The office would be hard to find, and that is the point. Bendings, a cybersecurity firm founded in 2013 and headquartered in New York, has spent over a decade keeping a deliberately low profile while running offensive and defensive security work for governments, banks and asset managers in the United States and the Gulf Cooperation Council states.
Jacksen Smith, who leads intelligence at Bendings Labs, the firm's research division, put it plainly: "The market does not need another scanner. It needs someone who can answer for what the scanner missed."
That profile ended quietly this month. In late October 2026 the firm confirmed the completed acquisition of Scopertos, a vulnerability research company, in a transaction it valued at $55 million, financed from its own resources. Scopertos, which began in software delivery engineering and moved into original security research, sold its findings to a small number of clients under exclusive, multi-year agreements. Its unpublished research library, its isolated validation lab and its entire team, founder included, joined the New York firm as the core of Bendings Labs, the company's vulnerability research division. The acquisition closed in stages over a process that began in 2025, a structure that would ordinarily be reflected in the parties' transaction documents, which Bendings does not make public.
The company does not name its clients or publish its research inventory. Specific vulnerabilities, client identities and contract terms are confidential under agreements that transferred with the acquisition, and prior ownership is not being disclosed at the sellers' request. Bendings plans the first coordinated disclosures from the acquired library in 2027.
Two products do most of the talking for the firm. Bendings Gauge is an AI model for continuous red and blue team work, the offensive and defensive testing that security teams run around the clock. It operates inside limits each client approves: it refuses any target outside the signed scope, risky steps wait for a Bendings operator to approve them, a named person on the client's side can halt it at any time, and it logs every action and hands the complete log to the client. It runs inside the client's network, in-country, fully air-gapped or hosted by Bendings, and the client's data is never used to train the model.
Bendings Frame is the operating system the firm's operators work in. It brings logs, alerts, network and device data into one live picture as they arrive, and it places cameras, access control and sensors in the same picture as a client's networks. Frame acts on its own within rules set in advance, with people approving what matters. According to figures the firm shared, Gauge runs tens of thousands of automated testing agents a year.
That physical-digital fusion is not an abstraction. In The Seam Report 2026, the firm's public research study documenting 78 intrusions into regulated environments, 7 of 78 cases show operational technology stopping because the victim lost its IT systems, against 6 in which the adversary acted inside the operational systems themselves. The report also found that security products, the software sold to keep intruders out, made up 17.6 percent of additions to the federal government's catalog of known exploited vulnerabilities in the first nine months of 2026, up from 10.7 percent in the same months of 2022, with a median of two days between a security-control flaw being published and appearing on the exploited list.
The reporting clocks those clients face give the automation argument teeth. In Bahrain, Qatar and Kuwait, a first report of a serious cyber incident to the central bank is expected within one hour; US bank regulators allow 36 hours from the bank's own determination.
The speed of the firm's recent activity stands out for a company that avoids press. Bendings has also agreed to acquire Spynapse, an automation and AI engineering company, for $10 million, with the team joining to automate security operations across Frame. The firm says it continues to evaluate further targeted acquisitions in the two regions where it already works, and signals more news about its Gulf operations before the end of the year.
A privately held firm with no outside investment, a $65 million pair of acquisitions and a research division that plans to publish in 2027 is an unusual combination at this end of the market. Smith sees it differently: "Everything we publish is verifiable. Everything we do not publish is contract. Both are deliberate." Whether the strategy works will show up in the only metric the firm seems to care about: whether the quietest test in the industry is the one that passes.
Bendings did not respond to a request to name clients or discuss transaction terms.
Media contact: press@bendings.com
