SpyCloud
SpyCloud is a private Austin, Texas-based cybersecurity company that provides holistic identity threat protection by ingesting and analyzing stolen identity data from criminal underground sources, serving half of the Fortune 10 and protecting more than 4 billion employee and consumer accounts through subscription and data partnership models.
- Company typePrivate
- Founded2015
- HeadquartersAustin, United States
- Headcount101–250
- GTM typeB2B
- OfferingSoftware
What SpyCloud does
SpyCloud is a private Austin, Texas-based cybersecurity company founded in 2015 that provides holistic identity threat protection built on a proprietary corpus of recaptured darknet data. The platform continuously ingests more than 25 billion assets per month from infostealer malware logs, active phishing kit infrastructure, and data breaches circulating in closed criminal communities, processing the data to surface exposed credentials, session cookies, API keys, and PII before attackers can weaponize them. SpyCloud's technology stack includes IDLink for automated identity correlation across records, a malware intelligence pipeline tracking 105+ malware families, the recently launched Research Agent for agentic investigation workflows, and Identity Guardians for automated remediation including forced password resets and session invalidation.
The company sells primarily through direct enterprise field sales with quote-based pricing, structured around subscription tiers (Enterprise Protection, Consumer Protection, Investigations portal and API, Data Partnerships, and the SpyCloud Connect managed integration service). Its customer base includes half of the Fortune 10, with named logos such as Atlassian, NASA, Bank of America, Verizon, Dropbox, Redfin, and ABS-CBN; across these customers the platform protects more than 4 billion employee and consumer accounts. SpyCloud has raised approximately $168.5 million across five funding rounds, most recently a $110 million Series D led by Riverwood Capital in August 2023, and maintains SOC 2 Type II, GDPR, CCPA, and HIPAA compliance.
SpyCloud has positioned itself as a research-led organization: SpyCloud Labs contributes to law enforcement operations (Operation Endgame, the Europol-coordinated Tycoon 2FA takedown alongside Microsoft) and co-founded the World Economic Forum's Cybercrime Atlas initiative. The platform is sold alongside native integrations into the dominant enterprise identity and security stack — Okta, Microsoft Defender, CrowdStrike Falcon, Sentinel, Splunk, Palo Alto Cortex XSOAR, Ping Identity, and Maltego — embedding SpyCloud data directly into identity events and SOC workflows.
SpyCloud firmographics
Firmographics- Name
- SpyCloud
- Legal name
- SpyCloud, Inc.
- Website
- https://spycloud.com
- Company type
- Private
- Founded year
- 2015
- Operating status
- Operating
- Headcount range
- 101–250 employees
- Short description
- SpyCloud is a private Austin, Texas-based cybersecurity company that provides holistic identity threat protection by ingesting and analyzing stolen identity data from criminal underground sources, serving half of the Fortune 10 and protecting more than 4 billion employee and consumer accounts through subscription and data partnership models.
- Ownership category
- akta.pro rank
SpyCloud industry classification
Industry- Product category
- Identity Threat Protection
- NAICS
- Security Systems Services (except Locksmiths) (561621)
- SIC
- Finance Services (6199)
- akta.pro primary industry
- On-Chain Monitoring, Threat Detection & Incident Response (FSAPAJAB)
- akta.pro secondary industries
- Fraud Detection & Prevention (payments fraud, account takeover, scams) (FSAGAFAE), Credential Stuffing & Password Attack Protection (HDADALAC)
Keywords
Where SpyCloud is headquartered
LocationHeadquarters
- HQ city
- Austin
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
SpyCloud business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure
Revenue model
- Enterprise Protection Subscription: SpyCloud Enterprise Protection helps organizations protect, prevent, and remediate compromised employee identity data. Pricing is tiered by the number of employee accounts protected. This is a recurring subscription model with annual or multi-year contract billing.
- Consumer Protection Subscription: SpyCloud Consumer Protection helps organizations preserve consumer account integrity and minimize risks from account takeover, fraud and unauthorized access. Pricing is tiered by the number of customer accounts protected.
- Investigations API and Portal: SpyCloud Investigations is available as an API tiered by number of queries, or as a portal tiered by seat count with unlimited in-portal queries and up to 200 API queries included per seat at no additional cost.
- Data Partnerships: SpyCloud offers data partnerships to leading global technology, financial services, and security organizations who want to enhance their security, fintech, and fraud detection products with recaptured identity insights.
