Halon Security
Halon Security AB is a Swedish email infrastructure and security software provider that sells a composable MTA platform (Halon Engage), gateway security (Halon Protect), and threat classification (Halon Classify) to large-scale email senders, ESPs, mailbox providers, and telecoms, processing over one trillion emails annually.
- Company typePrivate
- Founded2010
- HeadquartersGöteborg, Sweden
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What Halon Security does
Halon Security AB is a Swedish email infrastructure and security software company headquartered in Gothenburg, Sweden, founded in 2010. The company builds what it terms a "Composable Email Infrastructure" platform, centered on a proprietary Mail Transfer Agent (MTA) and a domain-specific scripting language (HSL, Halon Scripting Language) that allows operators to program email delivery and security behavior in a low-code fashion. Halon's product portfolio is organized around three core offerings: Halon Engage (a programmable MTA and delivery optimization platform for large-scale senders), Halon Protect (a gateway email security solution for service providers with spam filtering, anti-virus, and gateway-enforced PGP/S/MIME encryption), and Halon Classify (carrier-grade threat detection acquired from eleven cyber security GmbH in February 2026 and formerly branded eXpurgate). Supporting modules include the AI-powered Delivery Guru (ML-based bounce classification, adaptive throttling, IP warmup automation), Delivery Orchestrator (real-time cluster traffic shaping), Code Companion (AI-assisted HSL development in VS Code), Abuse Guard (anomaly detection and tenant isolation), DLP content inspection, and a comprehensive HTTP/JSON API plus Kafka, PostgreSQL, Elasticsearch, and Google Cloud Pub/Sub integrations.
The platform is built on a cloud-native, containerized architecture (Docker, Kubernetes) with full horizontal auto-scaling and a web-based administration interface, and is deployed both self-hosted and in customer cloud environments. Halon reports processing over one trillion emails annually across a customer base that includes Microsoft, LinkedIn, SAP Emarsys, Zendesk, IONOS, Rakuten, KPN, group.one, Netcore Cloud, Constant Contact, mail.de, Mailkit/Omnivery, GMX, WEB.DE, and mail.com.
Halon generates revenue through enterprise software licenses and subscriptions, priced quote-based on email volume, deployment model, and feature scope, with annual billing cadence and no publicly disclosed pricing tiers. Distribution is exclusively direct via field sales targeting large-scale senders, ESPs, mailbox providers, and telecoms, supported by "Book a demo" CTAs. The company employs between 11 and 50 people, with nine additional open roles as of February 2026, and is backed by Intera Partners following a private equity round in October 2024. Operational geographies include Sweden (HQ), Germany (Berlin engineering, post-acquisition), and active go-to-market in North America and broader EMEA.
Halon Security firmographics
Firmographics- Name
- Halon Security
- Legal name
- Halon Security AB
- Website
- https://halon.io
- Company type
- Private
- Founded year
- 2010
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- Halon Security AB is a Swedish email infrastructure and security software provider that sells a composable MTA platform (Halon Engage), gateway security (Halon Protect), and threat classification (Halon Classify) to large-scale email senders, ESPs, mailbox providers, and telecoms, processing over one trillion emails annually.
- Ownership category
- akta.pro rank
Halon Security industry classification
Industry- Product category
- Email Infrastructure and Security Software
- NAICS
- Software Publishers (5132), Software Publishers (513210)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Email Data Loss Prevention & Encryption (HDADAKAD)
- akta.pro secondary industry
- Data Security & Privacy for Cloud (DLP, DSPM, Tokenization) (HDABAHAK)
Keywords
Where Halon Security is headquartered
LocationHeadquarters
- HQ city
- Göteborg
- HQ country
- Sweden
- HQ region
- Europe
Offices2 records
Markets served
Halon Security business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations
Revenue model
- Software Licenses and Subscriptions: Halon sells software licenses and subscriptions for its email infrastructure and security solutions (Halon Engage, Halon Protect, Halon Classify). The company provides both self-hosted and cloud-native deployment options, with pricing likely based on email volume, message throughput, or infrastructure scale.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Enterprise and large-scale sender plans — custom pricing based on volume and deployment model |
Go-to-market motion2 records
Distribution channels1 record
Marketing channels7 records
Halon Security product offering
Product offeringCore offering
Halon Security develops and sells Composable Email Infrastructure software for large-scale email senders, email service providers, mailbox providers, and enterprises. Its portfolio centers on three products: Halon Engage (programmable MTA and delivery orchestration platform for high-volume senders), Halon Protect (inbound email security for service providers with anti-spam, anti-virus, and encryption), and Halon Classify (carrier-grade spam, phishing, and malware threat detection, acquired from eleven cyber security GmbH). The software is built on a proprietary domain-specific scripting language (HSL), runs on Docker/Kubernetes, and is sold as licensed/self-hosted or cloud-native subscriptions.
