ControlPlane
ControlPlane is a London-based cloud native security consultancy delivering Kubernetes, AI, and software supply chain security services to financial institutions, governments, and technology firms, supplemented by enterprise support products for Flux CD and OpenBao open-source projects.
- Company typePrivate
- Founded2017
- HeadquartersLondon, United Kingdom
- Headcount51–100
- GTM typeB2B
- OfferingServices
What ControlPlane does
ControlPlane is a London-headquartered cloud native security consultancy founded in 2017 that secures Kubernetes, container, and GitOps environments for financial institutions, government agencies, energy companies, and technology firms. The firm delivers professional services including threat modeling, Kubernetes and AI/ML penetration testing, red and purple team exercises, software supply chain security assessments, CRA/DORA/NIS2/EU AI Act advisory, and DevSecOps platform engineering, targeting regulated buyers facing compliance and emerging AI risk exposure. Its technology stack centers on CNCF open-source projects (Kubernetes, Flux CD, SPIFFE/SPIRE, OpenBao) augmented by proprietary tooling including Netassert for zero trust network policy validation and sandbox-probe for AI agent sandbox testing.
The firm complements consulting engagements with two enterprise support products — Enterprise for Flux CD and Enterprise for OpenBao — that deliver FIPS 140-3 validated, zero-CVE distributions, rapid CVE remediation, and compliance workflow integration for buyers who cannot rely on upstream community builds alone. The OpenBao offering was launched in March 2026 in direct response to IBM's $6.4 billion acquisition of HashiCorp, positioning ControlPlane to capture Vault migration demand at a cited 10x cost saving. In February 2026 the firm announced a strategic partnership with Check Point Software Technologies to deliver a joint AI security framework combining Check Point's AI-native threat prevention platform with ControlPlane's DevSecOps expertise.
Revenue is generated through three streams: project-based and retainer professional services, annual enterprise support subscriptions for the Flux CD and OpenBao products, and instructor-led training (including courses authored for the Linux Foundation). The firm is privately held with no disclosed external funding, employs CNCF Flux core maintainers, authored the Linux Foundation's KCSA certification exam, and operates through wholly-owned subsidiaries in the United States and New Zealand to serve clients across EMEA, North America, and Asia-Pacific.
ControlPlane firmographics
Firmographics- Name
- ControlPlane
- Legal name
- ControlPlane Group Limited
- Website
- https://control-plane.io
- Company type
- Private
- Founded year
- 2017
- Operating status
- Operating
- Headcount range
- 51–100 employees
- Short description
- ControlPlane is a London-based cloud native security consultancy delivering Kubernetes, AI, and software supply chain security services to financial institutions, governments, and technology firms, supplemented by enterprise support products for Flux CD and OpenBao open-source projects.
- Ownership category
- akta.pro rank
ControlPlane industry classification
Industry- Product category
- Cloud Native Security Consulting
- NAICS
- Computer Systems Design and Related Services (54151)
- SIC
- Services-Computer Integrated Systems Design (7373)
- akta.pro primary industry
- Cloud Security Services (Posture Mgmt, Workload Protection) (BPAKAHAK)
- akta.pro secondary industries
- Cloud Compliance, Audit & Continuous Controls Monitoring (CCM/GRC) (HDABAHAI), Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ)
Keywords
Where ControlPlane is headquartered
LocationHeadquarters
- HQ city
- London
- HQ country
- United Kingdom
- HQ region
- Europe
Offices4 records
Markets served
ControlPlane business model
Business model- GTM type
- B2B
- Offering type
- Services
- Cost components
- Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure
Revenue model
- Cybersecurity Consulting Services: Professional services engagements including threat modeling, penetration testing, red/purple team exercises, cloud native security assessments, and DevSecOps transformations. Typically structured as project-based or retainer engagements with enterprise clients.
- Enterprise Support Subscriptions: Annual enterprise support subscriptions for open-source projects including Enterprise for OpenBao and Enterprise for Flux CD, providing security hardening, CVE remediation, and compliance features.
- Training and Education: Instructor-led and hands-on training courses covering Kubernetes security, threat modeling, zero trust, and DevSecOps practices. Also authored courses for Linux Foundation.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Enterprise support subscriptions for open-source projects (OpenBao, Flux CD) |
Go-to-market motion2 records
Distribution channels5 records
Marketing channels7 records
ControlPlane product offering
Product offeringCore offering
ControlPlane is a cloud native security consultancy that delivers expert cybersecurity advisory, threat modelling, penetration testing, and DevSecOps services for Kubernetes and cloud native platforms. In addition to consulting, it offers two enterprise support subscriptions — Enterprise for Flux CD and Enterprise for OpenBao — providing security-hardened, FIPS 140-3 validated distributions of open-source CNCF projects.
