What Tidal Cyber does

Tidal Cyber is a privately held, venture-backed cybersecurity company founded in 2022 and headquartered in the Washington, DC metro area (Reston, VA) that sells a Threat-Led Defense SaaS platform built on the MITRE ATT&CK framework. The platform maps adversary tactics, techniques, and now procedures to an organization's defensive stack, enabling enterprises to assess coverage, prioritize detections and threat hunts against behaviors that actually matter to them, and quantify cyber posture via the proprietary Tidal Confidence Score. It is sold primarily to enterprise security teams in financial services, healthcare, retail, aerospace, technology, and critical infrastructure, with named design partners including SAIC, USAA, and Markel Corporation.

The product portfolio is structured in three tiers. The Enterprise Edition is a subscription SaaS platform offering continuous ATT&CK assessment, coverage mapping, threat profiling, BAS integrations (AttackIQ, SafeBreach), and prioritized remediation recommendations. The Community Edition is a freely available, self-service tier used to drive individual-analyst adoption and feed the enterprise funnel. NARC is a proprietary AI engine (acquired via the January 2025 purchase of Zero-Shot Security and generally launched in November 2025) that converts unstructured threat intelligence into ATT&CK-aligned procedures and links them to threat objects. The platform is enriched by the Tidal Vendor Registry of 37,000+ security product capabilities and the industry's first Procedures Library. Professional services (Custom Threat Profiling, Coverage Mapping, and MITRE ATT&CK Product Mapping for solution providers) are offered alongside the SaaS product.

Tidal Cyber makes money primarily through annual Enterprise Edition subscriptions sold via direct field sales with quote-based pricing, supplemented by professional services engagements; the Community Edition is free. Go-to-market blends enterprise sales, community-led growth, and heavy event presence at Black Hat, RSAC, FS-ISAC, H-ISAC, FIRST, ATT&CKcon, and Gartner. The company has raised approximately $19 million in disclosed equity across a $4M seed (Ultratech, Oct 2022), a $5M seed (Squadra, Nov 2023), an undisclosed strategic round from USAA and Capital One Ventures (Oct 2024), and a $10M Series A led by Bright Pixel Capital (Sep 2025), and reports 115% growth in 2025.

Name

Tidal Cyber

Legal name

Tidal Cyber, Inc.

Website

https://tidalcyber.com

Company type

Private

Founded year

2022

Operating status

Operating

Headcount range

11–50 employees

Short description

Tidal Cyber provides a Threat-Led Defense SaaS platform built on MITRE ATT&CK that maps adversary procedures to enterprise security stacks, helping financial services, healthcare, and other organizations quantify cyber posture and prioritize detection engineering.

Ownership category

akta.pro rank

Product category

Threat-Informed Defense Software

NAICS

Computer Systems Design and Related Services (54151), Security Systems Services (56162), Other Computer Related Services (541519)

akta.pro primary industry

OT/ICS & Critical Infrastructure Cybersecurity Services (BPAKAHAN)

akta.pro secondary industries

Vulnerability Management, Pen Testing & Attack Surface Management (ASM) (HLACAJAN), Secure Access Service Edge (SASE) & Secure SD-WAN (HDAIAFAH), Secure SD-WAN & Branch Security (HDADABAL), Vulnerability & Patch Management for OT Assets (EUADANAF), Application & API Security for Digital Health (WAF/RASP/API gateways) (HLACAJAH)

Keywords

• Threat-led defense platform
• MITRE ATT&CK mapping
• Cybersecurity threat intelligence
• Adversary emulation testing
• Security stack optimization

Headquarters

HQ city

Washington

HQ country

United States

HQ region

North America

Offices3 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations

Revenue model

1. Enterprise Subscription (Enterprise Edition): Recurring SaaS subscription for the Enterprise Edition, sold under separate Customer Agreements with enterprise customers. Includes continuous ATT&CK assessment, integrations to defensive solutions (XDR/EDR/SIEM), Tidal Confidence Score, and prioritized remediation recommendations.
2. Freemium (Community Edition): Free, perpetually available Community Edition for individual analysts, used to drive awareness, community engagement, and funnel users toward the paid Enterprise Edition. Currently no fee for Free Community Users per Terms of Use.
3. Professional Services (Threat Profiling, Coverage Mapping, ATT&CK Vendor Mapping): Expert-led services: custom threat profiling tailored to industry/region; coverage mapping that pairs relevant threats with the customer's existing defensive stack; and MITRE ATT&CK mapping services for security solution providers to map product capabilities to ATT&CK techniques.