Product overview
Halon Security offers a Composable Email Infrastructure platform consisting of three core products: Halon Engage for large-scale senders (MTA and delivery optimization), Halon Protect for service providers (email security and filtering), and Halon Classify for threat detection (formerly eXpurgate). The platform is built on a modular architecture with the Halon scripting language (HSL) as the programmable configuration layer. Supporting modules include Delivery Guru (AI-powered bounce classification and IP warmup), Delivery Orchestrator (cluster coordination), Web Administration UI, MSUI (end-user interface), HTTP Submission API, Rate Service, DLP content inspection, and Code Companion (AI development assistant). The platform processes over one trillion emails annually and is designed for Dynamic Email Operations enabling automated scaling, intelligent traffic management, and operational efficiency at scale.
Differentiator
Problem solved
Functional benefit
Brands
- Halon Engage: Email infrastructure solution for large-scale senders, providing control, intelligence, and agility for sending operations.
- Halon Protect
- Halon Classify
- Delivery Guru
- Delivery Orchestrator
- Code Companion
- Sender Shield
- Abuse Guard
- Delivery Insights
- Flow Dynamics
Products and services
- Halon Engage Composable email infrastructure platform (MTA and delivery orchestration) for large-scale senders, ESPs, martech platforms, and high-volume enterprises. Provides programmable delivery logic via HSL, AI-powered bounce classification, cluster-wide traffic shaping, full Kubernetes auto-scaling, and integrations such as Kafka, PostgreSQL, OpenID Connect, Elasticsearch, and Google Cloud Pub/Sub.
- Halon Protect Email security platform designed for service providers that delivers inbound threat protection, spam and malware filtering (with Sophos SASi/SAVDi integrations), gateway-enforced PGP and S/MIME encryption and signing, BIMI verification, DNSSEC, and connection prioritization. Includes AI-powered threat detection and integrates with Google Cloud Pub/Sub for event-driven workflows.
- Halon Classify Carrier-grade email threat detection product, built on deep threat intelligence, that accurately detects and stops spam, phishing, and malware for service providers and enterprises. Originates from the acquired eleven cyber security GmbH (eXpurgate) business, with carrier-grade accuracy derived from extensive real-world traffic data.
Quantifiable outcome
- Reduce code by 90% through Halon's proprietary scripting language
- +2 more outcomes
Companies that use Halon Security
Customer profileNamed customers17 records
Segments3 records
Ideal customer profiles3 records
Halon Security technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration10 records
AI capability6 records
Feature12 records
Halon Security partnerships and signals
Strategic signalPartnerships
Three partnerships are on record, tiered core and minor.
- eleven cyber security GmbHcoreHalon completed its acquisition of eleven cyber security GmbH and rebranded its eXpurgate Inhouse solution to 'Halon Classify'. The acquisition strengthens Halon's email security portfolio, adds German engineering talent (Berlin office), and integrates eleven's carrier-grade threat detection technology into Halon's portfolio.
- Netcore CloudcoreNetcore Cloud struck a strategic partnership with Halon to strengthen its global customer experience capabilities. Netcore Cloud uses Halon's email infrastructure as a core component of its marketing automation platform.
- M3AAWGminorHalon is a proud member of M3AAWG (Messaging, Malware, Mobile Anti-Abuse Working Group), a global industry organization working to fight abuse across email and messaging platforms.
Scale indicators6 records
Recent moves7 records
Expansion highlights6 records
Halon Security competitors and assessment
Company assessmentDirect peers
- PowerMTA (Port25 Solutions): Legacy on-premises MTA historically used by large senders and ESPs. PowerMTA is Halon's primary displacement target; Halon explicitly markets PowerMTA-to-Halon migration paths.
- Mailgun (Sinch): Developer-focused email API and delivery service owned by Sinch. Targets high-volume transactional senders and competes head-to-head with Halon Engage for API-first email infrastructure.
