Security1 publisher3 min readPublished
Brinqa buys PlexTrac, and pen-test reporting becomes a feature of someone else's platform
Brinqa says PlexTrac will keep operating standalone. That is the sentence PlexTrac customers should get into their next renewal in writing.
The Watch · Security desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- Brinqa announced its acquisition of PlexTrac, adding the ability to verify that remediation efforts have actually worked; the combined capabilities are positioned to identify and prioritise the exposures that matter most, drive remediation, and validate that fixes hold, closing the CTEM loop.
- Dan Pagel, CEO at Brinqa, said the company spent over a decade building the platform enterprise security teams trust to prioritise what to fix first, that PlexTrac brings real offensive security depth from practitioners who have spent years proving how attackers get in, and that pairing that expertise with Brinqa's exposure assessment platform gives customers proof they can defend to a board, an auditor, or any AI system acting on that data.
- Brinqa says it has spent more than a decade on exposure management for large organisations including Nestle, PhonePe, Cambia Health Solutions, Guidewire and SAP.
- Brinqa reports 2025 results of 164% year-over-year growth in new bookings, a 32% increase in new-logo average selling price, and inclusion in the inaugural Gartner Magic Quadrant for Exposure Assessment Platforms.
- Brinqa says momentum accelerated in 2026, with new logo bookings more than doubling year over year and existing customers expanding deployments as it shipped new AI capabilities including MCP interfaces, an AI Attribution Agent and an AI Deduplication Agent.
Compiled by The WatchSomething wrong?How this is made
Why it matters
Brinqa has acquired PlexTrac, folding offensive-security reporting into an exposure-assessment platform and marketing the result as validated remediation [1]. For teams whose pen-test and red-team reporting workflow runs on PlexTrac, the consequential detail is not the continuous threat exposure management story but whether the thing they renew next year is still a product or a module [10].
The stated logic is loop closure. Brinqa says the combined capabilities let it identify and prioritise exposures, drive remediation, and then verify that fixes actually held [1]. Chief executive Dan Pagel framed PlexTrac as the offensive-security depth Brinqa lacked, and said pairing it with the exposure platform gives customers proof they can defend to a board, an auditor, or an AI system acting on the data [2]. Brinqa's own framing is blunter: a vulnerability marked closed in a ticketing system is a status update, while one confirmed closed through validated retesting is proof [13]. That distinction is real, and it is also the oldest argument in the retest business.
The rest of the announcement is company-supplied numbers. Brinqa reports 164 percent year-over-year growth in new bookings for 2025, a 32 percent increase in new-logo average selling price, and inclusion in the inaugural Gartner Magic Quadrant for Exposure Assessment Platforms [4]. It says 2026 new-logo bookings more than doubled year over year alongside shipments of MCP interfaces, an AI Attribution Agent and an AI Deduplication Agent [5]. It now claims more than 3,000 customers across 57 countries, with named references including SAP, Guidewire, PhonePe and Cambia Health Solutions [6][3]. Bookings growth percentages are not revenue, and the "largest standalone vendor in Unified Exposure Management" line is Brinqa's characterisation of itself, not a third-party finding, though both companies were independently placed in that Gartner Magic Quadrant [7]. Thomas Krane of Insight Partners, a Brinqa board member, supplied the investor endorsement [12]. Deal price, terms and closing date are not in the announcement [14].
For PlexTrac's installed base, two sentences matter more than the rest. First, PlexTrac's solutions will continue operating as standalone offerings, with the same experience customers have today and the option to extend into Brinqa's platform later [10]. Second, every confirmed exploit and fix from PlexTrac is described as flowing into Brinqa's data layer to strengthen its Cyber Risk Graph and its AI agents, including models customers run through Brinqa's Bring Your Own AI programme [8]. Those two commitments are not in conflict on paper, but consultancies and internal red teams holding client findings in PlexTrac should ask exactly what "flows into" means for their data, and get the answer in the contract rather than the press release.
The organisational signal is Dan DeCloss, PlexTrac's founder, joining Brinqa's executive leadership team and board to lead the combined offensive-security practice [9]. His public line is that PlexTrac was built by offensive-security practitioners for offensive-security practitioners and that this is not changing [15]. Founders who stay usually mean the roadmap survives a year or two; the pattern after that is bundling.
Watch the packaging. If PlexTrac stops being sold as a separate SKU with separate pricing, the standalone promise has quietly expired, whatever the support portal says. Watch whether pre-remediation exploitability testing and post-remediation retesting stay available to customers who do not buy Brinqa's prioritisation engine, since the announcement pitches them as two ends of one workflow driven by one prioritised list [11]. And watch DeCloss's title.