CrowdSec
CrowdSec is a French cybersecurity company offering an open-source, crowdsourced IDS/IPS and threat intelligence platform that converts community attack signals into curated IP blocklists and CTI feeds, monetizing via paid Blocklists, IP Reputation API, and Console Premium subscriptions.
- Company typePrivate
- Founded2019
- HeadquartersMontrouge, France
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What CrowdSec does
CrowdSec is a French cybersecurity company, founded in 2019 and headquartered in Montrouge, that operates a crowdsourced threat intelligence platform built around an open-source Security Engine (MIT-licensed, written in Golang). The Security Engine analyzes logs and network traffic using YAML-based scenarios and parsers, applies a Trust Scoring System, Consensus Calculator, and Expert System to filter noise and data poisoning, and shares validated signals through a Central API. Customers deploy remediation components ("bouncers") to enforce blocks across firewalls (iptables, nftables, pfSense, OPNsense, Palo Alto, Fortinet, Check Point), CDNs (Cloudflare, Fastly, AWS WAF, GCP Cloud Armor), web servers (Nginx, HAProxy, Traefik, Caddy), and cloud platforms. The commercial layer includes the CrowdSec Console (SaaS management, free plus premium tiers), IP Reputation API (CTI database of 35M+ malicious IPs with 32-criteria context), and CrowdSec Blocklists (industry-, country-, and behavior-specific curated feeds).
CrowdSec monetizes through a freemium funnel: a free open-source Security Engine drives community adoption (70,000+ active users, 110K+ machines, 190+ countries), which feeds the data flywheel that powers paid tiers. Pricing includes Platinum Blocklists from $1,900/month, IP Reputation API from $49/month (or Local CTI replication from $9K/month), and Console Premium at $1K/month per enrolled Security Engine, plus custom blocklists under quote-based contracts and a tiered partner program with embedded-data licensing. Customers span MSSPs, hosting providers, financial services (Crédit Mutuel, Arkea), media (Le Monde), public sector (French Ministry of Interior), healthcare, telecommunications, energy (ButanGas), and education (Imperial College London, Universität München). Recent additions include Live Exploit Tracker (February 2026, real-time CVE exploitation intelligence) and CrowdSec MCP (February 2026, Model Context Protocol for LLMs to author detection rules).
The company has raised approximately €18M across seed, Series A, and earlier rounds (Bpifrance, Breega, Reflexion Capital, Supernova Invest), operates with 11-50 employees, and distributes through self-serve SaaS, direct enterprise sales, and an international partner network covering MSSPs, technology integrators, and resellers across Europe, the Middle East, Asia, and the Americas.
CrowdSec firmographics
Firmographics- Name
- CrowdSec
- Legal name
- CrowdSec – Société par actions simplifiée (SAS)
- Website
- https://crowdsec.net
- Company type
- Private
- Founded year
- 2019
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- CrowdSec is a French cybersecurity company offering an open-source, crowdsourced IDS/IPS and threat intelligence platform that converts community attack signals into curated IP blocklists and CTI feeds, monetizing via paid Blocklists, IP Reputation API, and Console Premium subscriptions.
- Ownership category
- akta.pro rank
CrowdSec industry classification
Industry- Product category
- Cybersecurity Threat Intelligence
- NAICS
- Investigation and Security Services (5616)
- akta.pro primary industry
- Data Security & Privacy Managed Services (DLP/Encryption) (BPAEADAL)
Keywords
Where CrowdSec is headquartered
LocationHeadquarters
- HQ city
- Montrouge
- HQ country
- France
- HQ region
- Europe
Offices1 record
Markets served
CrowdSec business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Infrastructure, Marketing or Sales, Operations
Revenue model
- Platinum Blocklists Subscription: Paid subscription to ultra-curated, real-time IP blocklists sourced from the global CrowdSec Network. Tiered pricing starting at $1,900/month for SMBs, with higher tiers for enterprise. Includes all blocklists (CrowdSec Intelligence, Industry-specific, Country-specific, High Background Noise, HTTP Attackers, AI Crawlers) accessible on any number of endpoints. Simple firewall and CDN integrations included.
- IP Reputation API / CTI Subscription: API-based access to the IP reputation database with per-query pricing starting at $49/month for 5,000 queries. Includes 32-criteria context per IP, hourly data updates, and bespoke API quotas. Local CTI replication available as a separate tier from $9K/month.
