What OODA does

OODA LLC is a Reston, Virginia-based global strategic advisory firm founded in 2019 by cybersecurity veterans Matt Devost (CEO) and Bob Gourley (CTO), built on over two decades of prior collaboration between the co-founders at firms including FusionX (acquired by Accenture), iDefense, and iSIGHT Partners. The firm operates across cybersecurity consulting, strategic advisory, due diligence, research, and intelligence services, serving Fortune 500 multinational corporations, government agencies (defense, intelligence, civilian), private equity and corporate development teams, and corporate boards. Its stated mission is to help clients identify, manage, and respond to global risks and uncertainties while exploring emerging opportunities across technology, security, and intelligence domains.

The firm's core service portfolio is built around proprietary assessment frameworks. Consulting services include EVALU8 (an 8-component enterprise risk framework), TURING Integrity Assessment (AI/ML security, algorithmic bias detection, and training data validation), Advanced Red Teaming, CXO-as-a-Service (CISO/CTO/CIO leadership, including Virtual CISO), and Crisis and Incident Response Support. Advisory services include Technical, Cybersecurity, and Business Due Diligence for M&A, Buy-Side Advisory for PE and corporate development, Growth and Strategy engagements, and Board Cyber Advisory Services. Research and Intelligence Services provide strategic research, HUMINT, predictive analytics, and specialized enterprise reports. The AI Acceleration Quotient (AAQ) is a trademarked methodology that scores organizations 0-100 across machine learning maturity, generative AI adoption, and agentic AI readiness. Underpinning service delivery is the OODA Network of 400+ global subject matter experts and former government executives, the OODA Loop membership intelligence platform (300+ members), and the annual OODAcon conference.

OODA's business model is professional services-led, with revenue generated from custom consulting engagements, multi-year advisory retainers, M&A due diligence, board advisory, and the OODA Loop subscription membership. Pricing is quote-based and not publicly disclosed. Distribution is direct and expert-driven, augmented by content marketing through OODAloop.com, the OODA Daily Pulse email newsletter, earned media coverage across major outlets (CNN, NBC, Financial Times, BBC, NYT), speaking engagements at Black Hat and DEF CON, and the annual OODAcon event that sells out each year. The firm also operates OODA Ventures, an in-house early-stage investment entity for cyber and disruptive technology startups. OODA has no parent company, no disclosed institutional investors, and operates as an independent LLC domiciled in Virginia.

Name

OODA

Legal name

OODA LLC

Website

http://www.ooda.com

Company type

Private

Founded year

2008

Operating status

Operating

Headcount range

11–50 employees

Short description

OODA LLC is a Reston, Virginia-based global strategic advisory firm providing cybersecurity consulting, M&A technical due diligence, AI risk assessment, and strategic intelligence services to Fortune 500 corporations, government agencies, private equity firms, and corporate boards worldwide.

Ownership category

akta.pro rank

Product category

Strategic Advisory Services

NAICS

Computer Systems Design and Related Services (54151), Custom Computer Programming Services (541511)

SIC

Services-Computer Programming Services (7371), Services-Management Consulting Services (8742)

akta.pro primary industry

Integration Monitoring, Observability & AIOps for Integration (HDAEAIAH)

akta.pro secondary industry

Enterprise Application Managed Services Outsourcing (ERP/CRM/HRIS AMS) (BPAEAMAI)

Keywords

• Strategic advisory services
• Cybersecurity consulting
• Technology risk management
• AI maturity assessment
• M&A due diligence

Headquarters

HQ city

Reston

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Marketing or Sales, Others

Revenue model

1. Strategic Advisory Services: Advisory services providing expert support for M&A activity, growth and strategy initiatives, market engagement, and board/governance issues. Delivered through senior expert engagements.
2. Cybersecurity Consulting: Cybersecurity and technology risk management support through EVALU8 methodology, red teaming, CXO-as-a-service, and AI Integrity services. Services can be one-time assessments or ongoing retained arrangements.
3. AI Acceleration Quotient Assessments: Research-driven assessment evaluating organizations' AI capabilities across machine learning maturity, generative AI adoption, and agentic AI readiness. Delivered as detailed briefings, presentations, or full written reports.
4. Technical and Business Due Diligence: Due diligence assessments for mergers and acquisitions evaluating technical, cybersecurity, and business strategy risks in target companies. Helps uncover technology risks that affect deal conditions, price, and future risks.
5. OODA Loop Membership: Decision-making insights and intelligence through OODAloop.com membership site providing actionable intelligence, analysis, and insight on global security, technology, and business issues.

