What Cyberhaven does

Cyberhaven is a Palo Alto-based AI-powered data security company that provides a unified platform combining Data Security Posture Management (DSPM), Data Loss Prevention (DLP), Insider Risk Management (IRM), and AI Security for enterprise customers. The company's foundational technology is a proprietary data lineage architecture that traces the full movement of every piece of data across endpoints, cloud, SaaS, on-prem, and AI workflows, augmented by what the company describes as a first-of-its-kind Large Lineage Model (LLiM) that predicts next likely workflow actions to identify risky behavior, and Linea AI, an autonomous agent for incident investigation and remediation. Founded in 2019 by five security researchers with PhDs from Stanford, MIT, EPFL, and UC Berkeley and building on DARPA and Swiss Federal Government-funded research from 2016, Cyberhaven has evolved from its initial Data Behavior Analytics (DaBA) solution through invented Data Detection and Response (DDR) capabilities into a SaaS platform hosted on Google Cloud Platform.

The company generates revenue primarily through annual subscription contracts scaled to organization or department size, sold via direct enterprise field sales and increasingly through cloud hyperscaler marketplaces (AWS, Azure, GCP) and channel partners. Named enterprise customers span financial services (Axos Bank), legal services (Cooley, Kirkland & Ellis), SaaS and technology (Navan, IVP, Bazaarvoice), telecommunications (Motorola), manufacturing (Crestron, Day & Zimmermann), healthcare (VaxCare, BioIVT, a surgical robotics company), information management (Iron Mountain), and nonprofits (Mission Australia). Cyberhaven has raised $250 million across four funding rounds from 2019 to 2025, with the $100 million Series D in April 2025 led by StepStone Group valuing the company at $1 billion (a sevenfold increase over one year), and the company employs 101-250 people across Palo Alto and San Francisco.

The company has rapidly expanded its platform scope from 2024 to 2026, launching Linea AI (February 2024), Cyberhaven for AI (April 2025), the reimagined DLP/Insider Threat Platform with Insights 360 (July 2025), DSPM in Early Access (November 2025) and GA (February 2026), the unified AI & Data Security Platform (February 2026), and Agentic AI Security (May 2026). Cyberhaven has been recognized on Deloitte's Technology Fast 500 (#51 in 2025), Redpoint's InfraRed 100 (three consecutive years), Fortune's Cyber 60 (2024), and as a 2023 Gartner Cool Vendor in Data Security; its Cyberhaven Labs research arm publishes annual AI Adoption & Risk Reports based on telemetry from millions of enterprise workers across customer deployments.

Name

Cyberhaven

Legal name

Cyberhaven, Inc.

Website

https://cyberhaven.com

Company type

Private

Founded year

2019

Operating status

Operating

Headcount range

251–500 employees

Short description

Cyberhaven is a Palo Alto-based AI data security company providing a unified platform combining DSPM, DLP, insider risk management, and AI security. It serves enterprise customers across financial services, legal, healthcare, manufacturing, and technology using a proprietary data lineage architecture.

Ownership category

akta.pro rank

Product category

Data Security Software

NAICS

Security Systems Services (56162), Computer Systems Design and Related Services (54151)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

Data Security & Privacy for Cloud (DLP, DSPM, Tokenization) (HDABAHAK)

Keywords

• Data loss prevention
• Insider risk management
• Data security posture
• AI data security
• Data lineage tracking

Headquarters

HQ city

San Francisco

HQ country

United States

HQ region

North America

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. Annual subscription (SaaS): Pricing is an annual subscription model, based on organization or department size. Cyberhaven is Generally Available as a SaaS service requiring zero infrastructure deployment and management. Customers purchase via direct sales or cloud hyperscaler marketplaces (AWS, Azure, GCP) using committed cloud spend.
2. Professional / Customer Experience Services: Turnkey Services and an Insider Threat Intelligence Service introduced alongside the unified platform launch to accelerate customer adoption and add services-based revenue on top of subscriptions.

Pricing tiers

Go-to-market motion1 record

Distribution channels5 records

Marketing channels10 records

Core offering

Cyberhaven provides a unified AI & Data Security Platform that combines Data Security Posture Management (DSPM), Data Loss Prevention (DLP), Insider Risk Management (IRM), and AI Security under a single architecture. Built on a proprietary Data Lineage Graph and powered by the Large Lineage Model (LLiM) and the Linea AI autonomous agent, the platform traces every movement of data across endpoints, SaaS, cloud, on-prem, and AI workflows. Delivered as a SaaS service hosted on Google Cloud Platform, it enables enterprises to discover, classify, and protect sensitive data, detect insider threats, govern AI tool usage, and stop data exfiltration without requiring upfront classification.