- CrowdSec Console Premium: SaaS management console tier at $1K/month per enrolled Security Engine (Pay as you Grow model). Includes Premium Community Blocklist, alert surge notifications, advanced stack management, background noise filtering, stack health monitoring, centralized lists management, SaaS API access, and multi-channel notification integrations. Optional Emergency Bug Fixes and Premium Service & Support at $1K/month each.
- Free Open-Source Security Engine: Free MIT-licensed Security Engine available for download. The free community tier generates user adoption and drives network effects. Conversion path to paid tiers for enterprise features, blocklists, and CTI access.
- Custom Blocklists: Custom blocklists tailored to specific organizational use cases, available via direct sales contact. Quote-based pricing.
- Partner Program (Reseller/Embedding): Commercial use of CrowdSec data embedded in partners' solutions, with pricing differing from standard plans. Partners can resell CrowdSec blocklists or embed CTI data in their own offerings. Tiered partner program (Silver, Gold, Platinum) with revenue sharing and co-marketing benefits.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Monthly | Community (Free) - Open-source Security Engine with free Console access |
| Subscription | Monthly | Platinum Blocklists - Full access to all curated blocklists for SMBs and enterprises |
| Usage-based | Monthly | IP Reputation / CTI - API access to IP reputation database with 32-criteria context |
| Subscription | Monthly | Console Premium - SaaS management for centralized Security Engine stack management |
| Subscription | Multi-year contract | Custom Blocklists - Tailored blocklists for specific organizational use cases |
Go-to-market motion3 records
Distribution channels5 records
Marketing channels11 records
CrowdSec product offering
Product offeringCore offering
CrowdSec sells a community-driven intrusion prevention and threat-intelligence platform built around an open-source Security Engine (MIT-licensed IDS/IPS in Golang) that analyzes logs and network traffic and shares attack signals with a central database. Paid tiers include Platinum Blocklists (curated IP feeds starting at $1,900/month), an IP Reputation/CTI API (from $49/month for 5,000 queries, with Local CTI replication from $9K/month), and the CrowdSec Console Premium management layer ($1K/month per enrolled engine), targeted at MSSPs, IT services, hosting providers, financial institutions, governments, and large enterprises.
Product overview
CrowdSec is a cybersecurity company offering a collaborative threat intelligence platform built around an open-source Security Engine (IDS/IPS) under MIT license. The core portfolio consists of the CrowdSec Security Engine, CrowdSec Console (SaaS management platform), CrowdSec IP Reputation (CTI database), CrowdSec Blocklists (curated threat feeds), and the Remediation Component (blocking enforcement). Additional modules include the AppSec Component (WAF capabilities) and Live Exploit Tracker (real-time CVE exploitation intelligence). The platform operates on a crowdsourced model where Security Engine installations worldwide contribute attack signals, which are processed through a Trust Scoring System and Expert System to generate ultra-curated blocklists available via API or direct integration with firewalls, CDNs, and web servers. Pricing tiers include free Community, SMB (Platinum Blocklists at $1,900/month), Enterprise, and IP Reputation API access starting at $49/month.
Differentiator
Problem solved
Functional benefit
Brands
- CrowdSec Security Engine: Open source intrusion detection and prevention system (IDS/IPS) that detects malicious behaviors and attacks by analyzing logs and requests. MIT licensed, GDPR compliant.
- CrowdSec Console
- CrowdSec IP Reputation / CTI
- CrowdSec Blocklists
- CrowdSec Live Exploit Tracker
Products and services
- CrowdSec Security Engine Open-source intrusion detection and prevention system (IDS/IPS) under MIT license that analyzes logs and network traffic to detect malicious behaviors, shares aggregated attack signals with the CrowdSec central database, and applies rules (scenarios in YAML) to protect internet-exposed assets. Sold under a freemium model with no paid license for the engine itself; targeted at sysadmins, DevOps, hosting providers, and security teams.
- CrowdSec Console SaaS management dashboard providing real-time insights and visualizations of intrusion attempts, centralized enrollment and management of multiple Security Engines, CLI enrollment, IP reputation lookups (50 free queries/day), Premium Community Blocklist access, and stacked-tier pricing for advanced features. Targeted at SMBs and enterprises operating CrowdSec at scale.
- CrowdSec IP Reputation (CTI) Real-time cyber threat intelligence service backed by a database of 35M+ malicious IPs and 40M+ daily signals, providing 32-criteria context per IP (targeted industry, country, connection type, Autonomous System reputation, MITRE techniques classification, timelined activity). Delivered via REST API (Central API / CAPI) starting at $49/month for 5,000 queries, with an optional Local CTI replication tier from $9K/month. Targeted at SOCs, MSSPs, and security vendors.
