Group-IB
- Company typePrivate
- Founded2003
- HeadquartersSingapore, Singapore
- Headcount501–1,000
- GTM typeB2B
- OfferingSoftware
Group-IB firmographics
Firmographics- Name
- Group-IB
- Legal name
- Group-IB
- Website
- https://group-ib.com
- Company type
- Private
- Founded year
- 2003
- Operating status
- Operating
- Headcount range
- 501–1,000 employees
- Ownership category
- akta.pro rank
Group-IB industry classification
Industry- Product category
- Cybersecurity Software and Services
- NAICS
- Software Publishers (5132), Software Publishers (513210)
- akta.pro primary industry
- Cybersecurity Architecture & Security Integration (BPAEAAAL)
- akta.pro secondary industry
- Cybersecurity & Identity Consulting (BPAHAEAG)
Keywords
Where Group-IB is headquartered
LocationHeadquarters
- HQ city
- Singapore
- HQ country
- Singapore
- HQ region
- Asia
Offices12 records
Markets served
Group-IB business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure
Revenue model
- Software Subscriptions: Subscription-based licensing for Unified Risk Platform products including Threat Intelligence, Fraud Protection, Attack Surface Management, Digital Risk Protection, Managed XDR, Business Email Protection, CSPM, and Cyber Fraud Intelligence Platform. Pricing is quote-based, typically annual subscriptions.
- Professional Services: Incident response, digital forensics, penetration testing, red teaming, threat hunting, SOC consulting, and cybersecurity training services delivered by expert teams.
- Managed Services: Managed XDR service providing continuous monitoring and response, and subscription-based investigation services.
- Service Retainer: Prepaid retainer agreements providing 24/7 access to incident response and cybersecurity expertise, designed to reduce response time during cyberattacks.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Enterprise subscription tiers with quote-based pricing |
| Subscription | Annual | Managed XDR subscription plans |
Go-to-market motion5 records
Distribution channels5 records
Marketing channels6 records
Group-IB product offering
Product offeringCore offering
Group-IB develops and sells an intelligence-driven cybersecurity Unified Risk Platform with modules for Threat Intelligence, Fraud Protection, Attack Surface Management, Digital Risk Protection, Managed XDR, Business Email Protection, Cyber Fraud Intelligence Platform (CFIP), and Cloud Security Posture Management. The company also delivers professional cybersecurity services including 24/7 incident response and digital forensics (CERT-GIB), penetration testing, red teaming, compromise assessments, SOC consulting, AI red teaming, cyber investigations, and technical and management training programs.
Product overview
Group-IB offers a platform-plus-modules architecture centered on its Unified Risk Platform—a single intelligence-driven console that unifies threat intelligence, fraud prevention, brand protection, managed detection, and investigations. The core product portfolio includes Threat Intelligence, Fraud Protection, Attack Surface Management, Digital Risk Protection, Managed XDR, Business Email Protection, Cyber Fraud Intelligence Platform (CFIP), and Cloud Security Posture Management (CSPM). The platform is augmented by add-on AI capabilities (Prevyn AI) and a Python SDK (ciaops) for programmatic API access. Beyond software, Group-IB provides a comprehensive suite of professional services including incident response and digital forensics (CERT-GIB), penetration testing, red teaming, vulnerability assessment, compromise assessment, SOC consulting, AI red teaming, tabletop exercises, cyber investigation, threat landscape assessments, training programs (technical and management), and investigation subscriptions. The company also maintains a global network of Digital Crime Resistance Centers (DCRC) in 60+ countries and collaborates actively with INTERPOL, Europol, and Afripol on global investigations.
Differentiator
Problem solved
Functional benefit
Products and services
- Unified Risk Platform Core intelligence-driven cybersecurity platform that prevents breaches, fraud, and brand abuse by unifying threat intelligence, fraud data, managed detection, sandboxing, and investigations under a single console. Serves as the umbrella platform for all Group-IB product modules and targets enterprise security teams.
- Threat Intelligence Provides deep knowledge of threat actors, their tactics, techniques, and procedures (TTPs), enabling organizations to understand adversaries and proactively defend against attacks. Recognized as a Leader in Gartner's first Magic Quadrant for Cyberthreat Intelligence Technologies.
- Fraud Protection
- Attack Surface Management
- Digital Risk Protection
- Managed XDR
- Business Email Protection
- Cyber Fraud Intelligence Platform (CFIP) Real-time collaborative fraud detection platform launched at Black Hat MEA 2025, using patented Distributed Tokenization to securely share anonymized risk signals between organizations to detect coordinated mule accounts, phishing scams, and synthetic identities. GDPR-compliant as verified by Bureau Veritas.
