Cyentia Institute

What Cyentia Institute does

Cyentia Institute is a privately held cybersecurity research firm founded in 2016 and headquartered in Leesburg, Virginia. Its core business is producing data-driven cyber risk research and intelligence, anchored by the IRIS (Information Risk Insights Study) flagship series sponsored by CISA since 2022. The firm monetizes through three channels: (1) sponsored research engagements in which vendors such as Veracode, Cobalt, RiskRecon, Living Security, Mimecast, and SecurityScorecard commission independent analyses of their telemetry (e.g., State of Software Security, State of Pentesting, Risky Business, Ripples Across the Risk Surface, Global 2000 Supply Chain Cyber Risk); (2) the Retina subscription, an annual recurring intelligence product that delivers sector- and size-calibrated incident frequency and loss distributions for use in cyber risk quantification (CRQ) models; and (3) a free membership tier that grants access to a RAG-based AI Research Assistant and serves as a funnel for paid subscriptions.

The technology stack combines Cyentia's proprietary methodology over multi-source datasets (Zywave Cyber Loss Data with 150,000+ incidents, Feedly threat intelligence, Board Cybersecurity governance data) with classification models, NLP, manual analyst review, and a GPT-4o-backed research assistant that supports both retrieval and structured SQL aggregation queries against IRIS and Retina content. Cyentia's customer base spans cyber risk and insurance professionals, security technology vendors, government agencies, and global advisory firms such as KPMG and Cisco, all of whom cite the company's empirical grounding as a differentiator from vendor-produced security research. Despite a 1-10 headcount, the firm maintains a substantial multi-year publication cadence, strategic technology and academic partners, and a recognizable brand within the cyber risk quantification community.

Name

Cyentia Institute

Legal name

Cyentia Institute

Website

https://cyentia.com

Company type

Private

Founded year

2016

Operating status

Operating

Headcount range

1–10 employees

Short description

Cyentia Institute is a private cyber risk research firm that produces CISA-sponsored empirical research (IRIS series) and a Retina subscription intelligence service, serving CISOs, cyber insurers, and security vendors with sector-calibrated loss and frequency data.

Ownership category

akta.pro rank

Product category

Cybersecurity Research and Risk Analytics

NAICS

Marketing Research and Public Opinion Polling (541910), Other Scientific and Technical Consulting Services (54169)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Cybersecurity & Identity Consulting (BPAHAEAG)

akta.pro secondary industries

Insider Threat Program Design & Risk Assessments (BPAKADAM), Threat Intelligence Services (BPAEADAC)

Keywords

• Cyber risk research
• Cyber risk intelligence
• Security data analytics
• Cyber incident analysis
• Risk quantification services

Headquarters

HQ city

Leesburg

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure, Others

Revenue model

1. Sponsored Research Reports: Companies commission Cyentia to analyze their unique security telemetry/data and produce independent research reports. Cyentia provides analytical rigor, domain expertise, and independent credibility. Partners include Veracode, Cobalt, Living Security, RiskRecon, SecurityScorecard, Mimecast, and others.
2. Retina Intelligence Subscription: Premium subscription service providing sector-specific cyber risk data and analysis. Delivers quarterly reports on incident frequency, loss distributions, risk trends, and CRQ model parameters. Includes AI assistant and expert analyst access.
3. Free Membership Program: Free membership provides baseline access to research reports, AI research assistant, data visualizations, and newsletter. Serves as lead generation for premium Retina services.

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels9 records

Core offering

Cyentia Institute conducts independent, data-driven cybersecurity research and delivers cyber risk intelligence through subscription services, flagship research reports (notably the CISA-sponsored IRIS series), and sponsored research engagements with security vendors. Its offerings center on empirical incident frequency and loss distributions, AI-assisted research tools, and analytics derived from datasets covering 150,000+ security incidents.

