What alphaMountain.ai does

alphaMountain.ai is a privately held threat intelligence company founded in June 2020 by former Symantec and Blue Coat executives John Ahlander (CEO) and Matthew Wood (CTO), headquartered in Draper, Utah. The company provides AI-driven domain and IP reputation scoring, URL classification across 92 content categories, and explainable threat factors delivered through REST APIs, data feeds, and an OEM-embedded distribution model. Its proprietary engine combines NLP, skip-gram language modeling, and statistical analysis with dedicated machine learning models for risk scoring, enabling real-time verdicts on newly registered domains before they appear on crowdsourced blocklists such as VirusTotal. Core products include the Threat Intelligence Feeds & APIs, the threatYeti free investigation tool, the Free Threat Intelligence Feeds (Top 1M Most Popular Sites and Community Threat 1000), and the aM Intelligence contextual enrichment API launched in limited beta in 2024.

The company generates revenue through a combination of quota-based API subscriptions, OEM database sync licensing for embedded partner consumption, and a 30-day enterprise API trial that converts to paid; threatYeti serves as a freemium top-of-funnel asset with no free API tier. Go-to-market is multi-modal: API-first self-serve trial generation at threatYeti.com, OEM/embedded distribution through Splunkbase, Cisco XDR, FortiSOAR, Sumo Logic, Maltego Transform Hub, ThreatQuotient, Swimlane, Cyware, Tines, Tenzir, and others, plus enterprise field sales targeting cybersecurity vendors and security operations teams. Customer segments span cybersecurity product vendors (SWG, DNS, SIEM, SOAR, secure browsers), enterprise security operations teams (SOC, DFIR, threat hunting, SIEM enrichment), and large end-user organizations including Fortune 100 enterprises and government buyers.

The business is venture-backed by a single disclosed $2.7M seed round in April 2022 led by Mercato Partners' Prelude Fund with participation from Crosspoint Capital Partners, has 1-10 employees per firmographic data, and does not publicly disclose revenue. The competitive position is built on three stated differentiators — freshness of detection, fidelity of explainable scoring, and breadth of integration footprint — which the company positions against legacy URL classification databases (Brightcloud, zvelo) and crowdsourced platforms (VirusTotal). Customer-reported outcomes include a 234% increase in true positive detections and a documented cost displacement case at a Fortune 500 telecommunications provider that replaced VirusTotal at $250,000 annual cost.

Name

alphaMountain.ai

Legal name

Alpha Mountain AI, Inc.

Website

https://alphamountain.ai

Company type

Private

Founded year

2020

Operating status

Operating

Headcount range

1–10 employees

Short description

alphaMountain.ai is a private Utah-based threat intelligence company providing AI-driven domain and IP reputation scoring, URL classification across 92 categories, and explainable risk feeds delivered via REST API and OEM-embedded integrations to cybersecurity vendors, SOC teams, and enterprise security operations.

Ownership category

akta.pro rank

Product category

Threat Intelligence

NAICS

Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (5182)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ)

Keywords

• Threat intelligence feeds
• Domain reputation scoring
• URL classification API
• IP reputation data
• Cyber threat intelligence

Headquarters

HQ city

Salt Lake City

HQ country

United States

HQ region

North America

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Infrastructure, Personnel, Marketing or Sales, Operations

Revenue model

1. API & Feed Subscriptions: Quota-based pricing for bulk API calls and subscription-based access to threat intelligence feeds delivered via REST API in JSON or CSV formats. Tiered based on volume and entitlements.
2. OEM Database Sync: Full database sync licensing for OEM customers and technology partners embedding alphaMountain data into their security products and platforms.
3. threatYeti SaaS: Free threat investigation and research SaaS tool for manual lookups, with free tier for individual use. Commercial API trial available for enterprise evaluation.

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels5 records

Core offering

alphaMountain.ai provides real-time, AI-driven domain and IP threat intelligence feeds and APIs used by cybersecurity vendors and security operations teams. Its platform delivers URL classification across 92 content categories, 1.00–10.0 risk scoring with explainable threat factors, WHOIS and passive DNS enrichment, and impersonation detection. Offerings are delivered via REST APIs, batch data feeds, OEM database sync, and a free investigation tool (threatYeti) for security analysts.

Product overview

alphaMountain.ai is a domain and IP threat intelligence company offering a unified platform of cybersecurity products. The core offerings include Threat Intelligence Feeds & APIs for real-time URL classification and IP reputation scoring, threatYeti (a free browser-based investigation tool), and free community threat feeds. The platform is differentiated by the 'DiFFFerence' (Freshness, Factors, Fidelity) utilizing AI-powered machine learning for continuous threat detection. Solutions span URL Classification (92 content categories), Domain & IP Reputation (1-10 risk scoring), and specialized feeds for DNS Security, SOAR, Secure Gateways, and Secure Browsers. The aM Intelligence API provides comprehensive contextual enrichment including passive DNS, WHOIS, DGA probability, and impersonation detection. Agentic AI integrations via MCP server and OpenClaw skill enable AI agent workflows.

Differentiator

Problem solved

Functional benefit

Brands

• threatYeti: A free URL scanning tool that empowers SOC analysts and threat researchers with domain and IP threat investigations. Provides instant risk scores, threat factors, and categorization for any host on the internet.
• aM Intelligence

Products and services

• Threat Intelligence Feeds & APIs

Quantifiable outcome

• 234% increase in true positive detections
• +2 more outcomes

Named customers1 record

Segments4 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration14 records

AI capability8 records

Feature6 records

Partnerships

15 partnerships are on record, tiered strategic, supporting and core.

