Reflectiz

Reflectiz addresses the runtime layer of web security that conventional server, network, WAF, code-scanning, and point-in-time assessment tools can miss. Its remote sandbox browser crawls selected pages and user journeys, including authentication and checkout flows, then observes scripts, iframes, tags, pixels, cookies, headers, JavaScript execution, and network requests. The platform builds an inventory of the components and external destinations present on a live site, compares observed behavior with baselines and reputation or vulnerability intelligence, and prioritizes changes such as keylogging, unauthorized tracking, PII harvesting, suspicious communications, malicious code, and other data-exposure paths. Reflectiz says the process is agentless and requires no embedded code or installation, which reduces deployment friction but also makes the quality and breadth of simulated journeys central to coverage.

The company now presents a unified platform organized around Security Hub, Privacy Hub, Offensive Hub, and a PCI Module. Security Hub targets Magecart, web-skimming, client-side supply-chain compromise, malicious scripts, and behavioral changes that occur after a page loads. Privacy Hub tests whether consent and opt-out controls are enforced in actual browser behavior, rather than merely configured in a consent-management platform. The PCI Module focuses on PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1 by maintaining payment-page script inventories, detecting unauthorized changes, and producing audit evidence. Offensive Hub extends the product toward continuous, agentic web penetration testing. These modules broaden the addressable buyer set across security, privacy, digital, marketing, compliance, and application-security teams, while creating a diligence question about product focus and the relative maturity of each module.

The commercial case is strongest in enterprises whose revenue, payments, regulated data, or brand reputation depend on complex public websites. Reflectiz identifies financial services, e-commerce, healthcare, and other global enterprises as target markets, and its public customer material references organizations including DAZN, Cox Communications, Village Roadshow, Leeds United, and lastminute.com. Those references demonstrate market validation, but they are not the same as disclosed recurring revenue, retention, deployment scale, or independent customer references; those metrics remain important diligence gaps. The company announced a Series A of more than $5 million in 2020 and currently states that it is backed by $22 million in Series B funding. Its public profiles indicate a transition from a small Israeli startup toward a 51–200-person, globally operated private company with Tel Aviv/Ramat Gan R&D, Boston commercial operations, and an ANZ presence.

Competition includes dedicated client-side security vendors such as c/side, Feroot, Source Defense, and Jscrambler, as well as adjacent website-privacy, digital-risk, continuous-penetration-testing, WAF, CDN, and broader application-security products. Reflectiz’s potential edge is the combination of remote browser observation, third- and fourth-party visibility, cross-functional risk context, and compliance evidence without a page-side agent. The trade-off is that a remote monitor must model meaningful authenticated and geographic journeys, distinguish legitimate dynamic behavior from attacks, and turn findings into prevention or remediation rather than merely producing another inventory. Larger platforms can bundle adjacent controls, while specialist competitors may offer deeper blocking, runtime enforcement, or code-level workflows.

The dual-use case is credible but should be framed as critical digital-service protection rather than battlefield technology. Government agencies, public-sector portals, financial infrastructure, healthcare systems, and defense contractors all operate public web properties whose third-party code and browser data flows can become supply-chain or privacy risks. Reflectiz can help those organizations discover and validate exposure, but the public evidence does not establish classified-system deployments, government contracts, or defense-specific certifications. Strategic relevance therefore rests on strengthening the resilience and trustworthiness of sensitive digital services, with customer authorization, data-handling controls, deployment coverage, and operational response procedures requiring verification.