What Amplicy does

Amplicy is a privately held cybersecurity company founded in 2020 and headquartered in Tel Aviv, Israel, with a workforce of 11-50 employees. Per its firmographic profile, Amplicy positions itself as a technology disruptor in global attack surface and vulnerability management. The supporting source material describes the company as operating in the threat intelligence space, with customers that include Microsoft, CrowdStrike, Cisco, Akamai, AT&T Cybersecurity, Walmart, Deloitte, FS-ISAC, and government buyers via Carahsoft, spanning technology, telecommunications, retail, consulting, financial services, and public-sector verticals.

The company's product portfolio centers on real-time threat intelligence derived from global internet activity monitoring and raw NetFlow data analysis. Core products include Pure Signal Recon for proactive threat hunting, Pure Signal Scout for real-time threat intelligence platform access, and machine-ready data feeds (IP Reputation Feed, Controller Feed, Total Insights Feed) delivering risk-scored IPs and domains for automated blocking. In 2025, the company launched an AI-Powered Visibility feature (MCP Server) that connects AI agents to real-time threat intelligence via structured, context-rich data. Additional offerings include botnet analysis and reporting, and a set of community services (Bogon Networks, Nimbus Threat Monitor, UTRS DDoS mitigation, CSIRT Assistance Program).

Amplicy's revenue model is subscription-recurring across threat intelligence feeds, SaaS platform access, and direct API integrations, with quote-based enterprise pricing that is not publicly disclosed. Go-to-market is hybrid: direct enterprise field sales targeting SOC and security operations teams, combined with technology alliance partnerships and a channel program for resellers, MSPs, and systems integrators. Core technology partners include Splunk, Google SecOps, Microsoft Sentinel, Palo Alto XSOAR, Cyware, ThreatQuotient, Anomali, Tines, OpenCTI, and Vertex, with the threat intelligence embedded into partner platforms to drive adoption through the security stack.

Name

Amplicy

Legal name

Team Cymru

Website

https://amplicy.io

Company type

Private

Founded year

2020

Operating status

Operating

Headcount range

11–50 employees

Short description

Amplicy is a Tel Aviv-based cybersecurity company founded in 2020 that delivers real-time threat intelligence feeds, NetFlow-based threat hunting tools, and AI-powered visibility to SOC teams and critical infrastructure defenders globally.

Ownership category

akta.pro rank

Product category

Threat Intelligence Platform

NAICS

Computer Systems Design and Related Services (5415), Other Computer Related Services (541519)

akta.pro primary industry

Threat Intelligence Services (BPAEADAC)

akta.pro secondary industries

Intrusion Prevention/Detection Systems (IPS/IDS) (HDADABAH), Security Operations Center (SOC) as a Service (BPAEADAB)

Keywords

• Attack surface management
• Vulnerability management
• Threat intelligence platform
• Cyber threat hunting
• SOC security operations

Headquarters

HQ city

Tel Aviv

HQ country

Israel

HQ region

Middle East

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Infrastructure, Marketing or Sales, Operations

Revenue model

1. Threat Intelligence Feeds: Subscription-based access to real-time threat intelligence feeds including Total Insights Feed, IP Reputation Feed, and Controller Feed. Machine-ready format with risk-scored IPs and domains for automated blocking.
2. Platform Access (Pure Signal): SaaS platform access for threat hunting and intelligence operations through Pure Signal Recon and Scout products
3. Data Integrations: Direct data feeds and API integrations for enterprise SIEM and security tooling enrichment

Go-to-market motion2 records

Distribution channels4 records

Marketing channels7 records

Core offering

Amplicy delivers real-time threat intelligence and global network visibility for proactive threat hunting and vulnerability management, anchored by the Pure Signal platform (Pure Signal Recon for threat hunting, Pure Signal Scout for intelligence operations) and machine-ready data feeds (Total Insights Feed, IP Reputation Feed, Controller Feed). Offerings include botnet analysis, an MCP Server for AI-driven agent access, and community services such as DDoS mitigation UTRS, Nimbus Threat Monitor, and the CSIRT Assistance Program.

Product overview

Team Cymru offers a comprehensive threat intelligence platform with a portfolio of products and community services. The core offerings include Pure Signal™ Recon for proactive threat hunting and Pure Signal™ Scout for real-time threat intelligence, complemented by data feeds (IP Reputation Feed, Controller Feed, Total Insights Feed) and botnet analysis services. Community services include Nimbus Threat Monitor, UTRS for DDoS mitigation, Bogon Reference data, and the CSIRT Assistance Program. The platform delivers real-time intelligence from global internet activity for critical infrastructure defenders.