• TenzirstrategicTechnology or Integration · 15 June 2026Integration announced June 2026. Moves URL enrichment from SIEM into Tenzir security data pipeline for pre-classification of events before they reach SIEM. Enables 30-70% reduction in SIEM hot-path volume. OCSF-aligned data mapping.
• Morado (Threatnote)supportingTechnology or Integration · 6 May 2026alphaMountain now native in Morado's Threatnote threat intelligence platform with two tiers and one integration.
• Fortinet (FortiSOAR)coreTechnology or Integration · 15 November 2024Two alphaMountain connectors for FortiSOAR: Threat Response connector for URL interrogation and Feed connector for threat hunting and log enrichment. Enables automated playbooks with alphaMountain threat ratings, URL categories, and impersonation detection. Integration with Fortinet's award-winning SOAR platform.
• Cisco XDRcoreTechnology or IntegrationalphaMountain threat ratings embedded into Cisco XDR investigations. alphaMountain risk scores viewable in SecureX (now XDR) platform. Integration allows security teams to view domain and IP threat verdicts directly in Cisco's security operations platform.
• SplunkcoreTechnology or IntegrationSplunkbase application enabling pivot from Splunk log data to alphaMountain categorization and risk scores. Log enrichment and detection enhancement integration.
• MaltegocoreTechnology or IntegrationalphaMountain Transform Hub integration allowing data enrichment with content categories and risk assessment within Maltego investigations.
• VirusTotalcoreTechnology or IntegrationalphaMountain malicious and suspicious verdicts integrated into VirusTotal URL query page. Competitive positioning as alphaMountain data appearing alongside VirusTotal's own analysis.
• Sumo LogiccoreTechnology or IntegrationSIEM investigations informed by alphaMountain reputation scores of hosts, domains, and IPs. Log enrichment and correlation capabilities.
• Reversing LabssupportingTechnology or IntegrationalphaMountain enrichment of domains and URLs found in files analyzed by Reversing Labs threat intelligence platform.
• CywaresupportingTechnology or IntegrationQuery alphaMountain reputation on indicators inside Cyware CTIX threat intelligence platform.
• ThreatQuotientsupportingTechnology or IntegrationIngest URL threat feeds and categories into ThreatQ platform via ThreatQ Marketplace.
• TinessupportingTechnology or IntegrationAutomate URL intelligence in Tines story-based security automation workflows.
• DatastreamersupportingTechnology or IntegrationEnrich log files with alphaMountain URL classification and threat ratings through Datastreamer integration.
• SwimlanesupportingTechnology or IntegrationUse alphaMountain categories and threat ratings in Swimlane SOAR playbooks via Swimlane Turbine Marketplace.
• CellopointsupportingTechnology or IntegrationalphaMountain risk scoring helps identify malicious, phishing, and scam email campaigns in Cellopoint email security solutions.

Scale indicators6 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• VirusTotal: Google-owned crowdsourced URL/file reputation platform. alphaMountain explicitly positions as a VirusTotal alternative and has a co-existing integration where alphaMountain verdicts appear on VirusTotal URL query pages—direct competitive overlap in URL/domain reputation intelligence.
• DomainTools: Established provider of domain intelligence, WHOIS history, and threat investigation data. alphaMountain markets itself as a DomainTools alternative and overlaps directly in WHOIS, passive DNS, and domain reputation for SOC investigations.
• Brightcloud (Proofpoint): URL classification and web reputation database widely used by security vendors. alphaMountain explicitly compares against Brightcloud in its alternative page and competes head-to-head in 92-category URL classification feeds for gateways and DNS providers.
• zvelo: Provider of URL categorization and web classification data feeds. alphaMountain names zvelo as a direct alternative competitor in its comparison pages, with overlap in URL classification and threat intelligence for network security vendors.
• WhoisXMLAPI: WHOIS, DNS, and domain intelligence API provider serving security researchers and vendors. alphaMountain lists WhoisXMLAPI as a comparison alternative, with overlapping capabilities in WHOIS data, passive DNS, and domain enrichment APIs.

Broad incumbents

• Cisco Talos: Cisco's threat intelligence division feeds URL, IP, and file reputation into Cisco XDR and SecureX. alphaMountain's data is embedded inside Cisco XDR/SecureX as a complementary feed, competing partly with Talos for the same threat intelligence budget.
• Recorded Future: Large-scale threat intelligence platform covering domains, IPs, and broader adversary context. Operates as a broader incumbent in the threat intelligence category where alphaMountain competes, though with significantly wider scope (e.g., actor profiling, dark web).
• Mandiant (Google Cloud): Google-owned threat intelligence and incident response firm. Competes in the broader threat intelligence space, particularly for Fortune 500 buyers that alphaMountain also targets with its enterprise sales motion.

Emerging players

• URLhaus / abuse.ch: Open-source community project tracking malicious URLs. While free and not a commercial competitor, abuse.ch serves a similar intelligence function for security teams and represents the community-data approach alphaMountain differentiates against with its first-party AI.
• SlashNext: AI-driven phishing and URL threat detection platform. Overlaps with alphaMountain's impersonation detection and URL classification capabilities, particularly in email security and phishing use cases served by their Cellopoint and SOAR integrations.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat6 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/alphamountainai
• LinkedInlinkedin.com/company/alphamountain

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds1 record

Investors2 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about alphaMountain.ai