Startup Deep Dive : Cyware — the threat-intel platform that stayed a well-kept secret until 2022

Cyware has raised somewhere between $73 million and $81 million in venture capital since its first outside cheque in 2019, depending on whose count you trust. That is a rounding error next to Recorded Future, the threat-intelligence rival Mastercard bought for $2.65 billion in September 2024. Yet Cyware’s own marketing case study puts its 2024 revenue at $49.2 million, up roughly 4x from $11.2 million in 2020.

The contradiction is the point. Cyware does not sell a better threat feed. It sells cooperation — a platform that gets competing banks, rival automakers and understaffed government agencies to hand each other attack data in real time, on the theory that no single security team can out-hire the attackers alone. Whether that idea is worth a fraction of what Mastercard just paid for a data company, or whether it gets swallowed by the same consolidation wave, is still an open question in September 2026.

Quick facts

What they do

Cyware builds software that large organisations use to turn scattered threat data into coordinated action, and to share that data with each other — what the company calls a “cyber fusion” platform, combining a threat intelligence platform (TIP) with security orchestration, automation and response (SOAR). It is not a threat-feed vendor competing to sell the most indicators of compromise; it operationalizes the feeds a customer already has, then automates the response across a security team’s other tools. Its buyers fall into four groups: large enterprises (banking customer Arvest Bank is a named case study), managed security service providers (MSSPs) reselling the platform to their own clients, sector-wide Information Sharing and Analysis Centers (ISACs) such as Auto-ISAC and Health-ISAC that need to distribute intelligence across an entire industry, and government agencies pursuing cloud tools that meet US federal security standards.

The origin

The founding insight came from inside a bank, not a security vendor. Anuj Goel spent years leading global cyber strategy at Citi, where he watched the same failure repeat: organisations spent heavily to collect threat intelligence, then let most of it sit unused because nobody had built the plumbing to turn a threat report into an actual blocked connection or an alerted analyst. He brought the idea to Akshat Jain, an engineer he had worked alongside at Adobe and Oracle. The two incorporated their venture in 2016 — records for Cyware Labs India Private Limited show incorporation on 9 May 2016 in Bangalore, Karnataka — and spent the next two years building before Cyware publicly launched its platform in 2018, positioned around what it called the “virtual cyber fusion centre”: a shared operating picture where intelligence, automation and cross-team collaboration lived in one place instead of three disconnected tools.

The struggle years

Two stretches nearly derailed the company, and neither shows up in the celebratory funding press releases.

The first was capital scarcity. Cyware ran for roughly three years — from its 2016 incorporation to its first outside institutional cheque, a $3 million seed round from Great Road Holdings and Emerald Development Managers on 10 September 2019 — while competing for enterprise security budgets against far better-funded threat-intelligence names. A $3 million seed is a modest base from which to sell into banks and federal agencies that expect vendors to survive a multi-year procurement cycle.

The second, more revealing setback came after the money problem was solved. By late 2022, Cyware’s product had real technical traction — the company says its platform was used by roughly 90% of major ISACs and more than 25,000 member organisations at the time — but it had no commercial engine behind that traction: no real demand-generation function, no analyst-relations program, no modern marketing stack, and a marketing team essentially built around a single hire. A case study on the turnaround, published by executive-search firm Christian & Timbers, describes the risk bluntly: Cyware was at risk of “remaining a well-kept secret in a market that was consolidating fast.” A company can build the right product and still lose simply because the market never finds out it exists — that is close to what was happening here through most of 2022.

The turning point

The fix was not a new product. It was a hire. In October 2022, Cyware brought on Willy Leichter — a 20-year cybersecurity marketing veteran with prior CMO and VP roles at LogicHub, Virsec and CipherCloud — as VP of Marketing, tasked with building the commercial infrastructure the product had outgrown. What followed in the next eight months reads like a compressed proof of the thesis: FedRAMP Ready designation for the Cyber Fusion Center platform in January 2023, opening the door to federal buyers; a self-serve “CTIX Lite” listing on AWS Marketplace in February 2023, cutting the enterprise sales cycle for smaller deals; a “Representative Vendor” mention from Gartner in its Security Threat Intelligence Market Guide in May 2023; and, in June 2023, both a $30 million Series C round and the launch of the CywareOne partner program for MSSPs. On one side of that turning point: revenue the company and its marketing partner put at roughly $11.2 million as recently as 2020, and a company “well-kept secret” as late as 2022. On the other side: estimated 2024 revenue of $49.2 million, with the same case study citing 84% year-over-year growth in 2024 alone. The product had not fundamentally changed; the ability of the market to find it had.

