Source Defense
Source Defense is a client-side web security vendor that protects enterprise websites from JavaScript-based attacks such as digital skimming and Magecart via patented browser sandboxing. It serves 1,000+ enterprise customers across financial services, retail, healthcare, and travel with subscription-based Detect and Protect platforms.
- Company typePrivate
- Founded2014
- HeadquartersRosh Ha'ayin, Israel
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What Source Defense does
Source Defense is an Israel-headquartered, privately held cybersecurity vendor founded in 2014 that pioneered the client-side web security category. The company's core platform extends web security beyond the server into the browser, using patented sandboxing and isolation technology to detect and prevent JavaScript-based attacks such as digital skimming, formjacking, and Magecart-style supply chain compromises. The platform comprises two product lines — Source Defense Protect, which delivers automated prevention through real-time JavaScript sandboxing and policy enforcement, and Source Defense Detect, launched in September 2022, which provides continuous external monitoring, AI-driven threat detection, and alerting. The company is a Principal Participating Organization and Board of Advisors member of the PCI Security Standards Council and directly influenced the eSkimming requirements codified in PCI DSS 4.0.1 (requirements 6.4.3 and 11.6.1).
The platform is deployed via a lightweight JavaScript snippet and serves enterprise customers across financial services (BlackRock, Mastercard, Equifax), retail and eCommerce (Chipotle, Callaway, Kingfisher), travel and hospitality (Hawaiian Airlines), healthcare, and telecommunications. The company reports more than 1,000 customers, protection of over $20 billion in annual client revenue, roughly 1.5 billion site visits under coverage, and the prevention of 8–9 billion compliance policy violations per year. The flagship Mastercard Start Path partnership (announced March 2023) anchors an alliance ecosystem spanning Splunk, CrowdStrike, AWS, SecurityScorecard, Ping Identity, and channel partners including Optiv, GuidePoint Security, and Presidio.
The business model is enterprise subscription SaaS with tiered packages (Basic, Pro, Enterprise) scaled to website traffic volume, supplemented by a freemium PCI 4.0 compliance assessment tool launched in June 2023 to drive top-of-funnel conversion. GTM is a hybrid model pairing direct enterprise field sales with a 'Channel First' partner program through resellers and MSSPs. Source Defense has raised approximately $41 million in disclosed venture funding across three rounds (2018, 2020, 2022), with the $27 million Series B in April 2022 led by Springtide Ventures. The company maintains a U.S. operational headquarters in New Haven, Connecticut alongside its Rosh Ha'ayin, Israel R&D base.
Source Defense firmographics
Firmographics- Name
- Source Defense
- Legal name
- Source Defense Ltd.
- Website
- https://sourcedefense.com
- Company type
- Private
- Founded year
- 2014
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- Source Defense is a client-side web security vendor that protects enterprise websites from JavaScript-based attacks such as digital skimming and Magecart via patented browser sandboxing. It serves 1,000+ enterprise customers across financial services, retail, healthcare, and travel with subscription-based Detect and Protect platforms.
- Ownership category
- akta.pro rank
Source Defense industry classification
Industry- Product category
- Client-Side Web Security Software
- NAICS
- Security Systems Services (56162)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Browser & Web Isolation Security (HDADAEAK)
- akta.pro secondary industries
- Software Supply Chain & Dependency Security (SBOM, Signing) (HDADACAD), Marketplace & Platform Trust & Safety (Buyer/Seller Abuse) (HDADALAI)
Keywords
Where Source Defense is headquartered
LocationHeadquarters
- HQ city
- Rosh Ha'ayin
- HQ country
- Israel
- HQ region
- Middle East
Offices2 records
Markets served
Source Defense business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Marketing or Sales, Infrastructure, Operations
Revenue model
- Security Platform Subscription: Source Defense generates revenue through annual subscription agreements for access to their Detect and Protect platforms. The company offers tiered packages (Basic, Pro, Enterprise) scaled for small, medium, and large websites with varying traffic volumes.
- Freemium Compliance Tool: Free 30-day trial for PCI DSS 4.0 compliance assessment tool designed to help merchants and QSAs evaluate compliance with requirements 6.4.3 and 11.6.1. This serves as a customer acquisition funnel for paid platform adoption.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Monthly | Free PCI 4.0.1 Compliance Trial - 30 day assessment tool |
| Subscription | Annual | Detect Basic - Entry-level monitoring package |
| Subscription | Annual | Detect Pro - Mid-tier monitoring package |
| Subscription | Annual | Detect Enterprise - Full monitoring and alerting solution |
Go-to-market motion3 records
Distribution channels4 records
Marketing channels7 records
Source Defense product offering
Product offeringCore offering
Source Defense provides a patented client-side web security platform that protects websites from third-party JavaScript-based attacks including digital skimming, Magecart attacks, formjacking, clickjacking, and credential harvesting. The platform offers both prevention (real-time JavaScript sandboxing and isolation in the browser) and detection (AI-driven monitoring and alerting) capabilities, with built-in support for PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1. The platform is delivered as a SaaS solution via a two-line JavaScript snippet on customer websites.