Product overview
ControlPlane is a cloud native security consulting and advisory firm offering a portfolio of expert consultancy services complemented by two enterprise support products. The core consultancy services include Threat Modelling, AI Security, Pentesting and Red Team, CRA & OSS Compliance, Platform Engineering, Software Supply Chain Security, Cloud Native Security Assurance, DevOps and Deployment, Red and Purple Teams, Advisory Services, and Training. These services are delivered by a focused team of cloud native security experts who work with organizations to build and assure mission-critical platforms. The two enterprise products—Enterprise for Flux CD and Enterprise for OpenBao—provide sustained enterprise-grade support, security hardening, and compliance capabilities for specific open-source projects, functioning as add-on support layers atop the consultancy practice.
Differentiator
Problem solved
Functional benefit
Brands
- Enterprise for Flux CD: Enterprise support and security offering for the Flux CD GitOps continuous delivery platform
- Enterprise for OpenBao
Products and services
- Threat Modelling Structured security assessment service that identifies and isolates critical security threats through formal threat analysis methodologies, delivered to enterprise clients operating cloud native platforms.
- AI Security Expert consultancy for securing AI/ML-enabled systems, covering agentic workflow security architecture, prompt injection defence, adversarial red teaming of LLMs, EU AI Act readiness, and secure AI/ML pipelines.
- Pentesting and Red Team Kubernetes and cloud system security testing and training services, including purple team collaboration, breach simulation, and incident response exercises for enterprise environments.
- CRA & OSS Compliance EU Cyber Resilience Act advisory and secure open-source software supply chain compliance services for organizations adopting or distributing open-source components.
- Platform Engineering Accelerated platform engineering and developer experience services emphasising security, policy-as-code, and infrastructure-as-code for cloud native platform teams.
- Software Supply Chain Security End-to-end secure software delivery service covering SBOM programmes, build assurance, policy-as-code enforcement, CVE-free base images, reachability analysis, and CRA readiness across the software supply chain.
- Cloud Native Security Assurance Enterprise security assessment services for cloud native infrastructure and applications, validating controls and posture across Kubernetes-based environments.
- DevOps and Secure Cloud Native Deployment Security-focused DevOps and cloud native deployment automation services implementing policy and infrastructure-as-code for secure application delivery.
- Red and Purple Teams Breach simulation, incident response testing, and training services combining offensive and defensive security collaboration for enterprise security teams.
- Advisory Services Trusted advisory and regulatory compliance services covering DORA, NIS2, CRA, and EU AI Act, with policy-as-code, continuous attestation, and immutable audit trails.
- Training Professional training courses covering Kubernetes security, cloud native security, and threat modelling methodologies, delivered as instructor-led and hands-on workshops.
- Enterprise for Flux CD Enterprise-grade support subscription for the CNCF Flux CD GitOps platform, providing security hardening, FIPS 140-3 validated distributions, zero-CVE releases, drift-proof auditable releases, progressive delivery, and compliance workflow integration.
- Enterprise for OpenBao Enterprise support subscription for the open-source OpenBao secrets management platform, providing security hardening, supply chain assurance, rapid CVE remediation, and optional FIPS 140-3 cryptographic compliance as a Vault alternative with claimed 10x savings versus IBM Vault.
Quantifiable outcome
- Secured AI workloads processing more than three million prompts per day in regulated financial services environment
- +2 more outcomes
Companies that use ControlPlane
Customer profileNamed customers12 records
Segments4 records
Ideal customer profiles4 records
ControlPlane technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
AI capability4 records
Feature5 records
ControlPlane partnerships and signals
Strategic signalPartnerships
Nine partnerships are on record, tiered flagship, core and minor.
- Check Point Software TechnologiesflagshipStrategic partnership to help enterprises securely deploy LLMs and agentic AI systems at scale. Combines Check Point's AI-native threat prevention platform with ControlPlane's cloud native and DevSecOps expertise. Addresses the growing 'AI readiness gap' with a regulator-ready security framework. ControlPlane has deployed Check Point's platform in a regulated financial services environment processing more than three million prompts per day.
- Amazon Web Services (AWS)coreAWS Partner with ControlPlane services available through AWS Marketplace including Enterprise for Flux CD. Joint go-to-market for AWS customers requiring Kubernetes and cloud native security expertise.
- Google CloudcoreGoogle Cloud Partner with designated partner page. Provides GKE security assessments, threat modeling, and Kubernetes security training for Google Cloud customers.
- Linux FoundationcoreLong-term relationship including KCSA exam authorship, Kubernetes security courseware development, and Flux project support. ControlPlane contributes to open-source security initiatives under Linux Foundation umbrella.
- CNCF (Cloud Native Computing Foundation)coreCNCF member and active contributor. ControlPlane employs Flux CD core maintainers and provides enterprise support for CNCF projects.
- OpenSSF (Open Source Security Foundation)coreOpenSSF member contributing to open-source security initiatives, best practices, and community efforts to improve security of open-source software.
- FINOS (Fintech Open Source Foundation)coreActive member contributing to AI Readiness SIG, Common Cloud Controls, and Compliant Financial Infrastructure initiatives for financial services.
