Active CounterMeasures
Active Countermeasures develops AC-Hunter, an agentless network threat detection platform that identifies compromised systems communicating with command-and-control infrastructure. It serves enterprise security teams, MSSPs, and organizations with heterogeneous IoT/BYOD environments through direct sales and global channel partners.
- Company typePrivate
- Founded2017
- HeadquartersSpearfish, United States
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What Active CounterMeasures does
Active Countermeasures (incorporated as Active Countermeasures, Inc., headquartered in Spearfish, South Dakota) is a privately held, self-funded cybersecurity software vendor founded in 2017 by security professionals including COO Chris Brenton and Jason Blanchard. The company develops AC-Hunter, an agentless network threat detection platform that continuously analyzes network traffic to identify compromised systems communicating with command-and-control infrastructure, bridging what it characterizes as the gap between protection-based security tools (firewalls, IDS, 2FA) and response-based tools (incident handling). Its primary users are enterprise security teams and managed security service providers that need to detect dwell time and beaconing behavior across heterogeneous environments that include IoT, IIoT, and BYOD devices that cannot host endpoint agents.
AC-Hunter's technical architecture combines the open-source Zeek network analysis framework for traffic capture with proprietary, patented detection algorithms covering beacon detection, long-connection detection, DNS covert-channel analysis, strobe detection, and cyber deception via canary tokens. The product ships as an Enterprise Edition running on standard Linux servers and as AI-Hunter Cloud, a fully managed service variant. It includes a dashboard, safelisting capabilities at granular IP/ASN/FQDN levels, encrypted session inspection, and syslog-based alerting into Splunk, Arcsight, QRadar, and Sumo Logic. The company also maintains a portfolio of seven free open-source tools (RITA, BeaKer, espy, Passer, SMUDGE, Threat Simulator, zcutter) that serve as community-building assets and a top-of-funnel for the commercial product.
The business model is sales-led with global channel distribution. Direct sales are supported by personalized live product demonstrations and publicly disclosed pricing of $19,500 for a one-year subscription or $30,550 for a three-year subscription, with an open-site license permitting unlimited internal deployment. The company runs a two-tier partner program that combines technology partners (Carbon Black, Corelight, Napatech) with regional channel resellers and integrators in North America (Optiv Security, Black Hills Information Security, iSECURE, rSolutions, Open Security, CyberWinter Studios), the UK and EMEA (Satisnet Limited), and Germany (Allgeier CyRis). The company has trained over 20,000 individuals in its Level 1 threat hunting class and counts more than 40,000 content subscribers, using this community footprint as a demand-generation engine. The company is self-funded with no disclosed venture capital.
Active CounterMeasures firmographics
Firmographics- Name
- Active CounterMeasures
- Legal name
- Active Countermeasures, Inc.
- Website
- https://activecountermeasures.com
- Company type
- Private
- Founded year
- 2017
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- Active Countermeasures develops AC-Hunter, an agentless network threat detection platform that identifies compromised systems communicating with command-and-control infrastructure. It serves enterprise security teams, MSSPs, and organizations with heterogeneous IoT/BYOD environments through direct sales and global channel partners.
- Ownership category
- akta.pro rank
Active CounterMeasures industry classification
Industry- Product category
- Network Threat Detection Software
- NAICS
- Software Publishers (513210)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Deception Technology & Threat Hunting (HDADAGAI)
- akta.pro secondary industry
- Threat Intelligence, Hunting & Adversary Emulation (BPAKAHAE)
Keywords
Where Active CounterMeasures is headquartered
LocationHeadquarters
- HQ city
- Spearfish
- HQ country
- United States
- HQ region
- North America
Markets served
Active CounterMeasures business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure
Revenue model
- AC-Hunter Enterprise Software License: AC-Hunter Enterprise Edition sold as a one-time software download with optional support renewals. Includes open-site license allowing deployment of unlimited instances within the organization, unlimited network sensors, unlimited bandwidth and data, and unlimited safelist entries.
- Technical Support and Software Updates: First year of technical support and software version updates included with initial purchase. Multi-year support packages available (1-year at $19,500, 3-year at $30,550).
- AI-Hunter Cloud (Managed Service): Fully managed cloud service version of AC-Hunter where the company deploys, manages, monitors, and helps identify compromised systems.
- Open Source Tools (Community): Free open-source tools provided to the community including RITA, BeaKer, espy, Passer, SMUDGE, Threat Simulator, and zcutter.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | AC-Hunter Enterprise Edition - 1 Year Support |
| Subscription | Multi-year contract | AC-Hunter Enterprise Edition - 3 Years Support |
Go-to-market motion2 records
Distribution channels4 records
Marketing channels7 records
Active CounterMeasures product offering
Product offeringCore offering
Active CounterMeasures produces AC-Hunter, an agentless network threat detection software that uses Zeek to capture network traffic and proprietary patented algorithms to continuously hunt for compromised systems communicating with command-and-control infrastructure. The software is sold as an enterprise self-managed license (AC-Hunter Enterprise Edition) and as a fully managed cloud service (AI-Hunter Cloud). The company also distributes several free open-source tools including RITA, BeaKer, espy, Passer, SMUDGE, Threat Simulator, and zcutter.
