XM Cyber is an exposure management company that shows security teams how an attacker could move through their hybrid environment to reach critical assets, and which fixes would cut off the most routes.
It is built for security and vulnerability teams in large organisations that face far more findings than they can fix, and need to know which few actually matter to an attacker.
At A Glance
| Vendor | XM Cyber |
|---|---|
| Category | Continuous exposure management, attack path analysis |
| Identities covered | Active Directory accounts, cloud identities and entitlements, local and domain credentials, AI agents and MCP servers |
| Deployment | Hybrid coverage of cloud and on-premises environments |
| Agentic AI | AI Exposures module covering MCP servers, AI agents and AI development resources |
| Ownership | Schwarz Group |
| Market classification | Vulnerability Management |
What XM Cyber Does
Most exposures in a large estate lead nowhere an attacker cares about. XM Cyber approaches the problem from the attacker’s side. It discovers CVEs, misconfigurations and identity exposures from the external perimeter to the internal network and the cloud, ranks them by threat intelligence, likelihood of exploit and business impact, and then shows how they chain together. The places where many attack scenarios meet are choke points, and fixing one of them can close several attack paths at once. The platform follows the five stages of continuous threat exposure management (CTEM): scoping, discovery, prioritisation, validation and mobilisation, ending with remediation work handed to the teams that own it.
Products
Continuous Exposure Management Platform
The core platform combines Attack Graph Analysis, a digital twin of the environment and Remediation Operations. It gives security teams an attacker’s view of the estate, picks out choke points, and supplies remediation guidance with alternative fixes and a way to confirm that each fix worked. The modules below all feed the same attack graph.
Identity And Access Exposures
This module helps identity and security teams stop attackers from abusing excessive permissions.
- Assesses Active Directory for exposures, compliance issues, misconfigurations and permissions
- Uses Cloud Infrastructure Entitlement Management (CIEM) to show whether assigned cloud permissions are actually used
- Finds where local and domain credentials are cached or reused across machines
- Checks that third-party identity tools are configured correctly and compliantly
- Scores Active Directory and cloud posture against best practices and regulatory standards over time
Other Exposure Modules
Several further modules feed the same attack graph, each aimed at a different team.
| Cloud Exposures | Security and compliance posture of cloud deployments, showing which misconfigurations open a path to sensitive resources |
|---|---|
| External Attack Surface Management (EASM) | Exposures on internet facing assets, often the first step in an attack path |
| Exposed Credentials Management (ECM) | Leaked credentials tied to the accounts they belong to, so teams know which to reset first |
| Security Controls Monitoring (SCM) | Configuration drift in security controls |
| Vulnerability Risk Management (VRM) | The same risk ranking applied to CVEs, giving a short list of patches that matter |
AI Exposures
AI Exposures finds attack paths aimed at AI development resources, MCP servers and agents. It catalogues and scans MCP servers to limit credential theft and unauthorised model access, shows how a misconfigured server creates a validated path to sensitive models and training data, and flags unauthorised configuration changes. It also looks for exposures that would let an attacker hijack an agent, with particular attention to agentic applications built on AWS Bedrock, and gives a real-time view of which AI tools employees use, including in the browser.
How It Works
The platform validates exploitable exposures continuously against a digital twin of the production environment, rather than testing on live systems.
Data flows in one direction: discovery collects exposures from the external perimeter, the internal network and cloud accounts; the digital twin tests which of them can really be exploited; Attack Graph Analysis chains the validated exposures into paths and locates the choke points; and Remediation Operations sends the resulting work to the IT service management and SOC tools of the teams that own each fix.
Identities And Systems Covered
| Active Directory | Exposures, compliance issues, misconfigurations and permissions |
|---|---|
| Cloud entitlements | Permission usage across Entra and other cloud platforms in multi-cloud environments |
| Cloud platforms | AWS, Azure, Google Cloud and STACKIT, plus OT, legacy and container environments on premises |
| Credentials | Local and domain accounts, and cached, leaked and reused credentials |
| Identity tools | The posture of third-party identity security tools |
| AI agents and MCP servers | MCP server inventory and exposures that could be used to hijack agents |
| AI services | AWS Bedrock, GCP Vertex and Azure OpenAI, plus public tools such as OpenAI, Claude and Cursor |
Integrations
| Area | Integrations |
|---|---|
| IT service management | ServiceNow Vulnerability Response, ITSM and CMDB |
| Endpoint and XDR | CrowdStrike Falcon: Falcon incidents enriched with exposure data, and Falcon agents tagged as critical assets or choke points |
Company Background
| Founded | April 2016, by executives from the Israeli cyber intelligence community |
|---|---|
| Founders | Tamir Pardo, Noam Erez, Boaz Gorodissky and Shaul Shani |
| Headquarters | Tel Aviv, Israel, with offices in North America, Europe and Asia Pacific |
| Leadership | Noam Erez (Co-founder and CEO) and Boaz Gorodissky (Co-founder and CTO) |
| Ownership | Acquired in November 2021 by Schwarz Group, and operates under its own brand |
| Acquisitions | Israeli startup Cyber Observer, announced in June 2022 |
| Recognition | Included in the 2025 Gartner Magic Quadrant for Exposure Assessment Platforms, and recognised by Frost & Sullivan for two years running |
Note: This overview is compiled from XM Cyber’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.