- OpenUKminorUK-based open source advocacy organization with shared focus on open-source security and community engagement.
- Scott LogicminorCollaborated on Scottish Government identity and payments systems security architecture and platform integration projects.
Scale indicators3 records
Recent moves6 records
Expansion highlights7 records
ControlPlane competitors and assessment
Company assessmentDirect peers
- Trail of Bits: Boutique US cybersecurity consultancy with comparable size and similar tight focus on software assurance, threat modeling, and applied security research for crypto and cloud native systems. Highly analogous business model as a specialist security firm selling deep technical expertise rather than managed services.
- Praetorian: US-based cybersecurity consultancy delivering offensive security, purple teaming, and cloud security assessments directly comparable to ControlPlane's Penetesting & Red Team, Cloud Native Security Assurance, and AI Security practices. Targets similar regulated enterprise buyers with project-based engagements.
- Bishop Fox: Specialist offensive security consultancy with a similar boutique scale and reputation, providing penetration testing, red teaming, and product security services to Fortune 500 and high-tech clients - functionally overlapping with ControlPlane's red/purple team and AI red teaming offerings.
Broad incumbents
- NCC Group: Global, publicly listed cybersecurity consultancy and managed services firm with comparable threat modeling, penetration testing, and software escrow capabilities but at much greater scale and broader vertical coverage. Represents the established incumbent against which ControlPlane's focused, cloud native-only offering must compete for enterprise wallets.
- HashiCorp: Owner of Vault secrets management and Terraform, now part of IBM following the $6.4B acquisition. HashiCorp's Vault is the alternative to OpenBao, and HashiCorp's enterprise support model directly competes with ControlPlane's Enterprise for OpenBao and broader secrets/governance advisory.
- Snyk: Mature developer security platform covering SCA, SAST, container security, and IaC scanning - overlapping with ControlPlane's software supply chain, cloud native, and DevSecOps transformation services, though delivered primarily via SaaS tooling rather than bespoke consulting.
- Aqua Security: Established cloud native security platform vendor for containers and Kubernetes, directly overlapping with the runtime security and assurance engagements that sit at the core of ControlPlane's Cloud Native Security Assurance practice.
- WithSecure (formerly F-Secure): European-headquartered cybersecurity consultancy and managed detection vendor with comparable cloud security, threat modeling, and incident response capabilities, competing for the same pan-European enterprise and government engagements that ControlPlane pursues.
Emerging players
- Chainguard: Emerging vendor addressing software supply chain security with hardened, zero-CVE container images and SBOM tooling - directly adjacent to ControlPlane's Software Supply Chain Security and CVE-free base image work for regulated clients. Increasingly competes for the same CISO budget line.
- Lakera AI: Venture-backed AI security vendor featured by ControlPlane as a partner for prompt injection defense and AI sandboxing. Competes for the same AI/ML workload security budget that ControlPlane addresses via red teaming and AI security advisory under its Check Point partnership.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks6 records
Key highlights6 records
Customer concentration
ControlPlane social profiles
Digital presenceControlPlane compliance and trust
Trust signalCompliance1 record
ControlPlane financial estimates
Financial estimateRevenue estimate
Valuation estimate
ControlPlane leadership team
Management profileNumber of profiles
Profiles3 records
ControlPlane subsidiaries and ownership
Company hierarchySubsidiaries2 records
ControlPlane funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
ControlPlane M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about ControlPlane
What does ControlPlane do?
ControlPlane is a cloud native security consultancy that delivers expert cybersecurity advisory, threat modelling, penetration testing, and DevSecOps services for Kubernetes and cloud native platforms. In addition to consulting, it offers two enterprise support subscriptions — Enterprise for Flux CD and Enterprise for OpenBao — providing security-hardened, FIPS 140-3 validated distributions of open-source CNCF projects.
Is ControlPlane a public or private company?
ControlPlane is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was ControlPlane founded?
ControlPlane was founded in 2017. It employs 51 to 100 people.
Where is ControlPlane based?
ControlPlane is headquartered in London, United Kingdom, in the Europe region.
How does ControlPlane make money?
Three revenue lines are on record. Cybersecurity Consulting Services are the primary driver. The others are enterprise Support Subscriptions and training and Education.
Who are ControlPlane's main competitors?
Direct peers on record are Trail of Bits, Praetorian and Bishop Fox. Broad incumbents are NCC Group, HashiCorp, Snyk, Aqua Security and WithSecure (formerly F-Secure). Emerging players are Chainguard and Lakera AI.
Does ControlPlane have an API?
No public API is recorded for ControlPlane.
What industry is ControlPlane in?
ControlPlane's product category is Cloud Native Security Consulting. Its primary akta.pro industry code is BPAKAHAK, Cloud Security Services (Posture Mgmt, Workload Protection), with a secondary code of HDABAHAI, Cloud Compliance, Audit & Continuous Controls Monitoring (CCM/GRC). Its NAICS code is 54151 and its SIC code is 7373.