- SpyCloud Connect: Managed workflow service where SpyCloud's engineering team designs, builds, and maintains custom integrations connecting SpyCloud data to any tool in an organization's security stack. Standard deployments delivered in 2 to 4 weeks.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Enterprise Protection - Tiered by employee accounts protected |
| Subscription | Annual | Consumer Protection - Tiered by customer accounts protected |
| Per seat | Annual | Investigations Portal - Seat-based with API queries included |
| Usage-based | Pay-as-you-go | Investigations API - Query-based pricing |
| Other | Multi-year contract | Data Partnerships - Custom pricing for technology, financial services, and security organizations |
Go-to-market motion2 records
Distribution channels5 records
Marketing channels8 records
SpyCloud product offering
Product offeringCore offering
SpyCloud sells a holistic identity threat protection platform that recaptures stolen identity data from the criminal underground and uses it to surface, alert on, and remediate exposed employee, consumer, and supply chain credentials, session cookies, PII, and tokens. Customers subscribe to modules such as Workforce, Endpoint, Session, Consumer, Financial, and Supply Chain Threat Protection, plus Cybercrime Investigations and Identity Guardians automated response, with pricing tiered by protected accounts, seats, or API queries.
Product overview
SpyCloud is a holistic identity threat protection platform that unifies eight core products to protect employee, consumer, and supply chain identities across the attack lifecycle. The platform is built on a recaptured identity corpus of over one trillion assets sourced directly from infostealer malware logs, active phishing kit infrastructure, and data breaches circulating in closed criminal communities. Core products include Workforce Threat Protection and Endpoint Threat Protection for enterprise identity security, Session Identity Protection for cookie-based attack prevention, Supply Chain Threat Protection for vendor ecosystem monitoring, Consumer Threat Protection and Financial Threat Protection for customer-facing organizations, and Cybercrime Investigations for attribution and threat actor profiling. The platform is enhanced by IDLink automated identity correlation and AI Insights report generation, with Research Agent providing agentic investigation capabilities. SpyCloud Connect offers managed custom integrations while the SpyCloud API enables programmatic access for enterprise and MSSP deployments.
Differentiator
Problem solved
Functional benefit
Brands
- SpyCloud Labs: SpyCloud's focused cybercrime research group dedicated to uncovering and analyzing patterns from the criminal underground
- SpyCloud Compass
- SpyCloud Research Agent
- IDLink
- AI Insights
- SpyCloud Connect
Products and services
- Workforce Threat Protection Monitors employee and contractor credentials across corporate domains against breach, malware, and phishing data to surface credential-level exposures and trigger credential hygiene remediation.
- Endpoint Threat Protection Provides device-level visibility into the full blast radius of infostealer infections, surfacing cookie count, application exposure scope, and PII from each infected device including session cookies, browser autofill data, and device fingerprints.
- Supply Chain Threat Protection Provides real-time visibility into identity threats affecting vendor ecosystems by analyzing recaptured darknet data from breaches, malware, and phishing campaigns to identify compromised supplier credentials rather than relying on static risk scoring.
- Session Identity Protection Identifies exposed session cookies and enables automated invalidation before criminals can use them for session hijacking, protecting against attacks that bypass MFA and passkeys.
- Consumer Threat Protection Preserves consumer account integrity and minimizes risks from account takeover, fraud, and unauthorized access by monitoring recaptured breach and malware data for compromised customer credentials.
- Financial Threat Protection Protects financial institutions and their customers from identity-based threats including credential theft and fraud targeting banking and financial services.
- Cybercrime Investigations Comprehensive investigation platform for cybercrime and identity threat investigations powered by dark web identity intelligence, enabling analysts to surface hidden risks and connect dots for rapid attribution and response.
- SpyCloud API Programmatic REST API providing direct queryable access to SpyCloud's recaptured darknet dataset, supporting queries across email addresses, usernames, IP addresses, domains, and other selectors for enterprise and MSSP deployments.
- SpyCloud Connect Managed workflow service where SpyCloud's engineering team designs, builds, and maintains custom integrations connecting SpyCloud data to any tool in an organization's security stack, targeted at organizations without internal engineering bandwidth.
- Research Agent Agentic investigation workflow inside SpyCloud Cybercrime Investigations that plans and executes investigations automatically by sequencing investigation pivots across over one trillion recaptured identity assets, returning finished intelligence with cited evidence rather than acting as a simple chatbot.
