Hackuity

If the primary need is a vulnerability scanner rather than a vulnerability operations/unification layer

• Vendors that offer end-to-end scanning and remediation workflows may be preferable when a customer requires integrated scanning and exposure discovery rather than a unification layer.

If procurement requires transparent, self-serve pricing and trial access

• Public pricing information is limited, and third-party metadata suggests no free trial is offered; this can be a barrier for smaller customers seeking hands-on evaluation before engaging sales.

If independent public validation and a large volume of peer reviews are required for procurement confidence

• Public review counts and detailed independent testimonials are limited in the materials reviewed.

If the organisation cannot commit to the process and governance changes required to realize remediation outcomes

• Unifying remediation across tools and teams requires process change and organizational commitment in addition to tooling.

Known limitations evidenced in public sources

• Limited public review volume restricts external validation of product maturity and support experience.
• At least one public review cited localization gaps at the time of that review.

Roadmap / indicators in vendor materials

• Vendor materials reference additional capability pages and forthcoming connectivity items; buyers should request an explicit product roadmap and timelines.

Scale limitations

• Vendor statements claim high scale in terms of findings and assets; independent benchmarking or customer validations were not available in the reviewed materials.

Security/compliance documentation gaps in public materials

• Beyond the SOC 2 Type II claim, detailed documentation of enterprise controls (SSO/SAML/SCIM/audit logging/encryption) and additional certifications were not publicly documented in the reviewed excerpts; buyers should request the relevant security package and certification evidence.

• Deduplication across multiple tools to reduce duplicate findings prior to prioritization.
• An explainability-focused risk scoring approach intended to provide context for prioritization decisions.
• Deployment flexibility with options for cloud or on-premises installations, which may support regulated environments.
• A large number of advertised integrations and a vendor process for adding connectors.

• Available review excerpts include statements valuing consolidation of vulnerabilities and orchestration features; buyers should validate claims in product demonstrations and with customer references.

• Competitors that provide integrated scanning and exposure management may reduce integration effort for customers standardized on a single vendor ecosystem.

• Review platforms show a small number of public reviews and summary ratings in the sampled materials; detailed review text is often gated behind reviewer-platform accounts.
• Example reviewer feedback visible in public summaries
  • Positive comments reference consolidation of findings across detection methods and the ability to orchestrate remediation workflows.
  • Some reviewers noted localization and product maturity gaps at the time of their reviews.
• Limitations
  • The quantity of publicly accessible, detailed reviews is small; platform snapshots and gated content limit the ability to draw broad conclusions.

• Vendor representatives have participated in community forums discussing technical topics such as connector development and normalization approaches. Public forum participation is informative but differs from independent customer reviews.

• Consolidation of findings across multiple tools and support for remediation orchestration are cited in available review excerpts.
• Responsiveness of vendor staff is mentioned in at least one review excerpt.

• Requests for improved localization and the lack of publicly available pricing information appear in the limited review excerpts examined.

• Public evidence is limited. One plausible rationale is that organizations with multiple scanners and a large volume of findings may select a unification and orchestration layer to reduce duplicate findings and coordinate remediation across teams.

• No robust public data on churn reasons was identified in the materials reviewed.

Vendor-provided case studies

• Vendor navigation references customer stories and an ROI calculator, but specific detailed case study pages with independent verification were not retrieved in the materials reviewed.

Vendor-published metrics (not independently verified)

• Vendor-published pages include templated or summary ROI metrics in some excerpts; some placeholders were visible in the reviewed content, suggesting buyers should request validated outcome data.

Critical evaluation

• Without independently verifiable case studies or third-party writeups that include methodology, buyers should treat ROI claims as directional and request baseline definitions, time windows, and details of concurrent operational changes.

• Vendor materials describe deployments ranging from mid-enterprise to very large organizations in terms of asset counts. Buyers should validate scale claims with vendor references.
• Practical ICP ranges (analyst inference)
  • Mid-enterprise to large enterprise organizations where multiple scanners and teams produce overlapping vulnerability findings and where cross-team remediation governance is a significant concern.

