Cymulate

SaaS exposure management platform for security validation via BAS and red teaming

Website: https://cymulate.com/

Cover Block
Name Cymulate
Tagline SaaS exposure management platform for security validation via BAS and red teaming
Headquarters Tel Aviv, Israel
Founded 2016
Stage Series D+
Business Model SaaS
Industry Security
Technology AI / Machine Learning
Geography Middle East / North Africa
Growth Profile Venture Scale
Founding Team Co-Founders (3+)
Funding Label $100M+ (total disclosed ~$137,500,000)

Links

The Short Version

Cymulate is a security validation platform that simulates real-world attacks to measure and control enterprise cyber risk, a category gaining urgency as organizations shift from periodic audits to continuous exposure management. Founded in 2016 by a trio of Israeli cybersecurity experts, the company has raised over $137 million to build a SaaS platform that combines breach and attack simulation (BAS) with continuous automated red teaming (CART) and exposure analytics [Cymulate website] [CB Insights, 202x].

The founding team's background in intelligence and cyber research underpins a product narrative focused on comprehensive, integrated validation rather than point-in-time testing [Cymulate about us]. The company reports traction with over 400 customers across 32 countries, targeting the mid-market and enterprise segments with a global office footprint [Cymulate media kit].

With a Series D round of $70 million closed in 2022, the capital base supports aggressive scaling, though the path to sustained growth hinges on proving the platform's differentiation in a crowded market of BAS and exposure management vendors [PRNewswire, Sep 2022] [ZoomInfo].

Data Accuracy: YELLOW -- Key traction and team claims rely on company-provided data; funding details are partially corroborated by press releases.

Taxonomy Snapshot

Axis Classification
Stage Series D+
Business Model SaaS
Industry / Vertical Security
Technology Type AI / Machine Learning
Geography Middle East / North Africa
Growth Profile Venture Scale
Founding Team Co-Founders (3+)
Funding $100M+ (total disclosed ~$137,500,000)

The Company in Brief

Cymulate was founded in Tel Aviv, Israel, in June 2016 by Avihai Ben-Yossef, Eyal Wachsman, and Eyal Gruner [Crunchbase]. The founding team, described by the company as former IDF intelligence officers and cyber researchers, built the initial product around the concept of continuous security validation, moving beyond periodic penetration testing [Cymulate]. The company's headquarters remain in Tel Aviv, with a global presence established through offices in the United States, United Kingdom, Spain, India, Singapore, and Mexico [Cymulate].

Key operational milestones track the company's funding and market recognition. Cymulate secured a $45 million Series C round in May 2021, led by growth investor One Peak [TechCrunch, May 2021]. The company reported a subsequent $70 million Series D round in 2022, bringing its total disclosed funding to approximately $137.5 million [ZoomInfo] [PRNewswire, Sep 2022]. Early product validation came from industry awards, including a Gold award in the Breach & Attack Simulation category at the Info Security PG’s Global Excellence Awards in 2018 and again in 2020 [Cymulate press release, 2020].

Data Accuracy: YELLOW -- Company founding and headquarters confirmed by multiple sources. Funding totals are aggregated from secondary sources; the Series D round is reported but specific lead investor details for that round are not fully corroborated by a primary press release.

What They Have Built

The platform's core proposition is continuous security validation, a concept that moves beyond periodic penetration tests by providing a persistent, automated assessment of an organization's defensive posture. Cymulate packages this as an integrated exposure management suite, with breach and attack simulation (BAS) and continuous automated red teaming (CART) serving as the primary engines for generating attack emulations [Cymulate website]. These simulations are designed to test security controls across the network, endpoint, email, and web vectors, providing a quantified risk score [CB Insights].

Differentiation is framed around breadth and integration. The company claims its platform offers a "truly comprehensive view" by combining exposure discovery with validation, a capability it attributes to its ability to integrate with a wide range of third-party security tools, including cloud security posture management (CSPM) and attack path management platforms [Cymulate blog: The Cymulate Story].

Key product surfaces, as described in company materials, include:

  • Breach and Attack Simulation (BAS). The foundational module for safely emulating adversary tactics, techniques, and procedures (TTPs) against production environments [Cymulate website].
  • Continuous Automated Red Teaming (CART). An evolution of traditional red teaming, automating multi-stage attack scenarios to test detection and response capabilities [CB Insights].
  • Exposure Analytics. A layer for aggregating findings from simulations and integrated tools to prioritize risks and track remediation [CB Insights].
  • Automated Penetration Testing. Focused on identifying specific vulnerabilities, complementing the behavioral focus of BAS [Cymulate website].

Data Accuracy: YELLOW -- Product claims are sourced from the company's website and a secondary analyst profile; technical stack details are inferred.

Market Size and Demand

The market for security validation tools is expanding as enterprises move from static vulnerability scans to continuous, attack-simulated assessments of their defensive posture.

