Core Security

What Core Security does

Core Security is a brand and operating division within Fortra, LLC, headquartered in Eden Prairie, Minnesota, that provides offensive cybersecurity software and services to enterprise, government, and regulated-industry customers worldwide. Its core technology stack is anchored by three interoperable commercial products — Core Impact (guided-automation penetration testing with a 3,000+ commercial-grade certified exploit library), Cobalt Strike (adversary simulation and red team operations built around the Beacon payload and Malleable C2 framework), and Outflank Security Tooling (OST, an evasive offensive toolkit for EDR-aware engagements) — with the open-source Impacket protocol library underpinning protocol-level capabilities.

The business operates a sales-led, subscription-based model with publicly disclosed per-seat pricing for Core Impact ($9,450–$12,600/user/year) and bundled suites such as the Advanced Bundle ($15,750/user/year), the Red Team Suite, and the Offensive Security Suite, supplemented by third-party Security Consulting Services (penetration testing, red team exercises, purple teaming, adversary simulations) with 35+ years of offensive security experience. Customers include federal government agencies (purchased via GSA, SEWP, CIO-CS, DHS FirstSource II, DOE BPA, Army CHESS, Army ITES-3H), financial services firms (PCI DSS, SOX, SEC compliance), healthcare organizations (HIPAA, ransomware simulation), and adjacent verticals such as retail, higher education, and utilities/energy, with regional headquarters spanning the US, UK, Spain, Argentina, and Australia.

Name

Core Security

Legal name

Fortra, LLC

Website

https://coresecurity.com

Company type

Private

Founded year

1996

Operating status

Operating

Headcount range

101–250 employees

Short description

Core Security, a brand within Fortra, provides offensive cybersecurity software and services — including Core Impact pen testing, Cobalt Strike adversary simulation, and Outflank Security Tooling — to enterprise, government, and regulated-industry customers worldwide.

Ownership category

akta.pro rank

Product category

Cybersecurity Software

NAICS

Software Publishers (5132)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

Application Security & DevSecOps Services (BPAKAHAJ)

akta.pro secondary industry

Application Security Testing (SAST/DAST/IAST/SCA) (HDADACAC)

Keywords

• Penetration testing software
• Adversary simulation platform
• Red team tooling
• Identity governance administration
• Vulnerability management

Headquarters

HQ city

Roswell

HQ country

United States

HQ region

North America

Offices6 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. Core Impact Software Licensing: Annual software licenses for Core Impact pen testing platform at three tiers: Basic $9,450 user/year, Pro $12,600 user/year, and Enterprise (varied pricing, quote-based). One-year license term; requires a vetting process.
2. Cobalt Strike Software Licensing: Software licensing for Cobalt Strike adversary simulation / red team operations tool. Quote-based pricing. Available as part of Advanced Bundle (Core Impact + Cobalt Strike) for $15,750.
3. Outflank Security Tooling (OST) Licensing: Licensed access to OST's advanced offensive toolset (Payload Generator, Office Intrusion Pack, Stego Loader, Lateral Pack, Outflank C2, HiddenDesktop). Demo-based sales motion.
4. Offensive Security Product Bundles and Suites: Bundle and suite pricing combining multiple Fortra offensive security products at a discount: Essentials Bundle (Fortra VM + Core Impact), Advanced Bundle (Core Impact + Cobalt Strike) at $15,750, Elite Bundle (Fortra VM + Core Impact + Cobalt Strike), Red Team Suite (Cobalt Strike + OST), and Offensive Security Suite (Core Impact + Cobalt Strike + OST). Includes exclusive Cobalt Strike Research Labs access and training (CSCO, CICO).
5. Security Consulting Services (SCS): Third-party penetration testing services delivered by expert consultants with 35+ years of offensive security experience. Includes Network Security, Web Application, Social Engineering, Cloud Security, IoT Security, Red Team Exercises, Purple Teaming, Adversary Simulations, Black Box Testing, and Application Security Testing. Quote-based pricing.
6. Identity Governance & Administration (IGA) Products: Separate IGA product line including Core Access, Core Provisioning, Core Compliance, Core Password and Secure Reset, and Core Privileged Access Manager (BoKS). Listed as Core Security products with associated pricing.

Pricing tiers

Go-to-market motion1 record

Distribution channels6 records

Marketing channels10 records

Core offering

Core Security, a brand within Fortra's cybersecurity portfolio, develops and licenses offensive security software used by enterprise and government security teams. Its commercial offerings center on Core Impact (a penetration testing platform with a certified exploit library), Cobalt Strike (adversary simulation and red team operations software), and Outflank Security Tooling (OST, an evasive red team toolset). The company also sells identity governance products, provides third-party penetration testing consulting services, and maintains the open-source Impacket library.

