Cymulate Expands Exposure Management with Cync Secure Deal

Cymulate purchased an Israeli startup to evolve from exposure validation to exposure management and bridge the gap between vulnerability finders and fixers.

See Also: August Spotlight | Automated Threat Intelligence Correlation

The New York-based company said it is aligned with Tel Aviv-based Cync Secure’s approach to offensive cybersecurity and will use the deal to drive development of a next-generation exposure management platform, according to co-founder and Chief Technology Officer Avihai Ben-Yossef. He said the deal will help Cymulate scale its operations and allow Cync Secure to transition to a larger deployment platform.

“We are going through some kind of uplift in our position to exposure management, and the acquisition of Cync was a great addition to direct our company and product vision in that direction, with those features of exposure, collection, aggregation, deduplication, all the way to mobilization of that exposure,” Ben-Yossef told Information Security Media Group. “That was the core of the acquisition.”

Cync Secure, founded in 2022, employs 10 people, never raised any outside funding and has been led since inception by Meir Abergel, who also served as CEO of crowdsourced security platform Iron.io and managed security service provider Bugsec. Terms of the acquisition weren’t disclosed, though Calcalist reported Cymulate paid approximately $10 million for Cync Secure (see: Cymulate Raises $70M to Strengthen Security Posture Testing).

From Exposure Validation to Exposure Management

Cymulate already had a strong position around identifying and validating security gaps, and Ben-Yossef said buying Cync Secure will boost the company’s ability to not only identify exposures but also manage and prioritize them. Ben-Yossef said both companies emphasize proactive defense mechanisms over traditional reactive methods, and want to fuse offensive security expertise with exposure management.

“They came with the same approach that we work at Cync, which is actual offensive people doing research and knowing how to ask the customer the right questions and to tackle the right issues around vulnerabilities, and not deal with that like all the other vulnerability management tools,” Abergel told ISMG.

The company plans to combine Cync Secure’s vulnerability pipeline and exposure aggregation and deduplication expertise with Cymulate’s validation capabilities to give customers actionable insights for prioritizing threats. An aggressive six-month timeline has been set for the launch of a next-generation exposure prioritization platform, with Ben-Yossef targeting a launch in the third quarter of 2025.

“We’re going to pull lots of different kinds of exposures from third-party sources, and we’re going to use that data with the exposure validation platform data to help create a next-gen exposure prioritization platform and management,” Ben-Yossef said. “It brings a totally new prioritization innovation into the market just doesn’t exist today, and just a new way to prioritize exposure.”

Cync Secure will help Cymulate integrate compensating controls into the decision-making processes, ensuring organizations focus on the most critical threats while deprioritizing issues mitigated by existing controls such as firewalls or intrusion prevention systems. For example, a web application firewall could neutralize the risk of a vulnerability like Log4j, meaning that companies wouldn’t need to prioritize a fix.

“If I can tell you that we have a web application firewall protecting from at least 100 different Log4j attacks, does that mean that you must patch Log4j?” Ben-Yossef asked. “It doesn’t mean that you don’t, but it definitely means that it’s not the most important thing right now, because you will have a well-tuned security control actually blocking a lot of attempts to exploit Log4j, which we have validated.”

Is More M&A in Cymulate’s Future?

Cymulate plans to initially focus on upselling exposure management to existing customers, who have already expressed demand for enhanced tools, before expanding into new markets, Ben-Yossef said. The new platform is expected to address pain points across industries including the financial services, retail and industrial sectors, and opens doors to new use cases and geographies like Asia-Pacific and Europe.

“Mature organizations that already use vulnerability tools have thousands, sometimes millions, of vulnerabilities, and they don’t know what to do with them,” Abergel said. “The exposure management programs and plans are an evolution of that. It’s the moment of chaos from how to manage the amount of vulnerabilities. So, we truly believe in this evolution, and we know that the market will thrive for it.”

Cync Secure is the first acquisition since Cymulate’s founding in 2016, and Ben-Yossef said future deals will be expected to either address specific gaps in capabilities or provide benefits like shortening development timelines or adding complementary expertise. Ben-Yossef said Cymulate is also looking to enhance its talent pool with specialists in offensive cybersecurity.

“M&A, in my perspective, is a tool. It’s not the goal,” Ben-Yossef said. “We’ve shortened timelines, but also got a very creative team and skillset that complemented our human resource for the company. Yes, there are more. We believe that there are more problems we probably want to solve over the course of next year.”

CISOs wants practical, actionable solutions to manage the overwhelming volume of vulnerabilities in their organizations, and Ben-Yossef said Cync Secure addresses the chaos of vulnerability overload by emphasizing remediation and mitigation strategies. Exposure management programs should be both threat-driven and actionable to address the issue of managing and prioritizing vulnerabilities at scale.

“We were always threat-driven, attack-driven, authentic-driven,” Ben-Yossef said. And with the Cync acquisition, we’re also going to want to be more process-driven, mitigation-driven, action-item driven. Together, that’s like the best policy if you want to create this exposure management program in the best possible way.”