What GreyNoise Intelligence does

GreyNoise Intelligence is a Washington, D.C.-based cybersecurity company that operates a real-time, primary-sourced threat intelligence platform powered by its Global Observation Grid — a global fleet of 5,000+ deception sensors deployed across 80+ countries that mimics commonly exploited software and captures full-packet traffic for classification. The platform processes more than 800,000 unique IPs observed daily, classifies IP intent (benign, malicious, suspicious, unknown), tags behavior, and exposes data through a proprietary query language (GNQL), a REST API with Python SDK, a Visualizer web portal, and bulk data files. Core use cases include CVE Disclosure Early Warning, Compromised Asset Detection, SOC Efficiency / alert reduction, Incident Investigation, and Threat Hunting, organized as a platform-plus-modules architecture: the GreyNoise Platform (Standard / Advanced / Elite tiers) with nested intelligence modules (Triage, Investigate, Hunt) and add-on modules (C2 Detection, Business Services, Vulnerability Prioritization). A separate GreyNoise Block product delivers configurable, firewall-grade real-time blocklists for SMB and mid-market buyers, while Project Swarm extends the sensor network into a community-led collective defense initiative.

The company monetizes through quote-based annual subscriptions on tiered platform SKUs plus separately licensed intelligence modules, a free community tier (Vizualizer) offering up to 50 IP lookups per week as a PLG funnel, and a 14-day free trial for GreyNoise Block. Pricing is opaque ("Talk to us about pricing") with module nesting (Hunt includes Investigate includes Triage) and unlimited integrations/users bundled into every paid tier. Distribution combines enterprise field sales, self-serve PLG, channel partners (resellers, MSSPs, OEMs), and 34+ pre-built integrations with SIEM, SOAR, TIP, XDR, firewall, and AI platforms (Splunk, CrowdStrike Falcon, Google SecOps, Palo Alto XSOAR, Microsoft Sentinel / Copilot for Security, MISP, OpenCTI, Recorded Future, etc.) plus firewall External Dynamic List distribution to AWS, Azure, Cisco, Fortinet, Check Point, Zscaler, and others. The company cites 80,000+ users, 60% of the Fortune 1000, 400+ global government agencies, and 11 US Federal Agencies as customers, backed by strategic investment from In-Q-Tel (2021) and a $15M Series A led by Radian Capital (2022), with a single acquisition (Krit, 2022) used to build product design and development capacity.

Name

GreyNoise Intelligence

Legal name

GreyNoise, Inc.

Website

https://greynoise.io

Company type

Private

Founded year

2021

Operating status

Operating

Headcount range

11–50 employees

Short description

GreyNoise Intelligence is a Washington D.C.-based cybersecurity company operating a real-time threat intelligence platform powered by a global deception sensor network spanning 80+ countries, serving enterprise security teams and government agencies with IP classification, CVE early warning, and firewall blocklists.

Ownership category

akta.pro rank

Product category

Threat Intelligence Platform

NAICS

Security Systems Services (except Locksmiths) (561621), Security Systems Services (56162)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Threat Intelligence Services (BPAEADAC)

akta.pro secondary industries

Network Security Managed Services (Firewall/IDS/IPS/SASE) (BPAEADAG), Vulnerability Assessment & Scanning (HDADAHAA), Secure Model Deployment & Runtime Protection (sandboxing, isolation) (HDAAAKAH)

Keywords

• Threat intelligence platform
• Internet scanning analysis
• Deception sensor network
• Firewall blocklist service
• SOC alert reduction

Headquarters

HQ city

Washington

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations

Revenue model

1. GreyNoise Platform subscriptions: Tiered annual subscriptions on the GreyNoise Platform (Free, Standard, Advanced, Elite) priced per tier with feature differences in data freshness (every 8 hours to every hour), Recall lookback (up to 90 days), alert capacity, feeds, blocklists, support hours, and SLAs. Customers must purchase one platform license plus at least one intelligence module (Triage, Investigate, or Hunt).
2. Intelligence Module add-ons: Add-on module licensing for specialized use cases: C2 Detection, Business Services (156M+ verified business IPs), and Vulnerability Prioritization, sold as separately licensed add-ons that attach to any paid platform tier.
3. GreyNoise Block subscription: GreyNoise Block product (real-time configurable blocklists for SMBs) sold with a 14-day free trial and request-a-quote enterprise model.
4. Free community tier: Free tier via Vizualizer offering IP lookups and limited searches (up to 50/week), serves as funnel to paid tiers.

