Companies Using Detectify

Every domain in our index gets a DNS lookup before we load a page, and Detectify is one of the signals that lookup finds. A domain counts when a TXT record contains detectify-verification. Our October 2026 crawl puts that at 5,234 domains once agency-held ones are removed, 4,090 matched to a company, 4th of 17 in Security Testing & Compliance. When I re-read their DNS on 15 October, 5,187 still carried the record. So the record is real. The question I had to answer first was whose it is.

What the record proves

Detectify runs attack payloads against websites, so it makes you prove you may test a domain first. Its support pages say the tests will most likely reveal sensitive information, and its docs say each root domain is verified once and covers its subdomains. A file in a /.well-known path or a meta tag works too, and those domains don't appear in our count. Nothing removes the DNS record when a contract ends.

Sales signal: a Detectify record means someone authorised outside security testing of that domain at least once. That's a stronger buying signal than a newsletter sign-up, and a weaker one than a renewal.

Whose account is it?

Detectify's code is per account, so one code on many domains is one account. Most shared codes are company groups: the Strawberry hotel group verified 41 hotel, spa and venue domains under one code, eXp Realty 24 domains, Alma Media 14 Finnish media and marketplace sites and Swedbank 6 country domains.

Some shared codes belonged to someone else, and we took those out. Bytbil, the Swedish car-listings company, had verified 48 dealer websites built on its platform. Go Sitebuilder, a small-business site builder, covered 23 sites and Pictrs, a shop platform for photographers, 19. Fifteen campaign groups, MoveOn and the AFL-CIO among them, shared one code with Action Network, the campaigning-tools provider. Web agencies and IT providers in Canada, Belgium, the Netherlands and Sri Lanka did the same on a smaller scale. Across 34 codes that came to 251 domains, 4.56% of the raw 5,500, now excluded. On the cleaned 5,234, 4,506 codes remain and 3,989 sit on a single domain.

"A Bytbil car dealer didn't sign up for Detectify. Bytbil did, for 48 dealers at once. Read the code before you read the domain." - David Thomson, CTO at TechnologyChecker.io

Sales signal: agencies and site platforms that verify client domains already run scanning for their clients. They're the better target for a scanning vendor; their client sites are poor leads for anyone else, which is why they're not on this list.

One month, steady exits

The usage chart has a single October point, because the cleaned count only exists for the current crawl; earlier months also wouldn't compare, since the domains we crawl turn over every month and our DNS detection has widened. Exits are rare: 91 domains dropped the record since 16 March 2026, 10 of them still carry it on another hostname, and when I re-checked the dropped hostnames, 68 of 91 had removed it.

Sales signal: don't pitch Detectify's base as a fast-growing market. It's a stable pool of about 5,000 domains whose owners rarely clean up.

Small software companies

The base is the opposite of Wiz's. 82.3% of matched companies with a known size have 200 staff or fewer, and the biggest band is 11 to 50 (34.83%). Only 5.9% pass 1,000. They're young too: 59% were founded in 2010 or later. Software Development (17.05%), IT Services (10.54%) and Technology, Information and Internet (7.22%) lead the industries. HubSpot, Canva, Seagate and Forbes are the large names; Toast, Box, Depop and QuintoAndar are typical of the software core.

Sales signal: these are product teams without a big security department. Pitch tools that save them headcount, such as automated fixes, managed pentests or compliance evidence, rather than another dashboard.

A Swedish home market

The United States has 1,194 matched companies and the United Kingdom 488. Sweden is third with 283, about one Swedish company for every four American ones, and Norway (56), Finland (47) and Denmark (47) take the Nordic total to 433. The Swedish list includes public bodies, the Swedish Tax Agency, the Public Employment Service, Stockholm University and Kungsbacka municipality, alongside Swedbank and PostNord.

Sales signal: for a Nordic security or compliance pitch, Detectify's Swedish list is a qualified start, now without Bytbil's dealer sites inflating it.

Overlap, not switching

We publish no migration table for Detectify. The largest overlap our checks found is with KnowBe4: 144 domains run both today, out of 150 ever seen with both. KnowBe4 trains staff against phishing and Detectify tests websites, so this is a company buying two layers of security, not swapping one for the other.

"144 Detectify domains also carry KnowBe4's record. Same security budget, different problem." - David Thomson, CTO at TechnologyChecker.io

Sales signal: the companies with both records have already taken security steps in more than one place. They're a short list for a third layer such as identity, backup or managed detection.

The stack around it

On the 5,234 domains, Cloudflare runs on 60.64%, Google Analytics on 68.23% and WordPress on 32.31%, with Webflow at 8.08%. Consent banners are split between Cookie Control (8.92%), Cookiebot (8.58%), OneTrust (6.46%) and CookieYes (6.44%). 1Password's verification record is on 3.88%, against 10.5% on Wiz's page.

Sales signal: the marketing site is usually WordPress or Webflow behind Cloudflare. Agencies that sell secure hosting or site maintenance will find their buyer here.

What it costs

Detectify's pricing page lists an annual platform fee: Starter from €0, Standard from €2,500, Professional from €5,000 and Enterprise from €15,000, with Surface Monitoring charged per domain and Application Scanning per target. PCI ASV scanning is €500 a year and non-profits get 30% off.

Sales signal: per-domain pricing punishes sprawl. Companies with many brands or country sites are the ones most likely to review the bill.

Key takeaways

1. 5,234 domains in October 2026, 4th of 17 at 4.09%; each verified a domain for Detectify scanning at least once.

2. 251 agency- and platform-held domains removed, led by Bytbil's 48 car dealers.

3. 82.3% of matched companies have 200 staff or fewer; 59% were founded after 2009.

4. Sweden is third by country with 283 matched companies.

5. 144 domains also run KnowBe4, an overlap rather than a switch.

How to use this list

Group rows by verification code and treat each as a past authorisation. Our DNS statistics report explains why we read TXT records as history. The full list of 5,234 domains, with 4,090 matched companies and their size, country and industry, is on TechnologyChecker.io.