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels9 records

Core offering

Tidal Cyber provides a Threat-Led Defense SaaS platform built on the MITRE ATT&CK framework that maps adversary tactics, techniques, and procedures (TTPs) to an organization's defensive stack. The product line includes a free Community Edition for individual analyst research, a paid Enterprise Edition with continuous ATT&CK assessment, the NARC AI engine for automated extraction of adversary procedures from unstructured intelligence, and the Tidal Vendor Registry covering 37,000+ security product capabilities.

Product overview

Tidal Cyber offers a Threat-Led Defense platform architecture centered on MITRE ATT&CK, organized into a tiered SaaS platform plus an AI engine and professional services. Tidal Cyber Enterprise Edition is the core platform, providing continual ATT&CK assessment, threat profiling, coverage mapping, defensive stack optimization, BAS integrations, and the proprietary Tidal Confidence Score; Tidal Cyber Community Edition is the freely-available tier for individual analysts to research and track adversary TTPs. The NARC AI engine is an integrated module that automatically extracts adversary procedures from unstructured intelligence and links them to ATT&CK-aligned threat objects (Groups, Campaigns, Software). The platform is supported by professional services - Custom Threat Profiling, Coverage Mapping, and MITRE ATT&CK Product Mapping for solution providers - and is enriched by the Tidal Vendor Registry (a 37,000+ capability product registry) and the Procedures Library for procedure-level defensive validation.

Differentiator

Problem solved

Functional benefit

Brands

• Tidal Cyber Enterprise Edition: Subscription-based Threat-Led Defense platform for organizations needing continuous ATT&CK assessment, coverage mapping, integrations with defensive solutions, Tidal Confidence Score, and prioritized remediation recommendations.
• Tidal Cyber Community Edition
• NARC AI

Products and services

• Tidal Cyber Enterprise Edition The flagship Threat-Led Defense platform for organizations needing continuous threat-informed defense. Provides continual ATT&CK assessment, coverage mapping, defensive stack analysis, threat profiling, the Tidal Confidence Score, prioritized remediation recommendations, and integrations with defensive solutions (XDR, EDR, SIEM, BAS tools). Sold as an annual subscription under separate Customer Agreements with enterprise customers.
• Tidal Cyber Community Edition The freely-available Threat-Informed Defense platform for security analysts to research and track adversary tactics, techniques, and procedures. Includes user-created technique sets and matrices, curated ATT&CK extensions, vendor registry, advanced search, and knowledge base labels. Used as a top-of-funnel entry into the Enterprise Edition.
• NARC AI Engine Tidal Cyber's proprietary AI engine (Natural Attack Reading and Comprehension) that transforms unstructured threat intelligence - CTI reports, blogs, IR documents, pentest outputs, red team reports, or free text - into structured, ATT&CK-aligned Procedures and automatically creates relationships between procedures and threat objects (software, groups, campaigns).
• Custom Threat Profiling Service Tidal Cyber's experts build a custom threat profile for the customer's organization factoring in industry, geographic region, and product/service type to identify the most relevant adversary behaviors. Delivered via direct engagement with the Tidal Cyber team.
• Coverage Mapping Service Tidal Cyber's experts generate a coverage map that shows how the customer's existing security solutions defend against the threats most relevant to the organization and highlights coverage gaps and redundancies. Delivered via direct engagement with the Tidal Cyber team.
• MITRE ATT&CK Product Mapping Service Service for security solution providers in which Tidal Cyber's subject matter experts map the customer's product capabilities to MITRE ATT&CK techniques using available documentation, hands-on platform testing, and adversary emulation testing when needed.

Quantifiable outcome

• 70% gain in control coverage after aligning the stack to ATT&CK techniques and sub-techniques
• +10 more outcomes

Named customers6 records

Segments7 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration3 records

AI capability7 records

Feature7 records

Partnerships

Five partnerships are on record, tiered core and flagship.

