Brinqa has announced its acquisition of PlexTrac, a move that integrates validated remediation capabilities into its exposure management platform. This acquisition aims to provide enterprises with a comprehensive solution for identifying, prioritizing, and verifying the resolution of security exposures, effectively closing the Cyber Threat Exposure Management (CTEM) loop.
According to Brinqa CEO Dan Pagel, the acquisition combines Brinqa's decade-long expertise in exposure assessment and prioritization with PlexTrac's offensive security depth. This integration is intended to offer customers concrete proof that remediation efforts have been successful, a critical element for reporting to boards, auditors, and AI systems.
Brinqa has a history of addressing exposure management for large organizations such, including Nestlé, PhonePe, Cambia Health Solutions, Guidewire, and SAP. The company reported significant growth in 2025, with a 164% year-over-year increase in new bookings and a 32% rise in new-logo average selling price. This momentum continued into 2026, with new logo bookings more than doubling and existing customers expanding their deployments, particularly with the introduction of new AI capabilities like MCP interfaces, the AI Attribution Agent, and the AI Deduplication Agent.
The acquisition of PlexTrac directly addresses a customer demand for verifiable proof that security fixes are effective. By integrating PlexTrac's confirmed exploit and fix data into Brinqa's Cyber Risk Graph, the combined entity aims to enhance its data foundation and AI agents, including those used through Brinqa’s "Bring Your Own AI" program.
With this acquisition, Brinqa now serves over 3,000 customers across 57 countries. The combined company positions itself as the largest standalone vendor in Unified Exposure Management, with both companies having been independently recognized in the Gartner Magic Quadrant for Exposure Assessment Platforms.
For Brinqa's existing customers, the acquisition means faster confirmation of successful fixes and robust evidence for reporting to auditors, insurers, and boards. The distinction is made between a vulnerability marked "closed" in a ticketing system and one confirmed closed through validated retesting.
PlexTrac's customers will benefit from their pentest teams and workflows being directly integrated into a CTEM program. Brinqa's prioritization engine will help focus pentest resources on the most critical exposures, and the validation process will cover both pre-remediation testing to confirm exploitability and post-remediation retesting to verify the fix. This integration aims to create a unified prioritized list for security, IT, and offensive security teams.
Dan DeCloss, founder and Chief Customer Brand Officer of PlexTrac, will join Brinqa's executive leadership team and board of directors to lead the combined offensive security practice. DeCloss emphasized that PlexTrac's focus on offensive security practitioners will remain, with the acquisition providing a larger platform to demonstrate the continued importance of hands-on offensive security expertise alongside increasing automation.
PlexTrac solutions will continue to operate as standalone offerings, allowing existing customers to maintain their current experience while having the option to integrate with Brinqa's broader platform as their programs evolve. Brinqa was advised by Covington Burling during the transaction.