Product overview
Active CounterMeasures offers a portfolio centered on AC-Hunter, a commercial network threat detection software platform. The core product uses Zeek for network traffic capture and proprietary patented algorithms to continuously hunt for compromised systems communicating with C2 infrastructure. AC-Hunter is available as self-managed enterprise software (AC-Hunter Enterprise Edition) or as a fully managed cloud service (AI-Hunter Cloud). The company also provides the open-source RITA tool for beacon analysis, plus six additional free community tools (BeaKer, espy, Passer, SMUDGE, Threat Simulator, zcutter). AC-Hunter's main modules include Dashboard for threat visualization, Beacons for detecting periodic connection patterns, Long Conns for persistent connections, DNS for covert channel analysis, Strobes for rapid repeated connections, Cyber Deception for canary tokens, Safelisting, and Alerting to SIEM systems.
Differentiator
Problem solved
Functional benefit
Products and services
- AC-Hunter Enterprise Edition Network threat detection software that continuously threat hunts networks to identify compromised systems communicating with C2 infrastructure. Uses Zeek for traffic capture and proprietary patented algorithms for beacon detection, long connections analysis, DNS tunneling detection, strobe detection, cyber deception, and SIEM alerting. Agentless solution monitoring all network devices including IoT, IIoT, and BYOD regardless of operating system or hardware.
- AI-Hunter Cloud Fully managed cloud service version of AC-Hunter. Active CounterMeasures deploys, manages, monitors, and helps identify compromised systems for enterprise customers that prefer not to manage the underlying infrastructure themselves.
- RITA (Real Intelligence Threat Analytics) Open-source threat hunting tool that analyzes Zeek logs to identify malicious beaconing behavior, scanning, and other suspicious network communication patterns. Version 5 was rewritten with a ClickHouse backend and Docker deployment.
- BeaKer Free open-source security tool provided by Active CounterMeasures for the information security community.
- espy Free open-source tool that enables network monitoring without requiring a physical network sensor, useful for remote or home networks.
- Passer Free open-source security tool provided by Active CounterMeasures for the information security community.
- SMUDGE Free open-source security tool provided by Active CounterMeasures for the information security community.
- Threat Simulator Free open-source tool for simulating threats during security testing, exercises, and training.
- zcutter Free open-source Zeek log processing tool that provides more flexible log analysis capabilities for security researchers.
Quantifiable outcome
- Reduces attacker dwell time from industry average of 6+ months to significantly shorter detection windows
- +1 more outcomes
Companies that use Active CounterMeasures
Customer profileNamed customers6 records
Segments3 records
Ideal customer profiles2 records
Active CounterMeasures technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Integration4 records
AI capability2 records
Feature7 records
Active CounterMeasures partnerships and signals
Strategic signalPartnerships
Eleven partnerships are on record, tiered core, regional and minor.
- Carbon Black (NASDAQ: CBLK)coreCarbon Black is a leader in cloud endpoint protection. The integration verifies that Carbon Black products are compatible with AC-Hunter and allows joint development of innovative solutions. Carbon Black analyzes billions of security events per day across the globe.
- CorelightcoreCorelight delivers powerful network visibility solutions built on the Zeek framework (formerly Bro), the widely-used open source network analysis framework. Joint solution brief available. Both companies leverage Zeek for network traffic analysis.
- Allgeier CyRisregionalLeading specialist for IT security in Germany since 2004. Provides consulting services, innovative in-house development teams, tailor-made solutions and managed services including security solutions, secure communication, security awareness training, and phishing simulations.
- Black Hills Information SecuritycoreFounded in 2008 by John Strand. Specializes in penetration testing, red teaming, and threat hunting. Develops and maintains popular open-source and free tools, publishes educational blogs, and gives webcasts for the information security community.
- CyberWinter StudiosminorProvides engineering and development for non-standard and innovative technology requests from the DOD. Works outside norms to provide novel technology solutions with tangible results.
- iSECUREregionalFocuses exclusively on design, deployment, and ongoing management of information security solutions across industries ranging from Fortune 500 enterprises to prestigious universities.
- Open Security, Inc.regionalFounded, owned, and operated by US Military members. Brings professional quality, analytically rigorous information security assessments to private sector businesses using experience fighting global cyberwarfare.
- Optiv SecuritycoreThe world's leading security solutions integrator (SSI) with years of experience supporting thousands of enterprise-level clients. Team includes former CISOs, security technologists and operations experts.
- rSolutionscoreProvides leadership in Cybersecurity by bringing best-in-breed product solutions together with market leading professional and managed services. Process-driven implementation ensures high client satisfaction.
- Satisnet LimitedregionalEstablished in 2004. Leading Security Integrator, Reseller, MSSP and Cyber Training Innovator with operations throughout UK, EMEA and United States. 60+ staff across three SOCs.
