Validin
Validin is a bootstrapped threat-intelligence platform that unifies DNS history, host-response fingerprinting, certificate transparency, OSINT, and registration data into a single hunting workspace for SOC analysts, threat researchers, MSSPs, and brand-protection teams, sold via freemium self-service and enterprise tiers.
- Company typePrivate
- Founded2021
- HeadquartersAtlanta, United States
- Headcount1–10
- GTM typeB2B
- OfferingSoftware
What Validin does
Validin is a privately held, bootstrapped threat-intelligence company founded in 2021 by Kenneth Kinion (ex-Microsoft, ex-Amazon) and headquartered operationally in Atlanta, GA, with its legal entity (Validin LLC) in Melbourne, FL. The company operates a unified internet-intelligence platform that combines passive DNS history, active scanning, host-response fingerprinting, certificate-transparency logs, OSINT aggregation, and WHOIS/RDAP registration data into a single workspace used by SOC analysts, threat hunters, incident responders, MSSPs, and brand-protection teams. Underlying technical assets include 6+ years of DNS history, 1 billion+ daily HTTP/S crawls, a 6+ billion-domain lookalike dataset, 650+ integrated OSINT sources, and 2,000+ threat-actor profiles with MITRE ATT&CK mappings; proprietary components include the Validin Query Language (VQL), host-response fingerprinting across dozens of dimensions, daily DNS scanning for six record types, full HTML capture enabling YARA-based retro hunting, and a Python SDK for API-driven enrichment.
The platform is sold through three tiers: a free Community Edition (self-register, 4+ years DNS history, 250 results/query), Professional at $399/month or $3,990/year (2,500 results/query, 270+ days crawl history, bulk search, lookalike domains), and Enterprise starting at $10,000/year (20,000+ results/query, team collaboration, monitoring, live scanning, YARA rules, full API). Go-to-market combines a community-led/PLG motion (free tier, community Slack, open-source Python SDK, threat-research blog) with enterprise sales (Contact Us / Book a Demo CTAs) and an OEM/embedding channel exemplified by the PacketWatch WireSight integration. Disclosed enterprise users include SentinelOne (SentinelLabs), Wiz, PwC, U.S. European Command, Merck, HarfangLab, and SBB Swiss Federal Railways, with 3,000+ individual users across hundreds of organizations reported as of late 2024. No external funding rounds have been disclosed.
Validin firmographics
Firmographics- Name
- Validin
- Legal name
- Validin LLC
- Website
- https://validin.com
- Company type
- Private
- Founded year
- 2021
- Operating status
- Operating
- Headcount range
- 1–10 employees
- Short description
- Validin is a bootstrapped threat-intelligence platform that unifies DNS history, host-response fingerprinting, certificate transparency, OSINT, and registration data into a single hunting workspace for SOC analysts, threat researchers, MSSPs, and brand-protection teams, sold via freemium self-service and enterprise tiers.
- Ownership category
- akta.pro rank
Validin industry classification
Industry- Product category
- Threat Intelligence Platform
- NAICS
- Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (5182), Web Search Portals and All Other Information Services (51929)
- SIC
- Services-Computer Programming, Data Processing, Etc. (7370)
- akta.pro primary industry
- DNS Security & Protective DNS (HDADABAF)
Keywords
Where Validin is headquartered
LocationHeadquarters
- HQ city
- Atlanta
- HQ country
- United States
- HQ region
- North America
Offices3 records
Markets served
Validin business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations
Revenue model
- Subscription - Community Edition: Free tier providing basic DNS pivoting and core search functionality for individual threat researchers and analysts. Serves as a lead-generation and community-building vehicle for future paid tier upgrades.
- Subscription - Professional: Annual subscription at $3,990/year or monthly at $399/month. Includes expanded search with up to 2,500 results per query, 10x daily query limit, wildcard and CIDR queries, bulk search, lookalike domains, and full crawl HTML access with 270+ days of crawl history.
