What Arms Cyber does

Arms Cyber is a private US cybersecurity company founded in 2020 and legally operating as ARMS Cyber Defense, Inc., incorporated in Delaware and headquartered in Los Gatos, California. The company sells a single endpoint anti-ransomware platform built on a patented Automated Moving Target Defense (AMTD) technique, structured around three core modules: Conceal (hides critical files in stealth directories that attackers cannot locate), Adapt (uses stealth decoys plus AI-enhanced file-entropy detection to identify encryption behavior early), and Restore (keeps file versions in concealed backup enclaves, enabling roughly 30-second recovery). The platform runs as a kernel-independent agent across Windows, Linux, and macOS, with fewer than 1% system overhead, under one-minute installation, and integration alongside mainstream EDR/XDR stacks including CrowdStrike, Microsoft Defender, and SentinelOne. Add-on capabilities include AI Policy Enforcement for endpoint AI governance, cross-hypervisor (VMware) protection, Windows XP / air-gapped legacy support, hardened Veeam integration, and Ransomware Readiness and Data Resilience assessment services.

Arms Cyber sells to enterprise and mid-market buyers in healthcare, finance, critical infrastructure, and technology through direct enterprise field sales, its Shield Partner Program for North American VARs and MSSPs, and channel partnerships with Solid Border and DigitalEra Group. Pricing is quote-based and not publicly disclosed; revenue is generated via a SaaS subscription licensing model with annual or multi-year contracts. Named reference customers include Vantage Mobility (manufacturing, 200+ endpoints) and Pearson. The company maintains a SOC 2 Type 2-aligned security program, is a Microsoft for Startups Pegasus Program participant, and operates a formal Veeam Incident API integration.

The company was co-founded by twin brothers Bradley Potteiger (CTO) and Tim Potteiger (Chief Architect) alongside Michael Bryant, drawing on prior state-level offensive cyber work for the U.S. Intelligence Community. Executive leadership now includes Bob Kruse (CEO), Steve Sayman (CRO, joined Feb 2025), Pete Johnson (CMO), Josh McCarthy (CPO), Nick Graves (VP Engineering), and Strategic Advisor Rick Congdon. Headcount is reported in the 11–50 range; no outside funding rounds have been disclosed, and revenue figures are not publicly available.

Name

Arms Cyber

Legal name

ARMS Cyber Defense, Inc.

Website

https://armscyber.com

Company type

Private

Founded year

2020

Operating status

Operating

Headcount range

11–50 employees

Short description

Arms Cyber is a private US cybersecurity vendor selling a patented Automated Moving Target Defense (AMTD) endpoint platform for preemptive ransomware defense, serving enterprise and mid-market buyers across healthcare, finance, critical infrastructure, and technology via direct sales and channel partners.

Ownership category

akta.pro rank

Product category

Endpoint Anti-Ransomware Software

NAICS

Computer Systems Design Services (541512)

akta.pro primary industry

Endpoint Deception & Anti-Ransomware (HDADAEAL)

akta.pro secondary industries

Immutable Backup, Air-Gap & Ransomware Recovery (HDABAIAJ), Deception Technology & Threat Hunting (HDADAGAI), Cyber Recovery & Ransomware-Resilient Backup Services (BPAEALAG)

Keywords

• Anti-ransomware software
• Endpoint security platform
• Preemptive cybersecurity
• Moving target defense
• Data protection

Headquarters

HQ city

Brentwood

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations

Revenue model

1. SaaS Subscription (Platform Licensing): Arms Cyber operates on a subscription licensing model, charging organizations for access to its stealth-driven preemptive security platform deployed as a lightweight endpoint agent. The platform is sold to enterprises via direct field sales and channel partners (VARs, MSSPs), with annual or multi-year contract billing. The company underwent independent SOC 2 third-party audits and vulnerability scanning, consistent with SaaS delivery on Google Cloud Platform.

Go-to-market motion2 records

Distribution channels6 records

Marketing channels6 records

Core offering

Arms Cyber sells a stealth-driven preemptive anti-ransomware platform built on patented Automated Moving Target Defense (AMTD) technology, deployed as a lightweight endpoint agent across Windows, Linux, and macOS. The platform is organized into three modules—Conceal (hides critical files in stealth directories), Adapt (uses stealth decoys and AI-enhanced encryption detection to lure and block attackers), and Restore (enables rapid recovery from concealed stealth backups in approximately 30 seconds). It integrates alongside existing EDR/XDR stacks (CrowdStrike, Microsoft Defender, SentinelOne) and adds capabilities such as AI Policy Enforcement and Veeam-specific backup hardening.