- CrowdSec Blocklists Ultra-curated, real-time IP blocklists sourced from the global CrowdSec Network, offered as multiple specialized feeds (CrowdSec Intelligence, Industry-focused, Country-focused, High Background Noise, HTTP Attackers, AI Crawlers, Custom). Includes 5% daily IP rotation on average, a published 0% false-positives guarantee, and 36% exclusive data versus other CTI vendors. Platinum Blocklists subscription starts at $1,900/month for SMBs with all blocklists on unlimited endpoints. Targeted at MSSPs, hosting providers, IT services, and enterprise security teams.
- Live Exploit Tracker Real-time CVE exploitation intelligence that surfaces which vulnerabilities are actively exploited in the wild based on observational, ground-truth data from hundreds of thousands of production systems running CrowdSec. Provides per-CVE IP feeds (refreshed multiple times per hour), top-targeted country data, and pre-CVE reconnaissance visibility. Targeted at vulnerability management teams, SOCs, and security operations leaders prioritizing remediation.
Quantifiable outcome
- Up to 95% reduction in malicious bot traffic
- +10 more outcomes
Companies that use CrowdSec
Customer profileNamed customers7 records
Segments10 records
Ideal customer profiles4 records
CrowdSec technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration67 records
AI capability6 records
Feature7 records
CrowdSec partnerships and signals
Strategic signalPartnerships
Nine partnerships are on record, tiered core and minor.
- OPNsensecoreOfficial OPNsense partnership announced May 2022. CrowdSec's Security Engine is integrated with the OPNsense firewall platform, allowing OPNsense users to leverage CrowdSec's crowdsourced threat intelligence and blocklists directly within their firewall management.
- TrinapscoreTrinaps is a certified cloud, cyber, and telecom operator in eastern France. Serves as a channel partner providing CrowdSec solutions to businesses and local authorities, combining telecommunications and cybersecurity services.
- Hayyan Middle EastcoreMSSP based in the Middle East providing vulnerability management, risk assessment, and penetration testing to enterprises in the Middle East, Mediterranean, and Africa region. Uses CrowdSec as part of its cybersecurity service offering.
- SekoiacoreSekoia is a cybersecurity and risk management group with 30+ international consultants. Integrates CrowdSec CTI data into its threat intelligence and SIEM offerings for security operations enrichment.
- CloudfenceminorCloudfence is a Managed Security Service Provider (MSSP) offering customers best-in-class information security technology. Uses CrowdSec threat intelligence within its managed security services.
- Lawrence SystemsminorLawrence Technology Services is an IT services company in North America that hosts a YouTube channel publishing IT tutorials and product reviews. Promotes CrowdSec through its YouTube content and uses it in customer deployments.
- Learn Linux TVminorA YouTube channel focused on Linux-related content, tutorials, distribution reviews, and CrowdSec coverage. Educational partner that amplifies CrowdSec's reach to the Linux and cybersecurity community.
- Cyber MindminorCyber Mind specializes in custom open-source software development and tailored cybersecurity solutions in France. Delivers CrowdSec deployments and integrations as part of its consulting services.
- OpenClassroomsminorPartnership announced October 2025 with OpenClassrooms to deliver accessible, hands-on cybersecurity education. CrowdSec features in curriculum as a practical tool for learners, building future user base and skills pipeline.
Scale indicators17 records
Recent moves6 records
Expansion highlights6 records
CrowdSec competitors and assessment
Company assessmentDirect peers
- AbuseIPDB: Crowdsourced IP reputation database that lets users report and check malicious IP addresses. Closest direct peer to CrowdSec on the IP reputation crowdsourcing axis, though CrowdSec extends further into prevention/IPS rather than just reporting.
- GreyNoise: Identifies internet-wide background scanner and botnet noise, providing curated blocklists of IPs conducting opportunistic attacks. Operates in the same IPS-adjacent IP reputation space with a similar focus on distinguishing mass-exploitation traffic from targeted threats.
- AlienVault Open Threat Exchange (OTX): Community-driven open threat intelligence sharing platform backed by AT&T Cybersecurity (now owned by Arctic Wolf). Comparable to CrowdSec in the open, community-contributed CTI model and integration with broader SOC tooling.
