JupiterOne helps security teams see every asset they are responsible for, and the risk that sits between them. Its platform pulls asset and security data from cloud, code, identity and AI tools into one model, so teams can find exposures, prioritise vulnerabilities and prove that compliance controls work.
Everything is built on a graph of assets and their relationships, captured in the line “Every risk in one graph”.
At A Glance
| Vendor | JupiterOne |
|---|---|
| Category | Cyber asset attack surface management (CAASM) and exposure management |
| Identities covered | Users, identities and integrations, AI agents and copilots |
| Deployment | API driven, agentless collection |
| Customers | Databricks, Indeed, Blend, Mercury Financial, Auth0 |
| Investors | Bain Capital, Sapphire, Tribe Capital, Okta |
| Market classification | Cyber asset attack surface management (CAASM) and exposure management |
What JupiterOne Does
Most organisations run separate tools for IT assets, cloud, code, identity and security findings, and risk often hides in the gaps between them. JupiterOne consolidates asset data from IT, DevOps, security, HR and other tools into a single source of truth and maps how those assets connect. With that context, a vulnerability on a server can be judged by what the server can reach, who owns it and whether it is exposed, rather than by its score alone. The same graph supports compliance work, because controls can be tested against live data instead of screenshots.
Products
Security Graph
Security Graph is the data layer the other products run on. It collects and normalises users, devices, networks, applications and data, maps the relationships between them and their owners, and shows the blast radius of an incident. Teams can run pre-built or custom queries against it.
Unified Vulnerability Management
Security teams buried in scanner findings use this product to work on what matters to the business. It continuously ingests findings from more than 200 sources and scores each one against asset relationships, proximity to crown-jewel systems and exploitability, with adjustable weighting for CVSS, EPSS and public exposure. Cases route to the asset owner, and Remediation Plans are assigned and tracked to closure with MTTR and SLA reporting.
AI Attack Surface Management
AI ASM answers a newer question for security leaders: which AI tools are in use, and what can they touch. It surfaces every copilot, agent and LLM API, approved or shadow, and maps what each AI tool, identity and integration can actually reach. This lets teams find, assess and govern models and agents continually, alongside every other asset.
Continuous Controls Monitoring
Compliance and GRC teams use this product to show that controls work every day, not only at audit time. Controls are written as code in J1QL, drift raises real-time alerts with full asset context, and evidence is generated from live data. One control definition maps to SOC 2, ISO, NIST, FedRAMP and HIPAA.
How It Works
The platform reads data from the tools a team already runs and builds its model from that, which keeps the graph current as the environment changes.
| Component | What it does |
|---|---|
| Collection | Collection is API driven and agentless across the technology stack, using more than 200 pre-built integrations. |
| Graph | Data from connected tools is normalised and merged into one graph of assets and relationships, which every product queries. |
| Query | Teams use J1QL, the JupiterOne query language, or ask JupiterOne AI in plain English; J1QL is optional. |
| Workflows | Reports, dashboards, evidence packages and automated workflows, including ticket routing. |
Identities And Systems Covered
| Human users | Users are an asset class next to devices, networks, applications and data. |
|---|---|
| Ownership | Assets are linked to their owners, which drives remediation routing. |
| AI agents | Copilots, agents and LLM APIs, with the identities and integrations each one can reach. |
| Identity systems | 1Password, Auth0 and Okta. |
| Cloud and code | AWS, AWS GovCloud, Google Cloud, Alibaba Cloud, Kubernetes, Cloudflare, GitHub and Artifactory. |
| SaaS and data | Salesforce and Snowflake. |
Integrations
| Area | Integrations |
|---|---|
| Vulnerability scanners | Tenable, Qualys, Rapid7, AWS Inspector, Azure Defender, GCP SCC, Snyk, Trivy, Prisma, Checkmarx |
| Ticketing and SIEM | Jira, ServiceNow, Splunk |
| Device management | Addigy, Automox, AirWatch, Apple Business Manager, Armis |
Company Background
| Chief Executive Officer | Paul Forte. |
|---|---|
| Board and product leadership | Erkang Zheng, Chief Innovation Officer and Chairman of the Board; Kevin Tonkin, Chief Product Officer. |
| Investors | Bain Capital, Rain Capital, Sapphire, Tribe Capital, 112 Capital, Uber, Robinhood, Splunk, Netflix, Atlassian, Okta and Mandiant. |
Note: This overview is compiled from JupiterOne’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.