What Expanse does

Expanse, founded in 2014 and now operating as Cortex Xpanse within Palo Alto Networks following its 2021 acquisition, builds an Active Attack Surface Management (ASM) platform that continuously discovers, classifies, and helps remediate an organization's internet-facing assets and exposures. The core product, Cortex Xpanse, combines three capabilities: Active Discovery, which automatically and continuously scans the entire internet to index unknown risks in connected systems and exposed services; Active Learning, which applies supervised machine-learning models to map the attack surface and prioritize remediation; and Active Response, which executes built-in automated playbooks to reduce attack surface risk rather than relying solely on manual IT ticketing. The platform operates internet-scale scanning infrastructure — 500B+ ports scanned daily and 4.3B IPv4 addresses scanned multiple times per day — and is deployed at scale across all six branches of the U.S. military and large enterprise customers in finance and other regulated verticals.

The technology stack is differentiated less by novel AI than by the scale of its internet telemetry and the resulting proprietary dataset on global exposure patterns, which is fed back into its ML-based prioritization engine. Cortex Xpanse addresses use cases including security blind-spot remediation, ransomware prevention, shadow cloud elimination, zero-day CVE response, M&A security due diligence, internet operations management, and cyber insurance risk reduction.

The business model is enterprise subscription licensing sold quote-based annually through Palo Alto Networks' direct enterprise sales force as part of the Cortex security operations platform suite. Pricing is not publicly disclosed and requires sales engagement; the go-to-motion is enterprise field sales targeting CISOs, SOC directors, vulnerability managers, and corporate development teams, with demand generation supported by content marketing, analyst recognition (Forrester Leader in ASM, GigaOm Leader and Outperformer), and Gartner Peer Insights customer validation. Customer base is concentrated in government/defense and large enterprises, and revenue is bundled within PAN's broader Cortex reporting rather than disclosed separately.

Name

Expanse

Legal name

Expanse Inc.

Website

https://expanse.co

Company type

Private

Founded year

2014

Operating status

Acquired

Headcount range

51–100 employees

Short description

Expanse, operating as Cortex Xpanse within Palo Alto Networks, provides an active attack surface management platform that continuously discovers and prioritizes unknown internet-facing assets for enterprise and government security teams.

Ownership category

akta.pro rank

Product category

Attack Surface Management

NAICS

Computer Systems Design and Related Services (54151), Computer Systems Design and Related Services (5415)

SIC

Services-Computer Integrated Systems Design (7373), Services-Computer Programming Services (7371)

akta.pro primary industry

Attack Surface Management (EASM/CAASM) (HDADAHAC)

akta.pro secondary industry

Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ)

Keywords

• Attack surface management
• External asset discovery
• Vulnerability prioritization
• Cyber exposure remediation
• Security monitoring platform

Headquarters

HQ city

San Francisco

HQ country

United States

HQ region

North America

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Marketing or Sales, Infrastructure, Operations

Revenue model

1. Enterprise Software Subscription: Part of Palo Alto Networks Cortex security platform, sold as enterprise subscription licensing. Typically includes platform access, scanning capabilities, and automated response features.

Pricing tiers

Go-to-market motion1 record

Distribution channels1 record

Marketing channels5 records

Core offering

Expanse, operating as Cortex Xpanse under Palo Alto Networks, sells an active Attack Surface Management (ASM) platform that continuously scans the entire internet to discover, learn about, and respond to unknown risks across all internet-connected systems and exposed services. The platform uses supervised machine-learning models to map attack surfaces and prioritize remediation, and ships automated playbooks to reduce attack surface risks without manual IT ticket workflows.

Product overview

Cortex Xpanse is an active attack surface management platform offered by Palo Alto Networks as part of the Cortex security operations suite. The product provides three core capabilities: Active Discovery (automatically and continuously scanning the internet to discover unknown risks), Active Learning (using supervised machine-learning models to map attack surface and prioritize remediation), and Active Response (automated playbooks to immediately reduce attack surface risks). Key statistics include scanning 500B+ ports daily and 4.3B IPv4 addresses multiple times per day. The platform serves enterprise customers across multiple use cases including security blindspot remediation, ransomware prevention, shadow cloud elimination, zero-day response, M&A evaluation, and cyber insurance reduction.

