What ThreatSTOP does

ThreatSTOP is a private cybersecurity company founded in 2009 and headquartered in Carlsbad, California, that operates a cloud-based automated threat intelligence platform delivering Protective DNS and IP-layer defense. The platform aggregates threat intelligence from over 900 feeds across 50+ public and proprietary sources, including trust groups and law enforcement, applies human and machine curation, and converts the resulting indicators into enforcement policies that automatically update customer DNS servers (RPZ, Active Directory), firewalls, routers, cloud-native infrastructure (AWS WAF, AWS Network Firewall, AWS Route53), SIEM systems, and endpoints every 15 minutes. Core products include DNS Defense (on-premises), DNS Defense Cloud (cloud resolvers for distributed workforces), and IP Defense (network-layer enforcement), supplemented by AWS Marketplace managed rule bundles, the CheckIOC free lookup tool, FirstSTOP indicator subscriptions, and Community Edition free tier. The company is led by founder and CEO Tomas Byrnes, a U.S. Army veteran and multiple-patent holder, with Paul Mockapetris, the inventor of DNS, serving as Chief Scientist.

ThreatSTOP serves a diversified customer base across healthcare (Geisinger), education (community colleges/universities), managed hosting (Armor), utilities (South Coast Water District), energy (Phoenix Energy), and global enterprises, with additional reach through Managed Service Providers via a dedicated MSP channel and tiered partner program. Revenue is generated primarily through annual subscription licensing, with AWS Marketplace monthly subscriptions as a secondary stream, and a freemium entry point via Community Edition and free trial. Pricing is quote-based with stated positioning of 'enterprise PDNS at SMB prices.' Go-to-market combines direct enterprise field sales, AWS Marketplace self-service activation, channel partners and MSPs, and online self-serve registration with sub-15-minute setup. The company reports customer outcomes including 90% reduction in malware-related help desk tickets and, in Armor's case, 41% of attacks filtered and 138,000+ daily attacks blocked.

The company is privately held, with its only disclosed funding round of $10.75M in September 2015 from investors including early Google backers, and operates with 11-50 employees and a global footprint including a Japan/Far East country management presence.

Name

ThreatSTOP

Legal name

ThreatSTOP Inc.

Website

https://threatstop.com

Company type

Private

Founded year

2009

Operating status

Operating

Headcount range

11–50 employees

Short description

ThreatSTOP is a Carlsbad-based cybersecurity company founded in 2009 that delivers Protective DNS and IP-layer threat intelligence, aggregating 900+ feeds to automatically enforce blocking policies across DNS servers, firewalls, routers, and AWS cloud infrastructure for enterprise, SMB, MSP, healthcare, and education customers.

Ownership category

akta.pro rank

Product category

Threat Intelligence & Network Security

NAICS

Security Systems Services (56162), Computer Systems Design and Related Services (5415)

SIC

Services-Computer Programming Services (7371)

akta.pro primary industry

DNS Security Appliances (HDAFAFAK)

akta.pro secondary industries

Cloud Network Security (Microsegmentation, Cloud Firewall, WAF, DDoS) (HDABAHAJ), Network Security Managed Services (Firewall/IDS/IPS/SASE) (BPAEADAG)

Keywords

• Protective DNS security
• Threat intelligence platform
• DNS firewall protection
• IP threat defense
• Network security software

Headquarters

HQ city

Carlsbad

HQ country

United States

HQ region

North America

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations

Revenue model

1. Subscription Licensing: Annual subscription model with fees paid in advance for the Initial Term. Subsequent years invoiced annually, 60 days in advance of anniversary date. Payment terms include 30 days from invoice date. Supports both direct purchase and through authorized resellers.
2. AWS Marketplace Subscriptions: Managed rules available as subscriptions through AWS Marketplace including CoreThreats, Malicious Bots, ITAR/OFAC, and HTTP threat rule sets. Customers activate within their AWS account.
3. Enterprise and SMB Plans: Tiered subscription plans with enterprise PDNS at SMB prices. Different pricing for all sizes of customers. Free trial and Community Edition available for evaluation.

Pricing tiers

Go-to-market motion5 records

Distribution channels5 records

Marketing channels7 records

Core offering

ThreatSTOP operates a cloud-based automated threat intelligence platform that aggregates 900+ threat feeds and converts them into enforcement policies automatically pushed to customer firewalls, routers, DNS servers, and endpoints. Its core products are Protective DNS (DNS Defense and DNS Defense Cloud) for blocking malicious domains at the DNS layer and IP Defense for blocking criminal infrastructure at the network perimeter, complemented by managed rules for AWS WAF and AWS Network Firewall available on AWS Marketplace. The platform targets enterprises, healthcare, education, MSPs, and SMBs, providing real-time threat filtering with setup in under 15 minutes.