The money behind it

Cyware has taken outside capital in four disclosed rounds, plus a smaller follow-on tranche, all funding a slow, steady climb rather than one blockbuster raise:

• Seed — $3 million, announced 10 September 2019, from Great Road Holdings and Emerald Development Managers.
• Series A follow-on — an undisclosed amount, announced 11 January 2020, from a group of named cybersecurity executives: Greg Clark (then CEO of Forescout), Tom Noonan (founder of Internet Security Systems and Endgame), and Signal Sciences co-founders Andrew Peterson and Zane Lackey — described by Cyware as “oversubscribed.”
• Series A — $10 million, closed August 2020, led by Prelude Fund (the venture arm of Mercato Partners) and cybersecurity vendor Tanium, with existing seed backers Great Road Holdings and Emerald Development Managers returning.
• Series B — $30 million, announced 16 March 2021, co-led by Advent International and Ten Eleven Ventures, taking total funding to date to $43 million.
• Series C — $30 million (reported as $37.9 million by data tracker Tracxn), announced 29 June 2023, led by Ten Eleven Ventures with Advent International, Zscaler, Emerald Development Managers, Prelude and Great Road Holdings participating; total funding reported at $73 million by SecurityWeek in 2023, versus $80.9 million across “4 rounds from 11 investors” per Crunchbase/Tracxn data as of 2026. No post-money valuation has been disclosed for any round.

Three backers stand out for what they specifically changed, beyond the cheque:

• Advent International — a global growth-equity firm, not a typical seed-stage cyber investor — co-led the 2021 Series B and returned for the 2023 Series C, bringing later-stage financial discipline usually reserved for companies closer to an exit.
• Ten Eleven Ventures — a fund that invests only in cybersecurity — backed Cyware twice, in the Series B and then as lead of the Series C, a repeat bet from a specialist investor that carries more signal to enterprise and government buyers than a generalist VC’s cheque.
• Zscaler — a publicly listed zero-trust networking vendor investing directly in a smaller company in the Series B and Series C — is a strategic rather than purely financial backer, the kind of investment that often precedes or accompanies a product integration or channel partnership between the two companies.

How it makes money

Cyware is a business-to-business software company, and its revenue model looks like most enterprise security software rather than like a data marketplace:

• Platform subscriptions: enterprises, MSSPs and ISACs pay recurring licence fees for the Cyware Intelligence Suite and its orchestration modules, typically under multi-year enterprise contracts common in security procurement.
• Marketplace self-service: since February 2023, a lighter “CTIX Lite” edition has been sold directly through AWS Marketplace, letting smaller buyers skip a traditional sales cycle — a lower-friction, lower-touch revenue line layered on top of the enterprise sales motion.
• Partner/channel revenue: the CywareOne program, launched June 2023, extends the platform through MSSPs and resellers rather than direct sales alone, a common way for security vendors to reach mid-market customers without building out their own field sales force.
• Government contracts: FedRAMP Ready status, first achieved in January 2023 and reaffirmed in November 2024, is aimed specifically at unlocking multi-year US federal agency contracts, though Ready is a preliminary step short of full Authorization (see risks, below).

The part outsiders tend to get wrong: because Cyware sits in the “threat intelligence” category, it is often assumed to earn money the way a data broker does — charging per threat indicator or per data feed consumed. No published pricing or company statement supports that. Like most of its SOAR and TIP peers, its economics run on flat or tiered annual licence value per seat or per data-source integration, not a metered, per-transaction take rate. No take rate or per-unit fee has been published by the company.

The numbers

Cyware is privately held and, unlike a listed company, is under no obligation to publish audited financial statements for its US parent, Cyware Labs, Inc. The only audited-style disclosures on public record sit with its small Indian engineering subsidiary, Cyware Labs India Private Limited, filed with India’s Registrar of Companies — and that entity’s revenue reflects a cost-and-delivery centre, not the group’s global sales. The two data sets should not be read as the same number:

• Group net profit/loss for Cyware Labs, Inc. is not publicly disclosed anywhere; as a VC-backed private company still raising rounds through 2023, it is plausible the group is prioritising growth over near-term profit, but that is inference, not a reported figure.
• The Indian subsidiary’s net profit rose an estimated 2.5% YoY in FY25, and its net worth grew roughly 34% YoY, according to Tracxn’s read of the same MCA filings — indicating the India entity itself is profitable, though it is a fraction of the global business and employed 134 people as of 31 January 2025.
• Exact rupee-crore profit and loss figures for the Indian entity sit behind Tofler’s paid tier and were not independently verifiable this session; they have accordingly been left out rather than estimated.

