IRONSCALES
Atlanta-based AI-native cloud email security platform combining Adaptive AI, a 35,000+ analyst community, and agentic SOC automation to protect 17,000+ global enterprises, MSPs, and mid-market organizations against phishing, BEC, ATO, and deepfake attacks.
- Company typePrivate
- Founded2014
- HeadquartersAtlanta, United States
- Headcount101–250
- GTM typeB2B
- OfferingSoftware
What IRONSCALES does
IRONSCALES is an Atlanta-based, AI-native cloud email security company founded in 2014 that protects more than 17,000 organizations globally against phishing, business email compromise (BEC), account takeover (ATO), QR-code attacks, and AI-generated threats including deepfake impersonation in Microsoft Teams. The platform is delivered as an API-driven, mailbox-level Integrated Cloud Email Security (ICES) solution that augments or replaces Microsoft 365 and Google Workspace native controls without changing the MX record; its core is the Adaptive AI engine, which combines behavioral AI, natural language understanding, computer vision, anomaly detection, and per-mailbox sender fingerprinting with a crowdsourced threat-intelligence community of over 35,000 security analysts. The Winter 2026 release added three agentic AI agents (Red-Teaming, Phishing SOC, Phishing Simulation) and Themis Copilot, an autonomous SOC analyst that performs L2-level forensic investigation and reportedly automates 99.7% of remediation.
The company's product surface spans a unified platform plus modules: BEC, ATO, credential harvesting, advanced malware/URL, QR-code, and generative-AI attack protection; deepfake detection for Microsoft Teams via voice biometric analysis; integrated outbound email encryption (including a multitenant MSP variant launched May 2026); DMARC management; phishing simulation testing; security awareness training; and bundled deployment solutions for M365 augmentation, Google Workspace augmentation, SEG augmentation, and SEG replacement. Threat-intelligence services (Email Attack of the Day series launched at RSAC 2026) and a 35,000+ analyst community reinforce the platform's data flywheel.
IRONSCALES generates revenue through annual SaaS subscriptions priced per mailbox, supplemented by a formalized @Scale MSP/MSSP partner program with custom tiered pricing, no minimums, and industry-leading margins. Distribution is hybrid: direct enterprise field sales augmented by self-serve free trials and on-demand product tours, alongside nine major cloud distributors (Pax8, ConnectWise, Sherweb, Atera, Synnex, Bemsp, Elovade, Concentrix, Malwarebytes), a Syncro Marketplace listing, and strategic partners including Todyl and RSA Security. As of mid-2026, the company is led by founder Eyal Benishti (CEO), with Steve McKenzie as COO and a recently expanded executive bench (CSO, SVP R&D, CMO, CRO, CFO). Disclosed funding totals approximately $121M across rounds led by PSG, K1 Investment Management, Jump Capital, and earlier investors Elron Ventures and RDC.
IRONSCALES firmographics
Firmographics- Name
- IRONSCALES
- Legal name
- IRONSCALES LTD
- Website
- https://ironscales.com
- Company type
- Private
- Founded year
- 2014
- Operating status
- Operating
- Headcount range
- 101–250 employees
- Short description
- Atlanta-based AI-native cloud email security platform combining Adaptive AI, a 35,000+ analyst community, and agentic SOC automation to protect 17,000+ global enterprises, MSPs, and mid-market organizations against phishing, BEC, ATO, and deepfake attacks.
- Ownership category
- akta.pro rank
IRONSCALES industry classification
Industry- Product category
- Cloud Email Security
- NAICS
- Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (5182), Computer Systems Design and Related Services (5415)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Email Phishing & BEC Protection (HDADAKAB)
- akta.pro secondary industries
- Email & Collaboration Threat Detection/Response (ICR/CTDR) (HDADAKAI), Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ), Data Security & Privacy Managed Services (DLP/Encryption) (BPAEADAL)
Keywords
Where IRONSCALES is headquartered
LocationHeadquarters
- HQ city
- Atlanta
- HQ country
- United States
- HQ region
- North America
Offices3 records
Markets served
IRONSCALES business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure
Revenue model
- IRONSCALES Cloud Email Security SaaS Subscriptions: Primary revenue stream: subscription-based SaaS pricing for the IRONSCALES Adaptive AI platform, sold per mailbox/user with tiered packaging. Includes the Winter 2026 release (three AI agents), Themis Copilot, integrated encryption, DMARC management, phishing simulation, security awareness training, and deepfake protection for Microsoft Teams. Sold direct to enterprises and via the MSP/MSSP @Scale partner program.