- Subscription - Enterprise: Custom-priced annual subscription starting at $10,000. Includes unlimited daily queries, 20,000+ results per query, team collaboration features, full API access, monitoring, live scanning, YARA rules, and enterprise-grade data coverage including 6+ years of DNS history.
- Security Researcher Pricing: Special access and pricing offered to security researchers, indicating a separate negotiable pricing tier for individual researchers and not-for-profit security professionals.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Monthly | Community - Free tier with core DNS search capabilities |
| Subscription | Annual | Professional - Scaled workflows for power users |
| Subscription | Annual | Enterprise - Full platform for large security teams |
Go-to-market motion3 records
Distribution channels4 records
Marketing channels6 records
Validin product offering
Product offeringCore offering
Validin is a historical DNS and threat intelligence platform that combines passive DNS resolution history, active web scanning, host response fingerprinting, certificate transparency logs, OSINT aggregation from 650+ sources, and WHOIS/RDAP registration data into a unified threat hunting workspace. Security teams use the platform to pivot across domains, IPs, hashes, and certificates, run YARA-based retro hunts, enrich indicators in bulk, detect lookalike/phishing domains, and monitor infrastructure changes for proactive defense and incident response.
Product overview
Validin offers a unified threat intelligence platform combining DNS data, host responses, certificates, OSINT, and registration data into a single interface for security teams, threat researchers, and threat hunters. The platform provides Core Search, Advanced Search (backed by Validin Query Language), Threat Actor Profiles, Bulk Search, Lookalike Domains, Projects, Active Scanning, and YARA Rules capabilities. Available in three tiers: Community (free), Professional ($399/month), and Enterprise (custom pricing starting at $10,000). A Python SDK is available for programmatic access.
Differentiator
Problem solved
Functional benefit
Products and services
- Validin Platform A unified SaaS threat intelligence and internet intelligence platform that combines DNS data, host response fingerprinting, certificates, OSINT, and WHOIS/RDAP registration data into a single workspace for security teams, threat researchers, MSSPs, and government/defense organizations to investigate threats, uncover hidden infrastructure connections, and enrich their security stacks via API and web application.
- Validin Python SDK An open-source Python SDK (validin-sdk) enabling developers and security analysts to programmatically access Validin's threat intelligence data and functionality, supporting bulk enrichment, Lookalike domain searches, campaign tracking, and integration with SIEM/SOAR workflows.
Quantifiable outcome
- Reduces investigation time from hours to minutes through purpose-built threat hunting tools and unified DNS, host response, and registration data
- +5 more outcomes
Companies that use Validin
Customer profileNamed customers8 records
Segments4 records
Ideal customer profiles4 records
Validin technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Feature14 records
Validin partnerships and signals
Strategic signalPartnerships
One partnership is on record.
- PacketWatchcorePacketWatch integrates Validin threat intelligence into its WireSight console. This integration includes the Validin Threat Feed, which WireSight checks against every single session for signs of malicious traffic, and the WireSight Lens Tool which allows analysts to quickly gather enrichment details on any public IP address or domain. Validin enables PacketWatch to offer clients a more complete investigation workflow for identifying malicious activity, investigating infrastructure patterns, and discovering new indicators to prevent further damage.
Scale indicators11 records
Recent moves6 records
Expansion highlights5 records
Validin competitors and assessment
Company assessmentDirect peers
- SecurityTrails: SecurityTrails provides historical DNS, WHOIS, and IP intelligence with a comparable dataset emphasis on internet infrastructure history. It is one of the closest direct competitors to Validin in passive DNS and domain intelligence, and is even referenced by name in the RiskIQ-replacement narrative.
- Censys: Censys offers a deep internet intelligence dataset including certificates, hosts, and DNS across an ongoing scan of the public internet, plus an API and threat hunting tooling. Like Validin, it combines daily scanning, certificate transparency, and pivots across host/DNS data, making it the most directly comparable product.
- DomainTools: DomainTools is a long-standing provider of WHOIS history, passive DNS, and threat intelligence feeds, serving similar security, IR, and brand protection personas. It competes directly with Validin for the same analyst workflows and pivots on DNS, registration, and infrastructure data.
