SecurityMetrics
SecurityMetrics is a privately held cybersecurity and compliance SaaS provider founded in 2001, serving over 800,000 businesses with PCI DSS, HIPAA, HITRUST, and CMMC solutions through patented scanning, monitoring, and forensic tools.
- Company typePrivate
- Founded2001
- HeadquartersOrem, United States
- Headcount251–500
- GTM typeB2B
- OfferingSoftware
What SecurityMetrics does
SecurityMetrics, Inc. is a privately held data security and compliance company founded in 2001 and headquartered in Orem, Utah, with 251-500 employees and additional sales presence in the United Kingdom. The company provides cybersecurity and compliance SaaS solutions centered on PCI DSS, HIPAA, HITRUST, CMMC, and GDPR frameworks, serving over 800,000 businesses globally including SMB merchants, healthcare organizations, defense contractors, and large enterprises such as TD Bank, Stripe, Skechers, and Washington State University.
The company's core technology stack combines proprietary patented tools — including Webpage Integrity Monitoring (WIM) Technology powering the award-winning Shopping Cart Inspect/Monitor products, PANscan for card data discovery, and PIIscan for PII discovery — with PCI SSC Approved Scanning Vendor services and HITRUST Assessor capabilities. SecurityMetrics maintains continuous representation on the PCI SSC Global Executive Assessor Roundtable (2018-2026) and operates a managed Security Operations Center through its Pulse product, which performs internal vulnerability scanning, network monitoring, and firewall log analysis. In September 2025, the company launched Spectre AI to extend its offering into AI-powered merchant portfolio risk analytics for acquirers and payment service providers.
SecurityMetrics operates a hybrid go-to-market model: SMB merchants are reached through acquiring bank and ISO channel partnerships (with named partners including North American Bancard, Wireless Zone's 375 franchisees, and Five Star Merchant Services) at acquirer-determined subscription pricing, while enterprise customers are sold through direct field sales with custom quotes for audits, penetration testing, managed security services, and consulting. Revenue streams include annual PCI compliance subscriptions, multi-year managed security contracts (3-year Pulse terms), enterprise compliance assessments, e-commerce security monitoring, data discovery tool licensing, and hourly consulting ($320/hour). The Premium Service Warranty provides up to $100,000 per merchant ID in breach protection, layering a value-added insurance-like component onto the core subscription.
SecurityMetrics firmographics
Firmographics- Name
- SecurityMetrics
- Legal name
- SecurityMetrics, Inc.
- Website
- https://securitymetrics.com
- Company type
- Private
- Founded year
- 2001
- Operating status
- Operating
- Headcount range
- 251–500 employees
- Short description
- SecurityMetrics is a privately held cybersecurity and compliance SaaS provider founded in 2001, serving over 800,000 businesses with PCI DSS, HIPAA, HITRUST, and CMMC solutions through patented scanning, monitoring, and forensic tools.
- Ownership category
- akta.pro rank
SecurityMetrics industry classification
Industry- Product category
- Cybersecurity and Compliance Software
- NAICS
- Security Systems Services (except Locksmiths) (561621), Security Systems Services (56162)
- akta.pro primary industry
- Security Audits & Compliance (ISO 27001, SOC 2, PCI DSS, HIPAA, SOX) (BPAKADAC)
- akta.pro secondary industries
- Data Loss Prevention (DLP) & Sensitive Data Discovery (PHI/PII) (HLACAJAC), Data Masking, Tokenization & De-identification (HDADAFAI), POS Security, Encryption & Key Management (P2PE, HSM, Key Injection) (FSAMADAK)
Keywords
Where SecurityMetrics is headquartered
LocationHeadquarters
- HQ city
- Orem
- HQ country
- United States
- HQ region
- North America
Offices2 records
Markets served
SecurityMetrics business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure
Revenue model
- PCI Compliance Services: Annual subscription-based PCI compliance services for merchants. SMB pricing varies based on packages offered through acquiring banks. Includes vulnerability scanning, self-assessment questionnaire support, PANscan licenses, training seats, and technical support bundled into service packages.
- Enterprise Compliance Assessments: One-time professional services including PCI DSS audits, HIPAA compliance assessments, HITRUST assessments, penetration testing, and CMMC compliance programs. Billed at quoted rates based on scope and complexity.
- E-commerce Security Monitoring: Shopping Cart Inspect and Shopping Cart Monitor services that provide ongoing detection of web skimming attacks. Includes faux purchase testing, risk reporting, and alert notifications. May be bundled with PCI compliance packages.
- Managed Security Services: Pulse managed security services with 3-year contract terms. Includes collector hardware deployment, network monitoring, internal scanning, and security operations center support. Cancellation fees apply for early termination.
- Data Discovery Tools: PANscan and PIIscan software tools for discovering sensitive data on networks. May be offered as included licenses within compliance packages or as standalone products.
