ANTIY Labs

What ANTIY Labs does

Antiy Labs is a Chinese-headquartered cybersecurity firm founded in 2000 that specializes in antivirus and malware detection engine technology. Its core product, the AVL SDK anti-virus engine, is a cross-platform threat detection middleware supporting X86, ARM, MIPS, RISC, and PowerPC architectures across Windows, Linux, domestic Chinese operating systems, and real-time industrial systems such as VxWorks. The engine detects over 18.6 million malware variants across 58,020+ families using 42 million+ detection rules, with bi-hourly signature updates, 84 weekly updates, and daily automated analysis of more than 2 million new file objects. As of June 2026, the engine provided 64.29% ATT&CK framework coverage via 533 behavior mapping tags across 171 tactical categories, with processing of 31 shell types and 132 package formats.

The company operates a pure OEM/embedded licensing model, distributing the AVL SDK to more than 100 industry partners that embed the engine into their own products. Distribution is concentrated in mobile device OEMs (Huawei, Xiaomi, Honor, VIVO, OPPO), large internet enterprises (Ant Financial), and listed cybersecurity vendors whose partner products have won AV-TEST and NSS Labs recognition. Beyond the core engine, Antiy markets its own IEP endpoint defense system, PTD persistent threat detection system, PTA/PTA-mobile persistent threat analysis systems, and a Situational Awareness platform, alongside professional services (threat intelligence, monitoring, audit, emergency response, consulting). Revenue is generated primarily through SDK licensing royalties and professional services, with no publicly disclosed pricing or financial figures.

Antiy's customer base skews toward Chinese technology and internet enterprises, supplemented by security regulatory bodies, critical infrastructure operators, and large/medium enterprises for its higher-level products. The firm has maintained continuous government R&D support from China's Ministry of Science and Technology, NDRC, and MIIT between 2004 and 2019, holds Microsoft Gold Certified Partner status since 2009, and is a participant in Microsoft's MAPP vulnerability disclosure program. Operational data confirms the company remains active, publishing weekly engine upgrade announcements and security research through June 2026.

Name

ANTIY Labs

Legal name

Antiy Labs

Website

https://antiy.net

Company type

Private

Founded year

2001

Operating status

Operating

Headcount range

101–250 employees

Short description

Antiy Labs is a Chinese cybersecurity firm that develops the AVL SDK anti-virus engine and licenses it as embedded middleware to over 100 partners including Huawei, Xiaomi, Honor, VIVO, and OPPO, deploying threat detection across more than 4 billion nodes.

Ownership category

akta.pro rank

Product category

Cybersecurity Software

NAICS

Other Computer Related Services (541519)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

Endpoint Protection Platforms (EPP/NGAV) (HDADAEAD)

akta.pro secondary industry

Threat Intelligence Services (BPAEADAC)

Keywords

• Antivirus engine SDK
• Endpoint security
• Malware analysis
• Threat intelligence
• Mobile security

Headquarters

HQ city

San Francisco

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations

Revenue model

1. SDK Licensing: Antiy licenses their AVL SDK anti-virus engine to industry partners who embed it into their products. Partners receive virus database updates and detection capabilities through the SDK.
2. Security Services: Professional services including High-level Threat Intelligence, Security Monitoring and Analysis, Audit and Test Service, Emergency Response, and Security Consulting and Training.

Go-to-market motion1 record

Distribution channels1 record

Marketing channels5 records

Core offering

ANTIY Labs develops and licenses the AVL SDK anti-malware engine family (Base, Network, Mobile, and Lite editions) for OEM embedding across operating systems and devices, and sells enterprise security platforms including IEP endpoint defense, PTD persistent threat detection, PTA/PTA-mobile threat analysis, and a Situational Awareness Platform. The company also delivers recurring security services — high-level threat intelligence, security monitoring and analysis, audit and testing, emergency response, and consulting and training — anchored by an on-demand malware analysis capability processing more than 2 million files per day.

Product overview

Antiy Labs is an anti-virus engine and security solution provider offering a comprehensive product portfolio centered around its AVL SDK anti-virus engine technology. The core offering includes AVL SDK variants (Base, Network, Mobile, Lite) providing threat detection middleware that can be embedded into partner products. The product ecosystem extends to endpoint security (IEP), network threat detection (PTD), and threat analysis systems (PTA, PTA-mobile), all powered by the proprietary AVL engine. The Situational Awareness Platform serves as an upper-level orchestration system integrating the detection capabilities across network, endpoint, and perimeter security products. Services include threat intelligence, security monitoring, auditing, emergency response, and consulting. The engine has been deployed across more than 4 billion nodes through over 100 industry partners including major mobile manufacturers (Huawei, Xiaomi, Honor, VIVO, OPPO) and internet enterprises.

