C

Cymulate

On-demand security control validation platform

Overview

Cymulate provides an on-demand security control validation platform that helps organizations manage and improve their cybersecurity posture. It continuously monitors a company’s security controls to identify gaps and risks, then prioritizes them so security teams can focus on the most significant threats. The platform offers actionable insights and clear risk rankings, making it easier for CISOs, security teams, and IT support to respond quickly and plan remediation efforts. Customers pay a subscription to access ongoing validation and risk-focused reporting, which translates into a better return on security investments. Cymulate differentiates itself by delivering continuous, prioritized risk visibility and practical guidance across the whole organization, not just the security team, enabling efficient allocation of resources and faster threat response.

Work here?Claim your company

About Cymulate

Simplify's Rating
Why Cymulate is rated
B-
Rated B on Competitive Edge
Rated B on Growth Potential
Rated C on Differentiation

Industries

Enterprise SoftwareCybersecurity

Company Size

201-500

Company Stage

Series D

Total Funding

$140.5M

Headquarters

Rishon LeTsiyon, Israel

Founded

2016

Get referred to Cymulate

See people who can refer or advise you

Simplify Jobs

Simplify's take

What believers are saying

  • Bitsight integration announced August 5, 2026 expands Cymulate’s threat-informed validation distribution.
  • Cymulate claims more than 1,000 enterprise security teams, strengthening referenceability and upsell potential.
  • Gartner 2026 recognition and G2 momentum rankings support category leadership and buyer trust.

What critics are saying

  • Crowded rivals like Bitsight, SentinelOne, and Wiz compress Cymulate’s pricing and differentiation.
  • The last disclosed funding remains September 2022, limiting firepower versus better-capitalized cybersecurity platforms.
  • If enterprise AI assistants bypass dedicated validation consoles, Cymulate’s platform becomes a feature, not a destination.

What makes Cymulate unique

  • Cymulate’s August 2026 Cowork, Claude Plugin, and MCP Server embed validation into AI workflows.
  • Vero AI turns exposure validation into recurring agentic workflows across SIEM, EDR, and ticketing tools.
  • Cymulate’s CTEM platform combines attack simulation, remediation validation, and detection engineering in one stack.

Help us improve and share your feedback! Did you find this helpful?

Funding

Total Funding

$140.5M

Below

Industry Average

Funded Over

5 Rounds

Series D funding is typically for companies that are already well-established but need more funding to continue their growth. This round is often used to stabilize the company or prepare for an IPO.
Series D Funding Comparison
Meet Average

Industry standards

$77M
$70M
$70M
$80M
$100M

Company News

Oberig IT
Aug 25th, 2026
Cymulate launches MCP Server and Claude Plugin.