- MSP/MSSP Channel Revenue: Recurring revenue from managed service providers and MSSPs who resell IRONSCALES to their end clients under multi-tenant management. Partner pricing includes industry-leading margins, custom tiered packages, and a deployable billable encryption service tier so partners can monetize compliance offerings.
- Marketplace Channel Revenue (Syncro): Transaction-facilitated revenue through the Syncro Marketplace where MSPs purchase, provision, and bill IRONSCALES email security through Syncro's Universal Billing model, consolidating vendor portals into a single system.
- Professional Services & Enablement: Partner enablement, POCs, demos, and cybersecurity insurance/regulatory compliance readiness support bundled with partner agreements to accelerate sell-through and customer onboarding.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Subscription SaaS — quote-based, not publicly disclosed |
| Other | Pay-as-you-go | MSP/MSSP partner pricing — custom, tiered, no minimums |
| Subscription | Pay-as-you-go | Syncro Marketplace billing for MSPs |
Go-to-market motion5 records
Distribution channels6 records
Marketing channels12 records
IRONSCALES product offering
Product offeringCore offering
IRONSCALES provides an API-driven, mailbox-level Integrated Cloud Email Security (ICES) platform that combines Adaptive AI (behavioral AI, NLP/NLU, computer vision), a crowdsourced global threat-hunting community of 35,000+ analysts, and agentic AI SOC automation (Themis Copilot and three specialized Winter 2026 agents) to detect and remediate phishing, BEC, ATO, QR-code, deepfake, and AI-generated email attacks. It integrates with Microsoft 365, Microsoft Teams, and Google Workspace, and is sold both directly to global enterprises and through a formalized MSP/MSSP partner program with multi-tenant management.
Product overview
IRONSCALES offers a single unified cloud email security platform branded as the IRONSCALES Adaptive AI Platform, built on a mailbox-level API architecture that integrates with Microsoft 365, Microsoft Teams, and Google Workspace. The platform is delivered as a core platform-plus-modules architecture: the core platform combines Adaptive AI, Human Element (crowdsourced intelligence from a 35,000+ analyst community), and Agentic SOC Automation, while solution modules extend coverage to specific threat types (BEC, ATO, credential harvesting, advanced malware/URL, QR-code attacks, generative-AI attacks, deepfake impersonation, and email encryption), to specific functions (DMARC management, phishing simulation testing, security awareness training), and to bundled deployment scenarios (M365 Augmentation, GWS Augmentation, SEG Augmentation, SEG Replacement, SOC Automation). The Winter 2026 release added three agentic AI agents (Red-Teaming, Phishing SOC, Phishing Simulation) and Themis Copilot as AI-augmented SOC analyst modules, and an outbound Email Encryption module was also integrated. Threat intelligence services (Email Attack of the Day and the IRONSCALES Community) and a dedicated MSP/MSSP multitenant partner program round out the offering.
Differentiator
Problem solved
Functional benefit
Products and services
- IRONSCALES Adaptive AI Platform Unified, API-driven, mailbox-level cloud email security platform combining Adaptive AI, Human Element (crowdsourced intelligence from 35,000+ analysts), and Agentic SOC Automation to protect 17,000+ organizations against phishing, BEC, ATO, QR-code, and deepfake attacks. Integrates with Microsoft 365, Microsoft Teams, and Google Workspace.
- Red-Teaming Agent Agentic AI module that researches the organization like an attacker would, then blocks anticipated threats before they arrive, enabling preemptive defense.
- Phishing SOC Agent Agentic AI module providing L2-level forensic investigation across five tracks, producing a clear verdict on reported phishing in minutes and reducing phishing remediation time from hours to minutes.
- Phishing Simulation Agent Agentic AI module delivering hyper-personalized GPT-powered spear phishing simulations targeting highest-risk employees using real OSINT and adapting as attacker tactics change.
