Cipher Tech Solutions

What Cipher Tech Solutions does

Cipher Tech Solutions is a privately held US defense and intelligence software company founded in 2006 and headquartered in Nyack, New York, with additional offices across the US defense corridor in Vienna (VA), Elkridge (MD), Huntsville (AL), Tampa (FL) and Melbourne (FL). The company's flagship product is ACCE (Automated Component and Configuration Extraction), a Python-based malware analysis framework that statically deobfuscates and unpacks malicious software and extracts configuration data such as Indicators of Compromise (IoCs). Unlike sandbox or antivirus tools, ACCE re-implements the algorithms malware uses to unpack itself, allowing it to bypass anti-analysis and anti-sandbox techniques; the framework is delivered as Docker-based micro-services triggered by YARA signatures and supports a custom multi-language deobfuscation tool called ctdeob. The ACCE module library has grown to more than 700 module groupings and 1,445+ module parsers covering malware families, threat actors, and attack vectors, with continuous monthly release updates. Customers include defense and intelligence organizations, corporate threat intelligence teams, and incident response teams. The IBM Security X-Force collaboration on the RoboSki packer (2021) demonstrates the technology's effectiveness in uncovering novel malware at scale.

Cipher Tech operates a sales-led, subscription-based business model with three ACCE tiers: Tier 1 (online hosted portal), Tier 2 (API integration), and Tier 3 (full offline source-code access for reverse engineering teams to author custom modules). Distribution is direct-to-organization with demo requests routed via [email protected]; a public Research ACCE instance is available for self-service evaluation. The company augments its commercial offering with an open-source GitHub presence (os_acce_parsers, ACCE IOCs) and a technical blog publishing release notes and malware analyses, which together act as content-marketing channels targeted at the security research community. The company is co-founded and led by CEO Keith Bertolino and CTO/founder Matthew Kowalski, and is described as founder-operated with no disclosed external funding or parent company.

Name

Cipher Tech Solutions

Legal name

Cipher Tech Solutions, Inc.

Website

https://ciphertechsolutions.com

Company type

Private

Founded year

2006

Operating status

Operating

Headcount range

51–100 employees

Short description

Cipher Tech Solutions is a privately held US defense and intelligence software company that builds ACCE, a static malware analysis framework for automating deobfuscation and extraction of Indicators of Compromise. It sells tiered subscriptions to defense, intelligence, and corporate security teams.

Ownership category

akta.pro rank

Product category

Cybersecurity Software

NAICS

Security Systems Services (except Locksmiths) (561621), Custom Computer Programming Services (541511)

SIC

Services-Prepackaged Software (7372), Services-Computer Integrated Systems Design (7373)

akta.pro primary industry

App Security, Compliance & Review Automation Platforms (BPAMADAJ)

akta.pro secondary industry

Cloud Identity & Access Management Infrastructure (IAM/IdP/MFA) (HDABAHAF)

Keywords

• Malware analysis software
• Digital forensics tools
• Threat intelligence platform
• Reverse engineering automation
• Indicator extraction

Headquarters

HQ city

Nyack

HQ country

United States

HQ region

North America

Offices5 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Infrastructure, Marketing or Sales

Revenue model

1. ACCE Subscriptions: Cipher Tech offers tiered subscription plans for ACCE access. Tiers include online hosted portal access, API integration, and full offline source code access. Subscriptions include daily (or as-required) module and signature updates, prioritized nomination processing for new malware samples, and access to Python-based modules and supporting libraries.

Pricing tiers

Go-to-market motion1 record

Distribution channels2 records

Marketing channels5 records

Core offering

ACCE (Automated Component and Configuration Extraction) is a framework that statically deobfuscates layers of embedded malware components and extracts configuration data, including Indicators of Compromise (IoCs), without running or emulating the malware. Cipher Tech Solutions sells ACCE via tiered annual subscriptions (online hosted portal, stand-alone API, or full offline source code access) to defense, intelligence, and enterprise security organizations, with continuous module and signature updates.

Product overview

Cipher Tech Solutions offers ACCE (Automated Component and Configuration Extraction), a targeted malware analysis framework that statically analyzes malware without emulation. The product consists of the core ACCE framework, targeted Python-based analysis modules (with 700+ module groupings and 1,445+ parsers as of September 2024), a lightweight UI, and a stand-alone API. ACCE is designed for threat intelligence teams and reverse engineers to automate extraction of indicators of compromise from malware. The company also publishes open-source parsers via os_acce_parsers on GitHub. ACCE is delivered as Docker-based micro-services and supports online and offline operation modes with tiered subscription levels.