Pricing tiers

Go-to-market motion2 records

Distribution channels1 record

Marketing channels6 records

Core offering

OODA is a global strategic advisory firm delivering cybersecurity risk management, technology due diligence, AI maturity assessment, and strategic intelligence services to global corporations and government agencies. Core service offerings include the EVALU8 risk assessment framework, AI Acceleration Quotient (AAQ) methodology, TURING Integrity Assessment for AI/ML, Advanced Red Teaming, CXO-as-a-Service, M&A due diligence, Buy-Side advisory, Board Cyber Advisory, and Research and Intelligence services. The firm also operates the subscription-based OODA Loop intelligence platform on OODAloop.com and the annual OODAcon conference, with the OODA Network of 400+ experts serving as the differentiated delivery backbone.

Product overview

OODA is a strategic advisory firm (not a software product company) offering a portfolio of professional services focused on cybersecurity, technology risk management, and strategic intelligence. The core offerings include consulting services (EVALU8 Risk Assessment, TURING Integrity Assessment, Advanced Red Teaming, CXO as a Service, Crisis & Incident Response Support), advisory services (Technical/Cybersecurity/Business Due Diligence, Growth and Strategy, Buy Side Advisory, Board Cyber Advisory Services), research and intelligence services, and the AI Acceleration Quotient (AAQ) methodology for assessing organizational AI maturity. The firm also operates branded initiatives including OODA Loop (membership intelligence platform), OODAcon (annual conference), the OODA Almanac (annual strategic guide), and OODA Ventures (early-stage investment vehicle). The portfolio is structured as service offerings rather than a unified software platform with modules.

Differentiator

Problem solved

Functional benefit

Products and services

• EVALU8 Risk Assessment A comprehensive risk assessment framework comprised of 8 core components designed to help identify and manage enterprise risks. Can be used as a holistic tool or as individual or combined components to address specific organizational needs. Targeted at enterprise security, risk, and strategy leaders.
• TURING Integrity Assessment AI and machine learning specific security service engaging cybersecurity testers and data scientists to identify technical vulnerabilities in AI technology and supporting infrastructure, ensure algorithms are not susceptible to algorithmic bias, validate training models and training data, and identify non-security pathways that attackers could exploit to influence algorithms. Targeted at organizations deploying or evaluating AI/ML systems.
• Advanced Red Teaming Adaptive Red Team engagements that test for vulnerability to a wide array of adversary tactics and techniques, or explore benefits of possible courses of action from a competitor's viewpoint. Provides alternative viewpoints, challenges common assumptions, and anticipates unintended consequences of events and actions. Past engagements include critical infrastructure vulnerability assessment, U.S. military strategy analysis, economic impact modeling, and regional stability assessment.
• CXO as a Service CISO-as-a-Service model providing deep security expertise to work with senior leadership, augment security programs, and bolster cybersecurity, with all CISOs holding over 15 years of direct cybersecurity management experience. Also provides CTO and CIO leadership to manage technology partners, developers, engineers and IT support. Offered as part-time, full-time, retained, and hourly engagements, with on-site or Virtual CISO (VCISO) delivery models.
• Crisis & Incident Response Support Cyber and conventional incident response support for organizations targeted by criminals, nation states, and other threat actors. Services include managing, investigating, and responding to incidents and attacks, ranging from high-net-worth individuals suffering financial fraud to Fortune 500 companies targeted with state-sponsored espionage.
• AI Acceleration Quotient (AAQ) A repeatable evaluation methodology producing a composite score from 0 to 100 across three dimensions of AI capability: machine learning maturity (deployed models, data infrastructure, MLOps practices, measurable business outcomes), generative AI adoption (workflow integration, foundation model usage, governance), and agentic AI readiness (autonomous AI architecture, organizational willingness, safety frameworks). Supports competitive intelligence, M&A due diligence, internal benchmarking, and portfolio monitoring.
• Technical, Cybersecurity, and Business Due Diligence Comprehensive technical, cybersecurity, and business strategy due diligence services for mergers and acquisitions. Evaluates technology risks, uncovers risks affecting deal conditions or price, vets existing technologies, evaluates R&D roadmaps, identifies inefficiencies, and proposes mitigation strategies as part of the transaction process.
• Growth and Strategy Advisory Advisory services for market potential analysis, product offering development, and marketing and messaging plans. Develops market engagement strategies to help technology or services get adopted by federal government buyers, or transition mission-oriented technology to private sector solutions. Also helps highly regulated businesses and government agencies respond to new mandates for cybersecurity compliance.
• Buy-Side Advisory

