Certus Cybersecurity
Certus Cybersecurity is a boutique product security consulting firm delivering penetration testing, threat modeling, secure code review, and GenAI security services to Fortune 100 technology, retail, banking, and global law firm clients across the US, Europe, Middle East, and Asia.
- Company typePrivate
- Founded2018
- HeadquartersRedwood City, United States
- Headcount11–50
- GTM typeB2B
- OfferingServices
What Certus Cybersecurity does
Certus Cybersecurity Solutions LLC is a boutique product security consulting firm headquartered at 303 Twin Dolphin Drive, Suite 600, Redwood City, California. Founded by Ryan McKamie (CEO) and Swapnil Deshmukh (CTO), both former Visa security directors, the firm specializes in deep technical security services across software, cloud, embedded/IoT, and GenAI/ML domains. Its client base is concentrated in Fortune 100 technology companies, Fortune 500 retailers, major banks, and global law firms, with delivery structured as long-term, on-site embedded engagements rather than transactional assessments.
The firm's service portfolio spans penetration testing, threat modeling (using ATLAS, STRIDE, and PASTA frameworks), secure code review, threat detection and response, embedded/IoT security assessments, and a productized GenAI/ML Security practice that includes Agent and Assistant AI Security and a self-developed GenAI threat taxonomy. Delivery methodology blends manual and automated testing, with consultants embedded inside client product and security teams to accumulate architectural and codebase context over multi-year engagements. Certus operates globally with active delivery presence in the United States, Europe, the Middle East, and Asia.
The business model is a quote-based, multi-year professional services model targeting large enterprises. Pricing is bespoke and consultation-led, with free initial consultations feeding into scoped engagements. The firm holds no disclosed outside funding and appears to operate as a bootstrapped entity. Both founders carry premier industry credentials — CISSP, QSA, CISM, CRISC, and CISA — and Swapnil Deshmukh is a co-author of the Hacking Exposed series, anchoring the firm's thought-leadership positioning in offensive security.
Certus Cybersecurity firmographics
Firmographics- Name
- Certus Cybersecurity
- Legal name
- Certus Cybersecurity Solutions LLC
- Website
- https://certuscyber.com
- Company type
- Private
- Founded year
- 2018
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- Certus Cybersecurity is a boutique product security consulting firm delivering penetration testing, threat modeling, secure code review, and GenAI security services to Fortune 100 technology, retail, banking, and global law firm clients across the US, Europe, Middle East, and Asia.
- Ownership category
- akta.pro rank
Certus Cybersecurity industry classification
Industry- Product category
- Cybersecurity Consulting Services
- NAICS
- Computer Systems Design and Related Services (5415), Other Computer Related Services (541519)
- SIC
- Services-Computer Integrated Systems Design (7373)
- akta.pro primary industry
- Vulnerability Management & Penetration Testing Services (BPAEADAD)
- akta.pro secondary industry
- Vulnerability Assessment, Security Audits & Compliance Testing (BPAKAHAG)
Keywords
Where Certus Cybersecurity is headquartered
LocationHeadquarters
- HQ city
- Redwood City
- HQ country
- United States
- HQ region
- North America
Offices2 records
Markets served
Certus Cybersecurity business model
Business model- GTM type
- B2B
- Offering type
- Services
- Cost components
- Personnel, Operations, Marketing or Sales, Technology or R&D
Revenue model
- Security Consulting and Professional Services: Certus Cybersecurity generates revenue by providing the services of its employees (security consultants and project managers) on an engagement basis to execute product security services including penetration testing, secure code review, threat modeling, cloud security assessments, and embedded/IoT security testing. Engagements range from short-term assessments to long-term on-site dedicated placements at Fortune 100 clients. Revenue is derived from professional services fees charged for security assessments, testing, and consulting engagements.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Other | Multi-year contract | Professional security consulting services — pricing not publicly disclosed |
Go-to-market motion1 record
Distribution channels3 records
Marketing channels6 records
Certus Cybersecurity product offering
Product offeringCore offering
Certus Cybersecurity delivers product security consulting services that combine expert manual testing with automation to identify and remediate security vulnerabilities across software, hardware, cloud, and AI/ML environments. The firm is organized around five service practices: Software Security, Cloud Security, Threat Detection and Response, Embedded Security, and GenAI/ML Security, with engagements ranging from short-term penetration tests to long-term dedicated on-site placements.
Product overview
Certus Cybersecurity is a cybersecurity consulting services provider offering a portfolio of security services organized around five core practice areas: Software Security, Cloud Security, Threat Detection and Response, Embedded Security, and GenAI/ML Security. The company provides services including penetration testing, secure code review, threat modeling, cloud security assessment, and specialized GenAI security services. The offering operates as a consulting services model rather than a software product platform.
Differentiator
Problem solved
Functional benefit
Products and services
- Software Security Security testing services including threat modeling, secure code review, and penetration testing for software applications, targeting enterprise clients building software products.
- Cloud Security Cloud security assessment, configuration review, and penetration testing services to identify weak or missing security controls and misconfigurations for enterprise clients operating in cloud environments.