Product overview

Core Security, a part of Fortra's cybersecurity portfolio, offers a platform-plus-modules architecture combining offensive security products, identity governance products, and bundled suites. The core offensive security platform centers on Core Impact (automated penetration testing software), Cobalt Strike (adversary simulation and red team operations), and Outflank Security Tooling (OST, evasive red team toolset), all of which interoperate and are offered in combination bundles such as the Essentials Bundle, Advanced Bundle, Elite Bundle, Red Team Suite, and Offensive Security Suite. Identity governance and administration is delivered through the Access Assurance Suite (Core Access), Core Provisioning, Core Compliance, Core Password and Secure Reset, and Core Privileged Access Manager (BoKS). Additional offerings include Penetration Testing Services (third-party Security Consulting Services), the Event Manager SIEM, Powertech Antivirus for IBM systems, and the open-source Impacket toolkit maintained by CoreLabs.

Differentiator

Problem solved

Functional benefit

Brands

• Core Impact: Penetration testing software to safely uncover and exploit security weaknesses across network, client-side, web application, and WiFi/mobile vectors.
• Cobalt Strike
• Outflank Security Tooling (OST)
• Impacket
• Core Access
• Core Provisioning
• Core Compliance
• Core Password
• Core Privileged Access Manager (BoKS)
• Event Manager
• Powertech Antivirus

Products and services

• Core Impact
• Cobalt Strike
• Outflank Security Tooling (OST)
• Penetration Testing Services
• Impacket
• Event Manager
• Powertech Antivirus
• Core Access
• Core Provisioning
• Core Compliance
• Core Password and Secure Reset
• Core Privileged Access Manager (BoKS)

Quantifiable outcome

• Reduces manual pen testing time from 3 hours to 10 minutes per task via Core Impact automation (testimonial from Advanced Threat Analysis Inc. CISO).
• +2 more outcomes

Named customers6 records

Segments6 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration14 records

Feature10 records

Partnerships

22 partnerships are on record, tiered flagship / parent, flagship integration, flagship / co-development, core integration, supporting integration, core partner, community partner and industry association partner.

• Fortraflagship / parentStrategic or Co-development PartnerCore Security operates as a brand within Fortra's cybersecurity portfolio. Fortra provides advanced offensive and defensive security solutions across the cyber kill chain; Core Security delivers Core Impact, Cobalt Strike, OST, and Security Consulting Services under this umbrella. Outflank joined Fortra to enhance the offensive security portfolio.
• Cobalt Strikeflagship integrationTechnology or IntegrationCobalt Strike is Fortra's adversary simulation and red team operations tool, interoperable with Core Impact via session passing and tunneling. Available as a standalone product and as part of the Advanced Bundle ($15,750), Red Team Suite, and Offensive Security Suite.
• Outflank Security Tooling (OST)flagship integrationTechnology or IntegrationOutflank Security Tooling (OST) is Fortra's evasive offensive toolset for advanced red teaming, interoperable with Cobalt Strike via Beacon Object Files (BOFs) and reflective DLL loading, and part of the Red Team Suite and Offensive Security Suite. Includes Payload Generator, Office Intrusion Pack, Stego Loader, Lateral Pack, Outflank C2 (formerly Stage 1), and HiddenDesktop.
• Outflankflagship / co-developmentStrategic or Co-development PartnerAmsterdam-based Outflank team of highly experienced professional security testers who assembled and released OST in 2021; Outflank has joined Fortra and complements the offensive security portfolio with vulnerability management, penetration testing, and red teaming/adversary simulation solutions.
• Metasploitcore integrationTechnology or IntegrationCore Impact integrates with Metasploit as part of its pen testing interoperability stack, enabling validation of vulnerabilities and centralization of pen testing. Listed as Basic+ tier feature in Core Impact pricing chart.
• PowerShell Empirecore integrationTechnology or IntegrationCore Impact integrates with PowerShell Empire for advanced post-exploitation and pen testing workflows; dedicated training eCourse 'Using Core Impact with PowerShell Empire' exists.
• Plextraccore integrationTechnology or IntegrationCore Impact integrates with Plextrac to centralize pen testing workflows and reporting; listed as Basic+ tier feature in Core Impact pricing chart.
• Burp Suitesupporting integrationTechnology or IntegrationCore Impact can import data from and validate vulnerabilities discovered by Burp Suite as part of its vulnerability scanner integration list.
• Fortra Vulnerability Management (Fortra VM)flagship integrationTechnology or IntegrationCore Impact integrates with Fortra VM for vulnerability validation; bundled together in the Essentials Bundle (Core Impact + Fortra VM) and Elite Bundle (Fortra VM + Core Impact + Cobalt Strike). Fortra VM is a SaaS vulnerability management solution with proprietary scanning technology.
• Nessussupporting integrationTechnology or IntegrationCore Impact can import data from and validate vulnerabilities discovered by Nessus as part of its vulnerability scanner integration list.
• Nexposesupporting integrationTechnology or IntegrationCore Impact can import data from and validate vulnerabilities discovered by Nexpose as part of its vulnerability scanner integration list.
• OpenVASsupporting integrationTechnology or IntegrationCore Impact can import data from and validate vulnerabilities discovered by OpenVAS as part of its vulnerability scanner integration list.
• Nmapsupporting integrationTechnology or IntegrationCore Impact can import data from and validate vulnerabilities discovered by Nmap as part of its vulnerability scanner integration list.
• Qualyssupporting integrationTechnology or IntegrationCore Impact can import data from and validate vulnerabilities discovered by Qualys as part of its vulnerability scanner integration list.
• SAINTsupporting integrationTechnology or IntegrationCore Impact can import data from and validate vulnerabilities discovered by SAINT as part of its vulnerability scanner integration list.
• Tenablesupporting integrationTechnology or IntegrationCore Impact can import data from and validate vulnerabilities discovered by Tenable as part of its vulnerability scanner integration list.
• Mythicsupporting integrationTechnology or IntegrationOST's Outflank C2 (formerly Stage 1) tool smuggles full C2 frameworks such as Cobalt Strike, Mythic, or Covenant past antivirus and EDR products.
• Covenantsupporting integrationTechnology or IntegrationOST's Outflank C2 tool smuggles Covenant and other C2 frameworks past antivirus and EDR products.
• ZeroPoint Securitycore partnerStrategic or Co-development PartnerZeroPoint Security co-developed Cobalt Strike introductory training referenced on coresecurity.com; training delivered in collaboration with ZeroPoint Security for the Red Team Suite.
• Bloodhound Gang Slackcommunity partnerOthersCobalt Strike user community is active on Bloodhound Gang Slack in the #aggressor channel; Cobalt Strike R&D team maintains a presence and incorporates customer requests from this community into the product roadmap.
• Red Siege Discordcommunity partnerOthersCobalt Strike community engages in the Cobalt Strike area within the Red Siege Discord server; Cobalt Strike R&D team has presence and incorporates community feedback.
• AFCEAindustry association partnerOthersCore Security is a proud member of AFCEA, an international nonprofit professional association aimed at connecting military, government, and industry for learning about and collaborating on the advancement of security technology.