- Cloud Security Posture Management (CSPM) Automated cloud security module launched January 2026 within the Unified Risk Platform, detecting cloud misconfigurations and providing ongoing compliance monitoring. Integrates with Attack Surface Management and Threat Intelligence tools to prioritize security issues based on real-world threat exposure.
- Prevyn AI AI cognitive core launched in May 2026, integrated into the Unified Risk Platform to help security teams respond faster to cyberattacks by leveraging Group-IB's intelligence data lake for improved threat detection and incident response, with emphasis on human oversight for governance compliance.
- Incident Response
- Penetration Testing
- Red Teaming
- Vulnerability Assessment
- Compromise Assessment
- Digital Forensics
- SOC Consulting
- AI Red Teaming
- Tabletop Exercises
- Threat Landscape Assessment
- Cyber Investigation
- Investigation Subscription
- Service Retainer
- Incident Response Readiness Assessment
- Technical Training Programs
- Management Masterclasses
Quantifiable outcome
- Over $1 billion USD saved by clients through fraud prevention and threat mitigation
- +4 more outcomes
Companies that use Group-IB
Customer profileNamed customers4 records
Segments8 records
Ideal customer profiles5 records
Group-IB technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration1 record
AI capability9 records
Feature6 records
Group-IB partnerships and signals
Strategic signalPartnerships
Twelve partnerships are on record, tiered core, supporting and minor.
- Google SecOpscoreIntegration of Group-IB Digital Risk Protection platform with Google SecOps enables brand threat intelligence (phishing domains, counterfeit listings, typosquatting detections) to be ingested directly into Google's SIEM/SOAR environment as structured cases. Automates takedown workflows and correlates external threat indicators with internal telemetry.
- Team CymrusupportingPrivate-sector partner contributing threat intelligence to INTERPOL Operation Ramz, helping disrupt cybercrime across the MENA region. Contributed alongside Group-IB, Kaspersky, Shadowserver Foundation, and TrendAI.
- KasperskysupportingThreat intelligence contributor to INTERPOL Operation Ramz and Operation Synergia III, providing technical support to track illegal cyber activity across multiple countries.
- Shadowserver FoundationsupportingNon-profit threat intelligence organization providing technical support to INTERPOL Operation Ramz alongside Group-IB, Kaspersky, Team Cymru, and TrendAI.
- Savex TechnologiescoreStrategic distribution partnership to deliver Group-IB's cybersecurity portfolio including Threat Intelligence, Fraud Protection, and Managed XDR to businesses in India and SAARC markets. Leverages Savex's regional distribution network to help organizations transition from reactive protection to predictive intelligence-driven cyber resilience.
- VAS Integrated SolutionscoreMoU signed at Black Hat MEA to establish strategic partnership for channel-led expansion and cybersecurity market development in Saudi Arabia. Covers joint market development, partner enablement, threat intelligence capabilities, and cybersecurity awareness programs including webinars, workshops, and training initiatives.
- Alpha DataminorStrategic MoU signed at GISEC Global 2025 to enhance cybersecurity collaboration in the Middle East and Africa region.
- CyberGate DefenseminorStrategic MoU signed at GISEC Global 2025 to enhance cybersecurity collaboration in the Middle East and Africa region.
- INTERPOLcoreActive collaborator in global investigations with INTERPOL, supporting operations including Operation Ramz (201 arrests across MENA), Operation Synergia III (94 arrests across 72 countries), and ongoing cybercrime investigations. Group-IB contributes threat intelligence on phishing infrastructure, malicious servers, and malware distribution networks.
- EuropolcoreLong-standing partner in joint investigations, contributing to cross-border cybercrime operations. Group-IB shares credential intelligence with Europol as part of fraud reduction intelligence platform capabilities.
- AfripolcoreActive collaboration with Afripol (African Policing Coordination Facility) for cybercrime investigations across African continent.
- SecurityHQminorPartnership aimed at expanding threat hunting capabilities in the region as noted in market analysis of threat hunting industry.
Scale indicators10 records
Recent moves7 records
Expansion highlights7 records
Group-IB competitors and assessment
Company assessmentDirect peers
- CrowdStrike: CrowdStrike Falcon is an AI-native cybersecurity platform spanning endpoint, XDR, threat intelligence, identity protection, and managed services. Directly competes with Group-IB's Unified Risk Platform, Managed XDR, and Threat Intelligence modules for enterprise and mid-market customers.
- Recorded Future (Mastercard): Recorded Future is a leading threat intelligence platform acquired by Mastercard. Overlaps directly with Group-IB's Threat Intelligence and Digital Risk Protection offerings, particularly for financial services customers where both companies emphasize fraud and brand threat data.