Quantifiable outcome

• 65% of acquirers have buyer's remorse post transition due to unforeseen cybersecurity issues (per Forescout survey cited by OODA)

Named customers11 records

Segments4 records

Ideal customer profiles4 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability4 records

Feature5 records

Partnerships

One partnership is on record.

• Boston MeridiancoreStrategic or Co-development PartnerOODA has partnered with Boston Meridian to provide deep subject matter expertise paired with broad cyber market intelligence to drive strategic buying initiatives for clients in Security, Infrastructure, and Analytics domains.

Scale indicators3 records

Recent moves6 records

Expansion highlights5 records

Broad incumbents

• Mandiant: Mandiant (now part of Google Cloud) is a leading incident response, threat intelligence, and cybersecurity advisory firm. Directly comparable to OODA in cybersecurity consulting, red teaming, and strategic advisory; now operates as a broad incumbent within Google's cloud security portfolio, offering much larger scale than OODA.
• Booz Allen Hamilton: Booz Allen Hamilton is a major management and technology consulting firm with a deep government and defense cybersecurity practice. Comparable to OODA in serving government agencies on cybersecurity strategy, emerging technology risk, and intelligence-community advisory — though at much larger scale and with broader service breadth.
• Kroll: Kroll is a global risk consulting firm with a strong cybersecurity, incident response, and due diligence practice. Comparable to OODA in offering cybersecurity advisory, M&A diligence, and risk management services to enterprise clients, but at significantly larger scale and broader geographic footprint.
• FTI Consulting: FTI Consulting is a global business advisory firm with a dedicated cybersecurity and risk management practice. Comparable to OODA in providing strategic advisory, M&A cyber due diligence, and risk consulting to enterprise and legal clients, though FTI operates at materially larger scale across multiple practice areas.
• Optiv: Optiv is a cybersecurity solutions and advisory provider offering consulting, risk management, and managed security services. Comparable to OODA in cybersecurity advisory and risk assessment offerings, though Optiv operates at much larger scale and bundles services with a broader vendor portfolio.
• CrowdStrike Services: CrowdStrike is a leading cybersecurity technology firm with a services arm providing incident response, advisory, and proactive threat hunting. Comparable to OODA in incident response and strategic cybersecurity advisory, though CrowdStrike pairs services with its dominant endpoint detection platform.

Direct peers

• Bishop Fox: Bishop Fox is a boutique cybersecurity consulting firm specializing in offensive security, red teaming, and security assessments. Closely comparable to OODA in size, talent-led delivery model, and emphasis on advanced adversary emulation and elite practitioner credentials.
• Trail of Bits: Trail of Bits is a boutique cybersecurity research and consulting firm specializing in software security, AI/ML safety, and applied cryptography. Comparable to OODA in elite-talent-led boutique positioning, specialized AI security advisory (aligned with TURING), and research-driven thought leadership.
• Kudelski Security: Kudelski Security is a cybersecurity services firm providing advisory, managed security, and incident response to enterprise and government clients. Comparable to OODA in boutique cybersecurity advisory, red-teaming, and CISO-as-a-service offerings, with similar emphasis on senior practitioner delivery.

Regional players

• NCC Group: NCC Group is a UK-headquartered cybersecurity and software resilience firm providing advisory, testing, and managed security services. Comparable to OODA in cybersecurity consulting, red teaming, and technical assessment; primarily serves European and UK markets rather than OODA's US-government-anchored footprint.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/ooda
• Facebookfacebook.com/ooda
• LinkedInlinkedin.com/company/ooda-llc

Revenue estimate

Valuation estimate

Number of profiles

Profiles5 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments7 records

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about OODA