Product overview

ThreatSTOP offers a cloud-based threat intelligence platform with a modular architecture consisting of core products (DNS Defense, DNS Defense Cloud, IP Defense) that work together to provide comprehensive network protection. The platform converts threat data from 800+ sources into enforcement policies and automatically updates customer network devices including firewalls, routers, DNS servers, and cloud services like AWS WAF and AWS Network Firewall. DNS Defense provides on-premises DNS filtering while DNS Defense Cloud offers cloud-based DNS protection; both leverage the same curated threat intelligence. IP Defense extends protection to firewalls and routers at the IP layer. AWS-specific integrations include IP Defense for AWS WAF and DNS Defense for Route53. The platform supports over 900 threat intelligence feeds and provides 600+ customizable policies across 60+ categories.

Differentiator

Problem solved

Functional benefit

Brands

• DNS Defense: On-premises DNS protection solution applying curated threat intelligence to existing DNS infrastructure.
• DNS Defense Cloud
• IP Defense
• ThreatSTOP Platform
• CheckIOC
• FirstSTOP

Products and services

• ThreatSTOP Platform Cloud-based automated threat intelligence platform that aggregates 900+ feeds, converts the latest threat data into enforcement policies, and automatically updates firewalls, routers, DNS servers, and endpoints to stop attacks before they become breaches. Supports 600+ customizable policies across 60+ categories.
• DNS Defense On-premises DNS protection solution that integrates with existing DNS servers (including Response Policy Zones and Active Directory DNS) to proactively block malicious domains, phishing, ransomware, malware, and command-and-control communications at the DNS layer.
• DNS Defense Cloud Cloud-based DNS protection service that redirects DNS queries through ThreatSTOP's intelligence-backed resolvers, providing continuous protection for distributed workforces and roaming devices without deploying or managing own DNS infrastructure.
• IP Defense IP-based threat intelligence solution that integrates with firewalls, routers, switches, and IPS devices to filter inbound and outbound traffic and block connections to criminal infrastructure at the IP layer, regardless of protocol or encryption.
• AWS WAF Managed Rules Managed rule subscriptions for AWS Web Application Firewall delivering real-time threat intelligence to AWS WAF enforcement points, including four bundles: CoreThreats (800+ curated feeds), Malicious Bots Rules, ITAR and OFAC Compliance Rules, and New and Active HTTP Threats.
• AWS Network Firewall Managed Rules Managed rules for AWS Network Firewall delivering continuously updated DNS and IP threat indicators, allowing AWS customers to automatically block high-risk domains and IP addresses while maintaining OFAC and ITAR compliance.
• DNS Defense for Route53 DNS firewall protection specifically designed for AWS Route53 environments, enabling customers to leverage ThreatSTOP's threat intelligence within AWS-managed DNS infrastructure.
• FirstSTOP Threat intelligence subscription service providing access to ThreatSTOP's indicator-of-compromise (IoC) database for threat research and investigation use cases.
• Community Edition Free community tier of the ThreatSTOP service for individual users and small deployments, with usage restrictions on number/type of devices, policy elements, custom lists, reporting, and support.
• App Control Bundle ThreatSTOP rule bundle that helps organizations manage and secure remote control applications to prevent compromise of remote access tools.
• CheckIOC Free online tool that allows users to check if an IP address or domain is in ThreatSTOP's threat targets database, providing instant threat intelligence lookup.

Quantifiable outcome

• Blocks 138,000+ daily attacks per customer (Armor example)
• +4 more outcomes

Named customers6 records

Segments5 records

Ideal customer profiles5 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration13 records

AI capability1 record

Feature10 records

Partnerships

Eight partnerships are on record, tiered flagship, strategic, minor, core and major.