- Mandiant (Google Cloud): Mandiant provides threat intelligence, incident response, and managed defense, and was acquired by Google Cloud in 2024. Closely comparable to Group-IB's CERT-GIB, DFIR services, Threat Intelligence, and law enforcement partnerships, with similar enterprise and public-sector customer profiles.
- Kaspersky: Kaspersky offers threat intelligence, endpoint protection, fraud prevention, and incident response globally. Direct overlap with Group-IB's full product portfolio; both have Russian-origin heritage and global Digital Crime Resistance / GERT-style operations supporting INTERPOL collaborations.
- Darktrace: Darktrace applies self-learning AI to threat detection, response, and fraud prevention across enterprise environments. Comparable to Group-IB's AI-led approach (Prevyn AI), Managed XDR, and email threat detection capabilities for enterprise customers.
- ZeroFox: ZeroFox specializes in external threat intelligence, digital risk protection, and brand protection. Direct overlap with Group-IB's Digital Risk Protection product for phishing domain, typosquatting, and brand impersonation takedowns.
- Kroll (Cyber Risk): Kroll's Cyber Risk practice delivers incident response, digital forensics, threat intelligence, and managed detection. Comparable to Group-IB's CERT-GIB DFIR, investigation subscriptions, and enterprise incident response retainer services for similar global enterprise clients.
Broad incumbents
- Palo Alto Networks (Unit 42): Palo Alto Networks' Unit 42 combines managed detection and response, threat intelligence, and incident response within its broader security platform portfolio. Comparable in DFIR and threat intel capability, but bundled into a much larger platform competing for the same CISO budgets.
- Trend Micro: Trend Micro provides a broad cybersecurity portfolio spanning endpoint, network, email, and threat intelligence. Both companies contribute threat intelligence to INTERPOL operations and serve similar enterprise segments, though Trend Micro's portfolio breadth is significantly larger.
Emerging players
- BioCatch: BioCatch focuses on behavioral biometrics for fraud detection and account takeover prevention. Adjacent to Group-IB's Fraud Protection and device fingerprint capabilities, with comparable banking and fintech customer bases but a narrower fraud-only focus.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks6 records
Key highlights7 records
Customer concentration
Group-IB social profiles
Digital presenceGroup-IB compliance and trust
Trust signalCompliance7 records
Group-IB financial estimates
Financial estimateRevenue estimate
Valuation estimate
Group-IB leadership team
Management profileNumber of profiles
Profiles23 records
Group-IB funding detail
Funding detailFunding overview
Funding rounds2 records
Investors4 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Group-IB M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Group-IB
What does Group-IB do?
Group-IB develops and sells an intelligence-driven cybersecurity Unified Risk Platform with modules for Threat Intelligence, Fraud Protection, Attack Surface Management, Digital Risk Protection, Managed XDR, Business Email Protection, Cyber Fraud Intelligence Platform (CFIP), and Cloud Security Posture Management. The company also delivers professional cybersecurity services including 24/7 incident response and digital forensics (CERT-GIB), penetration testing, red teaming, compromise assessments, SOC consulting, AI red teaming, cyber investigations, and technical and management training programs.
Is Group-IB a public or private company?
Group-IB is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was Group-IB founded?
Group-IB was founded in 2003. It employs 501 to 1,000 people.
Where is Group-IB based?
Group-IB is headquartered in Singapore, Singapore, in the Asia region.
How does Group-IB make money?
Four revenue lines are on record. Software Subscriptions are the primary driver. The others are professional Services, managed Services and service Retainer.
Who are Group-IB's main competitors?
Direct peers on record are CrowdStrike, Recorded Future (Mastercard), Mandiant (Google Cloud), Kaspersky, Darktrace, ZeroFox and Kroll (Cyber Risk). Broad incumbents are Palo Alto Networks (Unit 42) and Trend Micro. BioCatch is listed as an emerging player.
Does Group-IB have an API?
Yes. Group-IB offers the ciaops Python SDK that enables programmatic access to its DRP (Digital Risk Protection), Threat Intelligence, and Attack Surface Management APIs, enabling custom automation and integration beyond the Google SecOps connector. Developer documentation is at www.group-ib.com/integrations.
What industry is Group-IB in?
Group-IB's product category is Cybersecurity Software and Services. Its primary akta.pro industry code is BPAEAAAL, Cybersecurity Architecture & Security Integration, with a secondary code of BPAHAEAG, Cybersecurity & Identity Consulting. Its NAICS code is 5132.