Cymulate
Cymulate runs breach and attack simulation software that tests if security defenses actually work.
On the record
Checkpoint: Vero AI agentic platform GA milestones and customer adoption data
The call
Cymulate has real customers and a real product, but sits as a Challenger in a field where the giants it validates against are starting to validate on their own.
Cymulate sells software that helps companies test how well they can defend against cyberattacks. It has real customers locked into its platform and nine years of attack examples it built itself, which is hard to copy quickly. However, giants like Microsoft, Palo Alto Networks, and IBM (which already bought a rival called Randori) are building the same thing into their own products, and artificial intelligence tools could make Cymulate's reports and recommendations easier for anyone to create. The company's funding has been flat since 2022, which suggests either smart cost control or trouble growing, and the next funding round announcement or acquisition offer will show which one is true.
Why
01
AI pressure: Generic LLM security copilots from platform vendors. AI copilots threaten to automate report writing and remediation drafting that Cymulate now sells as part of its platform. Could AI do the core job? Only partly.
02
Bigger players: Microsoft, Palo Alto Networks, CrowdStrike, IBM/Randori. Microsoft bundles validation into Defender, IBM already owns Randori, and Palo Alto and CrowdStrike ship native posture testing that competes directly. Could a giant copy it? Yes, easily.
03
What protects it. A 9 year attack content library and deep workflow integration make customers slow to rip Cymulate out once installed.
What would change this call
Cymulate announces a Series E or is acquired within 12 months. Shows whether investors see independent growth or a sideways exit as more likely.
Next Gartner Magic Quadrant or ESP report on exposure validation names a platform giant as Leader over Cymulate. Would confirm platform bundlers are overtaking neutral specialists in buyer perception.
Vero AI agentic platform reports customer adoption numbers or case studies within 6 months of GA. Tests whether Cymulate's AI defense is gaining real usage or stalling.
Next Gartner Magic Quadrant or ESP report on exposure validation names a platform giant as Leader over Cymulate. Would confirm platform bundlers are overtaking neutral specialists in buyer perception.
Vero AI agentic platform reports customer adoption numbers or case studies within 6 months of GA. Tests whether Cymulate's AI defense is gaining real usage or stalling.
Key numbers
- $141M raised total, flat since Sept 2022
- 1,000+ customers in 50+ countries
- ~300 employees globally
Named risks
- Platform giants (Microsoft, Palo Alto, CrowdStrike, IBM) shipping native validation could commoditize the category.
- No new funding round since September 2022 raises questions of stalled growth or valuation markdown.
- Ranked Challenger, not Leader, among 15+ vendors in a 2026 industry matrix, limiting differentiation.
- Public competitive disputes, such as Picus Security's allegations, could escalate into legal or reputational exposure.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| IBM (Randori) | gaining on | IBM-owned Randori already shipping competitive native validation offering, cited 2026-04-17 |
| Microsoft | gaining on | Defender for Office 365 bundles free attack simulation training with E5 license, 2026-01-05 |
| Picus Security | contesting | Picus publicly alleges Cymulate made false and misleading claims about it, 2026-01-14 |
| CrowdStrike, Palo Alto Networks | gaining on | Both bolting agentic red-teaming and validation onto existing platforms per Prisma AIRS materials, 2026 |
| XM Cyber, Pentera, AttackIQ, SafeBreach | contesting | Named as closest direct BAS/AEV/CTEM rivals in a 2026-04-17 comparison of top tools |
Questions people ask
- Is Cymulate profitable in 2026?
- Cymulate does not publicly disclose revenue or profitability figures. It has raised $141M cumulative through a $70M Series D closed September 6, 2022, with no new round announced through July 2026, suggesting either capital discipline toward profitability or stalled growth.
- Who owns Cymulate?
- Cymulate is privately held and venture-backed, not publicly traded. Its September 6, 2022 Series D of $70M was led by One Peak, joined by Susquehanna Growth Equity, Vertex Ventures Israel, Vertex Growth, and Dell Technologies Capital, bringing cumulative funding to $141M.
- Is Cymulate a safe company to join right now?
- Cymulate employed nearly 300 people as of January 2025 with no reported layoffs, and made its first acquisition (CYNC Secure) that month. However, no new funding round has landed since September 2022, and the company is ranked 'Challenger' among 15+ vendors as of 2026.
- Could AI replace Cymulate's product?
- Cymulate's own value proposition already automates manual penetration testing via breach and attack simulation. It defends against further AI commoditization with its June 2026 'Vero AI' agentic engine and a July 2026 Anthropic Cyber Verification Program partnership, per its own announcements.
- Who is Cymulate's biggest competitor?
- IBM (via its Randori acquisition), Microsoft Defender's built-in attack simulation training, and BAS rivals AttackIQ, SafeBreach, Picus Security, XM Cyber, and Pentera all compete directly, per a 2026-04-17 industry comparison; Picus has publicly disputed Cymulate's marketing claims.
- Has Cymulate raised a new funding round since 2022?
- No. Cymulate's last disclosed round was a $70M Series D announced September 6, 2022, bringing cumulative funding to $141M. CB Insights data through January 2026 shows no Series E or new equity round reported since then.
Timeline
- 2026-07-06Cymulate joins Anthropic Cyber Verification Program for defensive AI research access
- 2026-06-04Announces Agentic Cyber Defense Engineering with Vero AI, Mitigation Hub, Detection Studio
- 2026-01Joins Wiz Integration Network for cloud-risk validation
- 2025-08-05Launches unified Exposure Management Platform with agentic AI workflows
- 2025-07-01Launches Cymulate AI Copilot in beta
- 2025-06Launches AI-powered Detection Engineering Assistant
- 2025-02-18Reveals next-level AI automation for threat exposure validation
- 2025-01-07Acquires CYNC Secure for a reported $10M, its first acquisition
- 2022-09-06Closes $70M Series D led by One Peak, cumulative funding hits $141M
- 2016Founded in Israel by Eyal Wachsman and Avihai Ben-Yossef
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- From Pen Testing to Exposure Management (2025-06-25)
- Cyberattack simulation company Cymulate picks up $7.5m in Series A
- Attack Simulation Firm Cymulate Raises $15 Million (2023-01-23)
- Cymulate snaps up $70M to help cybersecurity teams stress test their networks with attack simulations (2022-09-06)
- Products, Competitors, Financials, Employees, Headquarters Locations (2026-01-26)
- Cymulate acquires CYNC Secure to enhance exposure management solutions (2025-01-07)
- Cymulate Secures $70M Series D to Accelerate Growth (2025-01-06)
- Cymulate Named Gartner Customers' Choice 2025 (2026-03-29)
- Cymulate 2026 Company Profile
- Cymulate Expands Exposure Management With CYNC Secure Deal (2026-06-25)
- Cymulate Acquires CYNC Secure to Advance CTEM Innovation (2025-02-19)
- Cymulate Reveals Next-level AI Automation for Threat Exposure Validation (2025-02-18)