Governance & Risk Management
,
Security Operations
,
Vulnerability Assessment & Penetration Testing (VA/PT)
Pentera-DevOcean Platform to Deliver Unified Attack Simulation and Remediation
Pentera bought an Israeli startup led by CyberArk’s former head of security research to operationalize the remediation of attack findings.
The Boston-based security validation vendor said Tel Aviv, Israel-based DevOcean can integrate with more than 100 security tools to streamline and prioritize remediation tasks, said co-founder and CEO Amitai Ratzon. DevOcean impressed Pentera with its artificial intelligence-based prioritization engine, allowing it to streamline complex remediation workflows that are traditionally labor-intensive and inefficient, he said.
“One of the areas where we felt like we have a gap was everything that happens like operationalizing the results of the Pentera attack findings so that people can actually resolve the problem,” Ratzon told Information Security Media Group. “DevOcean was introduced to us by a friend in the industry, and it looks like a match made in heaven.”
DevOcean, founded in 2021, employs 15 people and has raised $6 million, having most recently closed a $6 million seed funding round in December 2022 led by Glilot Capital Partners. The company has been led since its inception by Doron Naim, who spent nearly five years at CyberArk, culminating in a role as head of security research. Calcalist reported that Pentera paid $30 million for DevOcean (see: Pentera Secures $60M to Boost AI-Powered Security Validation).
What Sets DevOcean’s Approach to Remediation Apart
While Pentera was effective at identifying issues, Ratzon said actual resolution of those vulnerabilities often fell short because of inefficient or manual internal enterprise processes. DevOcean stood out not only for its AI-powered remediation technology but for the fact that it had traction with Fortune-level firms despite being relatively unknown, and Pentera saw an opportunity to address its limitations.
“They say, ‘Hey, we’ve been monitoring you for quite some time. We feel that there is like a crazy better-together story here. We have early revenue, sub-$1 million and we have a working technology that’s mature.'” Ratzon said. “They have some Fortune customers. We’re very surprised to see that the company that we didn’t know about is already making waves in big enterprises.”
Buying DevOcean will help Pentera offer a closed-loop solution where detected issues are immediately routed to the right people and tracked through remediation. Prior to the acquisition, user would manually email findings or open tickets. Now, the system behaves like a train, automatically delivering tasks to the responsible parties, monitoring their progress and looping back to verify resolution, he said.
“Even if you do an amazing job, if they don’t have great processes in place to solve the problems, the operation succeeded, but the patient died,” Ratzon said. “DevOcean filled the gap. It’s as if the attack is over and then there is a new train that goes in the organization, takes the attack findings and offloads them in the hands of the person who needs to do something about it.”
Pentera’s strength lies in cyber sophistication and understanding the attacker mindset, not in operations and remediation, Ratzon said. To build remediation tools, Pentera would have needed to hire a completely different set of engineers with a focus on workflow automation, operations and ticketing rather than offensive security, Ratzon said.
“Historically, we said, ‘Customer, you manage the operational hurdle. It’s not what we do,'” Ratzon said. “But being right doesn’t make us smart. The smart move is to solve this operational hurdle for the customer.”
How Pentera, DevOcean Will Come Together
DevOcean’s system connects to more than 100 security tools and uses AI to triage and prioritize remediation efforts across a flood of vulnerability data the enterprises receive, Ratzon said. Where Pentera sifts through the haystack of systems to surface only critical attack paths, DevOcean sifts through remediation demands to surface the most urgent, business-critical fixes, Ratzon said.
“What impressed us here are two things: the fact that the technology has 100+ APIs to all the tools, and the fact that they’re utilizing AI to then tell the user how they should prioritize from all the noise and all the hundreds and thousands of things,” he said. “So the way we think about surfacing the needle from the haystack when it comes to attack – that’s how they think when it comes to remediation.”
As of Friday, customers can use Pentera with DevOcean through API-based integration, enabling findings from Pentera attack simulations to flow directly into DevOcean’s remediation platform, where they are prioritized and acted upon. By early 2026, they will be a unified experience providing a smooth workflow for security teams, whether they’re conducting validation or assigning or remediating vulnerabilities.
“We didn’t wait for the announcement to already develop the API and the necessary integration between Pentera and DevOcean to actually make it a workable solution tomorrow morning,” Ratzon said. “So actually, from tomorrow morning, our customers can actually work with Pentera with an API to DevOcean.”
After running a Pentera attack, users previously had to manually relay vulnerabilities to asset owners via email or Slack or create tickets in Jira, which Ratzon said was time-consuming, error-prone and dependent on individuals who may not follow through. DevOcean’s automation replaces this with a structured ticketing system, SLA enforcement, ownership assignment and escalation workflows.
“It’s as if the attack is over and then there is a new train that goes in the organization, drops the attack findings in the hands of the person who needs to do something about it, then you do your thing,” Ratzon said. “When you resolve it, the train goes back and eventually closes the loop.”