What PUNCH Cyber Analytic Group does

PUNCH Cyber Analytic Group (legal entity: PUNCH Cyber Corp., Virginia) is a privately-held, founder-owned cybersecurity firm founded in 2012 and headquartered in Reston, Virginia with a registered location in Ashburn, Virginia. The company operates with 11-50 employees and is bootstrapped — there is no disclosed institutional investment, parent company, or subsidiary structure. Leadership comprises three co-founders with deep federal cyber pedigree: Brent Wrisley (CEO, US-CERT founding member), Chris McIlroy (COO, homeland security background at DHS/DoD/European Commission), and Mike Geide (CTO, formerly of US-CERT). The firm is organized around a platform-plus-products architecture anchored by three proprietary AI/ML tools — CADO (DARPA-developed ML platform for automated triage and analyst support), FOCUS (LLM-powered analytics interface for threat intelligence), and SHADOWBOX (SOC operations framework) — combined with four professional service lines: SOC Operations & Optimization, Applied Research & Prototyping, Threat Analysis & Hunt Operations, and Security Engineering & DevSecOps.

The business model is federal government services contracting. PUNCH generates revenue as a prime contractor through GSA Schedule 70 SIN 54151 (HACS), the Treasury PROTECTS BPA ($20B ceiling, 2025-2033, one of ten awardees), and the Department of the Interior Cybersecurity Support BPA ($136M ceiling, 2023-2030). Multi-year BPAs provide recurring revenue visibility, with services priced at the task order level against pre-competed ceilings. Distribution is exclusively U.S.-focused and channeled through federal procurement vehicles, with secondary pursuit of Fortune 500 enterprise and energy sector clients evidenced by named customer testimonials. The company holds CMMC and ISO 27001 (certificate 078530335) certifications, and its marketing emphasizes a philosophy of 'clarity over chaos' and 'outcomes over activity' targeted at federal agency decision-makers and enterprise CISOs rather than broad-market channels.

Name

PUNCH Cyber Analytic Group

Legal name

PUNCH Cyber Corp.

Website

https://punchcyber.com

Company type

Private

Founded year

2012

Operating status

Operating

Headcount range

11–50 employees

Short description

PUNCH Cyber Analytic Group is a bootstrapped, founder-owned federal cybersecurity firm that delivers AI-powered SOC operations, threat hunting, and security engineering to U.S. government agencies and select Fortune 500 enterprises via GSA Schedule and multi-year BPAs.

Ownership category

akta.pro rank

Product category

Federal Cybersecurity Services

NAICS

Computer Systems Design and Related Services (54151), Software Publishers (513210), Other Scientific and Technical Consulting Services (54169)

SIC

Services-Computer Integrated Systems Design (7373)

akta.pro primary industry

Security Analytics & Detection Engineering (HDADAGAE)

akta.pro secondary industries

Governance, Risk & Compliance (GRC) Advisory & Assessments (BPAKAHAH), Cybersecurity & Identity Consulting (BPAHAEAG)

Keywords

• Cybersecurity operations services
• Threat intelligence analysis
• Security operations center
• Incident response services
• Federal cybersecurity contracting

Headquarters

HQ city

Washington

HQ country

United States

HQ region

North America

Offices2 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales

Revenue model

1. Federal Government Cybersecurity Services: PUNCH Cyber generates revenue through federal government contracting vehicles including Blanket Purchase Agreements (BPAs) and GSA Schedule 70. Services include SOC operations and optimization, threat analysis and hunting, applied research and prototyping, and security engineering. Revenue is primarily from multi-year federal contracts with agencies including the Department of Treasury and Department of the Interior.
2. Managed Cybersecurity Services: Ongoing cybersecurity support services delivered through BPA vehicles with recurring period of performance, providing steady revenue streams over contract lifecycles extending up to 8 years.

Pricing tiers

Go-to-market motion1 record

Distribution channels2 records

Marketing channels3 records

Core offering

PUNCH Cyber Analytic Group is a cybersecurity consulting firm that provides federal agencies and Fortune 500 enterprises with security operations center (SOC) services, threat hunting, applied research, and security engineering. The company delivers its services through government contracting vehicles (GSA Schedule 70, BPAs) and supports them with three proprietary technology platforms: CADO (DARPA-developed ML platform for automated triage), FOCUS (LLM-powered analytics interface for threat intelligence), and SHADOWBOX (SOC operations framework).