Differentiator

Problem solved

Functional benefit

Brands

• Cortex Xpanse: Active attack surface management solution that helps organizations actively discover, learn about and respond to unknown risks in all connected systems and exposed services.

Products and services

• Cortex Xpanse Active Attack Surface Management (ASM) solution that continuously scans the internet to discover unknown internet-connected systems and exposed services, uses supervised machine-learning models to map and prioritize the attack surface, and deploys automated playbooks to immediately reduce exposure. Sold to enterprise security teams (CISOs, SOC Directors, vulnerability managers) and government organizations.

Quantifiable outcome

• Scans entire internet for vulnerabilities within 45 minutes (vs. enterprises taking 3+ weeks)
• +2 more outcomes

Named customers3 records

Segments3 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability1 record

Feature4 records

Scale indicators4 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• Censys: Censys operates one of the largest internet-wide scanning datasets (similar to Xpanse's 4.3B IPv4 monitoring) and provides ASM, threat hunting, and exposure management to enterprise security teams. Direct overlap in EASM category with comparable continuous discovery capabilities.
• Bitsight: Bitsight pioneered the security ratings category and has expanded into attack surface management and continuous monitoring. Competes with Xpanse for enterprise security posture management use cases, including third-party risk and M&A evaluation.
• CyCognito: CyCognito is a pure-play external attack surface management vendor offering discovery, prioritization, and remediation workflows. Targets the same enterprise security buyers (CISOs, vulnerability managers) with a comparable active ASM value proposition.
• CrowdStrike Falcon Surface: CrowdStrike's external attack surface management module is bundled with the Falcon platform and competes directly with Cortex Xpanse for enterprise ASM deals, particularly among large security operations teams. Both target CISO and SOC Director buyers with continuous monitoring and prioritization capabilities.
• Tenable (Nessus / Tenable ASM): Tenable's attack surface management module extends its vulnerability management leadership (Nessus) into EASM. Competes with Xpanse for vulnerability manager and CISO budget, particularly in enterprises already standardized on Tenable for VM.
• Rapid7 (InsightConnect / Exposure Analytics): Rapid7 provides vulnerability management, ASM-adjacent exposure analytics, and orchestration to mid-market and enterprise security teams. Competes with Xpanse for security operations and vulnerability management budget allocations.

Emerging players

• Shodan: Shodan is an internet-connected device search engine that powers many security and ASM use cases via API. While more of a data provider than a packaged ASM product, it competes at the data layer with Xpanse's scanning infrastructure.
• Recorded Future: Recorded Future's threat intelligence platform integrates ASM-style external exposure data and competes for the same security operations budget. Overlap with Xpanse is partial, focused on internet-exposed asset discovery in the context of threat actor activity.

Broad incumbents

• Microsoft Defender External Attack Surface Management: Microsoft bundles EASM into Defender suite and offers Attack Surface Analyzer for free, putting significant pricing pressure on standalone ASM tools. As a hyperscaler-incumbent, Microsoft can distribute EASM to enterprises already standardized on the Microsoft security stack.
• Mandiant (Google Cloud): Mandiant Advantage Attack Surface Management (acquired from Intrigue) provides ASM as part of its threat intelligence and managed defense portfolio. Now part of Google Cloud, it offers broader threat-led ASM context that overlaps with Xpanse for high-end security buyers.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat5 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/Expanseinc
• YouTubeyoutube.com/user/paloaltonetworks
• Facebookfacebook.com/PaloAltoNetworks
• LinkedInlinkedin.com/company/palo-alto-networks

Revenue estimate

Valuation estimate

Number of profiles

Profiles8 records

Funding overview

Funding rounds4 records

Investors12 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Expanse