KuppingerCole Analysts has named Zafran an Overall Leader, Product Leader, and Innovation Leader in its 2026 Leadership Compass: Attack Surface Management report.
Of the 36 vendors evaluated, Zafran ranked #2 for Product Leadership, and it is the youngest company among the 17 Overall Leaders.
Security teams have more findings than they can fix. Attackers now use AI to find and weaponize vulnerabilities faster, and the time between disclosure and exploitation keeps shrinking. Zafran’s view is that most critical findings are already unreachable or blocked by existing defenses, so the job is to prove which findings are exploitable and close those first, using the tools a team already owns.
The report recognizes Zafran for helping organizations see which vulnerabilities are real risks in their environment and fix those first. It also recognizes Zafran’s agentic AI, which investigates exposures and carries out fixes with human approval.
What KuppingerCole Evaluated
The Leadership Compass compares attack surface management vendors on how well they discover assets, confirm which exposures can be exploited, and move prioritized findings into remediation. KuppingerCole also rated artificial intelligence as its own capability category. It looked at how AI is used across the workflow, how much manual analysis it removes, and whether customers keep control through human approval and audit trails.
The report is direct about why AI in attack surface management matters now. It points to AI models that can find vulnerabilities and build working exploits at a scale security teams have not faced before, and it warns that vendors who only produce long lists of findings may lose ground. In KuppingerCole’s view, the vendors that help customers keep up with AI-speed discovery and turn it into risk reduction will become more valuable.
Zafran was founded in 2022 as an AI-native threat exposure management company built to help security teams keep up with AI-speed exploitation. The platform pulls in findings from the tools a team already runs, works out which ones can be exploited in that specific environment, and then helps fix or mitigate them.
Turning Vulnerability Data into Actionable Risk Reduction
KuppingerCole highlights Zafran’s Threat Exposure Management Platform for its ability to prioritize vulnerabilities using runtime data, network reachability, threat intelligence, business context, and existing security controls.
Zafran uses CVSS as one input, then helps organizations understand which exposures are exploitable in their specific environments by checking whether each vulnerable asset is running, reachable, and not already protected by an existing firewall or EDR. To check reachability, Zafran maps paths from the internet to internal assets using network, endpoint, cloud, and WAF data, and it confirms exploitability from data it already collects, without running attacks against production systems. With this context, security teams with limited resources can focus remediation on the small set of exposures that pose a real threat.
KuppingerCole noted that “Zafran’s control analysis is broader than standard vulnerability prioritization.” The platform finds misconfigurations in EDR, WAF, network, and cloud controls, and shows where a configuration change can reduce risk before a patch is deployed. For supported integrations, Zafran can push that change through existing EDR and firewall tools with customer approval, and it opens detailed tickets for the rest. It connects to these tools through their APIs and adds no new endpoint agents.
Zafran weighs each risk factor and attaches the proof to every score. The risk view shows which factors raise a vulnerability’s score and which compensating controls lower it, producing what Zafran calls the Applicable Exposure score. Security and IT teams can see why a finding stays critical and needs attention now, while other findings received lower risk scores and can wait.
Product Excellence Meets Innovation
KuppingerCole’s list of Zafran strengths includes strong API and identity attack surface discovery, native attack-path analysis, control gap analysis that finds WAF coverage gaps, compliance mapping, including NIST 800-53 control evidence dashboards, and both single-tenant and multitenant SaaS options. The report also describes the interface as clear and easy to understand.
For security leaders, Zafran’s exposure tracker follows specific risk-reduction efforts, such as a remediation campaign or a group of critical vulnerabilities, and feeds customizable dashboards and scheduled reports. That gives CISOs measurable progress to share with leadership and the board.
KuppingerCole sees Zafran as best suited for hybrid mid-market and enterprise organizations that already run scanners, endpoint tools, cloud controls, WAFs, and ticketing systems, but struggle to tell which vulnerabilities are truly exploitable and which actions reduce the most risk.
Agentic AI With Human Approval Built In
AI is a standout in the report. KuppingerCole wrote:
“Agentic remediation is one of Zafran’s most innovative capabilities.”
Zafran’s agents investigate an exposure, check the affected assets and controls, and propose a fix. With human approval for each command, they connect to the affected systems, carry out the mitigation or remediation, and confirm the result with before-and-after evidence.
- Remediation operations: AI-powered root cause analysis groups overlapping vulnerabilities, finds the smallest set of actions that removes the most risk, and routes each task to the right owner.
- Zero day agent: assesses exposure to newly disclosed vulnerabilities before scanner plugins or CVE enrichment are available, using SBOM, component, and asset data.
- Agent library and custom agents: prebuilt and customer-built agents handle recurring work such as threat intelligence monitoring, SLA follow-up, report generation, and alerts when security control settings change.
- Exposure gateway: a controlled connection that lets outside AI tools, such as Claude, work with Zafran’s data on assets, vulnerabilities, and security controls. Zafran sets what each tool can see and do, and logs every request.
- Zafran AI: a chatbot for questions and analysis across the platform, plus AI-generated dashboards and summaries.
KuppingerCole asks vendors to keep AI controlled, explainable, and auditable. Zafran’s agents follow that standard: they do the investigation and the repetitive work, and people approve each remediation step before it runs.
A Practical Path to Exposure Reduction
KuppingerCole’s findings reinforce an important shift in cybersecurity: the market is moving from finding exposures to reducing them. Organizations need to show that the exposures they find get fixed.
Zafran’s approach follows four steps:
- Detect: pull in findings from the scanners, cloud, and endpoint tools a team already runs, and spot new vulnerabilities continuously from SBOM data.
- Prioritize: weigh runtime presence, reachability, threat intelligence, business context, and existing controls to find what can be exploited.
- Mitigate: adjust the firewall, EDR, and WAF controls already in place to block an exposure while waiting on a patch.
- Remediate: group fixes by root cause, route them to the right owners through Jira or ServiceNow, and use AI agents with human approval to carry out fixes and confirm the result.
Ranking #2 of 36 vendors for Product Leadership as the youngest of the 17 Overall Leaders shows how quickly Zafran has grown in the attack surface management market. As AI shortens the time between disclosure and exploitation, the team will keep working toward its mission: proactively stop vulnerability exploitation, everywhere.