- Themis Copilot AI-powered virtual SOC analyst that autonomously investigates, classifies, quarantines, clusters, or escalates email threats, freeing security teams from manual triage; cited at 99.7% automated remediation and a 95% reduction in phishing man-hours (City of Memphis).
- Deepfake Attack Protection Adaptive AI capability that detects and stops AI-driven voice and video impersonation in Microsoft Teams meetings through passive voice biometric learning and visual analysis.
- Email Encryption Integrated outbound email encryption solution that encrypts outbound email, automates audit-ready compliance evidence, and provides frictionless one-time passcode recipient authentication across healthcare, financial, education, and insurance verticals; includes an MSP/MSSP multitenant variant with billable service tier.
- DMARC Management Automated DMARC, SPF, and DKIM enforcement that flattens DNS records, monitors authentication health, and ensures only trusted senders can use the customer's domain.
- Phishing Simulation Testing Automated phishing simulation platform enabling organizations to launch real-world email attack simulations against employees and track engagement, susceptibility, and training impact.
- Security Awareness Training (SAT) Integrated SAT campaigns combined with real-time warning banners and a report phishing button, designed to build a security-first culture and reinforce AI-driven detection.
- Business Email Compromise (BEC) Protection Mailbox-level BEC protection that creates unique sender fingerprints per employee, flags BEC language patterns via NLU, and quarantines anomalies in real time to defend against CEO fraud, invoice fraud, and vendor impersonation.
- Account Takeover (ATO) Protection Capability to prevent, detect, and respond to account takeover attacks in real time using behavioral baselining and mailbox-level API visibility.
- Advanced Malware & URL Attack Protection Continuous protection against malicious links and attachments, including QR-code (quishing) attacks that bypass standard email authentication.
- Credential Harvesting Protection Mailbox-level fraud and anomaly detection that creates unique sender fingerprints and automatically quarantines credential-harvesting attempts that conventional SEGs miss.
- QR Code Attack Protection Specialized capability for detecting and blocking quishing (QR-code phishing) attacks that bypass SPF/DKIM/DMARC by encoding payloads in pre-rendered QR images.
- Generative AI Attack Protection Capability to defend against phishing attacks generated or enhanced by GenAI tools, leveraging behavioral AI that does not rely on legacy content indicators.
- SOC Automation Solution bundle packaging Agentic SOC Automation, M-SOAR orchestration, and Themis Copilot to minimize manual effort in phishing investigation and remediation.
- M365 Augmentation Solution bundle layering IRONSCALES Adaptive AI on top of Microsoft 365 native security to catch phishing, BEC, and QR-code attacks that bypass Defender for Office 365.
- GWS Augmentation Solution bundle augmenting Google Workspace native security with IRONSCALES behavioral AI and automated remediation.
- SEG Augmentation Solution bundle layering IRONSCALES on top of an existing Secure Email Gateway (SEG) to address advanced threats the SEG misses.
- SEG Replacement Solution bundle positioning IRONSCALES as a full replacement for legacy SEGs using API-native mailbox-level detection and automated remediation.
- Email Attack of the Day Daily threat intelligence series providing summaries of phishing attacks caught by IRONSCALES Adaptive AI and the 35,000+ analyst community, searchable by attack type, industry, and spoofed brand.
- IRONSCALES MSP/MSSP Partner Program (@Scale) Multitenant MSP/MSSP partner offering featuring industry-leading margins, no quotas, custom tiered pricing, multi-tenant management, global dashboards, and bundled marketing enablement for managed service providers.
Quantifiable outcome
- 99.7% of threats automatically remediated by AI
- +8 more outcomes
Companies that use IRONSCALES
Customer profileNamed customers12 records
Segments7 records
Ideal customer profiles5 records
IRONSCALES technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration6 records
AI capability15 records
Feature9 records
IRONSCALES partnerships and signals
Strategic signalPartnerships
15 partnerships are on record, tiered flagship, core and minor.
- AnthropicflagshipIRONSCALES became the first email security vendor formally verified under Anthropic's Cyber Verification Program (CVP). The verification grants IRONSCALES access to frontier AI capabilities for adversarial defense operations, enabling it to run adversarial simulations, generate targeted attack scenarios, and stress-test defenses using AI at parity with sophisticated threat actors.
