Overview

NEW YORK – May 14, 2026 – SecurityScorecard, the global leader in threat-informed third-party risk management (TPRM), today announced it has completed the acquisition of Driftnet, a pioneer in global internet scanning and next-generation threat intelligence. This acquisition will bring Driftnet's high-fidelity internet discovery engine into SecurityScorecard's TITAN AI platform, giving TPRM, Security Operations, and threat hunting teams the real-time intelligence they need to find and fix third-party risks before attackers exploit them.

Using the Driftnet engine, SecurityScorecard's threat intelligence team recently identified more than 816,000 internet-exposed AI OpenClaw agent deployments, many already correlated with prior breaches. Incidents like these illustrate a new class of third-party risk: powerful automation tools deployed across supplier and partner environments with weak access controls, exposed credentials, and no visibility in traditional TPRM workflows.

Driftnet's proprietary internet scanning capabilities — including non-standard port enumeration, advanced fingerprinting, and IPv6 dominance — surface exactly the kind of hidden, misconfigured infrastructure that creates third-party exposure. With the Driftnet engine, SecurityScorecard indexes 40% more internet-exposed hosts than any other intelligence provider.

Scanning external infrastructure can only tell you so much. Significant threat intelligence depth is required in addition to this data to help you pinpoint the issues you need to prioritize.Paul McKay
Principal Analyst, Forrester Research
The threat landscape has fundamentally changed. AI agentic automation and connected supply chain tools have exploded across enterprise environments — and most TPRM programs have no visibility into the risk AI poses for their vendors. Driftnet's proprietary scanning gives our customers real-time, high-fidelity intelligence to find these exposures across the entire third-party ecosystem, before they become breaches.Dr. Aleksandr Yampolskiy
CEO & Co-Founder, SecurityScorecard

What the acquisition enables

Proactive Breach Detection — TPRM teams that rely on breach notifications are already behind. Driftnet's continuous scanning surfaces vendor exposures before they become incidents, giving teams defensible, real-time evidence to act on.

Threat Intelligence Flowing Into Vendor Risk — When STRIKE identifies a threat actor campaign or a new class of AI agent exposure, that intelligence flows automatically into third-party risk assessments. TPRM teams get context, not just scores — understanding which vendor exposures are actively exploited and which threat groups are targeting them.

Security Operations and TPRM in Lockstep — When a SOC analyst flags suspicious activity linked to a vendor's infrastructure, the TPRM team can act on that signal immediately. SecurityScorecard now gives all three functions the data and workflows to move from detection through vendor remediation without handoffs.

We built Driftnet to go where traditional scanners can't — into the hidden corners of the internet that attackers exploit precisely because most tools ignore them. Joining SecurityScorecard means that intelligence will now flow directly into the hands of the TPRM and SOC teams who need it most.Ben Schofield
Founder, Driftnet

Research partnerships

SecurityScorecard will maintain Driftnet's existing collaborations with US, EU, and UK CERTs and several leading universities in internet measurement research. These partnerships have produced significant cited academic work on global internet health.