What CyLock does

CyLock S.r.l. is an Italian cybersecurity SaaS company founded in 2022 and headquartered in Rome, operating a single primary office at Via Fonte Buono 19 B. The company has built and commercialised EVA (Extended Vulnerability Assessment), an AI-powered platform that combines automated vulnerability assessment and penetration testing in a single, non-intrusive workflow. EVA is underpinned by the patented CyLock AnEVA analysis process and includes specialised modules (EVA URL, EVA Server, EVA Internal) plus complementary add-ons: Anti-Phishing simulation, Cyber Risk Investigation for dark-web exposure, manual penetration testing by certified ethical hackers, and a Fix-IT remote remediation service. An EVA Chatbot, world-premiered at Infosecurity Europe 2024, provides a natural-language interface to vulnerability reports. Deliverables are OWASP- and OSSTMM-aligned and produce certified reports valid for ISO 27001, GDPR Article 32, and NIS2 compliance.

The company targets primarily small and medium-sized enterprises that lack dedicated cybersecurity staff, with a secondary footprint in system integrators, compliance-driven organisations, and enterprise IT security teams. The go-to-market combines a self-serve SaaS funnel (multi-language website, demo request forms, free trials) with sales-assisted enterprise outreach and a channel programme of resellers, distributors, and system integrators, supplemented by presence at major European cybersecurity trade shows. Revenue is generated through monthly-billed SaaS subscriptions on a quote-based model; pricing is not publicly disclosed.

CyLock has raised over EUR 820,000 across a 2022/2023 accelerator round (Cyber Xcelerator with Zest Group, InnovaVenture, and business angels) and a EUR 500,000 2024 seed round led by Scientifica Venture Capital with CDP Venture Capital SGR, Startup Wise Guys, and Exor Ventures. Strategic partners include Leonardo (via Open Italy ELIS), Comtel (via ComNext), and WDA, alongside EU Horizon 2020 and Regione Lazio internationalisation grants. The company has accumulated recognition including the UK Unicorn Kingdom Pathfinder Award for Cyber Security (European and Global winner, 2024), OWASP tool listing, multiple Italian industry awards, ISO 9001/27001/27017/27018 certifications, and a patent for the AnEVA process.

Name

CyLock

Legal name

CyLock S.r.l.

Website

https://cylock.tech

Company type

Private

Founded year

2022

Operating status

Operating

Headcount range

11–50 employees

Short description

CyLock is an Italian AI-powered SaaS cybersecurity platform that automates vulnerability assessment and penetration testing via its patented EVA product, targeting SMEs, system integrators, and compliance-driven organisations across Europe.

Ownership category

akta.pro rank

Product category

Cybersecurity Software — Vulnerability Assessment and Penetration Testing

NAICS

Software Publishers (5132), Computer Systems Design and Related Services (54151)

SIC

Services-Testing Laboratories (8734), Services-Prepackaged Software (7372)

akta.pro primary industry

Application Security Testing (SAST/DAST/IAST/SCA) (HDADACAC)

akta.pro secondary industry

Vulnerability Management & Penetration Testing Services (BPAEADAD)

Keywords

• Vulnerability assessment
• Penetration testing
• Cybersecurity platform
• Threat intelligence
• Security compliance reporting

Headquarters

HQ city

Rome

HQ country

Italy

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Marketing or Sales, Operations, Infrastructure

Revenue model

1. SaaS Subscription (EVA Platform): CyLock operates as a SaaS cybersecurity platform providing automated VAPT-as-a-service on a subscription basis. Services are billed monthly under commercial offers subscribed by customers. The platform includes modules for URL testing, server/IP testing, internal network scanning, phishing simulation, and cyber risk investigation, all delivered as recurring subscription tiers.

Pricing tiers

Go-to-market motion4 records

Distribution channels4 records

Marketing channels7 records

Core offering

CyLock sells an AI-powered cybersecurity-as-a-service platform called EVA (Extended Vulnerability Assessment) that combines automated vulnerability assessment and penetration testing in a single SaaS tool. Customers input URLs, IP addresses, or emails and receive certified reports within 24–48 hours that are valid for ISO 27001, GDPR, and NIS2 compliance. The platform is designed for both specialist and non-specialist users, leveraging the patented CyLock AnEVA process to simulate attacker behaviour non-intrusively with zero impact on production systems.

Product overview

CyLock offers a unified Cybersecurity-as-a-Service platform centered on EVA (Extended Vulnerability Assessment), an AI-powered solution that combines automated vulnerability assessment and penetration testing. The platform includes specialized modules for URL/web application testing (EVA URL), server testing (EVA Server), and internal network scanning (EVA Internal). Complementary services include Anti-Phishing for employee awareness training, Cyber Risk Investigation (CRI) for dark web threat intelligence, and manual Penetration Testing with certified ethical hackers. The ecosystem is complemented by Fix-IT remediation support and is delivered as a click-and-play SaaS requiring no technical expertise or installations.