- VirusTotal: Google-owned aggregation service for file and URL/IP reputation analysis using multiple engines. Comparable as a community-of-vendors IP reputation lookup used by security analysts; CrowdSec offers a more proactive, IPS-integrated counterpart.
- Shodan: Internet-wide scanning and intelligence data on exposed devices and services. Comparable on the data-collection and internet-intelligence axis; CrowdSec leverages Crowd-contributed signals rather than active scanning.
- Censys: Internet intelligence platform with continuous scanning and an IP reputation/hosting context dataset. Adjacent to CrowdSec's IP reputation offering with broader attack-surface-management scope; serves overlapping security buyer personas.
Broad incumbents
- Recorded Future: Established commercial threat intelligence leader (now Mastercard-owned) providing broad CTI feeds, finished intelligence, and integrations. Direct overlap with CrowdSec IP Reputation; deeper analyst-driven content and larger sales reach but higher price points.
- Cloudflare: Major edge security and WAF/CDN provider with Bot Management and threat intelligence features in a single bundled platform. Overlaps CrowdSec Blocklists and AppSec Component; competes on price-performance in mid-market and bundles services incumbent players cannot match.
- Palo Alto Networks: Large enterprise security platform with Next-Generation Firewall, Cortex XSOAR/XDR, and Unit 42 threat intelligence. CrowdSec's Trinaps customer case showed direct head-to-head comparison; Palo Alto offers broader product depth but greater pricing/sales friction.
Emerging players
- DataDome: Bot and online fraud protection focused on ecommerce and API abuse prevention. Comparable in the bot/abuse prevention problem space and target buyer (security teams protecting customer-facing apps), but specialized rather than horizontal IP reputation.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks6 records
Key highlights7 records
Customer concentration
CrowdSec social profiles
Digital presenceCrowdSec compliance and trust
Trust signalCompliance1 record
CrowdSec financial estimates
Financial estimateRevenue estimate
Valuation estimate
CrowdSec leadership team
Management profileNumber of profiles
Profiles3 records
CrowdSec funding detail
Funding detailFunding overview
Funding rounds4 records
Investors4 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
CrowdSec M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about CrowdSec
What does CrowdSec do?
CrowdSec sells a community-driven intrusion prevention and threat-intelligence platform built around an open-source Security Engine (MIT-licensed IDS/IPS in Golang) that analyzes logs and network traffic and shares attack signals with a central database. Paid tiers include Platinum Blocklists (curated IP feeds starting at $1,900/month), an IP Reputation/CTI API (from $49/month for 5,000 queries, with Local CTI replication from $9K/month), and the CrowdSec Console Premium management layer ($1K/month per enrolled engine), targeted at MSSPs, IT services, hosting providers, financial institutions, governments, and large enterprises.
Is CrowdSec a public or private company?
CrowdSec is a private company. It is classified as venture growth investor backed and is currently operating.
When was CrowdSec founded?
CrowdSec was founded in 2019. It employs 11 to 50 people.
Where is CrowdSec based?
CrowdSec is headquartered in Montrouge, France, in the Europe region.
How does CrowdSec make money?
Six revenue lines are on record. Platinum Blocklists Subscription is the primary driver. The others are IP Reputation API / CTI Subscription, crowdSec Console Premium, free Open-Source Security Engine, custom Blocklists and partner Program (Reseller/Embedding).
Who are CrowdSec's main competitors?
Direct peers on record are AbuseIPDB, GreyNoise, AlienVault Open Threat Exchange (OTX), VirusTotal, Shodan and Censys. Broad incumbents are Recorded Future, Cloudflare and Palo Alto Networks. DataDome is listed as an emerging player.
Does CrowdSec have an API?
Yes. CrowdSec offers a REST API (Central API / CAPI) for querying IP reputation, threat intelligence, and blocklists. Features include rate limiting to prevent excessive traffic, multiple API keys for IP Reputation/CTI access, and a Local API (LAPI) for on-premises security engine communication. The IP Reputation API provides 32 criteria context including targeted industry, country, technology, connection type, timelined activity, Autonomous System & IP range reputation, MITRE techniques classification, and hourly updated data. Advanced features include bespoke API quotas, multi-dimensional IP search, and optional local replication for data synchronization. Developer documentation is at crowdsecurity.github.io/api_doc/index.html?urls.primaryName=LAPI.
What industry is CrowdSec in?
CrowdSec's product category is Cybersecurity Threat Intelligence. Its primary akta.pro industry code is BPAEADAL, Data Security & Privacy Managed Services (DLP/Encryption). Its NAICS code is 5616.