Product overview

Arms Cyber is a cybersecurity company offering a platform-based approach to ransomware defense with three core modules: Conceal, Adapt, and Restore. The Conceal module hides critical files using stealth directories; the Adapt module uses stealth decoys and AI-enhanced encryption detection to detect threats before damage occurs; and the Restore module enables rapid recovery through stealth backups. The platform operates across Windows, Linux, and Mac environments and integrates with existing security stacks including CrowdStrike, Microsoft Defender, and SentinelOne. Add-on capabilities include AI Policy Enforcement for endpoint governance of AI tools, Veeam hardening features (Immutable Shield, Honey Vault, Stealth Protection, Process Validation), and Ransomware Readiness Assessment services.

Differentiator

Problem solved

Functional benefit

Products and services

• Conceal Stealth-driven protection module that hides critical files using stealth directories, making them invisible to both encryption and exfiltration attempts. Even when ransomware executes, it cannot locate what it came for, stopping attacks before they cause meaningful damage. Sold to enterprise and mid-market organizations as part of the Arms Cyber platform.
• Adapt Deception and detection module that uses stealth decoys to lure attackers into false engagements and AI-enhanced encryption detection to expose threats with precision before they touch real data. Triggers high-fidelity alerts and blocks attackers in real time. Sold to enterprise and mid-market organizations as part of the Arms Cyber platform.
• Restore Recovery module that enables rapid recovery with zero data loss by keeping backups hidden from attackers in stealth-protected enclaves. File versions are continuously stored in concealed locations that ransomware cannot locate or corrupt, restoring operations in minutes. Sold to enterprise and mid-market organizations as part of the Arms Cyber platform.
• AI Policy Enforcement Endpoint security capability that provides real-time visibility and governance over AI tools, models, and services running across enterprise endpoints. Monitors AI processes and file access, enforces policies on AI data reach, and generates compliance audit trails for regulated industries including EU AI Act and SEC guidance requirements.
• Immutable Shield Protection Security capability for Veeam environments that restricts deletion commands against protected Windows backup repositories for defined time windows (24 hours or more), protecting backup data from accidental destruction, malicious insiders, and ransomware operators targeting recovery points.
• Honey Vault Decoy Backups Deception capability for Veeam environments that presents unauthorized processes with a high-fidelity decoy backup environment while real backup data stays hidden and blocked. Neutralizes double-extortion operators by causing them to exfiltrate worthless fakes instead of sensitive business data.
• Stealth Protection with Restricted Process Access Protection capability for Veeam environments that conceals sensitive backup data and system resources using stealth directories. Even attackers with elevated privileges cannot locate or touch what they cannot see.
• Parent/Child Process Validation Security validation for Veeam environments that validates parent/child process relationships in real time, ensuring only trusted execution paths can interact with protected Veeam components. Blocks living-off-the-land attacks and process-injection techniques at the source.
• Ransomware Readiness Assessment No-obligation evaluation service that reviews an organization's ability to defend against real-world ransomware tactics, evaluates endpoint ransomware security posture weaknesses, and provides practical recommendations to improve readiness. Used as a sales qualification and demand generation tool.
• Data Resilience Assessment Assessment service that examines how a destructive attack would move through an organization's environment, including blast radius analysis, recovery readiness evaluation, and prioritized remediation roadmap (30/60/90 days).

Quantifiable outcome

• $0 ransom paid by any customer, ever (vs. $2.73M industry average in 2024)
• +5 more outcomes

Named customers2 records

Segments4 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration4 records

AI capability3 records

Feature10 records

Partnerships

Four partnerships are on record, tiered core and strategic.