Differentiator

Problem solved

Functional benefit

Brands

• Pure Signal: Threat intelligence platform and tools including Pure Signal Recon and Pure Signal Scout for proactive threat hunting and real-time threat visibility.
• Total Insights Feed
• Nimbus Threat Monitor
• CSIRT Assistance Program

Products and services

• Pure Signal Recon Proactive threat hunting tool that delivers real-time visibility into network threats in motion using raw NetFlow data and historical analysis, designed for SOC analysts, threat hunters, and incident responders at large enterprises and critical infrastructure operators.
• Pure Signal Scout Real-time threat intelligence platform that delivers actionable threat intelligence for continuous monitoring, investigation, and incident response, targeted at enterprise security operations teams.
• Total Insights Feed Unified, machine-ready threat intelligence feed that delivers risk-scored IPs and domains daily with contextual data, purpose-built for confident automated blocking within SIEM, TIP, and SOAR environments.
• IP Reputation Feed Real-time IP address reputation feed providing risk-scored data on malicious IPs to enable confident, automated blocking and enrichment within enterprise security tools.
• Controller Feed Threat intelligence feed focused on controller infrastructure leveraged in malicious campaigns, providing targeted indicators for defender response and automated blocking.
• Botnet Analysis & Reporting Malware and botnet analysis and detection service that identifies botnet ecosystems and malicious infrastructure for enterprise and government security teams.
• AI-Powered Visibility / MCP Server AI-powered visibility layer exposed through a Model Context Protocol (MCP) server that connects AI agents to real-time threat intelligence, delivering structured, context-rich data built for investigation and analysis without bespoke parsing. Launched in 2025.
• Global Network Visibility (NetFlow Data) Raw NetFlow data offering global internet visibility for enterprise security teams across use cases including botnet detection, supply chain monitoring, root cause analysis, and raw data reconnaissance.
• Pure Signal Radar (Passive Asset Discovery Tool) Passive asset discovery tool that supports attack surface visibility for organizations seeking to identify exposed assets through network observation, complementing the Pure Signal threat intelligence suite.

Quantifiable outcome

• Accelerated incident response and faster investigations
• +2 more outcomes

Named customers8 records

Segments4 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration8 records

AI capability3 records

Feature7 records

Partnerships

Five partnerships are on record, tiered core.

• Google SecOpscoreTechnology or IntegrationTechnology alliance partnership providing integration of Team Cymru threat intelligence with Google Security Operations platform. Enables customers to enrich security tools with IP, vulnerability exposure, and external threat intelligence.
• MicrosoftcoreTechnology or IntegrationIntegration partnership providing threat intelligence enrichment for Microsoft Sentinel. Strategic relationship as both customer and partner.
• Palo Alto NetworkscoreTechnology or IntegrationTechnology alliance partner integrating with Palo Alto XSOAR for security orchestration and automation. Provides out-of-the-box integration for automated SOC workflows.
• SplunkcoreTechnology or IntegrationIntegration partner enabling enrichment of Splunk SIEM with internet IP, vulnerability exposures, and external threat intelligence. Flagship partnership for SOC tool enrichment.
• ThreatQuotientcoreTechnology or IntegrationThreat intelligence platform integration for coordinated defense and threat data sharing. Out-of-the-box integration available.

Scale indicators2 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• Recorded Future: Direct threat intelligence peer offering machine-analytics-driven intelligence across the surface, deep, and dark web. Closest functional competitor to Team Cymru's Pure Signal and Total Insights Feed, now owned by Mastercard.
• Mandiant (Google Cloud): Industry-leading threat intelligence and incident response provider, integrated into Google Cloud and competing head-to-head in SOC enrichment, adversary intelligence, and managed defense.
• Anomali: Threat intelligence platform combining TIP, threat feeds, and SIEM integrations. Directly comparable as a peer that integrates with the same Splunk/Sentinel ecosystem and competes for SOC intel budgets.
• ThreatQuotient: Specialized TIP vendor with strong SOC integrations. Functions both as a partner (integrates Team Cymru feeds) and a competitor in the threat intelligence platform category.
• Flashpoint: Threat intelligence and data breach analytics provider covering illicit communities, fraud, and adversary infrastructure. Comparable buyer profile (CTI teams, fraud, government) and overlapping use cases.
• Intel 471: Adversary-centric threat intelligence vendor with strong malware and cybercrime intelligence. Comparable on cyber-threat-intelligence subscription model and Fortune 500/government customer base.

Broad incumbents

• Microsoft Defender Threat Intelligence: Platform incumbent bundling threat intelligence natively into the Microsoft Defender / Sentinel stack. Competes on convenience and bundling economics rather than a standalone intel feed.
• CrowdStrike Intelligence: Endpoint-security incumbent with a growing threat intelligence module inside Falcon. Overlaps on adversary tracking, IOC feeds, and SOC enrichment; competes via platform bundling.

Emerging players

• Cyware: TIP and security orchestration platform targeting similar SOC automation buyers. Listed as a Team Cymru integration partner but increasingly competes in the SOAR/TIP layer.

Regional players

• Group-IB: Global threat intelligence and fraud-prevention vendor with comparable NetFlow-style telemetry, adversary tracking, and SOC enrichment offerings — primarily positioned in EMEA and APAC.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/teamcymru
• GitHubgithub.com/team-cymru
• YouTubeyoutube.com/channel/UC8xFhiG1tn_Jo4QRBgm_aSQ
• LinkedInlinkedin.com/company/team-cymru

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds1 record

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Amplicy