• AWS (Amazon Web Services)flagshipTechnology or Integration · 19 November 2025ThreatSTOP announced general availability of managed rules for AWS Network Firewall in AWS Marketplace, expanding protection beyond AWS WAF to include real-time DNS and IP threat intelligence. Allows AWS customers to automatically block high-risk domains and IP addresses with OFAC and ITAR compliance.
• Glasswing AIstrategicStrategic or Co-development Partner · 19 May 2025Strategic partnership announced to revolutionize enterprise AI vendor management and security. Combined approach to address AI-related security challenges for enterprise customers.
• 7FigureMSPminorGTM or Marketing Partner · 9 August 2024ThreatSTOP is a sponsor of 7FigureMSP's Mile High MRR event for IT & MSP business owners in Denver. Partnership aimed at MSP channel development and recurring revenue growth opportunities.
• AWS (Amazon Web Services)flagshipTechnology or Integration · 11 March 2021Initial release of managed rules for AWS Web Application Firewall (WAF). ThreatSTOP uses real-time threat intelligence to deliver live, highly curated TI to AWS WAF security enforcement points. Multiple rule bundles available: CoreThreats, Malicious Bots, ITAR/OFAC, and HTTP threats.
• Farsight SecuritycoreTechnology or IntegrationThreatSTOP partnered with Farsight Security to provide an automated way to take security action against Newly Observed Domains (NOD). Farsight's DNS intelligence enhances ThreatSTOP's threat detection capabilities.
• Bambenek LabscoreTechnology or IntegrationBambenek Labs provides reliable, relevant threat intelligence feeds that keep ThreatSTOP customers current and protected against attacker infrastructure. Integrated into ThreatSTOP's 900+ feed aggregation.
• CrowdStrikecoreTechnology or IntegrationNetwork layer breach prevention partnership. Operationalizes threat intelligence to prevent breaches with integrated threat intelligence from CrowdStrike Falcon X. Part of ThreatSTOP's multi-source intelligence approach.
• ArmormajorChannel Partner/ Reseller/ DistributorArmor, a managed cloud IaaS provider, uses ThreatSTOP to filter and block communication with untrustworthy IP addresses. After implementing ThreatSTOP, Armor blocks over 138,000 daily attacks and total attacks decreased by 40%.

Scale indicators10 records

Recent moves6 records

Expansion highlights6 records

Broad incumbents

• Cisco Umbrella (Cisco Secure Access): Cisco's flagship DNS-layer security and cloud-delivered Secure Service Edge (SSE) platform. Direct competitor in Protective DNS, but bundled within Cisco's massive networking and security portfolio. ThreatSTOP competes on price and specialization against Cisco's enterprise-scale offering.
• Zscaler ZIA / Zscaler Internet Access: Cloud-native SSE/SASE platform with integrated DNS filtering, URL filtering, and threat intelligence. Competes with ThreatSTOP's PDNS and IP Defense capabilities as part of a broader Zero Trust platform serving enterprise customers.
• Palo Alto Networks Advanced DNS Security: DNS-layer security offering within Palo Alto Networks' Prisma SASE platform. Direct overlap with ThreatSTOP's PDNS value proposition, but backed by much larger R&D and threat intelligence operations (Unit 42).
• Cloudflare Gateway (Zero Trust): Cloudflare's DNS filtering and secure web gateway as part of its broader Zero Trust platform. Competes with ThreatSTOP on DNS-layer security for SMB and enterprise, often bundled with Cloudflare's networking and security services.
• Akamai (Enterprise Threat Protector / Guardicore): Akamai's DNS security offering (formerly Enterprise Threat Protector) plus broader cloud security portfolio. Comparable threat intelligence-driven DNS protection capability, scaled within Akamai's CDN and security platform.

Direct peers

• Infoblox BloxOne Threat Defense: DNS-layer security and DDI (DNS, DHCP, IPAM) vendor offering threat intelligence-driven DNS firewalling. Highly comparable to ThreatSTOP's core PDNS and IP Defense products for enterprise customers.
• DNSFilter: Cloud-delivered Protective DNS service for MSPs and mid-market. Closest direct competitor to ThreatSTOP on price positioning, MSP channel focus, and product scope (DNS-layer threat filtering).
• BlueCat DNS Edge: Enterprise DNS and DDI vendor with DNS Edge security product offering threat intelligence at the DNS layer. Directly comparable to ThreatSTOP's DNS Defense and IP Defense for enterprise and MSP customers.
• WatchGuard DNSWatch / Firebox DNSWatchGO: DNS-layer security and content filtering integrated with WatchGuard firewall appliances. Competes in similar MSP and mid-market segment as ThreatSTOP with comparable threat intelligence-driven blocking capabilities.

Emerging players

• Quad9: Free, privacy-focused recursive DNS service with built-in threat intelligence blocking. Competes in DNS-layer protection space but as a free service rather than paid SaaS, representing a different monetization model.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks5 records

Key highlights7 records

Customer concentration

Compliance2 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles7 records

Funding overview

Funding rounds1 record

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about ThreatSTOP