Differentiator

Problem solved

Functional benefit

Brands

• AVL SDK: Antiy AVL SDK anti-virus engine - threat detection capability middleware supporting multiple architectures and platforms including X86, ARM, MIPS, RISC, PowerPC for Windows, Linux, and domestic operating systems.
• IEP
• PTD
• PTA
• L Tomahawk

Products and services

• AVL SDK for Network An OEM-licensed anti-malware engine edition tailored for network gateways and traffic inspection use cases, sold to platform and security vendors for embedding in network security products.
• AVL SDK for Mobile An OEM-licensed anti-malware engine edition for Android and other mobile platforms, sold to device manufacturers (such as Huawei and Xiaomi) for embedding directly in mobile devices.
• AVL SDK Lite A lightweight OEM-licensed anti-malware engine edition designed for resource-constrained environments such as IoT devices and embedded systems.
• AVL SDK Base The base edition of the AVL SDK anti-malware engine, designed for server-side, backend, and general-purpose scanning across Windows, Linux, and macOS environments.
• IEP (Endpoint Defense System) An enterprise endpoint defense product that protects hosts against malware and advanced threats, sold to corporate and government security teams.
• PTD (Persistent Threat Detection System) An enterprise product that detects advanced persistent threats and stealthy attacker behavior across endpoints and networks, sold to security operations teams.
• PTA (Persistent Threat Analysis System) An enterprise product that performs deep analysis of persistent threats to support incident response and threat hunting, sold to security operations teams.
• PTA-mobile A mobile-focused edition of the PTA persistent threat analysis system, sold to enterprise security teams for analyzing threats targeting mobile endpoints.
• Situational Awareness Platform An enterprise platform that aggregates threat telemetry and provides security situational awareness for enterprise and government security operations centers.
• High-level Threat Intelligence Service A subscription threat intelligence service delivering curated indicators, adversary analysis, and ATT&CK-aligned reporting to government and enterprise customers.
• Security Monitoring and Analysis Service A managed security service providing ongoing monitoring and analysis of customer environments for threats and anomalies, sold to enterprise and government customers.
• Audit and Test Service A professional services engagement in which ANTIY Labs audits and tests customer systems for security weaknesses, sold to government regulators and enterprise customers.
• Emergency Response Service An emergency cybersecurity incident response service that mobilizes ANTIY Labs analysts to contain and remediate active breaches, sold to enterprise and government customers.
• Security Consulting and Training Service A professional services offering in which ANTIY Labs provides security consulting and training to enterprise customers and government security teams.
• Comprehensive Solution A packaged combination of ANTIY Labs products and services sold as an integrated security solution to enterprise and government customers.
• Open Malware CloudDetection A public-facing malware cloud detection service that lets users submit suspicious files for AVL-engine-based scanning and verdict reporting.
• VirusView Malware Knowledge Encyclopedia An online malware knowledge encyclopedia published by ANTIY Labs that catalogs malware families and analysis findings, used as a reference by security professionals.
• Backend Automatic Malware Analysis System An automated backend malware analysis capability that processes large volumes of suspicious files using ANTIY Labs' engine and tooling, offered as a service to enterprise and government customers.
• On-demand Manual Analysis and Response An expert-driven on-demand malware analysis and incident response service in which ANTIY Labs analysts manually reverse-engineer and respond to customer submissions.

Quantifiable outcome

• Detects 18,609,487 malware variants of 58,020 families with 42,133,900 detection rules
• +4 more outcomes

Named customers6 records

Segments6 records

Ideal customer profiles5 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature4 records

Partnerships

Eight partnerships are on record, tiered core, strategic and major.