• Crimson7coreStrategic or Co-development PartnerStrategic partnership announced February 2026 to advance Threat-Led Hunting and Confidence Scoring. Integration maps Crimson7's threat hunts into the Tidal Cyber platform, enabling organizations to prioritize hunts that close coverage gaps and improve their Threat-Led Defense Confidence Score. Targets financial services, retail, aerospace, healthcare, technology, and critical infrastructure.
• AttackIQcoreTechnology or IntegrationTechnology integration with Tidal Cyber's BAS integration: AttackIQ Enterprise test results can be imported into Tidal Enterprise Edition to provide empirical feedback on defensive capabilities and modify the Confidence Score.
• SafeBreachcoreTechnology or IntegrationTechnology integration with Tidal Cyber's BAS integration: SafeBreach test results can be imported into Tidal Enterprise Edition to provide empirical feedback on defensive capabilities and modify the Confidence Score.
• Zero-Shot SecurityflagshipStrategic or Co-development PartnerAcquired by Tidal Cyber in January 2025; Zero-Shot Security's AI threat intelligence product (NARC) was integrated into the Tidal Cyber platform. Founder Harrison Van Riper joined Tidal Cyber as Director of AI. Acquisition accompanied by strategic investments from USAA and Capital One Ventures.
• MITRE ATT&CK Advisory CouncilcoreStrategic or Co-development PartnerTidal Cyber CTO and Co-Founder Richard Struse was appointed in 2026 to the newly formed MITRE ATT&CK Advisory Council, an independent body established to support the long-term sustainability and strategic evolution of the MITRE ATT&CK cybersecurity framework. Struse previously created MITRE's Center for Threat-Informed Defense.

Scale indicators8 records

Recent moves6 records

Expansion highlights7 records

Broad incumbents

• Anomali: Established threat intelligence platform with ATT&CK-mapped intelligence and SIEM/XDR integrations; competes with Tidal's threat profiling and CTI ingestion layers as a broader TI incumbent.
• Recorded Future: Large-scale threat intelligence platform owned by Mastercard; competes with Tidal in CTI consumption, threat-actor profiling, and ATT&CK-aligned intelligence.
• ThreatConnect: Threat intelligence operations platform with ATT&CK-aware analytics and orchestration; overlaps with Tidal's threat profiling, threat intel aggregation, and CTEM-aligned workflows.
• CrowdStrike (Falcon Platform): Endpoint/XDR incumbent with native ATT&CK mapping and threat intelligence in Falcon; bundles coverage scoring that overlaps with Tidal's Confidence Score and threat-led defense value proposition.
• Palo Alto Networks (Cortex XSIAM): XSIAM and Cortex platform embeds ATT&CK-mapped detections, threat intel, and exposure management, representing a potential bundle-driven competitive threat to Tidal's standalone coverage-mapping thesis.

Direct peers

• AttackIQ: Breach and attack simulation (BAS) vendor that validates security controls against MITRE ATT&CK; AttackIQ Enterprise is one of Tidal's named BAS integration partners, directly competing for ATT&CK-validation budget.
• SafeBreach: BAS platform that simulates adversary TTPs against customer environments; SafeBreach is a named Tidal Cyber BAS integration partner and directly overlaps in adversary-emulation and coverage-validation use cases.
• Picus Security: Continuous Threat Exposure Management (CTEM) and BAS vendor with strong MITRE ATT&CK alignment, overlapping with Tidal on adversary-emulation-driven validation and remediation prioritization.
• Cymulate: Continuous security validation platform offering BAS, exposure management, and attack-surface testing mapped to MITRE ATT&CK; competes with Tidal on threat-informed defense and coverage measurement.

Emerging players

• Scythe: Adversary emulation and purple-team platform that operationalizes adversary TTPs against customer environments; overlaps with Tidal's procedure-level approach and threat-led defense positioning.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks5 records

Key highlights7 records

Customer concentration

• Xx.com/TidalCyber
• LinkedInlinkedin.com/company/tidalcyber

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles14 records

Subsidiaries1 record

Funding overview

Funding rounds5 records

Investors16 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A1 record

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Tidal Cyber