Differentiator
Problem solved
Functional benefit
Brands
- Source Defense Detect: A web security monitoring and alerting solution that provides continuous scanning for client-side threats and alerts organizations to security and compliance incidents. Uses external scanning, AI-driven algorithm detection, and advanced alerting to inform organizations of threat activity.
- Source Defense Protect
Products and services
- Source Defense Protect Automated prevention and full-site protection solution that acts as a sandbox for JavaScript running on websites, isolating it from the web browser in real-time and preventing malicious code execution. Provides automated prevention of client-side security incidents including formjacking, clickjacking, digital skimming, credential harvesting, and Magecart attacks across payment pages and entire websites. Includes automated policy enforcement, third-party script governance, and push button compliance for PCI DSS 4.0.1.
- Source Defense Detect Threat visibility and monitoring solution that continuously scans and detects client-side threats, vulnerabilities, and unauthorized behavior across digital properties. Uses external scanning, AI-driven algorithm detection, and advanced alerting to inform organizations of threat activity and data privacy compliance violations. Includes JavaScript inventory management and risk scoring analysis with fast, lightweight deployment.
- Free PCI 4.0 Compliance Solution Free 30-day freemium compliance assessment tool designed to help merchants and QSAs evaluate compliance with PCI DSS 4.0 requirements 6.4.3 and 11.6.1. Features inventory of scripts on payment pages, justification documentation, integrity monitoring (weekly for first 30 days, then monthly), alerting, and blocking capabilities. Functions as customer acquisition funnel for paid platform adoption.
Quantifiable outcome
- Protects more than $20 billion in annual client revenues
- +4 more outcomes
Companies that use Source Defense
Customer profileNamed customers7 records
Segments5 records
Ideal customer profiles4 records
Source Defense technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Integration6 records
AI capability4 records
Feature5 records
Source Defense partnerships and signals
Strategic signalPartnerships
14 partnerships are on record, tiered flagship, minor and core.
- MastercardflagshipStrategic partnership where Source Defense is proudly partnering with Mastercard to eradicate digital skimming across the world. Selected for Mastercard Start Path program to combat eSkimming globally. Strong co-marketing and market development relationship.
- CampusGuardminorChannel Alliance Partner. CampusGuard provides cybersecurity, compliance, and assessment services with a focus on helping higher education, healthcare, and similar organizations manage PCI DSS, GLBA, and other regulatory requirements.
- IntersecminorChannel Alliance Partner and Technology Alliance Partner. Intersec Worldwide is a leading cybersecurity firm specializing in compliance, digital forensics, incident response, and remediation services.
- OptivcoreChannel Alliance Partner. Optiv Security is the world's leading security solutions integrator with years of experience supporting thousands of enterprise-level clients.
- TevoraminorChannel Alliance Partner and Data Privacy Alliance Partner. Tevora and Source Defense partner to deliver real-time prevention strategy for third-party JavaScript supply chain attacks with a combination of people and product.
- PresidiominorChannel Alliance Partner. Presidio is a leading North American IT solutions provider focused on Digital Infrastructure, Business Analytics, Cloud, Security and Emerging solutions.
- GuidePoint SecurityminorChannel Alliance Partner. GuidePoint Security provides innovative and valuable cyber security solutions and expertise that enable organizations to successfully achieve their missions.
- CipherTechsminorChannel Alliance Partner. CipherTechs is a global Cyber Security service provider for audit, integration services, managed services, training and product procurement.
- Trace3minorChannel Alliance Partner. Trace3 and Source Defense combine people and products to deliver client-side data privacy solutions and services.
- e92 CloudminorChannel Alliance Partner. e92cloud is a cloud security VAD built for the cloud generation.
- Mainline RTPminorChannel Alliance Partner. Mainline RTP is an information technology solutions firm that architects and delivers innovative IT solutions, hybrid cloud offerings, and software offerings and services.
- GothamminorChannel Alliance Partner. Gotham Security is a leading New York City-based Information Security Firm specializing in Professional Security Services and Managed Security SOC Services.
- Armour CyberminorChannel Alliance Partner. Armour Cybersecurity is a Canadian cybersecurity company providing advanced technological solutions to customers around the globe.