- TodylcoreTodyl hosted its second annual Partner Summit in Denver with IRONSCALES as a featured ecosystem partner and keynote participant. Todyl has an active strategic partnership with IRONSCALES for unified cybersecurity, alongside its separate partnership with RSA Security.
- SyncroflagshipSyncro and IRONSCALES announced a new partnership to integrate AI-driven email security into the Syncro Marketplace for MSPs. The integration enables MSPs to purchase, provision, and bill IRONSCALES email security through Syncro's Universal Billing model. A joint webinar was held on February 18, 2026 to provide details on the integration.
- Syncro MarketplaceflagshipIRONSCALES email security services are offered to MSPs through the Syncro Marketplace, enabling efficient deployment and management of IRONSCALES' email protection while simplifying billing.
- Pax8flagshipPax8 is listed as a trusted top distributor of IRONSCALES' MSP partner program, providing cloud distribution to MSPs for IRONSCALES email security and adjacent services.
- ConnectWisecoreConnectWise is listed as a trusted top distributor of IRONSCALES' MSP partner program, enabling MSPs to procure IRONSCALES alongside other ConnectWise-integrated managed services.
- SherwebcoreSherweb is listed as a trusted top distributor of IRONSCALES' MSP partner program, supporting cloud and email security distribution to MSPs.
- AteracoreAtera is listed as a trusted top distributor of IRONSCALES' MSP partner program, enabling joint RMM and email security distribution to MSPs.
- SynnexcoreSynnex is listed as a trusted top distributor of IRONSCALES' MSP partner program, supporting IT channel distribution to resellers and MSPs.
- ConcentrixminorConcentrix is listed as a trusted top distributor of IRONSCALES' MSP partner program.
- BemspminorBemsp is listed as a trusted top distributor of IRONSCALES' MSP partner program.
- ElovademinorElovade is listed as a trusted top distributor of IRONSCALES' MSP partner program.
- MalwarebytesminorMalwarebytes is listed as a trusted top distributor of IRONSCALES' MSP partner program, enabling bundling of email security with endpoint security offerings.
- RSA SecuritycoreRSA Security is a fellow ecosystem partner in the Todyl partner ecosystem; RSA selected Todyl to protect its commercial and corporate environments and power its Security Operations Center. The three vendors (IRONSCALES, Todyl, RSA) share stage and co-marketing presence at Todyl Partner Summit.
- OWASPminorIRONSCALES references the OWASP Session Management Cheat Sheet within its session hijacking detection content, indicating alignment with OWASP standards as part of its technical posture.
Scale indicators11 records
Recent moves6 records
Expansion highlights6 records
IRONSCALES competitors and assessment
Company assessmentDirect peers
- Abnormal Security: Abnormal Security is a leading Integrated Cloud Email Security (ICES) platform that uses behavioral AI to detect BEC, phishing, and account takeover attacks in Microsoft 365 and Google Workspace. It is the closest direct competitor to IRONSCALES, serving the same enterprise buyer and overlapping on core mailbox-level AI detection capabilities.
- Avanan (Check Point Software): Avanan is an ICES platform acquired by Check Point that protects cloud email and collaboration suites from phishing, BEC, and data loss. It directly competes with IRONSCALES on mailbox-level API-based email security for Microsoft 365 and Google Workspace customers.
Broad incumbents
- Mimecast: Mimecast is a long-standing email security, archiving, and resilience provider now owned by Permira. It overlaps with IRONSCALES on phishing, BEC, and awareness training and represents a comparable incumbent option for enterprises considering SEG replacement or augmentation.
- Proofpoint: Proofpoint is the largest dedicated email security incumbent with a broad portfolio spanning secure email gateway, ICES, security awareness, and archiving. It competes with IRONSCALES across both legacy SEG replacement and emerging ICES use cases for large enterprises.
- Cisco Secure Email (formerly IronPort): Cisco Secure Email (formerly IronPort/Cisco Email Security) is a legacy on-premises and cloud email security gateway. It competes with IRONSCALES primarily in the SEG augmentation/replacement category for large enterprises with existing Cisco security stacks.
