SafeBreach
Israeli firm selling breach and attack simulation software to test enterprise defenses.
On the record
Checkpoint: Next funding round or acquisition event, given no raise since Series D and active BAS market consolidation
The call
SafeBreach built real attack-simulation technology and sticky integrations, but sits capital-starved and smaller than rivals while giants fold similar features into their suites.
SafeBreach sells software that simulates hacker attacks on a company's computer systems to find weaknesses before real attackers do. The company has built a real advantage through 25,000 attack techniques it has collected and a way to safely run simulations inside production systems, plus it plugs into tools that security teams already use. However, bigger rivals like Google, Microsoft, and Palo Alto are adding similar capabilities to their own broader security packages, and they can do this cheaply because building attack simulations is becoming routine work that artificial intelligence can handle. SafeBreach has not raised new money since late 2021, has not grown its staff, and is now smaller in revenue than competitors Pentera and Cymulate, so the company may need a cash injection or acquisition within the next year or two to survive the squeeze.
Why
01
AI pressure: AI-driven adversary-generation tools compressing commodity attack playbooks. AI can auto-generate attack scenarios and reports, threatening the core Hacker's Playbook product; SafeBreach's own Helm and AI-CTEM answer this but show no revenue lift yet. Could AI do the core job? Only partly.
02
Bigger players: Google/Mandiant, Microsoft Attack Simulator, Palo Alto Networks, Rapid7, Qualys. Big security suite vendors are bundling breach simulation into broader platforms, offering 'good enough' for free or cheap alongside SIEM/XDR. Could a giant copy it? Yes, easily.
03
What protects it. 25,000+ proprietary attack techniques plus deep SIEM/SOAR/ServiceNow integrations that customers rely on for daily workflows.
What would change this call
SafeBreach announces a new funding round or acquisition within 12 months. Would show whether it can match Pentera/Cymulate's capital scale or is a distressed sale target.
Helm or AI-CTEM produce publicly reported net retention above 130% or new enterprise wins. Would show AI product bets are actually driving revenue, not just roadmap promises.
Major SIEM/XDR vendors (Rapid7, Qualys, IBM, Fortinet) add native breach-simulation features to core bundles. Would show SafeBreach's standalone niche is being absorbed by suite vendors.
Helm or AI-CTEM produce publicly reported net retention above 130% or new enterprise wins. Would show AI product bets are actually driving revenue, not just roadmap promises.
Major SIEM/XDR vendors (Rapid7, Qualys, IBM, Fortinet) add native breach-simulation features to core bundles. Would show SafeBreach's standalone niche is being absorbed by suite vendors.
Key numbers
- ~$106M total raised, last round Nov 2021
- Estimated revenue ~$23M vs Pentera's ~$105M
- Headcount flat near 140 since 2021
Named risks
- No new funding round since November 2021 amid active BAS sector consolidation.
- Losing relative capital and revenue scale to Pentera and Cymulate.
- Core simulation and reporting functions commoditizing via generic AI adversary-generation.
- Flat headcount growth (99 to 141, 2021 to 2026) and near-zero open roles mid-2026 signal stalled expansion.
- Revenue and valuation figures rely on unverified third-party estimates, not company disclosure.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Pentera | gaining on | Reported ~$105.5M revenue in 2023, dwarfing SafeBreach's estimated ~$23M |
| Cymulate | gaining on | Raised $141M+ VC funding vs SafeBreach's $106M lifetime, plus SMB tier launch Feb 2025 |
| Google/Mandiant (Verodin) | contesting | Acquired Verodin to bundle BAS capability into Mandiant suite |
| Microsoft | contesting | Bundles Attack Simulator into broader security suite, no separate BAS purchase needed |
| AttackIQ | gaining on | AWS Marketplace listing and US Marine Corps Continuous ATO deal noted in 2026 report |
| Palo Alto Networks | contesting | Fields adjacent breach-simulation features bundled into larger security platform |
Questions people ask
- Is SafeBreach profitable in 2026?
- SafeBreach discloses no official revenue or profit figures as a private company. Third-party estimates put revenue near $23M, but these are unverified aggregator guesses. No profitability claim has been made publicly as of July 2026.
- Has SafeBreach raised any funding since 2021?
- No. SafeBreach's last funding round was a $53.5M Series D closed November 9, 2021, led by Sonae IM and Israel Growth Partners with ServiceNow participating, bringing total funding to over $106M. No new round has been reported as of July 2026.
- Who founded SafeBreach and when?
- SafeBreach was founded in September 2014 in Tel Aviv, Israel by CEO Guy Bejerano and CTO Itzik Kotler. The company is now headquartered in Sunnyvale, California, with roughly 70% of staff still based in Tel Aviv R&D.
- Who is SafeBreach's biggest competitor?
- Pentera and Cymulate are SafeBreach's largest rivals in breach and attack simulation. Pentera reported about $105.5M revenue in 2023, and Cymulate has raised over $141M in VC funding, both outscaling SafeBreach's roughly $106M lifetime total, per a January 2026 Mordor Intelligence report.
- Could AI replace SafeBreach's product?
- Core BAS functions like running pre-built attacks and generating reports are commoditizing via generic AI adversary-generation tools, per Mordor Intelligence (Jan 2026). SafeBreach's 25,000+ technique Hacker's Playbook and safe production-grade execution are harder to replicate quickly.
- Who owns SafeBreach and could it be acquired?
- SafeBreach is private and venture-backed, with investors including Sequoia Capital, ServiceNow, Sonae IM and Israel Growth Partners. No acquisition or IPO has occurred as of July 2026, though industry reports flag rising BAS-sector consolidation pressure.
Timeline
- 2026-06-23Launched SafeBreach Helm, an AI agent layer for CTEM lifecycle management
- 2026-06-15Named Best CTEM Platform by The Hacker News Cybersecurity Stars Awards
- 2026-06-10Disclosed Gemini Fake Context Alignment notification-based prompt injection
- 2026-04Announced AI-Powered Continuous Threat Exposure Management launch
- 2026-01-28Released inaugural State of the Breach Report based on 1.8M simulations
- 2025Launched Propagate, agentless automated penetration-testing module
- 2024Launched enhanced MSSP partner program under Elevate initiative
- 2021-11-09Closed $53.5M Series D, total funding passes $106M
- 2020-04Raised $19M Series C led by OCV Partners
- 2014-09Founded in Tel Aviv by Guy Bejerano and Itzik Kotler
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- SafeBreach Lands $15M In Series A Funding
- SafeBreach Raises New Funding to Expand Attack Simulation Technology (2021-02-02)
- SafeBreach - Headcount, Funding & Open Jobs (2026-06-20)
- SafeBreach Closes $53.5 Million Series D New Funding to Fuel Momentum (2021-11-09)
- Safebreach - Overview, News & Similar companies (2026-06-06)
- Revenue, Competitors, Alternatives
- Breach and Attack Simulation Case Studies (2023-11-28)
- 2025 Year in Review (2026-02-04)
- SafeBreach 2024 Year in Review (2025-02-04)
- SafeBreach Careers, Perks + Culture
- Breach And Attack Simulation Market Size, Trends, Share Report 2031 (2026-01-20)
- SafeBreach 2026 State of the Breach Report Reveals... (2026-01-14)