- Shodan: Shodan is an internet-wide scanning and intelligence platform providing host, banner, and service data with pivots and an API. Validin overlaps with Shodan in active scanning, host response fingerprinting, and infrastructure search use cases for security researchers.
Emerging players
- FOFA: FOFA is a Chinese-origin internet asset search engine combining host, certificate, and protocol fingerprinting data. It is a partial overlap with Validin's host response fingerprinting and internet scanning capability, particularly relevant for global asset discovery and threat hunting.
- GreyNoise: GreyNoise focuses on internet-wide scan and background noise intelligence to help analysts separate benign from malicious activity. It targets overlapping personas (SOC analysts, threat hunters) and increasingly integrates with threat intelligence platforms alongside Validin-style datasets.
- Onyphe: Onyphe is a French-born threat intelligence and internet asset data platform combining passive DNS, scan, and threat data feeds. It targets similar security researcher and threat hunting personas as Validin, often positioned as a European alternative.
- FOFA / Quake (Qihoo 360): Quake is a Chinese internet asset search and intelligence system operated by Qihoo 360, similar in scope to Shodan/Censys. It is comparable to Validin on the active scanning, host response, and pivoting capability dimensions, particularly in non-Western markets.
Broad incumbents
- Recorded Future: Recorded Future is a large, established threat intelligence platform aggregating vast amounts of OSINT, dark web, and infrastructure data. It competes with Validin at the high end of the threat intel market, particularly for enterprise SOCs and security teams needing broader intelligence context.
- Mandiant Intelligence (Google): Mandiant, now part of Google Cloud, provides high-end threat intelligence built on years of incident response data and nation-state tracking. It overlaps with Validin in advanced threat research and infrastructure attribution, with Tom Hegel (Validin's advisor) coming from this lineage.
Market position
Strengths1 record
Weaknesses5 records
Competitive moat5 records
Key risks6 records
Key highlights8 records
Customer concentration
Validin social profiles
Digital presenceValidin financial estimates
Financial estimateRevenue estimate
Valuation estimate
Validin leadership team
Management profileNumber of profiles
Profiles4 records
Validin funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Validin M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Validin
What does Validin do?
Validin is a historical DNS and threat intelligence platform that combines passive DNS resolution history, active web scanning, host response fingerprinting, certificate transparency logs, OSINT aggregation from 650+ sources, and WHOIS/RDAP registration data into a unified threat hunting workspace. Security teams use the platform to pivot across domains, IPs, hashes, and certificates, run YARA-based retro hunts, enrich indicators in bulk, detect lookalike/phishing domains, and monitor infrastructure changes for proactive defense and incident response.
Is Validin a public or private company?
Validin is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was Validin founded?
Validin was founded in 2021. It employs 1 to 10 people.
Where is Validin based?
Validin is headquartered in Atlanta, United States, in the North America region.
How does Validin make money?
Four revenue lines are on record. Subscription - Community Edition is the primary driver. The others are subscription - Professional, subscription - Enterprise and security Researcher Pricing.
Who are Validin's main competitors?
Direct peers on record are SecurityTrails, Censys, DomainTools and Shodan. Emerging players are FOFA, GreyNoise, Onyphe and FOFA / Quake (Qihoo 360). Broad incumbents are Recorded Future and Mandiant Intelligence (Google).
Does Validin have an API?
Yes. Validin offers API access for programmatic access to its threat intelligence platform. The API enables automation of enrichment workflows, feeding SIEM/SOAR solutions, and building custom integrations. API access is available at different levels: Limited for Community and Professional tiers, Full for Enterprise. The platform supports bulk enrichment, Lookalike searches, and campaign tracking at scale via the API. A Python SDK (validin-sdk) is available in beta for API-driven enrichment and monitoring workflows. Developer documentation is at docs.validin.com.
What industry is Validin in?
Validin's product category is Threat Intelligence Platform. Its primary akta.pro industry code is HDADABAF, DNS Security & Protective DNS. Its NAICS code is 5182 and its SIC code is 7370.