Patrowl is an offensive security company that helps organisations find and fix weaknesses in their internet-facing systems before attackers do. It is built for security teams that want continuous testing of their external exposure rather than a single manual pentest each year.
An annual test describes the attack surface on one day of the year, while the real one changes every time a team launches a site or opens a port. Patrowl’s answer is to test all the time and to hand over only findings a person has confirmed.
At A Glance
| Vendor | Patrowl |
|---|---|
| Category | External attack surface management and automated pentesting |
| Deployment | Agentless SaaS, hosted on Patrowl infrastructure |
| Agentic AI | AI agents for daily pentesting, with pentester validation |
| Customers | Colas, MGEN, European Investment Bank, Forvis Mazars, Heetch |
| Certifications | Team holds OSCP, OSWE and CREST CRT |
| Founded | 2020, Paris, France |
| Market classification | Vulnerability Management |
What Patrowl Does
Patrowl was set up by pentesters and cybersecurity auditors, and its service follows the path an attacker would take: map what is exposed, look for weaknesses, try to exploit them, and report what works. The difference from a scanner is the end of that path. Real exploit attempts replace version matching, and pentesters review critical results before delivery, which is how Patrowl aims for “zero false positives”. Remediation is tracked through to an automatic retest, and reports can be produced for audits under NIS2, DORA, ISO 27001 and Cyberscore.
Products
External Attack Surface Management
EASM gives security teams an up-to-date inventory of what they expose online, which matters most for organisations where business units launch sites and cloud services without telling IT. It discovers and monitors:
- domains, subdomains, IP addresses, subnets and open ports
- SSL/TLS certificates, DNS records and email security settings (SPF, DKIM, DMARC)
- APIs, web services and cloud accounts on AWS, Azure and GCP
- misconfigured cloud services and exposed admin panels and login pages
- data leaks matched against custom keywords
Automated Penetration Testing
Automated Penetration Testing replaces the once-a-year pentest with continuous black-box testing at a frequency the customer sets, without affecting production. Rather than scanning for version numbers, it makes real exploit attempts. A certified pentester reviews each critical finding before it reaches the customer, so teams spend their time fixing confirmed issues.
Pentest As A Service And Supporting Tools
For organisations that also need traditional engagements, Patrowl offers Pentest as a Service. The platform adds DAST for web applications, CVE management, threat intelligence feeds and reputation checks on domains and IP addresses, which help teams spot assets that have been blacklisted or abused.
How It Works
Onboarding is agentless: nothing is installed and nothing in the customer’s environment changes. The customer declares domains, IP ranges or simply a company name, and a first map of the attack surface is produced within 24 hours. The platform runs entirely on Patrowl’s own infrastructure, and customer data is not shared with third parties.
| Component | What it does |
|---|---|
| Discovery | Assets are found through WHOIS, certificate transparency logs, DNS data and internet-wide scanning, then fingerprinted by technology. |
| Enrichment | Each finding is matched against threat intelligence such as CISA KEV, EPSS scores and known active exploits. |
| Attack | AI agents and automation attempt exploits against the mapped assets on the configured schedule. The AI runs on Patrowl’s own infrastructure, so client data does not go to external AI providers. |
| Validation | Certified pentesters replay critical findings and confirm them before delivery. |
| Remediation | Confirmed issues become tickets in the customer’s tools, and fixed assets are retested automatically. |
Integrations
| Area | Integrations |
|---|---|
| Ticketing and ITSM | Jira, ServiceNow, GLPI |
| SIEM and SOC | Splunk, ELK, Hackuity, Nucleus Security, TheHive |
| Exposure and threat intelligence | CybelAngel |
| Collaboration and alerting | Slack, Microsoft Teams, Zendesk |
| Single sign-on | Okta, Microsoft Entra ID |
Company Background
| Founded | 2020. |
|---|---|
| Founders | Florent Montel, Nicolas Mattiocco and Vladimir Kolla, all cybersecurity and penetration testing specialists. |
| Headquarters | Paris, France. |
| Scale | More than 3 million reported assets under continuous protection. |
| Funding | A seed round in 2022 and a second round of a reported 11 million in 2024. |
| Recognition | Grand Prix of the 2025 Startup Award at FIC (Forum INCYBER Europe) and innovation prizes at Les Assises in 2022 and 2023. |
Note: This overview is compiled from Patrowl’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.