• Public evidence is limited but vendor materials and review materials reference energy and banking sector customers.

• Decision makers
  • CISO, Head of Vulnerability Management, Head of Security Operations / Exposure Management
• End users
  • Vulnerability managers/analysts, security engineering, IT operations owners, application security teams, and remediation owners using issue trackers or ITSM systems

• Tool sprawl and duplicated findings
• High volumes of prioritized alerts with limited context for remediation
• Lack of remediation ownership and auditability

• Multiple scanners and tools producing overlapping findings
• Need to operationalize remediation SLAs and ownership across teams
• Existing ITSM usage where orchestration can integrate
• Regulated environments where deployment flexibility and data residency options are required (verify vendor capabilities)

• Small organizations with a single scanner and simple remediation processes
• Teams seeking primarily a vulnerability scanner rather than an orchestration/unification layer
• Buyers requiring large volumes of independent peer reviews and public benchmark data prior to procurement

• Hackuity is described by the vendor as a platform that applies machine learning and automation to consolidate vulnerability findings and asset data from existing security tools, deduplicate overlapping results, enrich and prioritize remediation items, and support remediation workflows including ownership assignment and reporting. The product is positioned as an operational layer that integrates with scanners and other security tools rather than replacing scanning capabilities.
• The vendor message includes a concise slogan emphasizing data unification and a remediation workflow layer that sits above scanners and security tools.

• Target buyers/roles highlighted by the vendor
  • Chief Information Security Officers (CISO)
  • Vulnerability managers
  • IT and security operations teams
  • Managed security service providers (MSSPs)
• Market category positioning (third-party market listings referenced by vendor materials)
  • Listed in categories related to Vulnerability Assessment and Exposure Assessment Platforms.

• HQ
  • Lyon, France is referenced as headquarters in vendor materials.
• Founding year discrepancy to note
  • Different vendor and third-party pages list founding or public dates as either 2018 or 2020; this may reflect reorganization, re-founding, or product relaunches. Buyers performing diligence should request the legal entity incorporation date and the product general availability date.
• Leadership (vendor stated)
  • Co-founder & CEO: Patrick Ragaru (vendor materials)
  • Co-founder & CRO: Pierre Samson (vendor materials)

• Funding (vendor claim)
  • The vendor has announced a late-stage funding round and reports cumulative funding; specific amounts, dates, and investor identities should be confirmed with the vendor and legal filings where available.
• Scale metrics (vendor claim; not independently verified)
  • The vendor publishes counts such as large volumes of findings and asset coverage and cites named enterprise customers. These metrics are vendor-published; methodology and production deployment status are not independently validated in this report.

• Vendor site shows a contact/sales-driven engagement model rather than a public price list.
• Review sites and third-party descriptions indicate subscription licensing that may be structured by asset counts, endpoints, or users and that the vendor offers cloud or on-premises deployment options. Public list prices are not available for the core product in the materials reviewed here.
• Practical takeaway
  • Expect enterprise, quote-based pricing tied to asset counts and selected modules; validate whether on-premises or hybrid deployment impacts pricing and whether connectors or custom integrations incur additional fees.

• Potential cost drivers implied by product type
  • Integration effort: connecting a wide range of tools requires identity resolution, asset modeling, data normalization, workflow mapping to ITSM/dev tools, and governance activities.
  • Organizational alignment: assigning a single remediation owner requires process and governance work alongside technical deployment.
• Possible hidden/variable costs to ask about
  • Connector development and delivery timelines: vendor materials reference timelines for adding additional connectors; buyers should confirm scope, service-level commitments, and what qualifies as a standard connector versus a custom integration.
  • On-premises deployment requirements: infrastructure, patching, backups, upgrades, and security hardening become internal responsibilities for on-premises installations.

• Examples of adjacent or directly comparable vendors
  • Cisco Vulnerability Management (former Kenna)
  • Tenable One (Exposure Management)
  • Rapid7 InsightVM
  • Qualys VMDR
  • Vulcan Cyber (remediation orchestration)
  • ArmorCode (application security posture management where AppSec findings are included)