BreachBits
The Cyber Risk Radar: AI-powered autonomous external testing that scores breach risk from evidence.
About
BreachBits is a Washington-based company built by US military cyber warfare veterans, led by CEO John Lundgren. Its BreachRisk platform runs the attacker's playbook continuously and safely: discover the external attack surface from little more than a domain, enumerate live hosts and crawl apps, verify every threat to kill false positives, safely exploit what is real, then assess impact and map results to compliance frameworks, rolling everything into a single BreachRisk Score. The framing is explicitly anti-questionnaire: evidence-based risk assessment instead of paperwork.
The platform comes in modules so customers pay for what they need. BreachRisk Business targets companies wanting continuous attacker-grade testing, while BreachRisk for Service Providers lets MSPs and consultants test client environments. A compliance-oriented offering maps real web-app, API, and external pentest findings to SOC 2, PCI DSS, HIPAA, ISO 27001, and NIST 800-53 controls with a coverage matrix auditors can inspect. The company says its approach is backed by Lloyd's, and it signed a Japan distribution deal through SentryMark and Nippon Telematique. Web-app and API testing includes injection, broken access control, authentication, business-logic abuse, and SSRF/RCE coverage with CVE, CVSS, EPSS, and KEV signal on findings.
What it can do
- AI-powered autonomous external attack-surface discovery from a domain
- Verification and safe exploitation to eliminate false positives
- BreachRisk Score for quantified, trendable cyber risk
- Web-app and API pentesting with coverage matrix (injection, IDOR, auth, SSRF, RCE)
- Findings mapped to SOC 2, PCI DSS, HIPAA, ISO 27001, NIST 800-53
- Modules for business, service providers, insurers, and compliance teams
Setup
- Sign up at breachbits.com and provide your domain for BreachRisk discovery.
- Choose modules: Business for your own estate, or Service Provider for client testing.
- Let the platform discover, verify, and safely exploit your external surface on a continuous schedule.
- Use the BreachRisk Score and compliance control mappings in board and auditor reporting.
Prerequisites
A BreachBits subscription; authorization for external testing of your domains.
Use cases
Works with
Trust score — 6/10
Scored 6/10 (verified tier, metrics-v1). Evidence: breachbits.com and product/solution pages verified live with detailed methodology; built by US military cyber warfare veterans, CEO John Lundgren (Business Wire via Silicon UK); Japan distribution via SentryMark/NTI announced; Lloyd's backing claimed on site. Strengths: evidence-based scoring model, compliance control mapping with coverage matrices, modular product lineup. Docked for: (1) no public funding, customer, or adoption metrics to verify scale; (2) scoring methodology and Lloyd's backing are vendor-stated. License: proprietary.
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 6.0/10
- Maintenance · recency, releases, issue load
- 7.0/10
- Openness · license + docs
- 3.0/10
- Manual review · sanity read + red-flag check
- 6.0/10
- · Built by US military cyber warfare veterans; CEO John Lundgren (Business Wire via Silicon UK)
- · BreachRisk platform: discover, enumerate, verify, test, assess, analyze, score; Lloyd's backing claimed on site
- · Japan distribution via SentryMark/Nippon Telematique; compliance mapping to SOC 2/PCI DSS/HIPAA/ISO 27001/NIST
- · breachbits.com verified live (HTTP 200)
- · No public funding, customer, or adoption metrics; scoring methodology vendor-stated
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.