Talk:SafeBreach

Request edit on 7 August 2026

Request to update the introduction, "Platform" section, and add "SafeBreach Labs" section

COI disclosure: I am an employee of SafeBreach and have a conflict of interest regarding this article. I am proposing the changes below for review by an uninvolved editor rather than editing the article directly.

The article's introduction and its description of the SafeBreach platform haven't been updated since the company's founding in 2014 and don't reflect the company's most recent product offerings. I'd also like to propose a new section on SafeBreach Labs, the company's internal security research team, which isn't currently covered in the article. Sources are independent media, industry-analyst reports, and vendor press releases/blog posts (marked as such); I'm happy to adjust wording or trim anything that reads as promotional.

1. Proposed update to the introduction

Current text:

SafeBreach is a cybersecurity company that develops:breach and attack simulation (BAS) and continuous security validation platform. It is based in Sunnyvale, California. It was founded in 2014 in Tel Aviv, Israel.

Proposed replacement:

SafeBreach is a cybersecurity company that was founded in 2014 in Tel Aviv, Israel. The company initially developed breach and attack simulation (BAS) technology, but later expanded its offerings to include adversarial exposure validation (AEV) and continuous threat exposure management (CTEM). It is based in Sunnyvale, California.

Note for reviewer: The existing footnote on the founding/BAS sentence can stay as-is — I haven't touched that part of the claim, just reordered it. The AEV and CTEM references are both to independent third-party sources: a trade-publication award recognizing SafeBreach specifically in the AEV category, a Gartner Market Guide naming SafeBreach as a Representative Vendor in that same category (Gartner's report itself is paywalled, but the citation is standard practice for analyst-firm coverage), and an industry awards site plus The Hacker News's CTEM awards page for the CTEM half of the sentence.

2. Proposed update to the Platform section

Suggested opening paragraph (rewrites the section's existing first paragraph, reusing the article's existing citations for the general claims plus one new citation for the specific attack-method count — see note below):

When SafeBreach was founded in 2014, its flagship offering was breach and attack simulation (BAS) technology designed to simulate the tactics, techniques, and procedures (TTPs) used by malicious actors to identify security control gaps. Using a library of more than 30,000 attack methods called "The Hacker's Playbook," SafeBreach runs simulations to identify whether or not an organization's security defenses work as expected. There are thousands of different possible breach scenarios depending on a client's unique network setup.

Note for reviewer: This mostly restates the section's existing opening paragraph with added framing (TTPs, founding year) reusing the article's own existing footnotes (Geek2016, SC, NW01, NW02) by name, so no new citations are needed for most of it. The one exception is the specific "30,000+ attack methods" figure: footnote NW02 is a 2016 article and predates that figure by roughly a decade, so it can't actually support it. I've added a current SafeBreach page as a second citation for that specific number, since I couldn't find independent, non-SafeBreach coverage stating an exact current count. If a precise, independently-sourced number becomes available, it should replace the SafeBreach citation.

Suggested addition (to follow the paragraph above):

In February 2025, SafeBreach launched the SafeBreach Exposure Validation Platform, unifying its existing breach and attack simulation technology, SafeBreach Validate, with a new attack path validation capability, SafeBreach Propagate. Together, these technologies offer adversarial exposure validation (AEV) that provides combined visibility into control effectiveness and lateral-movement risk. In April 2026, the company introduced the SafeBreach CTEM Platform, built on an AI infrastructure layer called SafeBreach Helm. SafeBreach Helm orchestrates three AI agents— an Analyst Agent, a Validation Agent, and a SecOps Agent—that together automate the stages of the continuous threat exposure management (CTEM) lifecycle: scoping, discovery, prioritization, validation, and mobilization.

Note for reviewer: The Helm blog post (ref name="sbhelm") is a company source and is included only to support the specific detail of the three agents' names/functions, which the independent sources describe in less detail. Happy to have that ref removed if it's preferred to rely solely on independent coverage.

3. Proposed new section: SafeBreach Labs

SafeBreach Labs is SafeBreach's internal security research team. As of 2026, the team has been credited with discovering move than 50 CVEs (Common Vulnerabilities and Exposures) in widely used software and cloud services, and has presented original research at Black Hat USA in most years since 2016, along with recurring presentations at DEF CON, Black Hat Asia and Black Hat Europe.

Black Hat USA presentations by SafeBreach Labs researchers have included:

• 2016 – "Crippling HTTPS with Unholy PAC" (Itzik Kotler, Amit Klein)
• 2017 – "The Adventures of AV and the Leaky Sandbox" (Itzik Kotler, Amit Klein)
• 2019 – "Process Injection Techniques – Gotta Catch Them All" (Itzik Kotler, Amit Klein)
• 2020 – "HTTP Request Smuggling in 2020" (Amit Klein) and "A Decade After Stuxnet's Printer Vulnerability" (Peleg Hadar, Tomer Bar)
• 2021 – "hAFL1: Our Journey of Fuzzing Hyper-V and Discovering a 0-Day" (Peleg Hadar, Ophir Harpaz)
• 2022 – "The COW (Container On Windows) Who Escaped the Silo" (Eran Segal)
• 2023 – "Defender-Pretender: When Windows Defender Updates Become a Security Risk" (Tomer Bar, Omer Attias); "EDR = Erase Data Remotely" (Tomer Bar, Shmuel Cohen); "One Drive, Double Agent: Clouded OneDrive Turns Sides" (Or Yair)
• 2024 – "Windows Downdate: Downgrade Attacks Using Windows Updates" (Alon Leviev)
• 2025 – "Invitation Is All You Need!," demonstrating exploitation of Google Gemini for Workspace assistants via a Google Calendar invitation (Or Yair, Ben Nassi, Stav Cohen)
• 2026 – "Forgotten but Not Gone: Unauthenticated RCEs and LPEs in Legacy Linux Services," examining decades-old vulnerabilities in Telnet and Samba, including CVE-2026-4480, a pre-authentication remote code execution flaw in Samba's print handling (Ron Ben Yizhak)

Thank you for your time reviewing this. MOatSB (talk) 15:12, 7 August 2026 (UTC)

MOatSB (talk) 15:12, 7 August 2026 (UTC)

References