Metric Value
Penetration Testing Market 2022 $1.7B
Penetration Testing Market 2032 $4.5B

Several demand drivers underpin this shift. The primary tailwind is the escalating frequency and sophistication of cyber attacks, which forces security teams to validate controls against real-world adversary techniques, not just compliance checklists. The adoption of the MITRE ATT&CK framework as an industry-standard knowledge base for adversary behavior has created a structured language for these validation exercises, a framework Cymulate explicitly leverages [Cybercrime Magazine]. Furthermore, the expansion of hybrid and multi-cloud environments has fragmented the attack surface, making manual testing impractical and increasing the need for automated, integrated platforms that can assess security posture across diverse infrastructure.

Data Accuracy: YELLOW -- Market sizing is drawn from an analogous sector report; specific TAM for exposure management/BAS is not publicly available from cited sources.

Who Else Is Fighting for This

Cymulate operates in a crowded security validation market, positioning its SaaS platform as a unified exposure management layer that consolidates point solutions for breach simulation, red teaming, and vulnerability assessment.

Company Positioning Stage / Funding Notable Differentiator Source
Cymulate Unified exposure management platform combining BAS, CART, and analytics. Series D+; ~$137.5M total disclosed. Emphasis on continuous validation and a holistic view via integrations. [Cymulate website] [CB Insights]
Pentera Breach and attack simulation focused on automated security validation. Venture Scale; $150M+ total funding. Agent-based approach for autonomous penetration testing. [Cymulate website]
AttackIQ Security optimization platform built on the MITRE ATT&CK framework. Venture Scale; $79M total funding. Strong alignment with the ATT&CK framework for validation. [CB Insights]
SafeBreach Breach and attack simulation for continuous security validation. Venture Scale; $106M total funding. Focus on simulating a vast library of breach methods. [CB Insights]
Picus Security BAS platform for security control validation and mitigation. Venture Scale; $55M total funding. Specialization in security control validation and reporting. [CB Insights]
SCYTHE Adversary emulation and red teaming platform. Venture Scale; $10M total funding. Focus on advanced adversary emulation for red teams. [CB Insights]

Data Accuracy: YELLOW -- Competitor funding and positioning sourced from CB Insights and company materials; differentiation claims are based on public positioning.

Opportunity

If Cymulate can successfully consolidate the fragmented security validation market under a unified exposure management platform, it could become the primary system of record for enterprise cyber risk, a role that commands premium pricing and deep operational lock-in.

The headline opportunity is to become the category-defining platform for continuous threat exposure management (CTEM), a concept Gartner has identified as a top security trend [Gartner]. Cymulate's own narrative frames its platform as providing a "truly comprehensive view of both exposure discovery and validation" by integrating multiple validation tools, a move that aligns with the broader industry shift from periodic testing to continuous control assessment [Cymulate]. With over 400 customers already using its suite across 32 countries, the company has a foundation of mid-market and enterprise logos to build upon [Cymulate media kit].

Data Accuracy: YELLOW -- The core opportunity framing relies on industry analyst trends and the company's stated platform vision. Customer count and revenue figures are sourced from company materials or aggregators without independent audit.

Sources

  1. [Cymulate website] Cymulate - Exposure Management Platform Built for Real Risk | https://cymulate.com/
  2. [Cymulate about us] About us - Learn about Cymulate | https://cymulate.com/about-us/
  3. [Cymulate media kit] Cymulate media kit | https://cymulate.com/
  4. [Crunchbase] Cymulate - Crunchbase Company Profile & Funding | https://www.crunchbase.com/organization/cymulate
  5. [TechCrunch, May 2021] Cymulate nabs $45M to test and improve cybersecurity defenses via attack simulations | https://techcrunch.com/2021/05/05/cymulate-nabs-45m-to-test-and-improve-cybersecurity-defenses-via-attack-simulations/
  6. [ZoomInfo] ZoomInfo company profile for Cymulate | https://www.zoominfo.com/
  7. [PRNewswire, Sep 2022] Cymulate press release on Series D funding | https://www.prnewswire.com/
  8. [Cymulate press release, 2020] Cymulate Co-founder and CTO Avihai Ben-Yossef Selected for Forbes Israel 30 Under 30 2020 | https://cymulate.com/press-releases/avihai-ben-yossef-forbes-30-under-30/
  9. [CB Insights, 202x] Cybersecurity - Cymulate | https://www.cbinsights.com/company/cymulate
  10. [Cymulate blog: The Cymulate Story] The Cymulate Story | https://cymulate.com/
  11. [Cybercrime Magazine] Cymulate BreachCast. What is MITRE ATT&CK? Avihai Ben-Yossef, Co-founder & CTO, Cymulate. | https://soundcloud.com/cybercrimemagazine/cymulate-breachcast-what-is-mitre-attack-avihai-ben-yossef-cymulate
  12. [Allied Market Research, 2023] Penetration Testing Market Report | https://www.alliedmarketresearch.com/
  13. [Gartner] Gartner Top Security Trends | https://www.gartner.com/

Articles about Cymulate

Related companies

Topics

View on Startuply.vc