Product overview

Cyentia Institute operates as a cyber risk research and intelligence organization offering a portfolio of products and services centered on empirical data-driven analysis. The core offerings include the IRIS (Information Risk Insights Study) flagship research report series and the Retina cyber risk intelligence subscription service, which together provide historical incident data, loss distributions, and risk quantification inputs for organizations. A free membership program provides access to the AI-powered Cyentia Research Assistant, additional data visualizations, and extended analysis beyond published reports. The company also produces sponsored research reports in partnership with industry vendors (Cobalt, Veracode, RiskRecon, Living Security, Mimecast, SecurityScorecard) covering specific domains including pentesting, software security, third-party risk, human risk, and supply chain security. All offerings are grounded in rigorous data analysis rather than theoretical threat models.

Differentiator

Problem solved

Functional benefit

Brands

• Retina: Cyber risk intelligence subscription service that delivers empirical incident frequency and loss distributions for organizations, grounded in IRIS research data. Provides quarterly CRQ models, risk baselines, and AI-assisted queries.
• IRIS
• Cyentia Research Assistant

Products and services

• Retina Cyber Risk Intelligence

Quantifiable outcome

• IRIS 2025 shows 650% increase in security incidents since 2008; median losses increased from $190K to nearly $3M (15x)
• +5 more outcomes

Named customers6 records

Segments5 records

Ideal customer profiles4 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability2 records

Feature4 records

Partnerships

15 partnerships are on record, tiered core, flagship and minor.

• AxiocoreTechnology or Integration · 1 August 2023Axio partnered with Cyentia to enhance data-driven cyber risk quantification. The partnership aims to provide information security professionals, C-suite executives, and boards with increased confidence in cyber decision-making by combining Axio's CRQ platform with Cyentia's empirical research.
• CISA (Cybersecurity and Infrastructure Security Agency)coreStrategic or Co-development Partner · 1 January 2022CISA has sponsored the IRIS research series since 2022, providing federal support for empirical cyber risk analysis. The Cybersecurity Division and Office of the Chief Economist at CISA enable Cyentia to devote extensive resources to this research that aids community efforts to manage cyber risk.
• VeracodeflagshipStrategic or Co-development PartnerVeracode partners with Cyentia for the annual State of Software Security report. Cyentia analyzes Veracode's cloud platform data (1.3M+ applications, 100M+ findings) to produce independent research on application security trends, security debt, and remediation patterns.
• Cobalt SecurityflagshipStrategic or Co-development PartnerCobalt partners with Cyentia for the annual State of Pentesting Report. Cyentia analyzes data from 16,500+ penetration tests across nearly 3,000 organizations. Joint webinars and promotional activities accompany report releases.
• Living SecuritycoreStrategic or Co-development PartnerLiving Security partners with Cyentia for the Risky Business report on human risk management. Cyentia analyzes data from Living Security's Unify platform covering 100+ organizations and 200+ risk signals to produce insights on employee security behavior.
• RiskRecon by MastercardcoreStrategic or Co-development PartnerRiskRecon partners with Cyentia on the Ripples Across the Risk Surface research analyzing multi-party cyber incidents. Joint analysis of 1,500+ ripple incidents spanning 2008-2024 examining how security failures propagate through supply chains.
• SecurityScorecardcoreStrategic or Co-development PartnerSecurityScorecard collaborates with Cyentia on Global 2000: Supply Chain Cyber Risk report analyzing the world's largest companies and their third-party risk exposure. Analyzes 331 confirmed breaches and supply chain ecosystems.
• MimecastcoreStrategic or Co-development PartnerMimecast partners with Cyentia for the Exposing Human Risk report. Cyentia analyzes Mimecast's global telemetry spanning 42,000+ organizations to examine human risk factors in cybersecurity including phishing, malware, and browsing behaviors.
• XM CyberminorStrategic or Co-development PartnerXM Cyber partnered with Cyentia for the Navigating Paths of Risk: State of Exposure Management 2023 report analyzing how organizations can focus risk management on critical assets leading to exposures.
• Elevate SecurityminorStrategic or Co-development PartnerElevate Security partnered with Cyentia for the High Risk Users and Where to Find Them study examining eight years of user risk data from 2014-2022.
• Tidal CyberminorStrategic or Co-development PartnerTidal Cyber collaborated with Cyentia on MITRE ATT&CK framework analysis examining how adversaries attack organizations and what defenses should be prioritized.
• CiscominorGTM or Marketing PartnerCisco's Wendy Nather (Head of Advisory CISOs) provided testimonial for Cyentia's sponsored research capabilities. Occasional collaboration on industry thought leadership.
• Zywave (Advisen)coreTechnology or IntegrationZywave's Cyber Loss Data (formerly Advisen) provides the foundational dataset for Cyentia's research. The dataset contains 150,000+ security incidents spanning decades with financial losses and firmographic data, extensively used by cyber insurers.
• FeedlycoreTechnology or IntegrationFeedly for Threat Intelligence provides continuous threat intelligence scanning across thousands of open sources using 1,000+ AI models. Cyentia uses this to enrich incidents with contextual threat information including attacks, threat actors, TTPs, and IOCs.
• Board CybersecuritycoreTechnology or IntegrationBoard Cybersecurity provides governance-oriented platform aggregating cyber risk signals from SEC disclosures, state AG notifications, news reports, and governance filings. Currently spans 12,000 companies and 9,000 incidents. Used in both frequency and loss models.