Differentiator

Problem solved

Functional benefit

Products and services

• EVA (Extended Vulnerability Assessment) AI-powered cybersecurity-as-a-service platform that combines automated vulnerability assessment and penetration testing in a single SaaS tool. Customers input URLs, IP addresses, or emails and the platform simulates thousands of targeted attacks, produces certified reports within 24–48 hours, and provides remediation guidance. Designed for both SMEs without dedicated security teams and enterprise security departments.
• Anti-Phishing Simulation Automated phishing simulation and cybersecurity awareness training service that sends simulated phishing emails with progressive difficulty levels to test and train employees' ability to recognise threats, providing reports on organisational resilience.
• Cyber Risk Investigation (CRI) Dark web and cyber threat intelligence service that analyses publicly available data across the Web, Deep Web, and Dark Web to identify compromised passwords, exposed domains, and leaked credentials. Produces a Cyber Risk Index for measuring organisational risk levels and supports predictive cybersecurity analysis.
• Penetration Testing Service Manual penetration testing performed by CyLock's certified ethical hackers (MAS Opsec, eWPT, eCPPT, CISM) that validates automated scan results and provides expert verification of vulnerabilities found, complementing the EVA automated platform.
• Fix-IT Remote Remediation Remote vulnerability remediation service providing step-by-step guidance and expert support for fixing identified security vulnerabilities, extending the EVA platform beyond assessment into remediation.

Quantifiable outcome

• Reduces vulnerability testing effort by 80–90% compared to traditional penetration testing
• +2 more outcomes

Segments4 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability7 records

Feature7 records

Partnerships

Five partnerships are on record, tiered strategic, minor and core.

• Leonardo (Open Italy ELIS)strategicStrategic or Co-development PartnerCyLock participated in the Open Italy ELIS co-innovation programme, partnering with Leonardo (major Italian aerospace and defence company) on a startup-corporate collaboration project.
• ComtelstrategicStrategic or Co-development PartnerCyLock was selected as a winner of the ComNext programme promoted by Comtel, an Italian ICT systems integrator with over 30 years of experience. The programme aims to promote high-impact technological solutions for digital transformation in Banking, Finance, Public Administration, Hospitality, and private enterprises.
• WDA | The Co-Founder You NeedminorImplementation/ SI/ Consulting PartnerWDA acted as a programme partner in the ComNext initiative, supporting CyLock in developing and optimising solutions for market fit and alignment with Comtel's requirements.
• OWASP (Open Web Application Security Project)coreOthersCyLock's software was officially listed in OWASP's Vulnerability Scanning Tools list, signifying recognition of the platform's quality, reliability, and compliance with international web security standards.
• Kickstart InnovationminorOthersCyLock was selected as a participant in Kickstart Innovation 2023, a Swiss open innovation programme connecting startups with corporate and public sector organisations seeking innovative solutions.

Scale indicators5 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Intruder: Intruder is a UK-based continuous vulnerability monitoring platform for SMEs offering automated scanning of external infrastructure, applications, and networks — overlapping CyLock's product surface and SMB-focused ease-of-use value proposition.
• Detectify: Detectify offers automated, crowdsourced vulnerability scanning for web applications and external attack surface — overlapping directly with CyLock's EVA offering and similarly targeting non-specialist security teams and SMEs.
• Probely: Probely is a European-based automated web vulnerability scanner aimed at SMEs and developers — a close comparable to CyLock on geography, target customer, and product positioning as an API-driven scanning SaaS.
• Pentest-Tools.com: Pentest-Tools.com provides an automated pentest platform for URLs, servers, and network infrastructure — a near-identical feature scope to CyLock's EVA modules with comparable SMB/mid-market positioning.
• Invicti (formerly Netsparker): Invicti provides automated web application vulnerability scanning and penetration testing with DAST capabilities for URLs and web apps — the same core use case CyLock's EVA URL module targets, but with a much larger enterprise install base.

Emerging players

• HackerOne: HackerOne is a leading platform for crowdsourced and continuous penetration testing — addressing the same use case (continuous pentest coverage) as CyLock's recurring VAPT offering but through a human-expert marketplace model rather than AI automation.
• Indusface: Indusface provides web application vulnerability scanning and managed penetration testing for SMEs and mid-market — a comparable emerging player in the automated VAPT-as-a-service category with similar customer segmentation to CyLock.

Broad incumbents

• Qualys: Qualys is a global cloud security and vulnerability management platform with extensive enterprise penetration testing and compliance reporting — a broad incumbent whose VMDR suite overlaps with CyLock's enterprise compliance use cases.
• Rapid7 (InsightVM / Metasploit): Rapid7 offers InsightVM for vulnerability management and Metasploit for penetration testing — a broad incumbent with overlapping VA/PT capabilities and a strong enterprise sales motion that competes with CyLock's enterprise tier.
• Tenable (Nessus): Tenable is a market-leading vulnerability management platform (Nessus, Tenable.io) covering the broader enterprise attack surface — a broad incumbent whose vulnerability scanning capabilities compete with CyLock's EVA across all of CyLock's modules.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/cylock
• Xx.com/cylock_tech
• Facebookfacebook.com/100077297528389

Compliance8 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles5 records

Funding overview

Funding rounds2 records

Investors7 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about CyLock