- SendGrid (Twilio): Cloud email API and delivery platform within Twilio, serving developers and enterprises. Competes with Halon Engage for transactional and marketing email workloads at scale.
- SparkPost (Bird / MessageBird): Sister product to PowerMTA in the same email delivery infrastructure category. SparkPost offers a cloud-native MTA and email API targeting high-volume senders and is the most direct functional competitor to Halon Engage.
- Postmark (ActiveCampaign): Transactional email delivery service for developers and product teams. Overlaps with Halon Engage for fast, reliable transactional email at scale, though primarily focused on lower volume senders.
Broad incumbents
- Mimecast: Public email security and archiving vendor for enterprises. Overlaps with Halon Protect on spam, phishing, and malware filtering, and bundles broader resilience features.
- Proofpoint: Large enterprise cybersecurity vendor with a broad email security, DLP, and compliance portfolio. Competes with Halon Protect/Classify in inbound threat protection for enterprises and large service providers.
- Barracuda Networks: Email security and network security vendor serving SMB and mid-market. Competes with Halon Protect for inbound filtering and gateway security, often at lower price points.
Others
- Sophos: Broad cybersecurity vendor whose Sophos SASi/SAVDi anti-spam/anti-virus engines are integrated as add-ons inside Halon. Partner in delivery, partial competitor in standalone email protection offerings.
- Netcore Cloud: MarTech/email marketing platform that partners with Halon for underlying delivery infrastructure. Comparable in that it serves large-volume senders, but is a customer/partner rather than a direct competitor.
Market position
Strengths5 records
Weaknesses3 records
Competitive moat5 records
Key risks6 records
Key highlights7 records
Customer concentration
Halon Security social profiles
Digital presenceHalon Security financial estimates
Financial estimateRevenue estimate
Valuation estimate
Halon Security leadership team
Management profileNumber of profiles
Profiles5 records
Halon Security subsidiaries and ownership
Company hierarchySubsidiaries2 records
Halon Security funding detail
Funding detailFunding overview
Funding rounds3 records
Investors3 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Halon Security M&A and investment
M&A and investmentM&A1 record
Investments1 record
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Halon Security
What does Halon Security do?
Halon Security develops and sells Composable Email Infrastructure software for large-scale email senders, email service providers, mailbox providers, and enterprises. Its portfolio centers on three products: Halon Engage (programmable MTA and delivery orchestration platform for high-volume senders), Halon Protect (inbound email security for service providers with anti-spam, anti-virus, and encryption), and Halon Classify (carrier-grade spam, phishing, and malware threat detection, acquired from eleven cyber security GmbH). The software is built on a proprietary domain-specific scripting language (HSL), runs on Docker/Kubernetes, and is sold as licensed/self-hosted or cloud-native subscriptions.
Is Halon Security a public or private company?
Halon Security is a private company. It is classified as private equity controlled and is currently operating.
When was Halon Security founded?
Halon Security was founded in 2010. It employs 11 to 50 people.
Where is Halon Security based?
Halon Security is headquartered in Göteborg, Sweden, in the Europe region.
How does Halon Security make money?
One revenue line is on record: software Licenses and Subscriptions.
Who are Halon Security's main competitors?
Direct peers on record are PowerMTA (Port25 Solutions), Mailgun (Sinch), SendGrid (Twilio), SparkPost (Bird / MessageBird) and Postmark (ActiveCampaign). Broad incumbents are Mimecast, Proofpoint and Barracuda Networks. Others are Sophos and Netcore Cloud.
Does Halon Security have an API?
Yes. Halon provides a comprehensive HTTP/JSON API that proxies calls to the smtpd control socket. The API takes version, program, command and payload as arguments, where payload contains the request body and response is a direct JSON representation of Protobuf structures. Additional APIs include DLP (content inspection) service API, tracking API for engagement events (click, open, unsubscribe), and policyd service API. The web administration interface is built on top of the API layer, enabling automation of routine tasks. Developer documentation is at docs.halon.io/manual/api.html.
What industry is Halon Security in?
Halon Security's product category is Email Infrastructure and Security Software. Its primary akta.pro industry code is HDADAKAD, Email Data Loss Prevention & Encryption, with a secondary code of HDABAHAK, Data Security & Privacy for Cloud (DLP, DSPM, Tokenization). Its NAICS code is 5132 and its SIC code is 7372.