Red Canary

What Red Canary does

Red Canary is a managed detection and response (MDR) provider founded in 2014 and headquartered in Denver, Colorado. The company delivers 24x7 threat monitoring, investigation, and response across endpoints, identities, email, and cloud environments through a subscription-based service that combines human analyst judgment with agentic AI automation. Its core platform uses a detection-as-code architecture, behavioral analytics, and proprietary threat intelligence drawn from analysis of more than 110,000 threats; following Zscaler's $675 million acquisition completed in August 2025, Red Canary now operates as a separate business unit within Zscaler while leveraging threat intelligence from the Zero Trust Exchange platform's 500+ billion daily transactions.

The product portfolio centers on the flagship MDR service and includes AI Agents for autonomous threat investigation, Threat Intelligence research and hunting, customizable automation playbooks, a Security Data Lake for cost-effective log storage, Managed Phishing Response, and Training & Tabletops for incident preparedness. Red Canary also maintains Atomic Red Team, an open-source testing framework mapped to MITRE ATT&CK that is used by the broader security community to validate detection coverage. The technology stack integrates natively with Microsoft, CrowdStrike, SentinelOne, Palo Alto Networks, AWS, Google Cloud, and Zscaler platforms, and the company publishes an annual Threat Detection Report covering AI tradecraft, identity-based threats, and ransomware trends.

Red Canary pursues a sales-led, enterprise-focused go-to-market with both direct enterprise field sales and inside sales teams, supplemented by channel distribution through Zscaler's global partner ecosystem of resellers, system integrators, and managed service providers. Customers include thousands of organizations across enterprise and mid-market segments spanning financial services, healthcare, technology, manufacturing, education, and government. The company monetizes through annual recurring subscription contracts with custom quote-based enterprise pricing, reaching over $140 million in ARR at the time of acquisition. Prior to the Zscaler transaction, Red Canary had raised approximately $130 million across five disclosed funding rounds between 2015 and 2021, led by Summit Partners, Access Venture Partners, and Noro-Moseley Partners.

Name

Red Canary

Legal name

Red Canary Inc.

Website

https://redcanary.com

Company type

Private

Founded year

2014

Operating status

Operating

Headcount range

251–500 employees

Ownership category

akta.pro rank

Product category

Managed Detection and Response

NAICS

Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (518)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Managed Detection & Response (MDR) (BPAEADAA)

akta.pro secondary industries

Managed Detection & Response (MDR) & SOC Services (HDADAGAG), Endpoint Detection & Response (EDR) (HDADAEAA), Email & Collaboration Threat Detection/Response (ICR/CTDR) (HDADAKAI), Cloud Detection & Response (CDR) (HDADADAG), Endpoint Security Managed Services (EDR/XDR) (BPAEADAH), Security Operations Center (SOC) as a Service (BPAEADAB)

Keywords

• Managed detection response
• Endpoint security monitoring
• Threat intelligence platform
• Cloud security operations
• Security operations automation

Headquarters

HQ city

Denver

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Managed Detection and Response Services: Subscription-based managed security services providing 24x7 monitoring, threat detection, investigation, and response across endpoints, identities, and cloud environments. Revenue generated through annual recurring contracts with enterprise customers.
2. AI Agents: AI-powered automation capabilities for SOC workflows, offered as part of the MDR platform or potentially as add-on services
3. Security Data Lake: Log storage and security data management platform that provides cost-effective compliance and investigation capabilities
4. Threat Intelligence: Tactical threat intelligence products and research reports including the annual Threat Detection Report

Pricing tiers

Go-to-market motion2 records

Distribution channels4 records

Marketing channels7 records

Core offering

Red Canary delivers managed detection and response (MDR) services that combine 24x7 human security operations with AI-powered detection across endpoints, identities, email, and cloud environments. The platform ingests telemetry from leading EDR, identity, and cloud sources to identify threats, triage alerts, and initiate response actions on behalf of customer SOCs. Customers subscribe to the platform as a managed service rather than operating the detection infrastructure themselves.

Product overview

Red Canary is a managed detection and response (MDR) provider offering a comprehensive security operations platform. The core offering is Managed Detection and Response (MDR), supplemented by AI Agents for autonomous threat investigation, Threat Intelligence for tactical insights, Automation for playbooks, Security Data Lake for cost-effective log storage, Managed Phishing Response, and Training & Tabletops for incident preparedness. The platform is built on open-source tools including Atomic Red Team for defense testing. Red Canary operates as a subsidiary of Zscaler following the $675 million acquisition completed in August 2025, integrating with the Zscaler Zero Trust Exchange platform while maintaining its own brand and operations. The company publishes the annual Threat Detection Report, analyzing over 110,000 threats with insights into AI tradecraft, ransomware, and emerging attack techniques.

