- Home
- Application Security Orchestration Platforms
- Strobes ASPM
Strobes ASPM
Plano, Texas, United States
What it is
Strobes ASPM brings application security findings into one view so developers and security teams can prioritize remediation. It ingests results from SAST, DAST, software composition analysis, container scanning, penetration tests, and bug bounty programs. Risk context includes exploit likelihood, asset criticality, compensating controls, EPSS, and KEV. The platform can apply security policies in CI/CD, block critical findings, warn about high findings, and give feedback in pull requests. AI agents can triage and deduplicate findings, create and route tickets, track SLAs, and check fixes by rescanning. Strobes lists more than 100 integrations, including security products and cloud services, and provides GraphQL access to assets, findings, engagements, and assessments. Deployment is available as cloud SaaS or private deployment; listed platforms are API, self-hosted, and web. The free plan is billed forever at no cost and covers up to 100 assets, 500 tasks a month, one connector, and community support. Paid plans start at $29,000 a year. A 14-day trial includes guided onboarding by a dedicated security engineer.
For and against
For
- Aggregates findings from six stated source categories
- Risk context includes EPSS and KEV
- AI agents can route work and verify fixes
- Free plan includes ASPM and one connector
- 14-day trial includes guided onboarding
Against
- Free plan is limited to 100 assets
- Free plan allows 500 tasks monthly
- Free plan includes only one connector
- Starter costs $29,000 a year
The verdict
Strobes ASPM focuses on consolidating findings, prioritizing risk, and organizing remediation across development and security workflows. The free tier has explicit asset, task, and connector limits; the paid Starter plan is $29,000 a year.
Who it suits
It suits security teams managing findings across multiple tools, particularly mid-market organizations and larger environments with high volumes or complex needs. Developers can also use its CI/CD checks and pull-request feedback.
Plans and prices
Free
up to 100 assets · 500 tasks/month · ASM, RBVM, ASPM · 1 connector
Read 15 Oct 2026 · strobes.co
Starter
up to 1,000 assets · 1,000 tasks/month · ASM, RBVM, ASPM · unlimited connectors
Read 15 Oct 2026 · strobes.co
Growth
1,001–25,000 assets · up to 25,000 tasks/month · ASM, RBVM, ASPM · unlimited connectors and users
Read 15 Oct 2026 · strobes.co
Enterprise
25,001+ assets · custom task limits · ASM, RBVM, ASPM · unlimited connectors and users
Read 15 Oct 2026 · strobes.co
On the record
- AI automation
- AI agents triage and deduplicate findings, create tickets, route work to teams, track SLAs, and verify fixes by rescanning.strobes.co · read 30 Sep 2026
- API
- The developer platform exposes GraphQL at /api/graphql/ for querying and mutating assets, findings, engagements and assessments.strobes.co · read 15 Oct 2026
- CI/CD
- Strobes says it can enforce security policy in CI/CD, block critical findings, warn on high findings, and provide in-PR feedback.strobes.co · read 30 Sep 2026
- CI/CD gates
- Policies can block critical issues or warn on high-severity issues directly in CI/CD pipelines.strobes.co · read 15 Oct 2026
- Company facts
- BounceWatch lists Strobes as founded in 2019, headquartered in Plano, with 61 employees and seed-stage status.bouncewatch.com · read 15 Oct 2026
- Company legal name
- The company-data profile identifies the legal name as Strobes Security, Inc.bouncewatch.com · read 15 Oct 2026
- Coverage
- The ASPM page says the platform ingests findings from SAST, DAST, SCA, container scanners, pentests, and bug bounty programs.strobes.co · read 30 Sep 2026
- Data and AI controls
- Strobes says customer data is not used to train its AI models and that agents use bounded autonomy, approval checkpoints and explainable reasoning.strobes.co · read 15 Oct 2026
- Data protection
- The trust page says Strobes uses SOC 2 certified data centers, network segmentation, intrusion detection, 24/7 monitoring, and regular third-party penetration testing of its platform.strobes.co · read 30 Sep 2026
- Deduplication
- Strobes says it normalizes overlapping findings from multiple tools and removes 60–70% of finding noise.strobes.co · read 15 Oct 2026
- Deployment
- The platform page says Strobes is available as cloud SaaS or private deployment.strobes.co · read 30 Sep 2026
- Developer API
- Strobes documents GraphQL platform access for querying and mutating assets, findings, engagements, and assessments.strobes.co · read 30 Sep 2026
- Documentation
- The help center lists 45 exposure-management articles, 39 integration articles, 34 agentic-pentesting articles and sections for dashboards, workflows and administration.help.strobes.co · read 15 Oct 2026
- Funding
- BounceWatch records four rounds totaling $780,000, including a $400,000 seed round from Chitra Holdings Inc. on March 5, 2022.bouncewatch.com · read 15 Oct 2026
- Integrations
- The integrations catalog advertises more than 100 connectors spanning scanners, cloud security, containers, ticketing and development tools.strobes.co · read 15 Oct 2026
- Intel API
- An Intel REST API at intel.strobes.co provides CVE lookup, EPSS, CISA KEV and threat-actor data; bulk and advanced endpoints require a license.strobes.co · read 15 Oct 2026
- Intended users
- Strobes describes its customers as security teams ranging from mid-market teams to large organizations with complex, high-volume environments.strobes.co · read 30 Sep 2026
- Limit: data visibility
- A G2 reviewer says some reported vulnerabilities occasionally fail to appear in the portal, complicating closure tracking.g2.com · read 15 Oct 2026