Cymulate launches MCP Server and Claude Plugin. How Cymulate transforms exposure validation from a destination platform into an AI-native security capability. Security teams have more data than ever before, but less time to act on it. Over the past several years, Cymulate has continued to evolve continuous exposure validation beyond attack simulation. Oberig IT has expanded the platform to help organizations continuously validate their security controls, prioritize vulnerabilities to support continuous threat exposure management (CTEM), auto-mitigate with vendor-specific remediation and accelerate security operations with agentic AI. Now Oberig IT is taking the next step to make automated validation more accessible across security teams and integrated into security processes with the Cymulate MCP Server and Cymulate Claude Plugin. As AI becomes the primary interface for how security teams investigate threats, automate workflows and make decisions, exposure validation must become part of that AI ecosystem. It must not remain confined to another security console. The Cymulate MCP Server and Cymulate Claude Plugin extend the platform beyond its own interface, enabling all customers to access validated exposure intelligence directly from the AI tools they already use to manage one-off tasks or create recurring agentic processes that execute assessments or apply validation findings. Whether organizations are building enterprise AI workflows or empowering analysts with AI assistants, Cymulate now delivers exposure validation and agentic cyber defense engineering where security work is increasingly happening. In this blog, you'll learn: * Why AI is becoming the new interface for security operations and how leading organizations are moving beyond traditional security dashboards. * How Cymulate is continuing to innovate Exposure Validation by bringing validated security intelligence directly into your organization's AI ecosystem. * The difference between the Cymulate MCP Server and the Cymulate Claude Plugin, and how the Claude Plugin includes Cymulate expertise in through programmed AI skills. * How integrating Cymulate with your preferred AI tools enables analysts to use AI systems with natural language to investigate threats, validate exposures, automate remediation workflows and generate reports. * Why combining Cymulate with third-party security data, including SIEM, EDR, vulnerability management, threat intelligence, ticketing and cloud security platforms, expands security orchestration and creates a richer context for faster and better-informed security decisions. * Real-world examples of how security teams can operationalize exposure validation through AI-driven workflows to accelerate detection engineering, CTEM, remediation validation and executive reporting. * Cymulate vision for AI-native security operations to help organizations make validated exposure intelligence accessible with speed and scale wherever security decisions are made. Expanding the Cymulate platform into AI ecosystems. Cymulate has always focused innovation on helping security teams move from identifying risk to validating it, prioritizing it and mitigating it. Oberig IT has made major advancements in simplifying the complexity of operating exposure validation and making it accessible and usable for all types of organizations. Its latest innovations continue that journey by extending Cymulate beyond the platform itself. Organizations can now integrate Cymulate Exposure Validation directly into their AI ecosystem through two complementary capabilities: * The Cymulate MCP Server, the foundation to provide open access for enterprise AI platforms and custom workflows * The Cymulate Claude Plugin, which builds on that foundation by adding Cymulate-managed AI skills that deliver expert guidance with minimal setup Together, these capabilities transform Cymulate from a siloed application into an intelligent service that becomes part of everyday security operations across all teams. Innovation that goes beyond connectivity. Many vendors are racing to expose APIs or deploy MCP servers. But simply connecting an AI assistant to a platform doesn't make it effective. Organizations still need to teach AI how experienced security practitioners investigate threats, validate exposures, prioritize findings and recommend actions. That's where the Cymulate Claude Plugin delivers a different kind of innovation. Rather than starting with a blank slate, the plugin combines secure platform access with Cymulate-managed AI skills that package years of security expertise into reusable workflows. Customers spend less time building prompts and more time solving problems. The result is: * Faster time to value * More consistent outcomes * Less prompt engineering * Easier adoption across security teams and less maintenance * AI workflows that reflect Cymulate best practices from day one Operationalize and integrate exposure intelligence across your security ecosystem. Connecting Cymulate to AI is about much more than replacing clicks with prompts. The real value comes from bringing validated exposure intelligence together with the rest of your security ecosystem. Every security decision relies on context. A vulnerability scanner may identify a critical CVE, your SIEM may detect suspicious activity and threat intelligence may indicate active exploitation. But these tools often answer different questions in isolation. By integrating Cymulate into your AI ecosystem, security teams can combine validated exposure data with information from other security tools, risk-based asset and vulnerability management, threat intelligence, ticketing systems, CMDBs, cloud security platforms and other enterprise tools. Instead of manually correlating data across multiple consoles, AI can synthesize information from across the environment and provide a more complete picture of organizational risk. For example, an analyst can ask: "Which of our actively exploited vulnerabilities have already been validated by Cymulate, remain unmitigated and have open ServiceNow tickets?" Rather than logging into multiple products to gather and synthesize the information, AI assembles the answer in seconds, streamlining the entire security workflow process. This is just one of many powerful ways that Cymulate validated exposure intelligence enhances AI-driven security operations. A few additional examples include: * Threat Validation: When a new threat actor or CVE is disclosed, AI can identify relevant campaigns, launch Cymulate assessments, determine whether your environment is exposed, and summarize the results for security leadership, all from a single prompt or as part of a scheduled AI workflow. * Remediation Validation: After a patching effort, AI can automatically rerun relevant attack simulations, confirm whether mitigations are effective, identify remaining gaps and prioritize next steps. * Detection Engineering: Detection engineers can validate and improve detection coverage by running a real-world attack simulation, generating a new detection rule, deploying it to their SIEM and rerunning the attack to confirm the threat is detected, all from a single prompt or automated workflow. * Executive Reporting: AI can automatically generate weekly executive risk summaries, board-ready cyber posture reports, exposure trend analysis, MITRE ATT&CK coverage updates, and remediation progress reports by combining validated Cymulate findings with data from across the security ecosystem to communicate business risk and security improvements with confidence. These aren't isolated AI use cases. They are examples of how organizations can operationalize Cymulate Exposure Validation as part of their everyday security operations. By combining proven exposure data with information from third-party security tools, organizations can accelerate investigations, improve decision-making, prioritize remediation based on actual risk, manage risk and make Continuous Exposure Validation an integral part of everyday security workflows Continuing to shape the future of Exposure Validation. At Cymulate, innovation has never been about adding features for the sake of features. It's about helping organizations continuously improve their security posture while reducing operational complexity and streamlining resources. By extending Exposure Validation into the AI platforms customers already use, Oberig IT is operationalizing validated security intelligence by making it easier to access and combine with the rest of the security ecosystem. Whether organizations choose the flexibility of the MCP Server for any AI platform or the guided and structured experience of the Cymulate Plugin (available only in Claude right now), they gain a new way to put validated exposure data at the center of AI-driven security operations. Because the future of cybersecurity isn't just AI-powered. It's AI powered by validated security intelligence. Solution on the topic Contact Oberig IT if you need to protect your business or strengthen your company's infrastructure. Kyiv, 13 Mykola Pymonenko Street, building 8C, office 21/22, 04050 Kazakhstan Astana, st. Kunaeva, 2, BC "CCC", 6th floor, 010000 Moldova, Georgia, Armenia, Romania Moldova, Chisinau, 174 Kolumna Street, MD2004 Azerbaijan Baku, 37 Khojaly Avenue, Demirchi Tower, 15th floor, AZ1025 Lublin, Hugo Kollataja str. 6, block 3, 20-006 Uzbekistan, Kyrgyzstan, Tajikistan, Turkmenistan

