VulnCheck is a vulnerability intelligence company. It tells security teams which vulnerabilities are being exploited, or are about to be, so they can fix those first instead of working through every published CVE in order. Its products supply exploitation data, early warning signals and detection content rather than scanning a customer’s own assets.
It serves vulnerability management, threat intelligence and detection teams in companies and in government, with a separate government offering that adds data and features available only to government partners.
At A Glance
| Vendor | VulnCheck Inc. |
|---|---|
| Category | Vulnerability and exploit intelligence |
| Deployment | API and VulnCheck console |
| Community | VulnCheck KEV, NVD++, VulnCheck Exploit Database |
| Funding | Series B led by Sorenson Capital (2026) |
| Market classification | Vulnerability Management |
What VulnCheck Does
Most vulnerability programmes are driven by disclosure: a CVE is published, scored and queued. VulnCheck aims to let security teams “operate on attacker timelines instead of disclosure timelines”, so they can make better decisions about which vulnerabilities need immediate remediation. The company reports that its exploit and vulnerability data arrives on average 14 days ahead of the NIST NVD. Its intelligence follows the life of a vulnerability, from disclosure through the first exploitation attempts to the hosts still exposed, and combines its own research and sensor data with public sources.
Products
Exploit & Vulnerability Intelligence
This is the core dataset for vulnerability management and threat intelligence teams. It gives early access to new vulnerability information not yet in the NVD, with dozens of extra fields. Each record includes:
- A full exploitation timeline from first disclosure onwards
- Real-time alerts when the vulnerability landscape changes
- Links to a large collection of exploit proof of concept code
- Exploit maturity, reported exploitation by threat actors, botnets and ransomware, EPSS scores and KEV status
Initial Access Intelligence
Initial Access Intelligence is for detection engineers defending against the vulnerabilities attackers use for a first foothold. VulnCheck researchers build exploit proofs of concept, packet captures and Suricata signatures in house. A free Initial Access Community Edition of exploits and detections is also available.
Canary Intelligence
Canary Intelligence shows the first signs that a vulnerability is being exploited. VulnCheck deploys genuinely vulnerable systems across the internet and correlates each attack with known CVEs, the software exploited and the attacker tooling. Event records include source and destination IP, port, country, CVE, signature, severity, request URL and timestamp.
Target Intelligence
Target Intelligence is for exposure and incident teams who need to know how widely a flaw is exposed: “You give us a CVE. We tell you every vulnerable host on the internet right now.” It turns a single CVE into a current list of affected internet hosts.
Community Resources
| VulnCheck KEV | The VulnCheck Known Exploited Vulnerabilities Catalog. |
|---|---|
| NVD++ | A single source for the NIST NVD, enriched with VulnCheck CPE data, and the MITRE CVE list. |
| VulnCheck Exploit Database (XDB) | An index of proof of concept exploit code held in Git repositories. |
How It Works
VulnCheck delivers intelligence as data rather than as installed software.
| Component | What it does |
|---|---|
| API | REST endpoints return JSON, for example GET /v3/index/exploits for exploit data and GET /v3/index/vulncheck-canaries for canary events. |
| Console | Analysts browse the same data in the VulnCheck console. |
| Sensor network | Canary data comes from a constantly refreshed worldwide network of monitored systems, and each captured attack is returned through the API as an event object. |
| Threat intelligence platforms | The data feeds Anomali, Cyware, Filigran, OpenCTI, Polarity, ThreatConnect, ThreatQuotient/Securonix and Vertex. |
Company Background
| Leadership | Anthony Bettini (founder and CEO) and Jacob Baines (Chief Technology Officer). |
|---|---|
| Offices | An EMEA regional headquarters in Cheltenham, United Kingdom. |
| Funding | A $25 million Series B in February 2026, led by Sorenson Capital with National Grid Partners and existing investors Ten Eleven Ventures and In-Q-Tel, bringing total funding to $45 million. NextEra Energy is also an investor. |
Note: This overview is compiled from VulnCheck’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.