Pricing tiers

Go-to-market motion5 records

Distribution channels7 records

Marketing channels10 records

Core offering

GreyNoise Intelligence operates a real-time, primary-sourced threat intelligence platform powered by the Global Observation Grid, a global fleet of thousands of deception sensors across 80+ countries that capture internet scanning and exploitation traffic and classify the originating IPs as benign, malicious, suspicious, or unknown. It sells tiered platform subscriptions (with required intelligence modules Triage/Investigate/Hunt and add-on modules such as C2 Detection, Business Services, and Vulnerability Prioritization), a separate GreyNoise Block firewall blocklist product for SMBs, the Visualizer web app, a public REST API with GreyNoise Query Language (GNQL), and the Project Swarm collective-defense initiative.

Product overview

GreyNoise Intelligence operates a platform-plus-modules architecture centered on the GreyNoise Platform, a real-time, verifiable network threat intelligence service powered by the world's largest deception sensor network (the Global Observation Grid) spanning thousands of sensors across 80+ countries. The core platform feeds into tiered intelligence modules (Triage, Investigate, Hunt) that nest progressively, plus add-on modules including C2 Detection, Business Services, and Vulnerability Prioritization for specialized use cases. Complementary offerings include GreyNoise Block (a configurable real-time blocklist service), Project Swarm (a collective sensor research initiative), the Visualizer web app, a public REST API with GNQL query language, and an MCP server for agentic SOC workflows. The portfolio is organized around use cases (CVE Disclosure Early Warning, Compromised Asset Detection, SOC Efficiency, Incident Investigation, Threat Hunting) and delivered through integrations with 30+ SIEM, SOAR, TIP, XDR, firewall, and AI tools including Splunk, CrowdStrike, Google SecOps, Palo Alto XSOAR, Microsoft Sentinel/Copilot, MISP, and OpenCTI.

Differentiator

Problem solved

Functional benefit

Brands

• GreyNoise Block: Fully configurable, real-time blocklists product to stop attackers in their tracks, integrating with major firewalls and security tools.
• Project Swarm

Products and services

• GreyNoise Platform Real-time, verifiable network threat intelligence platform powered by a global deception sensor network that detects attacks on network edge systems by surfacing malicious scanning and exploitation activity, with full packet capture backing the intelligence. Sold as tiered annual subscriptions to enterprise SOC teams.
• GreyNoise Block Fully configurable, real-time blocklists that stop mass exploitation by distributing External Dynamic Lists (EDL) to major firewalls. Includes both pre-built and custom query-based lists; sold with a 14-day free trial and a quote-based paid subscription targeting SMB and mid-market buyers.
• Project Swarm Collective research initiative inviting trusted partners to deploy deception sensors, contribute device profiles, and write detection rules to strengthen global threat intelligence; transforms the proprietary sensor network into a shared ecosystem for cyber defense of the network edge.
• GreyNoise API REST API for programmatic consumption of GreyNoise threat intelligence, available in Community (free) and Enterprise tiers with GreyNoise Query Language (GNQL) support, Lookup File API for bulk dataset uploads, webhook support, and Python SDK. Authentication via API key.
• Visualizer Web portal at viz.greynoise.io for searching GreyNoise data, accessing the platform, IP lookups, sensor activity visualization, GreyNoise Block management, and Project Swarm onboarding; offered with a free community tier (up to 50 searches/week) and login access for paid platform customers.