- Microsoft Defender for Office 365: Microsoft Defender for Office 365 is the native email security stack within the Microsoft 365 ecosystem. It is both an underlying platform IRONSCALES augments and a free or low-cost alternative buyer, posing an ongoing replacement-risk threat to IRONSCALES' M365 Augmentation business.
Emerging players
- KnowBe4: KnowBe4 is the dominant security awareness and phishing simulation vendor, with growing email security capabilities following its Egress acquisition. It overlaps with IRONSCALES on phishing simulation, SAT, and now email data protection, particularly within MSP and mid-market channels.
- Material Security: Material Security is a cloud-native email security platform focused on detection, response, and post-delivery protection within Microsoft 365 and Google Workspace. It overlaps with IRONSCALES on mailbox-level API-based detection and SOC automation for cloud email.
- Sublime Security: Sublime Security is an open, extensible ICES platform offering detection-as-code and community-driven email threat rules. It competes with IRONSCALES on advanced phishing/BEC detection for technically sophisticated buyers, though at smaller scale.
Regional players
- Vade (Hornetsecurity): Vade is a European-headquartered email security vendor now part of Hornetsecurity, offering AI-driven anti-phishing, spear-phishing, and ransomware protection for Microsoft 365. It is a comparable ICES-style alternative with strong EMEA distribution, comparable to IRONSCALES' MSP-led international expansion.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks6 records
Key highlights7 records
Customer concentration
IRONSCALES social profiles
Digital presenceIRONSCALES compliance and trust
Trust signalCompliance4 records
IRONSCALES financial estimates
Financial estimateRevenue estimate
Valuation estimate
IRONSCALES leadership team
Management profileNumber of profiles
Profiles10 records
IRONSCALES funding detail
Funding detailFunding overview
Funding rounds6 records
Investors6 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
IRONSCALES M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about IRONSCALES
What does IRONSCALES do?
IRONSCALES provides an API-driven, mailbox-level Integrated Cloud Email Security (ICES) platform that combines Adaptive AI (behavioral AI, NLP/NLU, computer vision), a crowdsourced global threat-hunting community of 35,000+ analysts, and agentic AI SOC automation (Themis Copilot and three specialized Winter 2026 agents) to detect and remediate phishing, BEC, ATO, QR-code, deepfake, and AI-generated email attacks. It integrates with Microsoft 365, Microsoft Teams, and Google Workspace, and is sold both directly to global enterprises and through a formalized MSP/MSSP partner program with multi-tenant management.
Is IRONSCALES a public or private company?
IRONSCALES is a private company. It is classified as venture growth investor backed and is currently operating.
When was IRONSCALES founded?
IRONSCALES was founded in 2014. It employs 101 to 250 people.
Where is IRONSCALES based?
IRONSCALES is headquartered in Atlanta, United States, in the North America region.
How does IRONSCALES make money?
Four revenue lines are on record. IRONSCALES Cloud Email Security SaaS Subscriptions are the primary driver. The others are MSP/MSSP Channel Revenue, marketplace Channel Revenue (Syncro) and professional Services & Enablement.
Who are IRONSCALES's main competitors?
Direct peers on record are Abnormal Security and Avanan (Check Point Software). Broad incumbents are Mimecast, Proofpoint, Cisco Secure Email (formerly IronPort) and Microsoft Defender for Office 365. Emerging players are KnowBe4, Material Security and Sublime Security. Vade (Hornetsecurity) is listed as a regional player.
Does IRONSCALES have an API?
Yes. IRONSCALES offers a mailbox-level, API-driven email security platform. The API integrates with cloud-based email services such as Microsoft 365 and Google Workspace to enable mailbox-level visibility, behavioral baselining, automated remediation, and event orchestration with SIEM/SOAR platforms. Developers and partners can use the API to power integrations such as the Syncro Marketplace, multi-tenant MSP management, and SOAR playbook automation.
What industry is IRONSCALES in?
IRONSCALES's product category is Cloud Email Security. Its primary akta.pro industry code is HDADAKAB, Email Phishing & BEC Protection, with a secondary code of HDADAKAI, Email & Collaboration Threat Detection/Response (ICR/CTDR). Its NAICS code is 5182 and its SIC code is 7372.