Quantifiable outcome
- 40% of malware infections occur on endpoints already running EDR or antivirus tools
- +5 more outcomes
Companies that use SpyCloud
Customer profileNamed customers8 records
Segments7 records
Ideal customer profiles3 records
SpyCloud technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration9 records
AI capability6 records
Feature5 records
SpyCloud partnerships and signals
Strategic signalPartnerships
Ten partnerships are on record, tiered core and minor.
- Ping IdentitycoreSpyCloud's partnership with Ping Identity embeds recaptured darknet identity data directly into PingOne DaVinci and PingOne Advanced Identity Cloud at every identity event, providing holistic identity intelligence for every login.
- Neon CybercoreStrategic partnership to enhance identity threat protection and prevent credential stuffing attacks. The collaboration merges threat intelligence with SpyCloud's large identity breach data repository, enabling rapid response to breached credentials. Neon Cyber users gain immediate access to new identity security capabilities without requiring any customer action.
- New York TourismminorNew York partnered with SpyCloud to enhance cybersecurity in the tourism sector by providing identity threat protection. The collaboration aims to prevent identity theft, breaches, and data misuse for tourists and businesses, especially in online transactions.
- EuropolcoreSpyCloud contributed victim identity intelligence to support Europol's coordinated seizure of Tycoon 2FA phishing-as-a-service infrastructure that enabled widespread MFA bypass. SpyCloud was part of the global coalition including Microsoft and industry partners that disrupted the phishing service.
- MicrosoftcoreSpyCloud was part of the global coalition with Microsoft and Europol that disrupted Tycoon 2FA phishing-as-a-service platform, contributing victim identity intelligence to the coordinated action that seized 330 domains.
- CoinbaseminorCoinbase coordinated with Microsoft, Europol, and industry partners including SpyCloud to disrupt Tycoon 2FA phishing platform.
- Shadowserver FoundationminorIndustry partner in the Tycoon 2FA takedown coalition alongside SpyCloud, Microsoft, Europol, Proofpoint, Intel 471, eSentire, Cloudflare, Resecurity, and Coinbase.
- The Cybercrime AtlascoreSpyCloud is a founding partner in The Cybercrime Atlas, a global initiative hosted by the World Economic Forum Centre for Cybersecurity. The initiative has supported law enforcement operations resulting in arrests, network takedowns, and asset recoveries across multiple African countries over SpyCloud's 4-year partnership.
- ABS-CBN CorporationcoreABS-CBN partnered with SpyCloud to deploy identity threat protection solutions to safeguard its workforce from cyber threats. The security upgrade provides real-time monitoring, active remediation of compromised credentials, and aims to prevent account takeovers and ransomware attacks.
- Defense Innovation Unit (DIU)coreSpyCloud is a DIU portfolio company, part of the Defense Innovation Unit's commercial technology bridge established to connect commercial technology with national security needs. SpyCloud is among 10 portfolio companies profiled with collective production contracts backed by billions in private investment.
Scale indicators24 records
Recent moves7 records
Expansion highlights6 records
SpyCloud competitors and assessment
Company assessmentDirect peers
- Recorded Future: Recorded Future (owned by Mastercard) operates a leading threat intelligence platform that ingests data from the dark web, open sources, and criminal communities to deliver real-time intelligence — directly comparable to SpyCloud's recaptured identity dataset and intelligence product offering for enterprise security teams.
- Flashpoint: Flashpoint provides threat intelligence and fraud prevention derived from illicit communities and dark web sources, including compromised credentials and identity exposure — a direct competitor in the same cybercrime analytics category as SpyCloud, particularly in fraud and credential monitoring use cases.
- ReliaQuest: ReliaQuest operates a security operations platform with GreyMatter intelligence that combines dark web monitoring, threat intelligence, and identity-focused detection — competing directly with SpyCloud for enterprise security budgets in account takeover, credential exposure, and ransomware prevention workflows.
- ZeroFox: ZeroFox provides external threat intelligence, dark web monitoring, and identity/credential protection for enterprise security teams. It is a direct competitor in the external attack surface and credential exposure monitoring category, with comparable buyer personas in Fortune 500 enterprises.
- Constella Intelligence: Constella Intelligence operates an identity intelligence platform that monitors compromised credentials, infostealer exposures, and darknet data — competing directly with SpyCloud's Enterprise Protection and Investigations offerings, particularly for financial services and consumer protection use cases.