Scale indicators6 records

Recent moves6 records

Expansion highlights6 records

Broad incumbents

• Recorded Future: Recorded Future (now Mastercard) is a large threat intelligence platform that produces original cyber research and intelligence products. It overlaps with Cyentia's threat-informed risk analytics and is a broader incumbent serving similar enterprise security buyers.
• SecurityScorecard: SecurityScorecard is a cyber risk ratings platform that partners with Cyentia on the Global 2000 supply chain research. It is a broader incumbent in cyber risk quantification with overlapping enterprise buyers and a substantial independent research output.
• Bitsight: Bitsight is a leading cyber risk ratings and analytics platform serving enterprise security and insurance buyers. It competes with Cyentia's risk intelligence offerings at the buyer level and produces its own empirical research, making it a broader incumbent peer.
• Mandiant (Google Cloud): Mandiant (now part of Google Cloud) publishes influential cyber threat intelligence and incident datasets (e.g., M-Trends). It overlaps with Cyentia's empirical cyber incident research and serves similar enterprise and government security buyers.
• Forrester Research: Forrester produces cyber risk and security research reports and advisory for enterprise technology buyers. It overlaps with Cyentia in serving security and risk leaders with subscription research, though at much greater scale and breadth.
• Gartner: Gartner is the largest IT research and advisory firm, producing extensive cybersecurity and risk management research for enterprise buyers. It competes with Cyentia for budget allocated to cyber risk intelligence among CISOs and risk leaders.

Direct peers

• Axio: Axio is a CRQ software vendor that partnered with Cyentia in 2023 to integrate empirical research into its platform. Both serve CISOs and boards with data-driven cyber risk quantification, making Axio a direct peer in the CRQ solution stack.
• Verizon (DBIR): Verizon's Data Breach Investigations Report is the most widely cited empirical cybersecurity incident dataset. Cyentia was founded by Wade Baker, the DBIR's architect, and IRIS is positioned as a continuation/extension of that work, making Verizon DBIR the closest direct peer in mission and methodology.
• Kovrr: Kovrr provides a CRQ platform with empirical cyber incident frequency and loss models for enterprise risk quantification. Like Cyentia's Retina service, Kovrr sells data-driven loss distributions and risk quantification inputs to CISOs and insurers, overlapping directly in product and buyer.

Emerging players

• KELA: KELA provides cybercrime and dark web intelligence, including incident data and threat actor monitoring. It overlaps with Cyentia in providing empirical threat data inputs to cyber risk quantification, though it is more focused on threat intelligence than full CRQ datasets.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat5 records

Key risks5 records

Key highlights6 records

Customer concentration

• YouTubeyoutube.com/@cyentia
• LinkedInlinkedin.com/company/cyentia-institute
• Xx.com/cyentiainst

Revenue estimate

Valuation estimate

Number of profiles

Profiles6 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Cyentia Institute