I learned about Qadium last spring. Not sure how under the radar they were then, but I heard about it through a referral of a referral working on cyber risk.

If they are able to credibly provide a baseline for number of connected devices and percentage that are vulnerable, it won't be a huge step up from zmap, but it could provide some interesting data for security pros, regulators and insurance. Not sure how they get to the part about vulnerability of devices.

The cyber kill chain provides a nice jumping off point for a hierarchical model, but the kind of data necessary to really flesh it out is just so damn hard to find at the quality levels necessary.