Named customers1 record

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration49 records

AI capability9 records

Feature9 records

Partnerships

24 partnerships are on record, tiered flagship, major and strategic.

• Google SecOpsflagshipTechnology or Integration · 10 March 2026Improved integration with Google SecOps spanning SIEM and SOAR capabilities, including standardized indicator ingestion, pre-built dashboards, YARA-L detection rules, saved searches, SOAR response actions, webhook support, and ready-to-deploy playbooks.
• SplunkmajorTechnology or Integration · 10 March 2026Pre-built integration that lets Splunk users filter out background noise from searches using GreyNoise classifications and tags to reduce false positives and enrich investigations.
• CrowdStrikeflagshipTechnology or Integration · 4 November 2025Integrated GreyNoise intelligence across the CrowdStrike Falcon platform including Falcon Next-Gen SIEM and a Falcon Foundry app launched at Fal.Con Europe 2025, bringing internet-wide scanning context to SIEM queries, SOAR workflows, and AI-driven triage.
• KritstrategicStrategic or Co-development Partner · 22 August 2022GreyNoise Intelligence acquired Krit in August 2022 to enhance product design and development capabilities for its cybersecurity platform. The Krit team now focuses on improving user experience and accelerating product enhancements.
• Microsoft Azure SentinelmajorTechnology or IntegrationFeatured integration that automatically enriches incidents generated by Sentinel with GreyNoise IP context for SIEM triage.
• Microsoft Copilot for SecuritymajorTechnology or IntegrationAllows security teams to query GreyNoise directly from within the Microsoft Copilot for Security portal for AI-assisted threat intelligence lookups.
• Palo Alto XSOARmajorTechnology or IntegrationContextualizes alerts, filters false-positives, finds compromised devices, and tracks emerging threats inside Palo Alto XSOAR using GreyNoise IP enrichment and GNQL queries.
• TinesmajorTechnology or IntegrationWorkflow automation integration enabling security teams to automate threat detection and enhance their security posture with GreyNoise.
• Cisco SecureXmajorTechnology or IntegrationAtomic action to enrich IP addresses using the GreyNoise Community API inside Cisco SecureX.
• Fortinet FortiSOARmajorTechnology or IntegrationPerforms automated investigative operations with GreyNoise IP enrichment and GNQL queries inside Fortinet FortiSOAR.
• Google Chronicle SOAR (Siemplify)majorTechnology or IntegrationAdds actions that provide context and modify cases based on GreyNoise IP enrichment inside Google Chronicle SOAR.
• IBM QRadarmajorTechnology or IntegrationScans IPs available in QRadar deployment and retrieves details from GreyNoise to enrich SIEM events.
• IBM ResilientmajorTechnology or IntegrationPerforms IP analysis using GreyNoise to categorize IP addresses and eliminate noise inside IBM Resilient SOAR.
• Splunk SOARmajorTechnology or IntegrationIdentifies IP addresses with malicious behaviors using GreyNoise inside Splunk SOAR (formerly Phantom) playbooks.
• Sumo Logic Cloud SIEMmajorTechnology or IntegrationReduces noise and prioritizes signal-targeted attacks against an organization inside Sumo Logic Cloud SIEM.
• Elastic LogstashmajorTechnology or IntegrationEnriches IP addresses from Logstash events with GreyNoise data inside Elastic.
• AnomalimajorTechnology or IntegrationIdentifies events to ignore, such as mass-internet scanners and harmless services, inside Anomali TIP.
• OpenCTImajorTechnology or IntegrationAnswers "Is everyone else seeing this, or is it just me?" using GreyNoise enrichment inside OpenCTI.
• Recorded Future TIPmajorTechnology or IntegrationEnriches threat intelligence with valuable context on IPs scanning the internet inside Recorded Future TIP.
• Fortinet (Firewall)majorTechnology or IntegrationFortinet firewalls consume GreyNoise Block dynamic blocklists as External Dynamic Lists for real-time defender-trusted IP blocking.
• Cisco (Firewall)majorTechnology or IntegrationCisco firewalls integrate with GreyNoise Block to ingest dynamic blocklists for perimeter defense.
• Palo Alto Networks (Firewall)majorTechnology or IntegrationPalo Alto firewalls consume GreyNoise Block dynamic blocklists for IP-based blocking at the perimeter.
• AWS (Firewall)majorTechnology or IntegrationAWS security services integrate with GreyNoise Block for dynamic blocklist consumption in cloud environments.
• Microsoft Azure (Firewall)majorTechnology or IntegrationMicrosoft Azure integrates with GreyNoise Block for dynamic blocklist consumption in cloud environments.