BitSight
Aug 5th, 2026
Cymulate to partner with Bitsight to help security teams validate defenses against the threats that matter.

Cymulate to partner with Bitsight to help security teams validate defenses against the threats that matter. August 05, 2026 Integration will connect Bitsight Threat Intelligence with Cymulate Exposure Validation to help customers prove security effectiveness and close validated gaps. TEL AVIV - August 5, 2026 - Cymulate, the leader in security and exposure validation, today announced its plans for a new integration with Bitsight, the global leader in cyber risk intelligence, to connect threat intelligence with continuous exposure validation. The integration will bring Cymulate's validation capabilities and Bitsight's threat intelligence together in one continuous workflow. Bitsight helps customers identify the threats most relevant to their organization, and Cymulate tests whether their defenses can stop them. Those results will then flow back into Bitsight, giving customers a more complete view of where risk is real and where action is needed. Through the integration, customers will be able to * Focus validation on relevant threats by using Bitsight threat intelligence to identify adversaries, campaigns, TTPs, IoCs, targeting trends and related CVEs that matter most to their organization. * Prove prevention and detection coverage by running Cymulate validation scenarios against the techniques and indicators associated with ransomware groups, APTs, malware families and campaigns. * Prioritize risk and remediation with evidence by connecting Bitsight threat context with Cymulate validation results to identify demonstrated control gaps associated with relevant threats. Customers can then apply remediation guidance, automated mitigation, and retest to confirm improvement. * Enrich threat intelligence with validation results by returning Cymulate evidence to the relevant threat actor, TTP, and CVE views in Bitsight, so customers can see which techniques their controls prevent or detect, and where gaps remain. * Streamline threat hunting through attack validation by validating threat detections and supporting threat hunters in determining whether their organization is or has been compromised. "Threat intelligence tells security teams what they should care about, but validation proves whether defenses can stop it," said Avihai Ben-Yossef, Cymulate co-founder and CTO. "By connecting Bitsight Threat Intelligence with Cymulate Exposure Validation, customers can tailor their testing to their specific threats, measure how controls perform against those threats and take action to improve resilience." "Security teams do not need another list of potential issues - they need evidence of which exposures create real risk," said Gabi Reish, VP Product at Bitsight. "This partnership will advance Bitsight's threat-informed approach to risk prioritization by enabling customers to validate the severity and potential impact of findings across their attack surface." The combination of Cymulate's adversarial exposure validation with Bitsight's asset discovery, business context, and threat intelligence supports a more complete continuous threat exposure management (CTEM) program. Together, Cymulate and Bitsight will help customers move from identifying potential exposure to validating and addressing the gaps that matter most. About Cymulate Cymulate is the leader in proactive, AI-powered security that continuously proves, prioritizes and adapts against real attacker behavior - before incidents occur. More than 1,000 enterprise security teams rely on Cymulate for autonomous threat validation and cyber defense engineering. Founded and led by experienced red teamers who know that testing alone does not deliver better security, Cymulate goes beyond threat validation to build threat- and exposure-informed cyber defenses. For more information, visit www.cymulate.com.