- Consulting Services: Post-report consulting services for breach response and risk remediation at $320 per hour. Also includes general security consulting engagements.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | SMB PCI Compliance - Acquirer-banked packages |
| Other | Multi-year contract | Enterprise PCI Audit - Custom quotes |
| Other | Multi-year contract | HIPAA Compliance - Custom quotes |
| Other | Multi-year contract | HITRUST Assessment - Custom quotes |
| Unit Pricing | Pay-as-you-go | Consulting Services - $320/hour |
| Subscription | Multi-year contract | Managed Security Services - 3-year term |
Go-to-market motion2 records
Distribution channels5 records
Marketing channels12 records
SecurityMetrics product offering
Product offeringCore offering
SecurityMetrics provides data security and compliance solutions primarily for organizations handling payment card data and protected health information. The company delivers PCI DSS, HIPAA, HITRUST, CMMC, and GDPR compliance services, complemented by proprietary cybersecurity technologies including patented Webpage Integrity Monitoring (WIM) for detecting JavaScript web skimming attacks, PANscan for card data discovery, and managed security operations center services.
Product overview
SecurityMetrics offers a comprehensive portfolio of data security and compliance solutions organized around PCI DSS, HIPAA, and broader cybersecurity offerings. The core portfolio includes PANscan (patented card data discovery), PIIscan (PII discovery), and Shopping Cart Inspect/Monitor products powered by proprietary Webpage Integrity Monitoring (WIM) technology for detecting ecommerce skimming attacks. Their compliance suite covers PCI DSS (with ASV scanning, audits, and managed programs), HIPAA (with training, policies, and Health Network Portal), HITRUST assessments, CMMC for defense contractors, and GDPR Defense. The company also provides managed security services including SecurityMetrics Pulse (network monitoring), Vision (internal scanning), penetration testing, and incident response/forensics. Recent innovation includes Spectre AI for predictive merchant risk analysis. The product architecture combines standalone tools with integrated platform offerings for small business, enterprise, and service provider segments.
Differentiator
Problem solved
Functional benefit
Brands
- PANscan: Patented card data discovery tool that detects unencrypted credit card numbers on computer systems
- PIIscan
- Shopping Cart Inspect
- Shopping Cart Monitor
- Webpage Integrity Monitoring (WIM)
- SecurityMetrics Pulse
- GDPR Defense
- SecurityMetrics Vision
- Spectre AI
Products and services
- PANscan Patented software that finds unencrypted credit card numbers (Primary Account Numbers) on computer systems to help merchants comply with PCI DSS and reduce data breach risk.
- PIIscan Software that discovers unencrypted personally identifiable information on computer systems to help organizations comply with GDPR, PCI DSS, and HIPAA.
- Shopping Cart Inspect Patented solution using Webpage Integrity Monitoring (WIM) Technology to detect JavaScript web skimming attacks on ecommerce sites, providing detailed risk reports to merchants. Winner of Data Leak Detection Solution of the Year award (2025).
- Shopping Cart Monitor Ecommerce security tool that monitors shopping cart purchase pages for Indicators of Compromise (IOCs) to comply with PCI requirements 6.4.3 and 11.6.1. Uses patented WIM Technology for webpage integrity monitoring.
- External Vulnerability Scan (ASV)
Quantifiable outcome
- Shopping Cart Inspect won 'Data Leak Detection Solution of the Year' in 2025 CyberSecurity Breakthrough Awards
- +4 more outcomes
Companies that use SecurityMetrics
Customer profileNamed customers12 records
Segments7 records
Ideal customer profiles5 records
SecurityMetrics technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
AI capability1 record
Feature7 records
SecurityMetrics partnerships and signals
Strategic signalPartnerships
Six partnerships are on record, tiered core and minor.
- Wireless ZonecorePartnership brought data security and PCI compliance to Wireless Zone's 375 franchisees across the United States. SecurityMetrics provides compliance services while Wireless Zone serves as the franchise system operator delivering these services to their franchise network.
- Travelport and IATAcoreSecurityMetrics partnered with Travelport and IATA to offer PCI DSS Certification Wizard Tool to travel agencies. The partnership streamlined and simplified the PCI compliance process for IATA merchants and agents, reducing cost and complexity of becoming PCI compliant through SecurityMetrics Expert online tool guiding agents through the self-assessment questionnaire process.
- North American BancardcoreAgreement to help thousands of NAB merchants increase data security and report PCI compliance. Technology-focused NAB chose SecurityMetrics for unique ability to cater to wide variety of merchant levels through custom PCI compliance program.
- Vectra CorpcoreVectra Corp selected SecurityMetrics as PFI (PCI Forensic Investigator) partner for Australia and Asia Pacific region. SecurityMetrics conducts incident response and forensic investigations for merchants in the region, providing fast recovery solutions for compromised merchants using comprehensive services and expert tools.
- UHIN (Utah Health Information Network)minorPartnership to address security challenges with new program helping UHIN members meet federal data security regulations and increase safety of electronic environments. Addresses HIPAA compliance and healthcare data security needs.
