What Reflectiz does

Reflectiz (founded 2016, Ramat Gan, Israel) provides an AI-powered web exposure management platform that monitors what executes inside end-user browsers on customer websites. The core architectural differentiator is a proprietary sandbox browser that observes live website execution externally — without deploying code on the customer's site, without accessing customer data, and with onboarding typically completing in under 24 hours. The platform captures behavioral data on scripts, pixels, third-party tools, network requests, and data flows, then applies AI engines to classify changes, surface malicious behavior (including AI-generated skimmers and Magecart attacks), and trigger remediation. Its intelligence database is built from monitoring millions of websites daily, generating billions of dynamic data points that feed a proprietary Exposure Rating scoring system.

The product is structured as a unified platform with four modules: Security Hub (Magecart/web skimming and supply-chain detection), Privacy Hub (GDPR/CCPA/HIPAA/PIPEDA tracking enforcement), Offensive Hub (agentic continuous penetration testing using autonomous AI agents, claimed at up to 10x the capacity of traditional pentesting), and a PCI Module that automates compliance with PCI DSS v4.0.1 Requirements 6.4.3 and 11.6.1. Supporting features include Atlas (autonomous AI remediation agent acting via CSP injection), an AI Assistant providing natural-language query over security data, and Reflectiz Policies for codifying internal vendor trust rules. The platform holds ISO 27001 certification and has been independently validated by Integrity360, a PCI Qualified Security Assessor.

Reflectiz operates a SaaS subscription model with a freemium self-serve entry point ("Try for free" with dashboard access in ~10 minutes) and enterprise field sales targeting CISO, VP Cyber Security, and Head of IT/IT Security buyers. Named customers include BigCommerce, Leeds United FC, DAZN, Cox Communications, Castore, Village Roadshow, Baby Bunting, Lion, Center Parcs, and APEXX, spanning eCommerce, media/streaming, telecom, sports/entertainment, retail, F&B, hospitality, and payments. Distribution combines direct enterprise sales, channel partnerships (notably Integrity360 in UK/Ireland), and event-driven demand generation. Total disclosed funding is approximately $27.5M across a seed round, a 2020 Series A ($5M led by Capri Ventures), and an October 2025 Series B ($22M led by Fulcrum Equity Partners with Capri Ventures, YYM Ventures, and AFG Partners). Proceeds are funding a new Boston global headquarters, product development, and geographic expansion.

Name

Reflectiz

Legal name

Reflectiz

Website

https://reflectiz.com

Company type

Private

Founded year

2016

Operating status

Operating

Headcount range

11–50 employees

Short description

Reflectiz is an AI-powered web exposure management platform that continuously monitors live websites via a proprietary sandbox browser to detect client-side security threats, privacy violations, and PCI DSS compliance gaps, serving enterprise customers in eCommerce, financial services, and healthcare.

Ownership category

akta.pro rank

Product category

Web Application Security

NAICS

Computer Systems Design and Related Services (54151)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Web Application Security (WAF, RASP) (HDADACAA)

Keywords

• Web application security
• Attack surface management
• Third-party risk monitoring
• Client-side security
• Web exposure management

Headquarters

HQ city

Ramat Gan

HQ country

Israel

HQ region

Middle East

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Marketing or Sales, Operations, Infrastructure

Revenue model

1. SaaS Subscription (Web Exposure Management Platform): Reflectiz operates as a SaaS platform offering subscription-based access to its web exposure management platform. Customers pay for continuous monitoring, behavioral analysis, and compliance support across their web properties. The platform is offered at multiple tiers (Plans page exists on website) and supports both enterprise and mid-market buyer segments. Agentless deployment with onboarding in under 24 hours supports both self-serve and sales-assisted purchase motions.

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels7 records

Core offering

Reflectiz is an AI-powered web exposure management platform that continuously discovers, monitors, and prioritizes vulnerabilities across websites and web applications — including third-party scripts, client-side threats such as Magecart/e-skimming attacks, and privacy or compliance gaps. The platform is delivered as a cloud-based SaaS solution with dedicated modules for security monitoring, privacy, offensive testing, and PCI DSS compliance, aimed at enterprise security, compliance, and risk teams.