- Threat Detection and Response Comprehensive threat detection, monitoring, and incident response capabilities including threat hunting, managed detection and response (MDR), and continuous monitoring for enterprise clients.
- Embedded Security Hardware security services including device penetration testing and device design review for IoT and embedded systems, targeting manufacturers of connected devices and embedded products.
- GenAI/ML Security Specialized services to uncover GenAI vulnerabilities including chatbots security, AI/ML pipeline security, agent and assistant AI security, and GenAI threat modeling for enterprise clients deploying AI/ML systems.
Quantifiable outcome
- Identification of three critical severity vulnerabilities impacting client assets within the first 60 days of an engagement for a Fortune 500 retailer, including a critical issue in backend APIs handling payment certificate encryption.
- +4 more outcomes
Companies that use Certus Cybersecurity
Customer profileNamed customers4 records
Segments3 records
Ideal customer profiles3 records
Certus Cybersecurity technology and API
TechnologyTechnology focussed No
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Feature5 records
Certus Cybersecurity partnerships and signals
Strategic signalScale indicators4 records
Recent moves5 records
Expansion highlights4 records
Certus Cybersecurity competitors and assessment
Company assessmentDirect peers
- Bishop Fox: Elite cybersecurity consulting firm specializing in penetration testing, red teaming, and product security assessments. Directly comparable to Certus as a boutique, talent-led security services firm serving Fortune 500 enterprises with similar consulting-focused operating model.
- Trail of Bits: High-end security research and consulting firm offering application security, cryptographic review, and advanced penetration testing. Comparable to Certus given similar talent-driven model, strong thought leadership, and focus on sophisticated enterprise and blockchain clients.
- NCC Group: Global cybersecurity consulting firm providing penetration testing, threat modeling, and product security services. Comparable to Certus as both offer enterprise-focused security consulting with similar penetration testing and threat modeling service lines.
- NetSPI: Penetration testing and attack surface management firm serving Fortune 500 enterprises. Comparable to Certus as both focus heavily on offensive security testing and serve large enterprise clients with similar service offerings.
- Cure53: Specialized web and application security consulting firm based in Berlin. Comparable to Certus given similar boutique scale, technical depth in penetration testing, and global enterprise client base.
Broad incumbents
- Coalfire: Larger cybersecurity advisory firm offering penetration testing, compliance, and risk assessment services. Comparable to Certus as a broader incumbent in the same enterprise security consulting space, though with more diverse service lines including GRC.
- Mandiant (Google Cloud): Major incident response and cybersecurity consulting firm, now part of Google Cloud. Comparable to Certus given overlap in threat detection, incident response, and security consulting services; competes for similar enterprise clients though at much larger scale.
- Optiv: Large cybersecurity solutions integrator offering advisory, managed security, and professional services. Comparable to Certus as a broader incumbent in enterprise security services, though Optiv operates at much larger scale with a wider portfolio.
Emerging players
- HackerOne: Bug bounty and continuous security testing platform with professional services. Comparable to Certus through overlap in vulnerability discovery services, though HackerOne pursues a platform-based approach rather than pure consulting.
- Synack: Crowdsourced security testing platform with enterprise penetration testing services. Comparable to Certus in the penetration testing and vulnerability assessment space, though Synack combines technology with human testers in a hybrid model.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat3 records
Key risks6 records
Key highlights7 records
Customer concentration
Certus Cybersecurity social profiles
Digital presenceCertus Cybersecurity financial estimates
Financial estimateRevenue estimate
Valuation estimate
Certus Cybersecurity leadership team
Management profileNumber of profiles
Profiles2 records
Certus Cybersecurity funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Certus Cybersecurity M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Certus Cybersecurity
What does Certus Cybersecurity do?
Certus Cybersecurity delivers product security consulting services that combine expert manual testing with automation to identify and remediate security vulnerabilities across software, hardware, cloud, and AI/ML environments. The firm is organized around five service practices: Software Security, Cloud Security, Threat Detection and Response, Embedded Security, and GenAI/ML Security, with engagements ranging from short-term penetration tests to long-term dedicated on-site placements.
Is Certus Cybersecurity a public or private company?
Certus Cybersecurity is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was Certus Cybersecurity founded?
Certus Cybersecurity was founded in 2018. It employs 11 to 50 people.
Where is Certus Cybersecurity based?
Certus Cybersecurity is headquartered in Redwood City, United States, in the North America region.
How does Certus Cybersecurity make money?
One revenue line is on record: security Consulting and Professional Services.
Who are Certus Cybersecurity's main competitors?
Direct peers on record are Bishop Fox, Trail of Bits, NCC Group, NetSPI and Cure53. Broad incumbents are Coalfire, Mandiant (Google Cloud) and Optiv. Emerging players are HackerOne and Synack.
Does Certus Cybersecurity have an API?
No public API is recorded for Certus Cybersecurity.
What industry is Certus Cybersecurity in?
Certus Cybersecurity's product category is Cybersecurity Consulting Services. Its primary akta.pro industry code is BPAEADAD, Vulnerability Management & Penetration Testing Services, with a secondary code of BPAKAHAG, Vulnerability Assessment, Security Audits & Compliance Testing. Its NAICS code is 5415 and its SIC code is 7373.