VENDOR NOTES · CYCOGNITO
CyCognito: ASM and exposure management facts (2026)
SHORT ANSWER
CyCognito starts from the organisation's name alone, attributes each asset to a subsidiary or brand with a trace of why, runs more than 100,000 active tests and retests after each fix. AWS Marketplace lists a 250-asset plan at $30,000 for 12 months. It checks WAF coverage but does not describe deploying rules or other automated mitigation.
By The Exposure Desk · Exposure Management Finder · Published 2026-10-11
Desk research from public vendor pages read in September 2026, updated 2026-10-11. Profiles follow our published method; we did not run the products.
Which tool types does CyCognito describe?
- Outer point: described on the vendor's pages we read
- Inner point: not in our sources (it may exist; we did not find it)
| Type | Status | What the pages say | Source |
|---|---|---|---|
| EASM discovery | Described | Starts from the organisation's name with no IP ranges or asset lists, and attributes assets to subsidiary, brand or business unit. | Source: CyCognito discovery · Read 27 Sep 2026 |
| Exposure validation | Described | More than 100,000 tests across 30+ categories, unauthenticated and designed not to change state. | Source: CyCognito active security testing · Read 27 Sep 2026 |
| Exposure management platforms | Described | CyCognito calls its product an exposure management platform; internal assets are not described on the pages we read. | Source: CyCognito press release: Continuous AI Pentesting · Read 27 Sep 2026 |
| CTEM programme support | Described | Describes CTEM as "discovery to remediation" and "what ties the platform together": discovery, context, prioritisation, validation and remediation, with a retest after each fix. | Source: CyCognito homepage (re-read) · Read 11 Oct 2026 |
| WAF posture | Described | Its Application Security use case includes ensuring WAF coverage; producing or deploying WAF rules is not described. | Source: CyCognito homepage (re-read) · Read 11 Oct 2026 |
How does CyCognito prove an exposure is real?
| Exploitability checked | Matches Active black-box tests with no brute force or state changes. Source: CyCognito active security testing · Read 27 Sep 2026 |
|---|---|
| Attack-style testing | Matches More than 100,000 active tests, and Continuous AI Pentesting announced on 16 June 2026. Source: CyCognito press release: Continuous AI Pentesting · Read 27 Sep 2026 |
| Retests after a fix | Matches Retests after each fix. Source: CyCognito remediation acceleration · Read 27 Sep 2026 |
What does CyCognito do with a finding?
| Subsidiary and owner attribution | Matches Every finding carries a trace of how it was found and why it belongs to the subsidiary, brand or business unit. Source: CyCognito discovery · Read 27 Sep 2026 |
|---|---|
| Routes findings to owners and tickets | Matches Owner-linked workflows with ServiceNow, Jira, Splunk and Zendesk. Source: CyCognito remediation acceleration · Read 27 Sep 2026 |
| Applies a compensating control | Not in our sources |
| Works through your WAF or edge | Not in our sources |
| WAF coverage across several vendors | Partly Its Application Security use case includes ensuring WAF coverage; producing or deploying WAF rules is not described. Source: CyCognito homepage (re-read) · Read 11 Oct 2026 |
| Integrations | ServiceNow, Jira, Splunk and Zendesk for remediation workflows. Source: CyCognito remediation acceleration · Read 27 Sep 2026 |
Where does CyCognito run, and what does it connect to?
| Deployment | Unauthenticated black-box testing from outside, with no brute force or state changes. Source: CyCognito active security testing · Read 27 Sep 2026 |
|---|---|
| Internal as well as external assets | Not in our sources |
| Cloud connections named | Not in our sources |
| Platform it extends | None |
| Platforms it connects to | None in our sources |
What does CyCognito cost?
AWS Marketplace, 12-month contract: CyCognito ASM 250 (up to 250 assets) $30,000; 24- and 36-month contracts save up to 8% and 11%. Direct pricing basis: total asset volume (ASM); active IPs and web applications (exposure validation), by quote.
Source: AWS Marketplace: CyCognito Attack Surface Management Platform · Read 11 Oct 2026
Source: CyCognito pricing · Read 27 Sep 2026
Trial or self-serve start: Not in our sources
Where is CyCognito strong, and where are its limits?
Strengths and limits come from the vendor's own pages and our sources; a limit can be something we did not find.
Strengths
- Starts from the organisation's name alone, with no IP ranges or asset lists.
- Each finding carries a trace of how it was found and why it belongs to you.
- Retests after each fix, and lists a 250-asset plan on AWS Marketplace.
Limits
- No automated mitigation is described: remediation is guidance, owner-linked tickets and retests.
- WAF coverage is checked, but producing or deploying WAF rules is not described.
What does CyCognito say about itself?
What do peer reviews say?
Context only. Ratings come from Gartner Peer Insights' External Attack Surface Management market page read on 11 October 2026. They are not used in the finder and we have not verified them.
4.7 from 39 ratings.
Source: Gartner Peer Insights: External Attack Surface Management market · Read 11 Oct 2026
What has CyCognito announced recently?
- 2026-06-16
Unveiled Continuous AI Pentesting, AI-driven offensive testing that runs continuously across the external attack surface through its Target Graph architecture.
Source: CyCognito press release: Continuous AI Pentesting · Read 27 Sep 2026
Who should shortlist CyCognito?
Consider CyCognito if you want to start from a company name and see the attribution trail for each asset, or if you need proof that a fix worked, through a retest.
In our example finder profiles, CyCognito is not in the first group; your own answers may differ.
Run the finder with your answersHow does CyCognito compare with each other vendor?
Questions readers ask
Does CyCognito prove exploitability?
Matches. Active black-box tests with no brute force or state changes. Attack-style testing: Matches.
Does CyCognito work with WAFs?
Not in our sources. Not described on the pages we read.
Does CyCognito publish its prices?
AWS Marketplace, 12-month contract: CyCognito ASM 250 (up to 250 assets) $30,000; 24- and 36-month contracts save up to 8% and 11%. Direct pricing basis: total asset volume (ASM); active IPs and web applications (exposure validation), by quote.