- Failsafe PaymentsminorFailsafe Payments, Merchant Service Provider in North America and Europe, added SecurityMetrics PCI DSS compliance services to help merchants meet industry requirements and prevent theft of customer card data.
Scale indicators5 records
Recent moves6 records
Expansion highlights6 records
SecurityMetrics competitors and assessment
Company assessmentDirect peers
- Trustwave: Trustwave is one of the largest PCI QSA and ASV providers globally, offering managed security, compliance, and incident response services overlapping nearly 1:1 with SecurityMetrics' PCI/HIPAA/managed-detection portfolio across SMB and enterprise customers.
- A-LIGN: A-LIGN is a leading cybersecurity and compliance audit firm offering PCI DSS, HITRUST, SOC 2, ISO 27001, FedRAMP, and CMMC assessments — directly competing for enterprise compliance audit and managed-compliance engagements.
- Coalfire: Coalfire is a top-tier PCI QSA and HITRUST/CMMC assessor providing cyber risk management, advisory, and compliance services — competing head-to-head with SecurityMetrics in QSA audits, HITRUST assessments, and managed compliance programs.
- Sysnet (formerly ControlScan): Sysnet (which acquired ControlScan) is one of the closest direct peers to SecurityMetrics' SMB PCI compliance business, providing acquirer-channel PCI programs, ASV scanning, and merchant compliance solutions to thousands of small merchants globally.
- Schellman: Schellman is a top-ranked attestation and compliance assessor providing PCI DSS, HITRUST CSF, SOC 2, ISO, and FedRAMP services — overlapping with SecurityMetrics' enterprise audit and healthcare compliance lines.
Emerging players
- Vanta: Vanta is a venture-backed automated compliance platform for SOC 2, ISO 27001, HIPAA, and increasingly PCI — competing with SecurityMetrics in SMB and mid-market by automating evidence collection and continuous monitoring that SecurityMetrics delivers as managed services.
- Drata: Drata is a fast-growing compliance automation platform with continuous control monitoring for SOC 2, ISO 27001, HIPAA, and PCI — threatening SecurityMetrics' SMB compliance posture by displacing manual workflows with self-service automation.
Broad incumbents
- Qualys: Qualys is a public cybersecurity platform with VMDR, ASV scanning, web application scanning, and PCI compliance capabilities — competing with SecurityMetrics' external/internal vulnerability scanning and ASV lines as part of a broader enterprise security portfolio.
- Tenable: Tenable is a public exposure management platform (Nessus, Tenable One) offering vulnerability scanning, web app scanning, and PCI ASV services — competing with SecurityMetrics' ASV and vulnerability assessment offerings as part of a broader enterprise platform.
- Rapid7: Rapid7 is a public cybersecurity company offering vulnerability management (InsightVM), application security, SIEM/managed detection, and PCI ASV — overlapping with SecurityMetrics' vulnerability scanning, managed SOC (Pulse), and incident response lines.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat7 records
Key risks7 records
Key highlights7 records
Customer concentration
SecurityMetrics social profiles
Digital presenceSecurityMetrics compliance and trust
Trust signalCompliance7 records
SecurityMetrics financial estimates
Financial estimateRevenue estimate
Valuation estimate
SecurityMetrics leadership team
Management profileNumber of profiles
Profiles4 records
SecurityMetrics funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
SecurityMetrics M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about SecurityMetrics
What does SecurityMetrics do?
SecurityMetrics provides data security and compliance solutions primarily for organizations handling payment card data and protected health information. The company delivers PCI DSS, HIPAA, HITRUST, CMMC, and GDPR compliance services, complemented by proprietary cybersecurity technologies including patented Webpage Integrity Monitoring (WIM) for detecting JavaScript web skimming attacks, PANscan for card data discovery, and managed security operations center services.
Is SecurityMetrics a public or private company?
SecurityMetrics is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was SecurityMetrics founded?
SecurityMetrics was founded in 2001. It employs 251 to 500 people.
Where is SecurityMetrics based?
SecurityMetrics is headquartered in Orem, United States, in the North America region.
How does SecurityMetrics make money?
Six revenue lines are on record. PCI Compliance Services are the primary driver. The others are enterprise Compliance Assessments, E-commerce Security Monitoring, managed Security Services, data Discovery Tools and consulting Services.
Who are SecurityMetrics's main competitors?
Direct peers on record are Trustwave, A-LIGN, Coalfire, Sysnet (formerly ControlScan) and Schellman. Emerging players are Vanta and Drata. Broad incumbents are Qualys, Tenable and Rapid7.
Does SecurityMetrics have an API?
No public API is recorded for SecurityMetrics.
What industry is SecurityMetrics in?
SecurityMetrics's product category is Cybersecurity and Compliance Software. Its primary akta.pro industry code is BPAKADAC, Security Audits & Compliance (ISO 27001, SOC 2, PCI DSS, HIPAA, SOX), with a secondary code of HLACAJAC, Data Loss Prevention (DLP) & Sensitive Data Discovery (PHI/PII). Its NAICS code is 561621.