- Share Tech SolutionsregionalHelps small and medium-sized businesses better utilize technology. Provides computing, high tech info management, administration support services, and data processing solutions.
Scale indicators4 records
Recent moves6 records
Expansion highlights6 records
Active CounterMeasures competitors and assessment
Company assessmentDirect peers
- Vectra AI: Vectra AI is a leading network detection and response (NDR) vendor using AI to surface attacker behaviors in network traffic. It directly competes with AC-Hunter in the same enterprise threat-hunting category, with a similar focus on compromised-system and C2 detection.
- Darktrace: Darktrace provides AI-driven network threat detection for enterprise customers globally. It is a direct competitor to AC-Hunter, addressing the same use case (finding compromised systems and anomalous network behavior) at a similar target market.
- ExtraHop: ExtraHop offers Reveal(x), a network detection and response platform that uses wire data for threat hunting and east-west visibility. Comparable to AC-Hunter as an enterprise NDR solution with proprietary analytics on network metadata.
- Corelight: Corelight builds commercial sensors and analytics on the open-source Zeek framework, the same foundation used by AC-Hunter. As both a technology partner and adjacent NDR vendor, Corelight is the closest architectural and go-to-market comparable.
- IronNet Cybersecurity: IronNet provides network threat detection and collective defense for enterprises and critical infrastructure. It competes directly with AC-Hunter in the network-based behavioral analytics and threat-hunting category.
- BluVector (Comcast Technology Solutions): BluVector is an NDR platform focused on advanced threat detection using machine learning on network traffic. It targets the same enterprise buyer as AC-Hunter with comparable network behavioral analytics.
Broad incumbents
- Awake Security (Arista Networks): Awake Security was an NDR vendor acquired by Arista Networks to extend its networking portfolio into threat detection. As part of Arista's broader platform, it overlaps with AC-Hunter but ships as one feature of a much larger networking vendor.
- Cisco Secure Network Analytics: Cisco Secure Network Analytics (formerly Stealthwatch) is the incumbent enterprise NDR offering inside Cisco's security portfolio. It competes with AC-Hunter for enterprise network-threat-detection budgets while bundling across the wider Cisco security stack.
- Trelix (Trellix): Trellix (formed from the FireEye/McAfee enterprise business) is a broad cybersecurity incumbent with network detection and threat-hunting capabilities. It competes with AC-Hunter through a much wider XDR portfolio rather than as a specialist.
Emerging players
- Stellar Cyber: Stellar Cyber is an open XDR platform that includes network detection alongside SIEM, EDR, and NDR functions. Comparable to AC-Hunter at the network-analytics layer, with broader ambitions that may pull some of the same buyers.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks5 records
Key highlights7 records
Customer concentration
Active CounterMeasures social profiles
Digital presenceActive CounterMeasures financial estimates
Financial estimateRevenue estimate
Valuation estimate
Active CounterMeasures leadership team
Management profileNumber of profiles
Profiles1 record
Active CounterMeasures funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Active CounterMeasures M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Active CounterMeasures
What does Active CounterMeasures do?
Active CounterMeasures produces AC-Hunter, an agentless network threat detection software that uses Zeek to capture network traffic and proprietary patented algorithms to continuously hunt for compromised systems communicating with command-and-control infrastructure. The software is sold as an enterprise self-managed license (AC-Hunter Enterprise Edition) and as a fully managed cloud service (AI-Hunter Cloud). The company also distributes several free open-source tools including RITA, BeaKer, espy, Passer, SMUDGE, Threat Simulator, and zcutter.
Is Active CounterMeasures a public or private company?
Active CounterMeasures is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was Active CounterMeasures founded?
Active CounterMeasures was founded in 2017. It employs 11 to 50 people.
Where is Active CounterMeasures based?
Active CounterMeasures is headquartered in Spearfish, United States, in the North America region.
How does Active CounterMeasures make money?
Four revenue lines are on record. AC-Hunter Enterprise Software License is the primary driver. The others are technical Support and Software Updates, AI-Hunter Cloud (Managed Service) and open Source Tools (Community).
Who are Active CounterMeasures's main competitors?
Direct peers on record are Vectra AI, Darktrace, ExtraHop, Corelight, IronNet Cybersecurity and BluVector (Comcast Technology Solutions). Broad incumbents are Awake Security (Arista Networks), Cisco Secure Network Analytics and Trelix (Trellix). Stellar Cyber is listed as an emerging player.
Does Active CounterMeasures have an API?
No public API is recorded for Active CounterMeasures.
What industry is Active CounterMeasures in?
Active CounterMeasures's product category is Network Threat Detection Software. Its primary akta.pro industry code is HDADAGAI, Deception Technology & Threat Hunting, with a secondary code of BPAKAHAE, Threat Intelligence, Hunting & Adversary Emulation. Its NAICS code is 513210 and its SIC code is 7372.