Broad incumbents
- CrowdStrike: CrowdStrike's Falcon Intelligence platform offers dark web monitoring and identity threat protection as part of its broader XDR suite, overlapping SpyCloud's Session Identity Protection and Workforce Threat Protection. As a large incumbent, CrowdStrike could bundle competing capabilities natively.
- Microsoft Defender Threat Intelligence: Microsoft Defender Threat Intelligence ingests dark web and infostealer intelligence and integrates directly into the Microsoft Defender XDR ecosystem. As a broad incumbent with native distribution, it represents both a partner (SpyCloud integrates into Defender) and a competitive threat as Microsoft expands identity threat capabilities.
- Mandiant (Google Cloud): Mandiant (now part of Google Cloud) provides threat intelligence and incident response services drawing on intelligence from criminal underground sources, overlapping SpyCloud's Cybercrime Investigations and identity exposure use cases — particularly for Fortune-tier enterprise buyers.
- Darktrace: Darktrace provides AI-driven threat detection and response that increasingly incorporates identity-based attack detection and credential exposure signals. As a publicly traded cybersecurity incumbent with broad enterprise distribution, it competes for similar budgets and overlapping security use cases.
- SentinelOne: SentinelOne's Singularity XDR platform includes identity threat protection capabilities and integrates dark web intelligence, with enterprise customers overlapping SpyCloud's Fortune-tier buyer base. As a broad incumbent, it represents both an integration partner and a competitive threat via native bundling.
Market position
Strengths4 records
Weaknesses4 records
Competitive moat5 records
Key risks6 records
Key highlights7 records
Customer concentration
SpyCloud social profiles
Digital presenceSpyCloud compliance and trust
Trust signalCompliance5 records
SpyCloud financial estimates
Financial estimateRevenue estimate
Valuation estimate
SpyCloud leadership team
Management profileNumber of profiles
Profiles16 records
SpyCloud funding detail
Funding detailFunding overview
Funding rounds6 records
Investors7 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
SpyCloud M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about SpyCloud
What does SpyCloud do?
SpyCloud sells a holistic identity threat protection platform that recaptures stolen identity data from the criminal underground and uses it to surface, alert on, and remediate exposed employee, consumer, and supply chain credentials, session cookies, PII, and tokens. Customers subscribe to modules such as Workforce, Endpoint, Session, Consumer, Financial, and Supply Chain Threat Protection, plus Cybercrime Investigations and Identity Guardians automated response, with pricing tiered by protected accounts, seats, or API queries.
Is SpyCloud a public or private company?
SpyCloud is a private company. It is classified as venture growth investor backed and is currently operating.
When was SpyCloud founded?
SpyCloud was founded in 2015. It employs 101 to 250 people.
Where is SpyCloud based?
SpyCloud is headquartered in Austin, United States, in the North America region.
How does SpyCloud make money?
Five revenue lines are on record. Enterprise Protection Subscription is the primary driver. The others are consumer Protection Subscription, investigations API and Portal, data Partnerships and spyCloud Connect.
Who are SpyCloud's main competitors?
Direct peers on record are Recorded Future, Flashpoint, ReliaQuest, ZeroFox and Constella Intelligence. Broad incumbents are CrowdStrike, Microsoft Defender Threat Intelligence, Mandiant (Google Cloud), Darktrace and SentinelOne.
Does SpyCloud have an API?
Yes. SpyCloud offers a public REST API for querying recaptured identity data, including breach records, infostealer malware logs, and phishing campaign data. The API supports queries across email addresses, usernames, IP addresses, domains, and other selectors. Available as part of SpyCloud Cybercrime Investigations (API tier priced by number of queries), with up to 200 API queries included per seat in portal deployments. The API integrates natively with Maltego for visual link analysis, Splunk for SIEM-embedded enrichment, and Jupyter Notebook for custom analytical workflows. SpyCloud Connect is a managed workflow service where SpyCloud's engineering team designs, builds, and maintains custom integrations connecting SpyCloud data to any tool in an organization's security stack. Developer documentation is at docs.spycloud.com.
What industry is SpyCloud in?
SpyCloud's product category is Identity Threat Protection. Its primary akta.pro industry code is FSAPAJAB, On-Chain Monitoring, Threat Detection & Incident Response, with a secondary code of FSAGAFAE, Fraud Detection & Prevention (payments fraud, account takeover, scams). Its NAICS code is 561621 and its SIC code is 6199.