Where the money comes from

Cyware’s customer base splits across channels that are unusual for enterprise security software — a large share of its reference customers are non-profit consortia, not just corporates:

• Sector ISACs/ISAOs: Auto-ISAC (automotive industry), Health-ISAC (healthcare), and MTS-ISAC (maritime transportation) all run on Cyware as their information-sharing platform; the company’s broader network also touches CISA’s Automated Indicator Sharing (AIS) program, MS-ISAC (US state and local government), REN-ISAC (higher education) and NRECA (electric co-operatives).
• Enterprises: named customers include Arvest Bank, using the platform to unify fraud and cybersecurity operations into a single view.
• Government: federal agencies pursuing cloud tools cleared to FedRAMP standards, a channel Cyware specifically targeted with its January 2023 and November 2024 FedRAMP Ready milestones.
• Geography: Cyware earmarked part of its 2019 seed round specifically for expansion into the Asia-Pacific and Gulf regions, alongside its core US base, according to the round’s own announcement.
• Channel: AWS Marketplace self-service (from February 2023) and the CywareOne MSSP partner program (from June 2023) added lower-touch and channel-led revenue on top of direct enterprise sales.

The surprise is the ISAC concentration. A company selling into “threat intelligence” conjures images of banks and defence contractors as the default buyer. In Cyware’s case, a meaningful share of its scale and credibility — the “85% of major ISACs” and “30,000+ organisations” figures the company cites — comes from member-funded, non-profit information-sharing bodies that exist specifically because no single company in an industry trusts, or can afford, to fight threats alone.

The risks

• Platform consolidation squeezing point solutions. Five vendors — IBM, Palo Alto Networks, CrowdStrike, Cisco and Google — hold an estimated 60–70% of the broader threat intelligence market, per MarketsandMarkets’ 2026 research. That consolidation is active, not theoretical: Palo Alto Networks paid roughly $1.14 billion for IBM’s QRadar SaaS assets in September 2024 specifically to migrate those customers onto its own Cortex XSIAM platform, and Mastercard paid $2.65 billion for Recorded Future the same month. Large buyers increasingly prefer one vendor’s bundled platform over a standalone TIP/SOAR tool — a structural headwind for a company Cyware’s size.
• Dependence on budget-constrained consortia. ISACs are member-funded, non-profit bodies, not large corporates with expansive security budgets. A vendor whose reference base leans heavily on “85% of major ISACs” (Cyware, 2025) is partly exposed to renewal decisions made by consortium boards operating on member dues rather than enterprise procurement budgets, which can cap average deal size and slow expansion in that channel even as the enterprise and government segments grow.
• FedRAMP “Ready” is not “Authorized.” Cyware’s Cyber Fusion Center platform achieved FedRAMP Ready status in January 2023 and again in November 2024 — a preliminary step confirming a third-party assessment organisation found the platform’s security posture acceptable. Full FedRAMP Authorization still requires a sponsoring federal agency and a further assessment process that, across the industry, commonly takes well over a year. Until that step is reached, the size of federal contracts Cyware can actually sign into remains capped.

The takeaway

The most transferable lesson from Cyware’s decade is an uncomfortable one for engineers who believe the best product wins: it did not. By the company’s own account, it had already built the harder thing — technology trusted by roughly 90% of major information-sharing organisations — while still being, in its own marketing partner’s words, “a well-kept secret.” The unlock was not another feature. It was hiring someone whose entire job was making sure the market knew the product existed, then giving that hire the time to build category-standard infrastructure: analyst relations, a marketplace listing, a partner program, a compliance credential. Distribution is not the part of a B2B security business that engineers respect most, but for years it was the only part Cyware was missing.

Frequently asked questions

Is Cyware an Indian company?

Its origin is Indian in ownership and engineering, not headquarters. Records show Cyware Labs India Private Limited was incorporated in Bangalore on 9 May 2016, and it remains the company’s Indian engineering entity, employing 134 people as of January 2025. The parent company, Cyware Labs, Inc., is a US corporation headquartered in Jersey City, New Jersey (earlier press coverage placed it in New York). Founders Anuj Goel and Akshat Jain are both of Indian origin.