• HuaweicoreOEM/ Whitelabel/ Licensing PartnerMobile phone enterprise embedding Antiy AVL SDK engine into their mobile devices for built-in malware detection capabilities.
• XiaomicoreOEM/ Whitelabel/ Licensing PartnerMobile phone enterprise embedding Antiy AVL SDK engine into their mobile devices for built-in malware detection capabilities.
• HonorcoreOEM/ Whitelabel/ Licensing PartnerMobile phone enterprise embedding Antiy AVL SDK engine into their mobile devices for built-in malware detection capabilities.
• VIVOcoreOEM/ Whitelabel/ Licensing PartnerMobile phone enterprise embedding Antiy AVL SDK engine into their mobile devices for built-in malware detection capabilities.
• OPPOcoreOEM/ Whitelabel/ Licensing PartnerMobile phone enterprise embedding Antiy AVL SDK engine into their mobile devices for built-in malware detection capabilities.
• Ant FinancialcoreOEM/ Whitelabel/ Licensing PartnerLarge Internet enterprise using Antiy Engine for enterprise security protection within their financial technology products and services.
• MicrosoftstrategicTechnology or IntegrationAntiy Labs is a Microsoft Gold Certified Partner with certifications in Microsoft Business Intelligence, Microsoft Networking Infrastructure Solutions Competency and Microsoft Security Solutions. Antiy is also part of Microsoft's MAPP (Microsoft Active Protections Program) initiative, able to respond to vulnerabilities within 48 hours.
• Listed Cybersecurity CompaniesmajorOEM/ Whitelabel/ Licensing PartnerSeveral listed cybersecurity companies integrate Antiy Engine into their security products. Partner products have won internationally renowned evaluation awards such as AV-TEST and NSS Labs.

Scale indicators5 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• ESET: ESET offers its NOD32 / ThreatSense engine via OEM technology licensing, integrated into endpoint, mobile, and network security products by partner vendors worldwide. ESET's long-standing engine licensing business, multi-architecture support, and malware-knowledge depth make it a structurally similar peer to ANTIY's AVL SDK.
• Bitdefender: Bitdefender is a Romanian cybersecurity vendor whose Bitdefender SDK / GravityZone engine is licensed to OEMs and embedded into partner products across endpoint, mobile, and network categories. This is the closest direct analog to ANTIY's AVL SDK OEM licensing model, with comparable architectural breadth and global OEM footprint.
• Sophos: Sophos delivers endpoint, network, and mobile security with OEM/intercept-X engine technology licensed to hardware vendors and managed security providers. Its broad OEM integration footprint and endpoint-focused engine compete with ANTIY for shared OEM and embedded security customers.
• Qihoo 360: Qihoo 360 is a major Chinese cybersecurity company offering consumer and enterprise AV, mobile security, and a proprietary antivirus engine that competes head-to-head with ANTIY in the Chinese OEM and enterprise market. Direct domestic competitor with comparable threat intelligence scale and government relationships.
• Kaspersky: Kaspersky licenses its antivirus engine (Kaspersky Anti-Virus SDK / Whitelisting / Machine Learning) to OEMs, device manufacturers, and security vendors globally. Like ANTIY, it competes on detection depth, multi-platform support, and threat intelligence scale, making it a direct comparable in the embedded engine market.

Broad incumbents

• CrowdStrike: CrowdStrike's Falcon platform is an AI-native endpoint security and XDR suite increasingly selected by enterprise buyers and OEMs over traditional AV engines. It represents the structural next-gen alternative to embedded AV SDKs like ANTIY's and a key competitive threat to the embedded engine category.
• Trend Micro: Trend Micro is a global incumbent offering endpoint, server, mobile, and network security with its Smart Protection Network threat intelligence backbone. While broader than ANTIY, Trend Micro is a comparable endpoint-detection player with OEM/embedded licensing components and a multi-decade threat intelligence base.
• Palo Alto Networks: Palo Alto Networks operates a broad cybersecurity portfolio including Cortex XDR endpoint security, threat intelligence (Unit 42), and network/edge security. As a global incumbent with growing endpoint security capabilities, it competes with ANTIY in the broader threat detection and enterprise security market.
• SentinelOne: SentinelOne provides AI-driven endpoint protection, XDR, and Singularity platform with behavior-based detection competing against signature-based AV engines. As an OEM-considered next-gen endpoint security stack, it directly threatens the embedded third-party AV engine model that ANTIY depends on.

Regional players

• Rising (Ruixing): Rising is a long-established Chinese antivirus vendor offering consumer and enterprise security products primarily within the Chinese market. As a domestic Chinese peer, Rising competes with ANTIY for Chinese OEM, enterprise, and government security procurement.

Market position

Strengths5 records

Weaknesses2 records

Competitive moat6 records

Key risks6 records

Key highlights6 records

Customer concentration

• Xx.com/antiylabs
• Facebookfacebook.com/antiylabs
• LinkedInlinkedin.com/company/antiylabs

Compliance3 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Subsidiaries2 records

Funding overview

Funding rounds1 record

Investors1 record

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about ANTIY Labs