Scale indicators17 records

Recent moves6 records

Expansion highlights7 records

Direct peers

• Recorded Future: Recorded Future operates a large-scale threat intelligence platform aggregating data across the open, dark, and deep web for SOC, vulnerability, and brand-protection use cases. It is the closest direct peer to GreyNoise in primary-sourced threat intelligence feeding enterprise SIEM/SOAR/TIP workflows.
• Shodan: Shodan is the most widely known internet-wide scanning and device-intelligence platform. It is directly comparable to GreyNoise in telemetry collection methodology (active internet scanning) and in selling exposure/intelligence to security teams, though Shodan leans more toward exposure-management than active-attack classification.
• Censys: Censys provides internet-wide scanning intelligence and attack-surface management for security teams. Like GreyNoise, it operates proprietary global scanning infrastructure to deliver primary-sourced data on hosts, services, and certificates, competing for similar enterprise use cases.
• Anomali: Anomali is a threat intelligence platform and TIP vendor that aggregates threat feeds and integrates with SIEM/SOAR — overlapping directly with GreyNoise's enrichment and SOC-triage use cases, especially via its Anomali TIP integration that already lists GreyNoise as a data source.
• BinaryEdge: BinaryEdge is a cybersecurity data company providing continuous internet scanning, exposed-asset discovery, and threat intelligence feeds. It is comparable to GreyNoise in primary-sourced telemetry collection and in serving security teams with IP/host context for triage and threat hunting.
• Onyphe: Onyphe aggregates and curates internet-scanning data (open ports, vulnerabilities, exposed assets, dark-web exposure) and sells threat intelligence feeds to security teams. It is comparable to GreyNoise in methodology and target buyer, though it positions more toward OSINT/exposure data.
• ThreatConnect: ThreatConnect offers a TIP and threat intelligence platform with built-in analytics, scoring, and SIEM/SOAR integration. It overlaps directly with GreyNoise on TIP enrichment and SOC triage workflows and lists GreyNoise as one of its enrichment data sources.
• EclecticIQ: EclecticIQ is a threat intelligence platform vendor (CTI, TIP) serving enterprise and government customers, with deep integrations into SIEM/SOAR. It is comparable to GreyNoise in target market and in ingesting/enriching IP/CVE data for analyst workflows.

Broad incumbents

• Flashpoint: Flashpoint delivers finished threat intelligence, vulnerability intelligence, and fraud data across the deep/dark web for enterprise security teams. It is comparable to GreyNoise in customer and use case (intelligence-driven defense) but is broader in scope and incumbent in market presence.
• RiskIQ (Microsoft Defender Threat Intelligence): RiskIQ, now Microsoft Defender Threat Intelligence, provides internet-scale scanning and attack-surface intelligence bundled into Microsoft's security platform. It is a broad incumbent comparable to GreyNoise in primary-sourced scanning intelligence and enterprise distribution.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks7 records

Key highlights7 records

Customer concentration

• Xx.com/GreyNoiseIO
• YouTubeyoutube.com/channel/UCenRCNSQ3pCBuWNDOne606w
• LinkedInlinkedin.com/company/greynoise
• TikToktiktok.com/@greynoiseintelligence

Revenue estimate

Valuation estimate

Number of profiles

Profiles6 records

Subsidiaries1 record

Funding overview

Funding rounds5 records

Investors7 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A1 record

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about GreyNoise Intelligence