Product overview

PUNCH Cyber Analytic Group offers a platform-plus-products architecture centered on three core AI-powered cybersecurity products: CADO (DARPA-developed ML platform for automated triage and analyst support), FOCUS (LLM-powered analytics interface for threat intelligence), and SHADOWBOX (SOC performance optimization tool). These products are complemented by four professional services: SOC Operations & Optimization, Applied Research & Prototyping, Threat Analysis & Hunt Operations, and Security Engineering & DevSecOps. The portfolio is designed to enable defenders through automation, AI-driven analytics, and operational expertise.

Differentiator

Problem solved

Functional benefit

Products and services

• CADO

Quantifiable outcome

• Enterprise SOC performance optimization through streamlined workflows and clear team roles

Named customers4 records

Segments2 records

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability6 records

Feature3 records

Partnerships

Three partnerships are on record, tiered flagship and core.

• U.S. Department of the TreasuryflagshipOthers · 25 March 2025PUNCH Cyber was awarded a position on the PROTECTS (Treasury Enterprise Cybersecurity Technology and Services) Blanket Purchase Agreement with a $20 billion ceiling covering 2025-2033. The BPA aims to transform cybersecurity operations and service models across the Department of Treasury and its Bureaus, enhancing capabilities, standardizing practices, and achieving greater efficiencies across Treasury's cybersecurity and SOC functions.
• U.S. Department of the InteriorcoreOthers · 1 May 2023PUNCH Cyber holds the Department of Interior Cybersecurity Support BPA with a $136 million ceiling covering 2023-2030. The BPA provides comprehensive cybersecurity support including security operations, architecture review, system security engineering, threat hunting, threat intelligence analysis, and counterintelligence services.
• U.S. General Services AdministrationcoreOthersPUNCH Cyber has been awarded GSA Schedule 70, allowing all federal agencies access to the company's cybersecurity solutions through the pre-competed schedule contract vehicle. Services available include High-Value Asset Assessments, Risk and Vulnerability Assessments, Cyber Hunt, Incident Response, and Penetration Testing.

Scale indicators2 records

Recent moves5 records

Expansion highlights5 records

Broad incumbents

• Peraton: Large federal IT and cyber contractor serving defense, intelligence, and civilian agencies. Provides overlapping SOC operations, threat intelligence, and cyber engineering services at significantly greater scale than PUNCH.
• ManTech International: Major federal civilian and defense IT/cyber contractor (Carlyle portfolio company). Competes with PUNCH in federal cyber services but across a much broader portfolio and customer base.
• MITRE Corporation: Federally funded R&D center with deep ties to DARPA, DHS, and national cyber initiatives. Comparable to PUNCH in DARPA-heritage and research-driven cyber operations approach, though structured as a nonprofit.
• Booz Allen Hamilton: Large management and technology consulting firm with deep federal cyber practice. Overlaps with PUNCH on federal cyber operations, SOC transformation, and R&D-driven cyber capabilities.
• Battelle: National security-focused R&D organization with cyber operations and threat intelligence capabilities serving federal agencies. Comparable in research-driven, mission-focused cyber posture.

Direct peers

• Valiant Solutions: Federal cybersecurity services firm and PROTECTS co-awardee. Provides cybersecurity operations support and engineering for federal civilian agencies with a comparable delivery model.
• Obsidian Global: Federal cybersecurity services firm and co-awardee on the Treasury PROTECTS BPA alongside PUNCH. Comparable in size, federal-only focus, and SOC/threat hunting offerings, making it the most directly comparable peer.
• Maveris: Federal cybersecurity services company and PROTECTS co-awardee. Specializes in security operations and identity services for federal agencies, competing head-to-head with PUNCH on BPA task orders.
• ShorePoint: Federal civilian cybersecurity services provider and PROTECTS co-awardee. Offers similar SOC, threat hunting, and cyber operations support to federal agencies, directly competing for task orders.
• Electrosoft Services: IT and cybersecurity services provider for federal civilian agencies and PROTECTS co-awardee. Comparable in scale and federal focus, offering overlapping cybersecurity and IT services.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/punch-cyber-analytic-group
• Xx.com/punchcyber

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about PUNCH Cyber Analytic Group