Differentiator

Problem solved

Functional benefit

Brands

• ACCE: Automated Component and Configuration Extraction (ACCE) is a framework that runs targeted modules to automatically deobfuscate layers of embedded malware components and extract configuration data, including Indicators of Compromise (IoCs).
• os_acce_parsers

Products and services

• ACCE (Automated Component and Configuration Extraction) ACCE is a framework that runs targeted modules to automatically deobfuscate layers of embedded malware components and extract configuration data, including Indicators of Compromise (IoCs). The analysis is performed statically by re-implementing the algorithms that malware uses to unpack its embedded components, bypassing anti-analysis and anti-sandbox features. Sold to defense, intelligence, and corporate security teams for reverse engineering automation, threat intelligence, and network defense.
• os_acce_parsers Open-source version of ACCE published on the company's GitHub, providing researchers and the security community with access to ACCE parser modules for malware analysis and indicator extraction.

Quantifiable outcome

• More than 1,300 additional RoboSki-packed malware samples discovered through automated analysis using ACCE
• +2 more outcomes

Named customers4 records

Segments3 records

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

AI capability2 records

Feature5 records

Partnerships

One partnership is on record.

• IBM Security X-ForcecoreStrategic or Co-development Partner · 12 July 2021Cipher Tech partnered with IBM Security X-Force to investigate RoboSki packer malware. IBM X-Force provided global phishing campaign data and infrastructure analysis while Cipher Tech provided automated malware configuration extraction via ACCE. The collaboration resulted in a joint publication analyzing the malware distribution chain and global trade-themed phishing campaigns.

Scale indicators2 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• VMRay: VMRay provides malware analysis and threat detection built around evasion-resistant dynamic sandboxing. It serves enterprise SOCs and threat intelligence teams with overlapping use cases to ACCE's automated configuration extraction.
• Mandiant (Google Cloud): Mandiant is a leading provider of malware analysis, threat intelligence, and incident response services to defense and enterprise customers. It is the closest direct competitor in the malware reverse-engineering automation and IOC extraction space that Cipher Tech addresses with ACCE.
• ReversingLabs: ReversingLabs provides static malware analysis, file classification, and threat intelligence used by security operations teams. Its static-first approach and enterprise/government customer base make it highly comparable to Cipher Tech's ACCE.
• Joe Security (Joe Sandbox): Joe Sandbox offers deep malware analysis via dynamic and hybrid sandboxing, with a focus on configuration extraction and IOC generation for enterprise and government customers. It competes for the same security analyst workflows that ACCE targets.

Emerging players

• Intezer: Intezer applies code-reuse analysis to malware classification and threat intelligence, with an automation-led approach comparable to ACCE's. It targets enterprise SOCs and MSSPs and represents an emerging alternative in automated malware triage.
• ANY.RUN: ANY.RUN provides an interactive malware sandbox with configuration extraction and IOC reporting, increasingly used by SOC analysts and threat hunters. It is an emerging competitor in the same malware-triage workflows ACCE serves.
• ThreatConnect: ThreatConnect offers a threat intelligence operations platform that ingests malware IOCs and orchestrates response, including integrations with malware analysis tooling. It is an adjacent platform player that competes for the same threat intelligence budget.
• Cofense: Cofense specializes in phishing-driven malware detection and intelligence feeds, with a customer base overlapping ACCE's incident response and threat intel users. It represents an emerging player in malware-focused threat intelligence.

Broad incumbents

• CrowdStrike: CrowdStrike's Falcon platform includes malware analysis, threat intelligence (via Falcon Intelligence), and sandboxing (Malware Search / Falcon Sandbox) sold to enterprise and government customers — a broader incumbent that overlaps with ACCE's use cases.
• Palo Alto Networks (Unit 42): Palo Alto Networks delivers malware analysis and threat intelligence through Unit 42 and the Cortex platform, including WildFire sandboxing. As a broad cybersecurity incumbent, it bundles capabilities that overlap with ACCE inside larger platform deals.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• GitHubgithub.com/ciphertechsolutions

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Cipher Tech Solutions