Athena Coalition for coordinated open source software defense. Zafran participates alongside Akamai, Black Duck, Cycode, JFrog, Morgan Stanley, Qualys, and Upwind.
- AnthropiccoreAccepted into Anthropic's Cyber Verification Program. Partnership focused on AI security resilience for the post-Mythos era.
- OpenAIcoreSelected for OpenAI's Trusted Access for Cyber program, indicating collaboration on AI security capabilities.
- Amazon Web Services (AWS)coreAWS Partner Solutions integration using Amazon Bedrock for AI-powered remediation. Platform operationalizes CTEM across hybrid-cloud environments using AWS services.
- Recorded FuturecorePartnership with world's largest threat intelligence company to enhance vulnerability context and prioritization. Integrates threat intelligence for actionable risk assessment.
Scale indicators14 records
Recent moves6 records
Expansion highlights8 records
Zafran Security competitors and assessment
Company assessmentDirect peers
- Tenable: Tenable is the long-standing leader in vulnerability management (Nessus, Tenable One) and is extending into CTEM-style exposure assessment platforms. It directly competes with Zafran for the same enterprise vulnerability management budget, with Tenable One positioned as a broader exposure management suite.
- Qualys: Qualys offers the VMDR platform and TruRisk exposure prioritization, directly addressing the same vulnerability risk prioritization and remediation workflow problem Zafran targets. It is a direct competitor in enterprise vulnerability and exposure management.
- Rapid7: Rapid7 InsightVM and the exposure analytics offering compete directly with Zafran in enterprise vulnerability management, prioritization, and remediation operations, with overlapping Fortune 500 buyer personas in security operations.
- Wiz: Wiz provides cloud security and exposure management with strong prioritization capabilities, including cloud vulnerability prioritization. It is a direct competitor for the same enterprise security buyers and is widely cited as the new generation VM-adjacent platform in the same CTEM conversation.
- Axonius: Axonius focuses on cybersecurity asset management and exposure management, correlating assets, vulnerabilities, and controls across enterprise environments. It is a direct competitor in the exposure management category where Zafran is positioned.
- Vulcan Cyber: Vulcan Cyber offers a vulnerability remediation operations platform that automates prioritization and remediation workflows, directly overlapping with Zafran's Mitigate and RemOps modules and competing for the same enterprise remediation tooling budget.
- Brinqa: Brinqa provides a vulnerability risk management platform that unifies vulnerability data and applies business risk context to prioritization, directly competing with Zafran's Assess Risk and Unify Findings capabilities in the exposure management category.
Broad incumbents
- CrowdStrike: CrowdStrike's Falcon Spotlight and broader Falcon platform provide vulnerability and exposure management as part of a much larger endpoint and security operations suite. It is a broad incumbent that competes with Zafran in vulnerability prioritization, with the platform's incumbent positioning often making it the default incumbent choice.
- Palo Alto Networks: Palo Alto Networks bundles vulnerability, exposure, and remediation capabilities into its Cortex XSIAM and Prisma Cloud platforms. As a broad incumbent, it competes with Zafran by offering exposure management as part of a wider security operations and cloud security portfolio.
Emerging players
- Cyera: Cyera is an emerging data security posture management (DSPM) and AI security platform that intersects Zafran's exposure management category through AI-related exposure and risk prioritization, particularly for the 'post-Mythos' AI resilience use case Zafran is targeting with Zafran AIR.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks6 records
Key highlights7 records
Customer concentration
Zafran Security social profiles
Digital presenceZafran Security financial estimates
Financial estimateRevenue estimate
Valuation estimate
Zafran Security leadership team
Management profileNumber of profiles
Profiles6 records
Zafran Security funding detail
Funding detailFunding overview
Funding rounds5 records
Investors10 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Zafran Security M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Zafran Security
What does Zafran Security do?
Zafran Security offers an AI-Native Threat Exposure Management platform that operationalizes Continuous Threat Exposure Management (CTEM) across hybrid cloud environments. The platform identifies which vulnerabilities are actually exploitable in a customer's environment and mobilizes existing security controls (EDR, firewalls, WAFs, cloud security, identity) to mitigate risk. It serves enterprise security teams with autonomous AI agents that automate vulnerability detection, risk assessment, and remediation workflows.
Is Zafran Security a public or private company?
Zafran Security is a private company. It is classified as venture growth investor backed and is currently operating.
When was Zafran Security founded?
Zafran Security was founded in 2022. It employs 51 to 100 people.
Where is Zafran Security based?
Zafran Security is headquartered in New York, United States, in the North America region.
How does Zafran Security make money?
One revenue line is on record: saaS Subscription.
Who are Zafran Security's main competitors?
Direct peers on record are Tenable, Qualys, Rapid7, Wiz, Axonius, Vulcan Cyber and Brinqa. Broad incumbents are CrowdStrike and Palo Alto Networks. Cyera is listed as an emerging player.
Does Zafran Security have an API?
Yes. Zafran offers an API-based integration approach. The platform is described as 'agentless, API-based' with API-based integrations for vulnerability detection and threat exposure management. The platform uses API connections to integrate with existing security tools and data sources for continuous vulnerability discovery.
What industry is Zafran Security in?
Zafran Security's product category is Threat Exposure Management Software. Its primary akta.pro industry code is HDADAHAI, Vulnerability Intelligence & Exploit Prediction, with a secondary code of HDADAGAJ, Attack Detection & Response for Cloud/SaaS (SOC for Cloud). Its NAICS code is 561621 and its SIC code is 7373.