Scale indicators10 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Rapid7: Rapid7 owns Metasploit and InsightAppSec, directly competing with Core Impact in the penetration testing software market. Both serve enterprise security teams and consultants seeking exploit-driven testing and vulnerability validation.
• PortSwigger (Burp Suite): PortSwigger's Burp Suite is the dominant web application penetration testing platform and integrates with Core Impact as a vulnerability scanner import source. Both compete for application security testing budget within security teams.
• Pentera: Pentera offers automated security validation that emulates adversary attack paths against enterprise environments, overlapping with Core Impact's automated penetration testing capabilities and serving similar enterprise red team buyers.
• SafeBreach: SafeBreach provides breach and attack simulation (BAS) that automates adversary emulation, competing directly with Cobalt Strike and OST in the adversary simulation / red team tooling category for enterprise security operations.
• AttackIQ: AttackIQ is a breach and attack simulation platform that validates security controls against adversary TTPs, directly competing with Cobalt Strike and OST for red team and security validation budgets across enterprise and federal customers.
• Bishop Fox: Bishop Fox is a leading offensive security services firm offering penetration testing and red team services, directly competing with Core Security's Security Consulting Services (SCS) team for enterprise and federal testing engagements.
• NCC Group: NCC Group provides third-party penetration testing, red teaming, and adversary simulation services globally, competing with Core Security's Security Consulting Services for enterprise and government offensive security engagements.

Emerging players

• Scythe: Scythe builds adversary emulation platforms used by red teams to simulate threat actors, overlapping with Cobalt Strike's post-exploitation and C2 capabilities while targeting similar enterprise and MSSP buyers.

Broad incumbents

• Tenable: Tenable Nessus is one of Core Impact's 20+ vulnerability scanner integrations but also competes for vulnerability management budget. As a large public cybersecurity incumbent, Tenable offers overlapping capabilities within a much broader security platform.
• Qualys: Qualys is another integrated vulnerability scanner that Core Impact imports vulnerabilities from, while also competing for broader vulnerability management and security testing budget within enterprise and federal customers.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/CoreSecurity
• YouTubeyoutube.com/channel/UCuiogAh6174TT6ms4bEz3og
• LinkedInlinkedin.com/company/core-impact-pen-testing

Compliance7 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds8 records

Investors11 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A3 records

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Core Security