Product overview

Cyberhaven sells a single unified AI & Data Security Platform built on its proprietary data lineage technology and Large Lineage Model (LLiM). The platform combines four tightly integrated modules — Data Security Posture Management (DSPM), Data Loss Prevention (DLP), Insider Risk Management (IRM), and AI Security — that share the same data lineage graph and the Linea AI autonomous analyst agent. Layered on top of this core are add-ons including Agentic AI Security, the Analyst Plugin (for Claude Code and Codex), the Standalone Browser Extension, Cloud Connectors (OneDrive, SharePoint, Google Drive), and Cyberhaven for AI oversight. The platform evolved from the earlier Data Detection and Response (DDR) category and the original Data Behavior Analytics (DaBA) technology, and is delivered as a SaaS service hosted on Google Cloud Platform.

Differentiator

Problem solved

Functional benefit

Brands

• Linea AI: Autonomous AI agent for data security powered by Cyberhaven's Large Lineage Model (LLiM); acts as an autonomous security analyst for incident investigations.

Products and services

• AI & Data Security Platform (Unified Platform) Cyberhaven's unified platform integrating DSPM, DLP, Insider Risk Management (IRM), and AI Security under a single architecture. Uses data lineage and the proprietary Large Lineage Model (LLiM) to protect data across endpoints, SaaS, cloud, on-prem, and AI workflows.
• Data Security Posture Management (DSPM) Discovers and classifies sensitive data, detects risk as it flows between clouds and devices, and provides a dynamic map of sensitive data across cloud, on-prem, and endpoint environments.
• Data Loss Prevention (DLP) Reimagined Data Loss Prevention that uses data lineage context rather than content scanning alone to coach users and block data leaks across email, web, cloud, removable storage, generative AI, and devices.
• Insider Risk Management (IRM) Combines data and behavior signals (powered by Linea AI and the Cyberhaven Graph) to detect insider threats, clarify intent, identify slow-burning risks, and stop data exfiltration in real time.
• AI Security (Cyberhaven for AI) Provides Shadow AI Discovery, AI Usage Insights, AI Risk IQ (risk profiles for 700+ AI tools), and AI Data Flow Control so enterprises can adopt AI tools securely without blocking teams.
• Linea AI Cyberhaven's autonomous AI security analyst agent, powered by the proprietary Large Lineage Model (LLiM). Performs end-to-end incident investigations, prioritizes risk, generates plain-language summaries, and recommends smart remediation across the unified platform.
• Agentic AI Security Provides discovery, monitoring, and control over autonomous AI agents and shadow agents operating on enterprise endpoints and across workflows. Addresses prompt injection and other agentic risks.
• Data Detection and Response (DDR) Foundational platform capability combining DLP and IRM with Cyberhaven's Full Context Blocking. Invented by Cyberhaven as a new category that traces data lineage to detect and respond to data misuse and theft.
• Cyberhaven Analyst Plugin Embeds Cyberhaven's data security intelligence directly into AI coding assistants (Claude Code and Codex), enabling developers to query Cyberhaven context from inside their coding environment.
• Standalone Browser Extension Extends Cyberhaven data loss prevention coverage to ChromeOS, browser-capable contractor devices, and unmanaged endpoints without requiring the full Cyberhaven endpoint agent.
• Cloud Data Security Extends Cyberhaven data lineage and protection into cloud storage environments (OneDrive, SharePoint, Google Drive via Cloud Connectors) to stop data leaks to personal cloud accounts.
• Turnkey Services and Insider Threat Intelligence Service Professional services offering that accelerates customer adoption of the unified platform and provides insider threat intelligence as a managed service on top of subscriptions.

Named customers14 records

Segments5 records

Ideal customer profiles5 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration16 records

AI capability13 records

Feature7 records

Partnerships

Eleven partnerships are on record, tiered core integration and marketplace partner, core infrastructure and marketplace partner, flagship uk channel partner, thought leadership partner, core integration, specialized macos integration partner, security automation integration and strategic ai research partner.

