Loading story…
Pentera, a Boston-based security validation company, has acquired DevOcean, an Israeli startup specializing in vulnerability remediation and workflow automation. The acquisition aims to address a critical gap in Pentera's platform by operationalizing the remediation of attack findings, enabling organizations to more efficiently resolve security issues identified during attack simulations. DevOcean, founded in 2021 and led by Doron Naim, the former head of security research at CyberArk, brings a team of 15 employees and a strong background in integrating with over 100 security tools. The company has raised $6 million in seed funding, with its most recent round led by Glilot Capital Partners in December 2022. Pentera's CEO, Amitai Ratzon, highlighted that DevOcean's artificial intelligence-based prioritization engine was a key factor in the acquisition, as it streamlines complex and traditionally labor-intensive remediation workflows. The integration of DevOcean's technology is expected to deliver a unified platform that combines attack simulation with automated remediation, reducing the time and effort required for security teams to address vulnerabilities. This move reflects a broader industry trend toward automating and prioritizing vulnerability management to keep pace with evolving threats and the increasing volume of security findings. By leveraging DevOcean's capabilities, Pentera aims to provide customers with a more seamless and effective way to transition from identifying security gaps to closing them. The acquisition also underscores the importance of interoperability in modern security operations, as DevOcean's platform is designed to work with a wide array of existing security tools. Both companies see the partnership as highly complementary, with DevOcean's expertise in remediation filling a strategic need for Pentera's customers. The deal is expected to enhance Pentera's value proposition in the competitive security validation and vulnerability management market. Industry observers note that the acquisition could set a precedent for further consolidation in the cybersecurity sector, particularly among vendors seeking to offer end-to-end solutions. The leadership of both companies expressed optimism about the integration process and the potential for innovation in automated security operations. Customers of both Pentera and DevOcean are anticipated to benefit from improved efficiency and effectiveness in their vulnerability management programs. The acquisition is also likely to accelerate the development of new features that bridge the gap between attack simulation and actionable remediation. As organizations face mounting pressure to address vulnerabilities quickly, the combined Pentera-DevOcean platform is positioned to deliver significant operational advantages. The move highlights the growing role of artificial intelligence in prioritizing and automating security tasks. Ultimately, the acquisition is expected to help organizations better defend against cyber threats by closing the loop between detection and remediation.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Pentera announced its acquisition of DevOcean, a move aimed at streamlining vulnerability remediation and improving how security findings are translated into fixes. The two provided references report the same acquisition event.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Penetration testing remains a cornerstone of modern cybersecurity programs, but the effectiveness of these efforts is often undermined by delays and inefficiencies in the remediation process. Security teams frequently struggle with the manual delivery of pentest findings, which are typically compiled into static reports and distributed through slow, outdated channels. This lag between discovery and remediation can leave organizations exposed to known vulnerabilities for extended periods. Automation is increasingly recognized as a solution to this problem, enabling the seamless transfer of findings into remediation workflows and ticketing systems such as Jira, ServiceNow, or Azure DevOps. By automating the creation of remediation tickets as soon as vulnerabilities are identified, organizations can accelerate the handoff to IT and engineering teams, reducing the window of exposure. Platforms like PlexTrac exemplify this approach by providing real-time, rule-based workflows that eliminate the need to wait for final reports before action is taken. The financial services sector, despite its significant investment in cybersecurity and relatively low rate of serious findings, faces unique challenges in this area. Research indicates that financial institutions have a median remediation time of 61 days, one of the slowest across industries, due to operational friction. This friction is caused by the complexity of legacy systems, dependencies on third-party vendors for patching, and rigorous change management processes designed to ensure compliance and stability. The result is a growing backlog of unresolved vulnerabilities, referred to as 'security debt,' which increases the risk of exploitation. The burden of prioritizing which issues to address first further complicates timely remediation, as teams must balance the volume of alerts with available resources. Automating key workflows in pentest delivery can help mitigate these challenges by streamlining the process and ensuring that critical findings are addressed promptly. The shift toward continuous testing and automated delivery is essential for organizations seeking to keep pace with the evolving threat landscape. By focusing on the most impactful workflows, security teams can lay the groundwork for a scalable and modern approach to vulnerability management. Ultimately, reducing the time from discovery to remediation is vital for minimizing risk and maintaining a strong security posture in complex, regulated environments like financial services. The integration of automation into pentest delivery not only accelerates response times but also reduces the operational burden on already stretched security teams. As organizations continue to mature their security programs, embracing automation will be key to overcoming the persistent challenges of remediation delays and security debt.
Jun 29, 2026
OpenAI announced plans to acquire **Promptfoo**, positioning the deal as a way to strengthen security testing for *AI agents* and application workflows, alongside separate claims that its **Codex Security** capability identified **11,000 “high-impact” bugs in a month**. The coverage frames these moves as part of a broader push toward automated, AI-assisted security validation in software development and DevSecOps, with an emphasis on scaling vulnerability discovery and testing as organizations adopt agentic AI. Other items in the set are largely *opinion/feature* pieces or unrelated security-policy reporting rather than additional reporting on the OpenAI/Promptfoo transaction or Codex Security results. Notably, one article reports that **CVE program funding was secured**, easing concerns about continuity of the vulnerability identifier ecosystem, while several other references discuss general themes such as IAM strategy in the public sector, access-decision risk in identity security, OT/legacy industrial cyber risk, SOC preparation for agentic AI, and post-quantum cryptography (PQC) planning—useful context, but not the same specific event as the OpenAI acquisition or Codex Security claim.
Jun 29, 2026
Bugcrowd has acquired Mayhem Security, an AI-powered offensive security firm, to enhance its application security testing platform by combining automated vulnerability discovery with human-led expertise. The acquisition brings together Mayhem Security’s autonomous security testing technology—recognized for its real-time vulnerability detection and repair capabilities—with Bugcrowd’s established crowdsourced bug bounty and vulnerability disclosure programs. All Mayhem Security employees, including co-founder David Brumley, have joined Bugcrowd, with Brumley taking on the role of chief AI and science officer. The unified platform aims to provide organizations with continuous, end-to-end application security coverage, spanning autonomous scanning, dynamic SBOM profiling, red-teaming, and bug bounty services. This strategic move is positioned as a response to the increasing complexity of software development and the need for security solutions that integrate artificial intelligence with the creativity of skilled security researchers. The acquisition is expected to accelerate the delivery of advanced, programmatic security testing throughout the software development lifecycle.
Jun 29, 2026