• Veeam SoftwarecoreTechnology or Integration · 26 February 2026Technology partnership integrating Arms Cyber's stealth-driven security platform with the Veeam Data Platform via the Veeam Incident API. The integration enables automated flagging and isolation of ransomware-infected backup restore points, preventing reinfection loops during disaster recovery. The June 2026 expansion introduced four new capabilities: Immutable Shield Protection, Honey Vault Decoy Backups, Stealth Protection with Restricted Process Access, and Parent/Child Process Validation — all purpose-built for Veeam environments to shield backup data, services, and execution paths.
• MicrosoftcoreGTM or Marketing Partner · 28 April 2025Selected for the Microsoft for Startups Pegasus Program, a global invitation-only accelerator providing access to Microsoft's extensive resources, technology, enterprise network, and co-selling opportunities. Kevin Magee, Global Director of Cybersecurity at Microsoft for Startups, stated: 'Arms Cyber's commitment to redefining ransomware defense aligns with our mission to support startups that drive technological innovation.' The partnership leverages Microsoft's Azure and enterprise ecosystem.
• Solid BorderstrategicChannel Partner/ Reseller/ Distributor · 18 March 2025Strategic partnership with Solid Border, a Texas-based cybersecurity solutions boutique, to strengthen cybersecurity and ransomware defense. Solid Border acts as a channel partner/reseller delivering Arms Cyber's preemptive security solutions to customers in the Texas and broader US market.
• DigitalEra GroupstrategicChannel Partner/ Reseller/ Distributor · 6 March 2025Strategic partnership with DigitalEra Group, a trusted cybersecurity advisor and solution provider, to strengthen cybersecurity defense across the Americas. DigitalEra Group serves as a channel partner distributing Arms Cyber's stealth-driven preemptive security platform to enterprise customers throughout North and South America.

Scale indicators8 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Acronis: Acronis combines backup, disaster recovery, and cybersecurity (including anti-ransomware) into a single cyber protection platform. It overlaps directly with Arms Cyber's Conceal/Adapt/Restore value proposition and is especially comparable in backup-integrated ransomware defense.
• Halcyon: Halcyon is a direct anti-ransomware specialist platform built specifically to prevent and recover from ransomware attacks, mirroring Arms Cyber's category, target buyer (mid-market and enterprise CISOs), and ransomware-first value proposition. The two compete head-to-head on preemptive ransomware defense, deception, and rapid recovery.
• SentinelOne: SentinelOne offers an AI-driven Singularity endpoint platform with autonomous EDR/XDR capabilities and ransomware protection features. It targets the same enterprise and mid-market buyers as Arms Cyber and is also a named integration partner — making it both a complementary product and a direct competitive threat.
• Cybereason: Cybereason is an EDR/XDR platform with operation-centric defense and anti-ransomware capabilities, targeting enterprise security teams. It overlaps with Arms Cyber's behavioral detection and ransomware-response use cases for enterprise CISOs.

Emerging players

• Rubrik: Rubrik is a data security and resilience platform with ransomware recovery, immutable backups, and threat-hunting capabilities. It is comparable to Arms Cyber on the data-resilience and recovery side of the value proposition and increasingly overlaps on ransomware preparedness for enterprise backup estates.
• Cohesity: Cohesity delivers data management and security with ransomware detection, immutable backups, and data isolation. It competes with Arms Cyber's Restore/stealth-backup positioning for enterprises modernizing backup infrastructure against ransomware.

Broad incumbents

• Sophos: Sophos offers Intercept X, a broad endpoint security platform with built-in anti-ransomware, exploit prevention, and managed detection and response. It is a direct competitor in the ransomware defense category, particularly within mid-market and via MSSP-led deployments.
• Bitdefender: Bitdefender offers GravityZone, a broad endpoint security suite including anti-ransomware, EDR, and threat intelligence. It is a comparable competitor in mid-market and enterprise ransomware defense, particularly via channel-led deployments.
• Microsoft Defender for Endpoint: Microsoft Defender for Endpoint is the broadest incumbent EDR/XDR platform, embedded across the Windows estate and increasingly macOS and Linux. As Arms Cyber's Pegasus Program partner and a named integration target, Microsoft Defender is the highest-leverage incumbent that could absorb anti-ransomware capabilities into a bundled offering.
• CrowdStrike: CrowdStrike is the leading endpoint security incumbent with the Falcon platform spanning EDR, XDR, identity protection, and managed services. It is one of the platforms Arms Cyber integrates alongside, and is the most likely large incumbent to bundle competing anti-ransomware functionality into its core platform.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks5 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/armscyber
• Xx.com/ArmsCyber

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles10 records

Funding overview

Funding rounds1 record

Investors1 record

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Arms Cyber