Detectify Platform

What it does

Detectify is an application security platform that combines External Attack Surface Management (EASM) with payload-based Dynamic Application Security Testing (DAST) to find exploitable vulnerabilities across an organization's internet-facing domains, applications, and APIs. Its defining mechanism is Crowdsource, an invite-only community of more than 400 ethical hackers whose submissions are validated by Detectify's research team and turned into live scanner tests. Alfred AI extends that pipeline with large language model (LLM) agents that build tests for new CVEs, each signed off by a human researcher.

How it works

Every module starts from Discovery, an asset inventory synced through cloud DNS connectors. Surface Monitoring continuously maps subdomains, IPs, and technologies and tests them for subdomain takeovers, certificate issues, and misconfigurations, with 600-plus takeover detection methods. Application Scanning and API Scanning crawl and fuzz custom web apps and REST or GraphQL APIs behind authentication, with a fuzzing engine that fires real payloads, not version fingerprints, and rotates them each run. Internal Scanning runs the same tests behind the firewall through a Terraform-deployed scanner, and a hosted Model Context Protocol (MCP) server exposes findings to AI coding tools.

Credentials and traction

Detectify holds ISO/IEC 27001:2022 certification and is GDPR compliant. It is a Major Player in the IDC MarketScape: Worldwide Dynamic Application Security Testing 2026 Vendor Assessment and was included in Forrester's Attack Surface Management Solutions Landscape, Q2 2024. The platform serves more than 2,100 organizations and 10,000 users across technology, government, media, and gaming, with customers including the UK Department for Science, Innovation and Technology, Auth0, evroc, Trustly, Storytel, and New Relic.