Differentiator

Problem solved

Functional benefit

Products and services

• Managed Detection and Response (MDR) 24x7 managed detection and response service that ingests telemetry from EDR, identity, and cloud platforms, triages alerts using AI and human analysts, and initiates response actions on behalf of enterprise security operations teams.
• AI Agents Agentic AI feature set within the Red Canary platform that performs autonomous alert triage, investigation, and response actions, reducing manual analyst workload. Targeted at enterprise SOC teams seeking to scale detection and response without proportional headcount increases.
• Threat Intelligence Curated threat intelligence offering that delivers adversary research, detection content, and contextualized threat data to help enterprise SOC teams prioritize and respond to the most relevant threats to their environment.
• Security Data Lake Cloud-based security data lake that aggregates and retains endpoint, identity, and cloud telemetry to enable long-term search, correlation, and advanced analytics for enterprise security teams.
• Managed Phishing Response Managed phishing response service that triages user-reported phishing emails, performs analysis, and coordinates remediation actions across the enterprise email environment to reduce user risk and analyst workload.
• Training & Tabletops Training and tabletop exercise program that prepares enterprise security and incident response teams using Red Canary's real-world threat intelligence and adversary scenarios.
• Atomic Red Team Open-source library of adversary emulation tests that map to the MITRE ATT&CK framework, allowing security teams to validate detection coverage against real-world attacker techniques.

Quantifiable outcome

• Detects 4x more threats compared to legacy security tools
• +5 more outcomes

Named customers3 records

Segments8 records

Ideal customer profiles1 record

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration8 records

AI capability7 records

Feature5 records

Partnerships

Seven partnerships are on record, tiered core and major.

• CrowdStrikecoreTechnology or Integration · 20 August 2025Expanded partnership between Red Canary (Zscaler) and CrowdStrike to deliver enhanced AI-driven security operations. The joint offering combines Zscaler Zero Trust Exchange with CrowdStrike Falcon platform for unified cloud-native security architecture with AI-powered threat detection and automated responses.
• ZscalercoreTechnology or Integration · 1 August 2025Zscaler completed acquisition of Red Canary in August 2025 for $675 million in cash plus equity. Red Canary operates as a separate business unit while integrating with Zscaler's Zero Trust Exchange platform. The combination leverages Zscaler's 500+ billion daily transactions for enhanced threat intelligence and detection capabilities.
• MicrosoftmajorTechnology or IntegrationIntegration partnership providing Red Canary MDR capabilities with Microsoft Security products including Microsoft Defender and related Microsoft security stack components.
• SentinelOnemajorTechnology or IntegrationTechnology integration partnership enabling Red Canary detection and response capabilities to work with SentinelOne endpoint protection platform.
• Palo Alto NetworksmajorTechnology or IntegrationTechnology integration partnership providing interoperability between Red Canary MDR services and Palo Alto Networks security platforms.
• AWSmajorTechnology or IntegrationCloud security integration partnership enabling Red Canary threat detection and response capabilities across AWS cloud environments.
• Google CloudmajorTechnology or IntegrationCloud security integration partnership providing Red Canary detection capabilities across Google Cloud Platform environments.

Scale indicators11 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Arctic Wolf: Pure-play MDR/security operations vendor offering 24x7 managed detection and response across endpoint, network, cloud, and identity; the closest head-to-head competitor to Red Canary in mid-market and enterprise MDR deals.
• Expel: MDR provider focused on transparent, cloud-native managed detection and response with strong integrations into Microsoft, CrowdStrike, and Okta ecosystems; competes directly with Red Canary for enterprise SOC replacement deals.
• eSentire: Managed detection and response vendor offering 24x7 SOC services across endpoint, network, cloud, and identity; competes for similar mid-market and enterprise customers as Red Canary with a comparable analyst-led model.
• ReliaQuest: MDR/XDR-as-a-service provider delivering security operations across multi-vendor environments with an open XDR platform; overlaps with Red Canary in large enterprise SOC modernization deals.
• Secureworks: MDR and managed security services provider with a Taegis XDR platform, serving mid-market and enterprise customers; a long-standing direct competitor to Red Canary in managed detection and response.
• Rapid7 (Managed Services): Offers managed detection and response built on its InsightIDR/InsightConnect platform; competes with Red Canary for SOC outsourcing deals, particularly among mid-market and cloud-first enterprises.

Broad incumbents

• Sophos Managed Detection and Response: Broad incumbent endpoint and network security vendor that bundles 24x7 MDR with its own endpoint/EDR stack; competes with Red Canary particularly when customers prefer single-vendor endpoint + MDR.
• CrowdStrike (Falcon Complete MDR): CrowdStrike's Falcon Complete is a fully managed MDR service built on its Falcon endpoint platform; competes with Red Canary and is simultaneously a technology partner via the expanded 2025 joint offering.
• Palo Alto Networks (Unit 42 MDR): Offers managed detection and response via Unit 42 bundled across its Cortex XSIAM/XDR platform; competes with Red Canary as a broader security platform vendor with native MDR.
• SentinelOne (Managed Detection and Response): Singularity platform vendor offering managed detection and response built on its own EDR data; competes with Red Canary while also being an integration partner across endpoint telemetry.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks6 records

Key highlights7 records

Customer concentration

• GitHubgithub.com/redcanaryco
• Xx.com/redcanary
• LinkedInlinkedin.com/company/redcanary

Revenue estimate

Valuation estimate

Number of profiles

Profiles8 records

Subsidiaries1 record

Funding overview

Funding rounds5 records

Investors5 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Red Canary