- Zadyn GroupminorChannel Alliance Partner. Zadyn Group is a global provider of Information Technology Solutions, Services, and Research.
Scale indicators7 records
Recent moves7 records
Expansion highlights6 records
Source Defense competitors and assessment
Company assessmentDirect peers
- Jscrambler: Jscrambler provides client-side JavaScript protection and web application shielding, including code obfuscation, runtime defense, and PCI DSS 6.4.3/11.6.1 compliance support — directly competing with Source Defense in the same client-side security category.
- HUMAN Security: HUMAN Security (formerly PerimeterX) provides bot management and client-side application protection against account takeover, scraping, and eSkimming. It overlaps directly with Source Defense on protecting web applications from JavaScript-based abuse at the browser layer.
Broad incumbents
- F5 (Shape Security): F5's Shape Security provides bot management, fraud prevention, and application protection for enterprise web properties. It overlaps with Source Defense on protecting high-value digital experiences from automated and client-side abuse, particularly in financial services.
- Akamai Technologies: Akamai offers Page Integrity Manager and broader App & API Security solutions that include client-side script monitoring. As a large incumbent CDN/security vendor, it competes with Source Defense by bundling similar capabilities into a much broader platform.
- Cloudflare: Cloudflare's Web Application Firewall, Bot Management, and Page Shield products extend into client-side JavaScript monitoring. As a massively scaled platform with a global edge network, it represents a structural pricing and bundling threat to Source Defense.
- Imperva: Imperva delivers Web Application Firewall (WAF), RASP, and API security products to enterprise customers. While broader in scope than Source Defense, it competes for the same enterprise security budget and increasingly addresses client-side/JS-layer risk.
Emerging players
- Reblaze: Reblaze delivers cloud web application security including WAF, bot mitigation, and DDoS protection. It targets the same enterprise and eCommerce buyer as Source Defense, though with a more general-purpose WAF positioning.
- DataDome: DataDome provides bot and online fraud protection for websites, mobile apps, and APIs, with overlapping capability on protecting digital storefronts from automated abuse — competing with Source Defense for retailer and marketplace security budgets.
- Cequence Security: Cequence Security offers API protection and bot management for web applications. It competes with Source Defense in protecting customer-facing digital properties, particularly for enterprises seeking consolidated API + client-side coverage.
Others
- Snyk: Snyk focuses on software supply chain security (SCA, SBOM, dependency scanning) rather than runtime browser-side protection, but is thematically adjacent as enterprises build out third-party software risk programs that may overlap with Source Defense's JavaScript inventory use case.
Market position
Strengths4 records
Weaknesses4 records
Competitive moat5 records
Key risks7 records
Key highlights7 records
Customer concentration
Source Defense social profiles
Digital presenceSource Defense financial estimates
Financial estimateRevenue estimate
Valuation estimate
Source Defense leadership team
Management profileNumber of profiles
Profiles5 records
Source Defense funding detail
Funding detailFunding overview
Funding rounds3 records
Investors7 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Source Defense M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Source Defense
What does Source Defense do?
Source Defense provides a patented client-side web security platform that protects websites from third-party JavaScript-based attacks including digital skimming, Magecart attacks, formjacking, clickjacking, and credential harvesting. The platform offers both prevention (real-time JavaScript sandboxing and isolation in the browser) and detection (AI-driven monitoring and alerting) capabilities, with built-in support for PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1. The platform is delivered as a SaaS solution via a two-line JavaScript snippet on customer websites.
Is Source Defense a public or private company?
Source Defense is a private company. It is classified as venture growth investor backed and is currently operating.
When was Source Defense founded?
Source Defense was founded in 2014. It employs 11 to 50 people.
Where is Source Defense based?
Source Defense is headquartered in Rosh Ha'ayin, Israel, in the Middle East region.
How does Source Defense make money?
Two revenue lines are on record. Security Platform Subscription is the primary driver. The others are freemium Compliance Tool.
Who are Source Defense's main competitors?
Direct peers on record are Jscrambler and HUMAN Security. Broad incumbents are F5 (Shape Security), Akamai Technologies, Cloudflare and Imperva. Emerging players are Reblaze, DataDome and Cequence Security. Snyk is listed as an others.
Does Source Defense have an API?
No public API is recorded for Source Defense.
What industry is Source Defense in?
Source Defense's product category is Client-Side Web Security Software. Its primary akta.pro industry code is HDADAEAK, Browser & Web Isolation Security, with a secondary code of HDADACAD, Software Supply Chain & Dependency Security (SBOM, Signing). Its NAICS code is 56162 and its SIC code is 7372.