How much money has Cyware raised in total?

Reported totals vary by source: SecurityWeek put cumulative funding at $73 million as of the June 2023 Series C announcement, while Crunchbase and Tracxn list $80.9 million across four rounds from 11 investors as of 2026. Either way, no funding round has come with a disclosed valuation.

Is Cyware profitable?

Unknown at the group level — Cyware Labs, Inc. is private and does not publish financial statements. Its Indian subsidiary, a much smaller engineering entity, reported an estimated 2.5% year-over-year rise in net profit for FY25 (year to 31 March 2025), according to Tracxn and Tofler analysis of Ministry of Corporate Affairs filings, but that figure describes a cost centre, not the global business.

Who actually uses Cyware’s platform?

A mix of enterprises (banking customer Arvest Bank is a named case study), managed security service providers, sector-wide information-sharing bodies including Auto-ISAC, Health-ISAC and MTS-ISAC, and government agencies pursuing FedRAMP-cleared cloud tools since January 2023.

Could Cyware be acquired or go public?

Nothing specific has been reported about either path as of September 2026. The wider threat-intelligence category saw two large acquisitions in September 2024 alone — Mastercard’s purchase of Recorded Future for $2.65 billion and Palo Alto Networks’ roughly $1.14 billion purchase of IBM’s QRadar SaaS assets — showing an active market for consolidation, but no filing or announcement ties Cyware itself to an IPO or sale process.

Sources

Figures are as of September 2026. Currency converted at $1 ≈ ₹96.0 as of 18 September 2026 (Trading Economics).

• Cyware, “About Cyware” (company website, accessed September 2026)
• Cyware, Anuj Goel CEO interview series (company website, published July 2025)
• Cyware, “Cyware Labs Raises $3 Million in Seed Funding” (company blog, 10 September 2019)
• Cyware, “Cyware Announces Follow-on Investment as part of its Series A Fundraise” (company blog, 11 January 2020)
• FinSMEs, “Cyware Raises $10M in Series A Funding” (August 2020)
• TechCrunch, “Cyware nabs $30M to help organizations detect and stop advanced cyberattacks” (16 March 2021)
• PR Newswire / Cyware, “Cyware Announces $30M Series B Funding Led by Advent International and Ten Eleven Ventures” (March 2021)
• SecurityWeek, “Cyware Snags $30M for Threat Intel Infrastructure Tech” (29 June 2023)
• Cyware, “Cyware Raises $30 Million to Accelerate Expansion of AI-Powered Global Cyber Fusion and Threat Sharing Networks” (company blog, June 2023)
• Tracxn, “Cyware — 2026 Company Profile, Team, Funding & Competitors” (accessed September 2026)
• Crunchbase, “Cyware — Financial Details” (accessed September 2026)
• Business Wire, “Cyware Cyber Fusion Center (CFC) Platform Achieves FedRAMP Ready Designation” (26 January 2023)
• Business Wire, “Cyware Achieves FedRAMP Ready Status to Advance State-of-the-Art Cyber Intelligence Exchange Across U.S. Federal Agencies” (12 November 2024)
• Christian & Timbers, “How Cyware Grew Revenue 4X to $49M & Earned Gartner Recognition with Strategic VP of Marketing Leadership” (case study, accessed September 2026)
• Latka (getlatka.com), “Cyware Labs Revenue 2024: $49.2M Est. ARR” (accessed September 2026)
• Ten Eleven Ventures, “Cyware” portfolio page (accessed September 2026)
• Tofler, “Cyware Labs India Private Limited” company financial record, CIN U72900KA2016PTC093029 (accessed September 2026)
• Tracxn, “Cyware Labs India Private Limited — 2026 Company Profile & Financials” (accessed September 2026)
• Automotive ISAC, “Auto-ISAC Chooses Cyware to Enhance Automated Threat Intelligence Sharing and Security Operations Efficiency” (press release, accessed September 2026)
• Cyware, Arvest Bank case study (company website, accessed September 2026)
• MarketsandMarkets, “Top Companies in Threat Intelligence Market” (research note, accessed September 2026)
• Infosecurity Magazine, “Cybersecurity M&A Roundup: MasterCard and Visa Announce Acquisitions” (September 2024)
• Palo Alto Networks, “Palo Alto Networks Strategic Acquisitions” (company website, referencing IBM QRadar SaaS asset acquisition, September 2024)

Found an error? Write to us and we’ll correct it in the open, dated, on the piece.