Vicarius makes vulnerability remediation software for IT and security teams that already know about more vulnerabilities than they can fix. Its vRx platform finds weaknesses across endpoints, servers and other assets, ranks them, and then closes them by patching, shielding in memory or running a script.
The gap it addresses is between knowing and fixing. Scanners produce long lists, patch tools work through them slowly, and in between sit exposures an attacker can use.
At A Glance
| Vendor | Vicarius |
|---|---|
| Category | Vulnerability management and remediation |
| Deployment | Hosted platform, with agent-based and agentless discovery |
| Agentic AI | ScriptAI, AI search assistant, AI grouping, agentic exploit validation |
| Customers | Bupa, Domino’s, Starbucks, NHS, Toyota |
| Funding | Series A (2022) and Series B (2023) |
| Market classification | Vulnerability Management |
What Vicarius Does
Most vulnerability tools stop once they have produced a report, and the backlog of unfixed issues keeps growing. Vicarius reports an average of 74 days to remediate a vulnerability, with 81% of exploited CVEs having a patch available before the attack. Its pitch is that discovery and fixing belong in the same tool, so vRx is built “remediation-first”. Where a patch cannot be applied, a compensating control keeps the flaw from being exploited until it can. For teams that already own several scanners, Vicarius also works as a validation layer on top of them rather than a replacement.
Products
VRx
vRx is the core platform for teams that need to cut their exposure, not just measure it. It brings together several modules:
| Vulnerability management | Agent and agentless detection across every asset, combined with SBOM-based detection. |
|---|---|
| vScore | Prioritisation by exploitability, context and business impact. |
| vPatch | Automatic deployment of patches for more than 20,000 third-party applications and operating system versions. |
| vShield | In-memory shielding that acts as a compensating control when patching is not possible; it does not remove the underlying flaw or replace the patch. |
| vScript | A scripting engine for detection, remediation and operational workflows. |
| vComply | More than 100 built-in CIS benchmarks plus PCI-DSS, HIPAA and CMMC checks. |
| Asset and site management | A single view of every asset, piece of software and site. |
VIntelligence
vIntelligence is a separate intelligence and validation platform for organisations that already run scanners, EDR and cloud posture tools but struggle to decide what to fix first. It orchestrates remediation, produces custom and board-level reports, and tracks risk reduction over time in line with continuous threat exposure management (CTEM).
How It Works
Discovery runs through agents or agentless scanning on endpoints, servers, network devices, IoT and containers. Customers sign in to a hosted portal at sign-in.vicarius.cloud.
| Component | What it does |
|---|---|
| Inputs | EDR, SIEM, CSPM, CMDB and vulnerability scanner data feed into the platform directly, along with threat feeds. |
| Data model | vRx normalises what it receives from agents, scanners, integrations and threat feeds into one vulnerability model. |
| Remediation | Patches cover Windows, Linux and macOS. Where no patch exists, vShield protects the vulnerable process in memory. |
| Orchestration | vIntelligence recommends an action for each finding, whether a patch, a vetted script or a workaround, and routes it through vRx or another patch management platform for approval before it runs. Every recommendation, approval and dispatched action is logged with a timestamp. |
Agentic AI Capabilities
ScriptAI
ScriptAI uses a large language model to write remediation scripts on demand, which then run through the vScript engine.
AI Search Assistant And AI Grouping
The search assistant lets an analyst ask questions about the environment in plain language. AI grouping builds dynamic asset and software groups from the same kind of query, which can then be targeted by a fix or a report.
Exploit Validation
Agentic AI checks which vulnerabilities an attacker could realistically exploit and removes false positives before they reach the team, with a reported 95% of false positives filtered out.
Company Background
| Founded | 2016 |
|---|---|
| Headquarters | New York, United States |
| Offices | Melbourne, São Paulo, Santiago, Düsseldorf, Bangalore, Tel Aviv, Singapore and Pontypool (UK) |
| Leadership | Roi Cohen, Co-founder and CEO; Yossi Ze’evi, Co-founder and CTO; Ohad Rubin, COO; Orna Mintz-Dov, Chairman of the Board |
| Funding | A reported $24 million Series A in 2022 and $30 million Series B in 2023 |
| Investors | Bright Pixel Capital, AlleyCorp, GoldBell, JVP, Future Energy and AllegisCyber |
| Recognition | Included in the Gartner Magic Quadrant for Exposure Assessment Platforms (2025) |
Note: This overview is compiled from Vicarius’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.