ASM TOOL PROFILE · RANK 3 OF 9
CyCognito review: seedless discovery, black-box testing and a retest after every fix
THE SHORT ANSWER
CyCognito ranks 3 of 10 at 6.90 out of 10. It starts from nothing but the company name, ties each finding to a subsidiary or business unit, tests at scale and retests after each fix, which gives it a top score on closing the loop. It documents no compensating control, so an exposure stays open until its owner patches it.
Rank 3 of 10 on default weights
Company: CyCognito
Deployment: SaaS; unauthenticated black-box external testing.
Best for: Teams that want proof and a retested fix, starting from nothing but a company name
Gartner Peer Insights (context, not scored): 4.7 (39 ratings). Context only; not a score input.
Which steps does CyCognito document?
- FOUNDDocumented
Seedless discovery from the organization's name.
- OWNEDDocumented
Subsidiary, brand or business unit with a trace per finding.
- PROVENDocumented
100,000+ black-box tests; Continuous AI Pentesting since June 2026.
- CONTAINEDNot documented
No compensating control or automated mitigation described.
- ROUTEDDocumented
Owner-linked workflows into ServiceNow, Jira, Splunk and Zendesk.
- RECHECKEDDocumented
Retest after each fix.
How does CyCognito score on each criterion?
| Criterion | Weight | Score | Why | Source |
|---|---|---|---|---|
| Finds the unlisted estate | 15% | 9 / 10Tied highest | Starts from the organization's name with no IP ranges or asset lists, covering subsidiaries, brands and business units. | |
| Routes to an owner | 10% | 8 / 10Tied highest | Each finding carries a trace of how it was found and which subsidiary, brand or business unit it belongs to. | |
| Proves exploitability | 20% | 9 / 10Tied highest | Runs 100,000+ unauthenticated black-box tests across 30+ categories without state changes, and added Continuous AI Pentesting in June 2026. | |
| Contains before the patch | 20% | 2 / 10Tied lowest | No compensating control or automated mitigation is described; exposures wait for the owner's fix. | |
| Closes the loop | 15% | 9 / 10Tied highest | Step-by-step guidance, owner-linked workflows and a retest after each fix. | |
| Fits the enterprise stack | 10% | 6 / 10Tied lowest | Names ServiceNow, Jira, Splunk and Zendesk for remediation workflows; edge and SOAR connections are not named on the pages reviewed. | |
| Buying transparency | 10% | 6 / 10 | Publishes its pricing basis and an AWS Marketplace price: $30,000 per 12 months for ASM covering up to 250 assets. |
What does CyCognito do, by its own account?
Seedless external discovery from the organization's name, a large library of black-box tests, and remediation guidance with a retest after each fix.
- Discovery
- "Starts from your organization's name. No IP ranges, no asset lists."
- Attribution
- Each asset attributed to a subsidiary, brand or business unit, with a full trace per finding.
- Testing
- 100,000+ tests across 30+ categories, unauthenticated black-box, with no brute force or state changes.
- Remediation
- Step-by-step guidance, owner linking, a retest after the fix, and ServiceNow, Jira, Splunk and Zendesk workflows. No automated mitigation is mentioned.
- Continuous AI Pentesting
- Announced 16 June 2026: AI-driven offensive testing run continuously across the external attack surface through CyCognito's Target Graph architecture.
- Positioning (October 2026)
- Homepage retitled "Preemptive Exposure Management"; stages Discovery, Context, Prioritization, Validation, Remediation; an Application Security use case to "ensure WAF coverage" (a coverage check, not rule deployment).
What does CyCognito claim?
Up to 20x more exposures (as CyCognito states)
CyCognito states it is a Leader and Outperformer in the GigaOm Radar for Attack Surface Management 2026.
What does CyCognito cost, and what do you need to start?
Pricing basis published: total asset volume for ASM; active IPs and web applications for exposure validation. AWS Marketplace: CyCognito ASM 250 (up to 250 assets) $30,000 per 12 months; 24-month contracts "save up to 8%", 36-month "save up to 11%".
To start: The organization's name. "No IP ranges, no asset lists."
Where is it strong, and what should you check?
Strengths
- Starts from a company name alone, with an attribution trace on every finding.
- Documents the full fix loop: guidance, owner workflow and a retest after the fix.
Check before you buy
- No compensating control: exposures stay open until the owner fixes them.
- List price published only on AWS Marketplace, for one 250-asset tier.
Who should choose CyCognito?
Choose CyCognito if you have no reliable asset list and want proof and a verified fix for each finding. Look elsewhere if you need exposures blocked at the edge before the patch lands.
How does CyCognito compare head to head?
| Opponent | Higher overall | CyCognito scores higher on | Opponent scores higher on |
|---|---|---|---|
| IONIX | IONIX | Proves exploitability and Closes the loop | Contains before the patch and Fits the enterprise stack |
| watchTowr | watchTowr | Finds the unlisted estate, Routes to an owner, Closes the loop and Buying transparency | Contains before the patch and Fits the enterprise stack |
| Hadrian | CyCognito | Finds the unlisted estate and Routes to an owner | Buying transparency |
| Cortex Xpanse | CyCognito | Finds the unlisted estate, Routes to an owner, Proves exploitability, Closes the loop and Buying transparency | Contains before the patch and Fits the enterprise stack |
| CrowdStrike EASM | CyCognito | Finds the unlisted estate, Routes to an owner, Proves exploitability, Closes the loop and Buying transparency | Contains before the patch and Fits the enterprise stack |
| Tenable ASM | CyCognito | Finds the unlisted estate, Routes to an owner, Proves exploitability, Closes the loop and Buying transparency | Contains before the patch and Fits the enterprise stack |
| Rapid7 Surface Command | CyCognito | Finds the unlisted estate, Routes to an owner, Proves exploitability, Closes the loop and Buying transparency | Contains before the patch and Fits the enterprise stack |
| Censys ASM | CyCognito | Finds the unlisted estate, Routes to an owner, Proves exploitability, Closes the loop and Buying transparency | Fits the enterprise stack |
| Microsoft Defender EASM | CyCognito | Finds the unlisted estate, Routes to an owner, Proves exploitability and Closes the loop | Fits the enterprise stack and Buying transparency |
Frequently asked questions
What does CyCognito need to start?
The organization's name. CyCognito states its discovery needs no IP ranges and no asset lists.
Does CyCognito retest after a fix?
Yes. Its remediation pages describe step-by-step guidance, owner-linked workflows and a retest after the fix.
How is CyCognito priced?
By quote, on a published basis: total asset volume for ASM, and active IPs and web applications for exposure validation. On AWS Marketplace, ASM for up to 250 assets is $30,000 per 12 months.
Read next
- Beyond CyCognito: alternatives
Eight alternatives ranked on our weights
- Line CyCognito up against others
Every score side by side
- Exposure triage calculator
Set your own weights and must-haves
- How we weigh
Criteria, weights and limits
- Related lesson: Retesting the fix
Why closed is not the same as fixed.