• Amazon Web Services (AWS)core integration and marketplace partnerTechnology or Integration · 22 April 2026AWS is both a technology integration partner and a marketplace channel for Cyberhaven. The platform integrates with AWS environments (logo shown on integrations page) and Cyberhaven's Unified AI & Data Security Platform is listed on AWS Marketplace as of April 22, 2026, allowing enterprise customers to purchase using committed AWS cloud spend. Marketplace listing supports channel-led transactions through resellers and MSPs.
• Microsoft (Azure)core integration and marketplace partnerTechnology or Integration · 22 April 2026Microsoft is both a technology integration partner and a marketplace channel. Cyberhaven integrates with Microsoft environments (logo on integrations page) and has a published integration datasheet for Cyberhaven and Microsoft Purview. As of April 22, 2026, Cyberhaven is also listed on the Microsoft Azure Marketplace, allowing purchase via committed Azure cloud spend.
• Google Cloudcore infrastructure and marketplace partnerTechnology or Integration · 22 April 2026Google Cloud Platform (GCP) is Cyberhaven's primary cloud infrastructure provider (hosting all SaaS customer data in North America on GCP data centers in the US). Google Cloud is also an integration partner (logo on integrations page) and a marketplace channel — Cyberhaven listed on Google Cloud Marketplace as of April 22, 2026.
• Ignition Technologyflagship uk channel partnerChannel Partner/ Reseller/ Distributor · 11 March 2026Strategic partnership announced March 11, 2026 to distribute Cyberhaven's AI & data security platform in the United Kingdom. The collaboration addresses growing enterprise demand for AI-ready data security in the UK and supports Cyberhaven's European expansion following its recent funding rounds.
• O'Reillythought leadership partnerGTM or Marketing Partner · 15 January 2026Partnership to publish the guide 'Insider Risk Management: The Guide to Proactive Data Security,' authored by Reet Kaur, distributed via O'Reilly's platform to security leaders and compliance professionals. Positions Cyberhaven as a thought leader in insider risk and data security.
• Databrickscore integrationTechnology or IntegrationDatabricks is listed as a technology integration partner on Cyberhaven's integrations page, enabling data lineage and protection to extend to Databricks lakehouse and analytics environments.
• Snowflakecore integrationTechnology or IntegrationSnowflake is listed as a technology integration partner on Cyberhaven's integrations page, allowing data lineage tracking and protection of sensitive data within Snowflake cloud data platform.
• Splunkcore integrationTechnology or IntegrationSplunk is listed as a technology integration partner on Cyberhaven's integrations page, enabling Cyberhaven data security telemetry to flow into Splunk SIEM environments.
• Jamfspecialized macos integration partnerTechnology or IntegrationPartnership to deliver data security for macOS-managed devices. Documented in Cyberhaven's blog post detailing how Cyberhaven and Jamf partner to deliver unmatched data security for Apple endpoints in enterprise environments.
• Torqsecurity automation integrationTechnology or IntegrationIntegration with Torq brings AI-powered automation to Insider Risk Management (IRM) and Data Loss Prevention (DLP), enabling SOC workflows and automated response actions via Torq's security automation platform.
• Anthropicstrategic ai research partnerStrategic or Co-development PartnerCyberhaven was selected for Anthropic's Cyber Verification Program to advance defensive AI security research, giving Cyberhaven access to Anthropic's Claude models for security applications and research collaboration.

Scale indicators10 records

Recent moves8 records

Expansion highlights7 records

Direct peers

• BigID: Data intelligence platform for data discovery, classification, privacy, security, and governance. Directly comparable to Cyberhaven's DSPM and data classification capabilities, with similar enterprise buyers and overlapping value proposition around AI-era data protection.
• Securiti: Unified data security, privacy, and governance platform with strong DSPM and AI security/governance capabilities. Closely comparable to Cyberhaven's unified platform strategy, with overlapping modules in data discovery, classification, DLP, and AI governance.
• Forcepoint: Established enterprise DLP and insider threat platform with a long history in data protection. Direct competitor to Cyberhaven's DLP and IRM modules; James McCarthy (Cyberhaven's SVP of Sales) and others came from Forcepoint, underscoring the direct competitive overlap.
• Netskope: Cloud-native SSE/SASE platform with DLP and insider risk capabilities built into its cloud data security stack. Comparable to Cyberhaven's cloud data security, DLP, and IRM modules, especially for cloud-first enterprise buyers.
• Proofpoint: Major enterprise security vendor with mature DLP, insider threat management, and information protection offerings. Comparable to Cyberhaven's DLP and IRM modules, with a large enterprise sales footprint and overlapping target buyer (CISO and security leadership).
• Varonis: Public data security platform focused on detecting insider threats, preventing data exposure, and securing cloud data across Microsoft 365, Google Workspace, Salesforce, and cloud data warehouses. Closely comparable to Cyberhaven's IRM and DSPM modules, with a larger installed base of enterprise customers.
• Cyera: AI-powered data security posture management (DSPM) company that discovers, classifies, and secures sensitive data across cloud environments. Closely comparable to Cyberhaven's DSPM module and competing directly in the same enterprise buyer conversations; Cyera is also a competitor in the broader data security category.

Emerging players

• Dig Security: Cloud data security and DSPM-focused startup that secured a strategic investment from CrowdStrike and competes in cloud data detection and response. Emerging competitor comparable to Cyberhaven's cloud data security and DSPM modules.

Broad incumbents

• CrowdStrike: Endpoint security leader that has expanded into identity, cloud, and increasingly data security/AI security. Broad incumbent comparable to Cyberhaven on the endpoint and increasingly on AI security, with bundled pricing that competes with standalone offerings.
• Microsoft Purview: Microsoft's data security and governance suite bundled into Microsoft 365 E5, offering DLP, information protection, and increasingly DSPM/AI security capabilities. Direct overlap with Cyberhaven's DLP, IRM, and DSPM modules, with the strategic advantage of being the default starting point in most Microsoft-centric enterprises.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/cyberhaven
• Xx.com/CyberhavenInc
• Facebookfacebook.com/CyberhavenInc

Compliance4 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles23 records

Subsidiaries1 record

Funding overview

Funding rounds5 records

Investors15 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Cyberhaven