Product overview

Reflectiz is an AI-powered web exposure management platform delivered as a unified platform with multiple integrated modules. The core Reflectiz Platform provides continuous external monitoring of websites using a proprietary sandbox browser. The platform comprises four main hub modules: Security Hub for detecting Magecart and supply-chain attacks, Privacy Hub for monitoring PII data flows and consent enforcement, Offensive Hub for continuous agentic penetration testing, and the PCI Module for automating PCI DSS 4.0.1 compliance. Key AI-powered features include Atlas (autonomous remediation agent), AI Assistant (natural language query interface), and Exposure Rating (proprietary risk scoring system). The platform operates agentlessly with no code changes required and onboarding typically under 24 hours.

Differentiator

Problem solved

Functional benefit

Products and services

• Reflectiz Web Exposure Management Platform Cloud-based SaaS platform that continuously discovers, monitors, and prioritizes web application exposures — including third-party scripts, client-side attacks such as Magecart/e-skimming, and compliance gaps — for enterprise security and compliance teams.
• PCI Compliance Module for Reflectiz Standalone PCI compliance offering built on the Reflectiz platform, helping eCommerce, financial services, and other payment-handling organizations demonstrate and maintain PCI DSS compliance on their websites and web applications.

Quantifiable outcome

• 64% of third-party apps access sensitive data without justification (2026 State of Web Exposure Research, 4,700 websites analyzed)
• +3 more outcomes

Named customers10 records

Segments4 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability7 records

Feature11 records

Partnerships

One partnership is on record.

• Integrity360coreImplementation/ SI/ Consulting Partner · 1 January 2026Integrity360 Europe, a PCI Qualified Security Assessor and member of the PCI SSC Global Executive Assessor Roundtable, independently assessed Reflectiz's PCI DSS Platform against Requirements 6.4.3 and 11.6.1. The QSA found Reflectiz effective for compliance with both requirements, highlighting behavior-based monitoring and QSA-ready audit evidence generation. Integrity360 and Reflectiz also conduct joint sales workshops targeting the UK and Irish cybersecurity markets.

Scale indicators6 records

Recent moves4 records

Expansion highlights6 records

Direct peers

• HUMAN Security: HUMAN Security offers Code Defender, a client-side web application protection product that detects and mitigates malicious scripts, similar to Reflectiz's Security Hub. Both compete directly in client-side Magecart and supply-chain protection, with HUMAN having stronger bot mitigation heritage and broader platform scope.
• Source Defense: Source Defense specializes in client-side web application security with a focus on preventing e-skimming, formjacking, and supply-chain attacks via JavaScript monitoring. Closely aligned with Reflectiz's core Magecart/PCI protection use case, serving similar e-commerce and financial services buyers.
• Jscrambler: Jscrambler provides client-side JavaScript protection including web application integrity and PCI DSS compliance for payment pages. Directly comparable to Reflectiz's PCI Module and Security Hub in terms of use case and customer segment, with stronger code-level obfuscation capabilities.

Broad incumbents

• Akamai (Page Integrity Manager): Akamai's Page Integrity Manager provides client-side script monitoring within its broader application security portfolio. As a large CDN and security incumbent, Akamai competes with Reflectiz on enterprise deals by bundling client-side protection into wider WAF/Bot/CDN contracts.
• Imperva (Client-Side Protection): Imperva offers client-side protection as part of its broader application and data security suite. Competes with Reflectiz on enterprise deals by combining client-side monitoring with WAF, DDoS, and bot management capabilities from a well-established security vendor.
• F5 (Shape Security / Application Security): F5's Shape Security and Distributed Cloud Account Protection cover application and client-side security. As a large incumbent in application delivery and security, F5 competes on enterprise application security RFPs where client-side visibility is one of multiple evaluation criteria.

Emerging players

• DataDome: DataDome focuses primarily on bot management but has expanded into broader application protection including client-side risks. An emerging player that overlaps with Reflectiz's threat detection positioning for high-traffic e-commerce and digital properties.
• Cequence Security: Cequence Security provides API and application security including detection of client-side threats and bot-driven abuse. An emerging player with overlapping enterprise buyer base and adjacent coverage of web exposure management themes.
• Salt Security: Salt Security focuses on API security with capabilities adjacent to Reflectiz's web exposure monitoring. While more API-centric, Salt competes for similar CISO budgets around runtime application risk visibility and shares Reflectiz's enterprise buyer persona.
• Traceable AI: Traceable AI provides API security and observability with behavioral analysis of application traffic. Comparable to Reflectiz in applying AI to runtime threat detection and in serving enterprise digital security buyers, though focused more on API than browser client-side layer.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/_Reflectiz_
• Facebookfacebook.com/Reflectiz.Cyber
• LinkedInlinkedin.com/company/reflectiz

Compliance5 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds4 records

Investors6 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Reflectiz