Yahoo Finance
Aug 4th, 2026
Cymulate launches Cowork agentic AI for autonomous cyber defense workflows

Cymulate has launched three AI-powered tools aimed at automating cybersecurity workflows. Announced at Black Hat USA 2026 in Las Vegas, the tools expand the company's Vero AI platform to enable autonomous cyber defence operations. Cymulate Cowork allows users to create automated security workflows using natural language prompts. It assembles agents and integrations to analyse risk, validate security measures, and coordinate actions across security tools. Users can schedule recurring tasks such as threat analysis, vulnerability assessments, and mitigation tracking. The Cymulate Claude Plugin and Model Context Protocol Server extend the platform's capabilities into customer AI environments and open AI ecosystems. According to CTO Avihai Ben-Yossef, the tools address the manual, fragmented nature of cyber defence work whilst reducing dependence on scarce security expertise.

Cymulate
Jun 2nd, 2026
Beyond validation. The Future is agentic cyber defense engineering.

Beyond validation. The Future is agentic cyber defense engineering. Last Updated: June 2, 2026 What's the value of one more dashboard, one more list of security findings? Today's cyber program must apply insights to engineer stronger security that automatically adapts to today's threats and exposures. It's an AI vs. AI battleground. Attackers apply artificial intelligence to evolve and exploit at machine speed. Validation and testing alone are not enough. Defenders must also apply AI to continuously evolve security. While AI is driving unprecedented scale to automated pen testing and attack simulation, too often the results are limited to hundreds or even thousands of new security findings that require manual remediation. AI must provide more than insights. Security teams demand agentic AI that combines insights with action to engineer adaptive security. "Autonomous engines of defiance" As Cymulate Ltd automate the discovery of every form of threat exposure and security posture, Cymulate Ltd overwhelm teams with growing lists of tasks and projects while deploying disparate security tools that operate in silos to handle the hundreds of "jobs to be done" to stay ahead of the next threat. A recent Gartner report said it best: "Stop building 'dashboards of despair' that only report on decay and start engineering autonomous engines of defiance."[1] This is only possible through agentic AI to drive the collaboration of threat intelligence, security testing, exposure discovery and security controls. Prove, Prioritize and adapt Cybersecurity. Today, Cymulate launched a major evolution of its platform to make exposure validation more autonomous while integrating automated security testing into preemptive security that continuously adapts to external threats and your internal exposures. Cymulate Ltd call this agentic cyber defense engineering - a closed-loop system to prove, prioritize and adapt. With this innovation, Cymulate now delivers the proactive, AI-driven security that closes the risk-to-fix gap by optimizing your existing security to stay ahead of your environment-specific threats. Going beyond one-size-fits-all assessment templates and static lists of security findings, Cymulate engineers autonomous engines of defiance to: * Profile relevant attacker behavior * Tailor testing to your environment, assets, industry, exposures and controls * Execute safe, realistic attack simulation * Validate prevention and detection of existing security controls * Prioritize fixes by real-world impact * Optimize security controls to mitigate with and threat detection Introducing Cymulate Vero AI. To deliver agentic cyber defense engineering, the Cymulate platform now includes Vero AI. Through agentic workflows, Cymulate delivers proactive exposure validation to test more of what's relevant to you and automate the security controls updates that adapt to threats and exposures. With Vero AI, Cymulate automates both insights and action: * New threat intel => Vero AI creates and run an assessment specific to your environment * New exposure discovered by your scanner => Vero AI triggers assessment to validate exploitability * New or modified SIEM rule => Vero AI creates and runs an assessment to validate effectiveness * Security control configuration change => Vero AI triggers control assessment to validate updates and identify drift Agentic cyber defense engineering control plane. To engineer defenses from these triggers and validation insights, Vero AI provides the Cymulate platform with an agentic cyber defense control plane, a closed-loop system to prove, prioritize and adapt security. Continuous validation drives continuous improvement across security controls and detections with a system of agents that include: * Threat intel agent => Analyze threat intel for what's relevant to you * Attack scenario mapping agent => Identify attack scenarios for threats * Targeting agent => Identify the environment(s) to test * Assessment builder agent => Assemble assessment configuration * Mitigation agent => Prioritize and coordinate action * Reporting agent => Build & share dashboards & reports These agents work in coordination with deep integrations to security controls for Cymulate to: * Understand control response with API integrations for full context of telemetry, alerting and detection logic * Create vendor-specific mitigations with new detection logic and threat updates for your specific security control * Pushes threat and detection updates directly to security controls with trusted auto mitigation Engineering threat detection with Cymulate Detection Studio. Agentic cyber defense engineering includes proactive detection engineering. Powered by Vero AI, Cymulate Detection Studio is a new extension of the Cymulate platform that takes a rule-led approach to detection engineering by validating SIEM rules against real-world threats. Cymulate Detection Studio ingests the detection rules from a SIEM and applies Vero AI to map those rules to Cymulate attack scenarios for validation tailored to the specific detection rule. Using automated correlation and agentic cyber defense engineering, Cymulate identifies where detections fail and delivers vendor-specific rule recommendations to tune and continuously validate detections. Mitigation Hub Coordinates Mobilization Cyber defense engineering demands coordinated action, so Cymulate Exposure Validation now includes a Mitigation Hub to drive meaningful and measurable security optimization by converting Cymulate insights, findings and data into prioritized, actionable and automated mitigation tasks. With Vero AI making validation more autonomous, the Mitigation Hub feature allows security engineers to focus on action with clear visibility to all assessment results and easy workflows to group actions by: * Security control * Environment * Indicators of Compromise (IoCs) * Exposure or CVE The Future of preemptive cyber security. For years, the security industry prioritized visibility to provide insights of vulnerabilities to fix, configurations to update, controls to tune, new investments to prioritize. Today, the movement to proactive security is undeniable with security teams adopting continuous threat exposure management (CTEM), new technologies emerging like automate security control assessment, and the potential market disruption of AI SOC agents. In the end, the core security requirement remains: engineer defenses faster than attackers find your gaps. That's the Cymulate mission. That's why Cymulate Ltd deliver agentic cyber defense engineering. [1] "Emerging Tech: The Future of Exposure Management Will Be Preemptive - Driven By Autonomous Interdiction," Gartner, Feb. 13. 2026. Avihai Ben-Yossef Avihai is the co-founder and CTO of Cymulate. He started his career in an intelligence unit of the IDF in a leading technological role. Prior to Cymulate, Avihai was the head of the cyber research team at Avnet Cyber & Information Security, where he worked on several projects on behalf of the Israeli Ministry of Defense. Table of Contents Cymulate Exposure Validation makes advanced security testing fast and easy. When it comes to building custom attack chains, it's all right in front of you in one place. Mike Humbert, Cybersecurity Engineer DARLING INGREDIENTS INC.

ITWeb
May 13th, 2025
Cymulate reveals proven value across industry sectors at ITWeb Security Summit 2025 CT event

Cymulate, which positions itself as the leader in security and exposure validation, is a platinum sponsor of the ITWeb Security Summit 2025 Cape Town on 27 and 28 May, where it will reveal the proven value of its solutions and implementations across a broad range of industry sectors.

Recently Posted Jobs

Sign up to get curated job recommendations

Cymulate is Hiring for 10 Jobs on Simplify!

Find jobs on Simplify and start your career today

Don't see your dream role? Check out thousands of other roles on Simplify.Browse all jobs