ecfirst

What ecfirst does

ecfirst (legal entity Websolv Computing, dba ecfirst) is a privately held cybersecurity compliance and certification services firm headquartered in Waukee, Iowa, founded in 2016 and led by CEO Ali Pabrai. The company operates across four interlocking revenue streams: (1) certification training programs (CHP, CCP, CCA, CSCS, CCSA, CHA, aiCRP) delivered through instructor-led, virtual, and self-study formats priced from $695 to $1,195; (2) enterprise consulting and assessment services including CMMC Level 1/2/3 assessments as an authorized C3PAO, HITRUST e1/i1/r2 certification assessments as an Authorized External Assessor, PCI DSS QSA engagements, and cybersecurity assessments (penetration testing, vulnerability assessment, red team, social engineering); (3) recurring SaaS subscriptions to its proprietary TRACER compliance management platform, which spans 15+ integrated portals (Assessment, Policy, Evidence, HIPAA, GDPR, NIST, Remediation, Cybermapper, Vendor Management, Incident/Breach/Ransomware, Executive Dashboard, etc.); and (4) one-time license sales of compliance toolkits and policy templates via the ecfirst.biz online store.

The company has accumulated a portfolio of regulated authorizations that is rare in this category: CMMC C3PAO (Cyber-AB, 2024), HITRUST Authorized External Assessor (2024), PCI QSA (2016), ISACA Accredited Training Organization (2025), ISACA AAISM Authorized Organization (2026), CAICO ATP (2026), and HIMSS Approved Education Partner (2019). Its primary customer segments are healthcare covered entities (HIPAA compliance), Defense Industrial Base contractors seeking CMMC certification, and organizations pursuing HITRUST certification. Disclosed customers include Beacon Health Options, Episource, Kno2, Trionfo Solutions, SmartStory, NorthCoast, MX2/MX2 Technology, Alico Cyber Solutions, and CyFlare. The go-to-market combines direct enterprise field sales (with proposal forms on the website), an inside sales team, event-driven demand generation through Ali Pabrai's global keynote circuit, and a self-service e-commerce channel for training and toolkits. The company is founder/management-owned, has no disclosed external funding, and shows recent deliberate expansion into AI risk management products (AI Cyber Defense Academy, aiCRP certification, AI Risk Assessment, AI Penetration Testing) positioned around NIST AI RMF and the EU AI Act.

Name

ecfirst

Legal name

Websolv Computing, dba ecfirst

Website

https://www.ecfirst.com/

Company type

Private

Founded year

1999

Operating status

Operating

Headcount range

11–50 employees

Short description

ecfirst is a US-based cybersecurity compliance firm that delivers HIPAA, HITRUST, and CMMC assessment, training, and SaaS tools to healthcare organizations, defense contractors, and enterprises seeking regulated certification.

Ownership category

akta.pro rank

Product category

Cybersecurity Compliance Services

NAICS

Testing Laboratories and Services (54138), Computer Systems Design and Related Services (54151)

SIC

Services-Testing Laboratories (8734), Services-Computer Programming Services (7371)

akta.pro primary industry

Security Audits & Compliance (ISO 27001, SOC 2, PCI DSS, HIPAA, SOX) (BPAKADAC)

akta.pro secondary industries

Information Technology (IT) & Cybersecurity Certifications (EDAAANAA), Penetration Testing, Red Team & Ethical Hacking (EDAOAIAH)

Keywords

• Cybersecurity compliance services
• CMMC assessment services
• HITRUST certification assessments
• HIPAA compliance training
• Compliance management SaaS

Headquarters

HQ city

Waukee

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. Certification Training Programs: Revenue from professional certification training programs including CHP, CCP, CCA, CSCS, CCSA, CHA, and aiCRP. Programs offered in virtual, in-person, and self-study formats. Includes exam fees and course materials.
2. Consulting and Assessment Services: Revenue from C3PAO assessments, RPO readiness services, HITRUST certification assessments (e1, i1, r2), cybersecurity assessments, penetration testing, vulnerability assessments, and compliance consulting engagements.
3. SaaS Subscriptions (TRACER): Subscription revenue from TRACER compliance management platform providing ongoing access to compliance tools, portals, and management features.
4. Toolkits and Templates: One-time license sales of compliance toolkit packages (HIPAA, CMMC Level 1/2, NIST SP 800-171 r2, NIST SP 800-53 r5, PCI DSS, GDPR, ISO 27001, etc.) and policy/procedure templates.

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels6 records

Core offering

ecfirst provides authorized cybersecurity compliance assessments (CMMC C3PAO, HITRUST e1/i1/r2, PCI DSS QSA), professional certification training programs (CHP, CHA, CSCS, CCSA, CCP, CCA, aiCRP), proprietary compliance tooling via the TRACER SaaS platform, and cybersecurity testing services (vulnerability, penetration, red team, social engineering). The company operates HIPAA Academy for healthcare compliance training and delivers toolkits and templates for HIPAA, CMMC, NIST, PCI DSS, GDPR, ISO 27001, and CCPA frameworks.

Differentiator

Problem solved

Functional benefit

Products and services

• TRACER Compliance Management Platform SaaS platform providing comprehensive compliance management with integrated portals for Assessment, Policy, Procedure, Evidence, HIPAA, GDPR, NIST, Remediation, Cybermapper, Vendor Management, Asset Management, Incident/Breach/Ransomware, Executive Dashboard, Readiness, and Contingency Planning. Files uploaded to TRACER are encrypted using AES-256-GCM with annual key rotation. Targets organizations that need ongoing compliance program management across multiple frameworks.
• CMMC C3PAO Assessment Services Authorized CMMC Level 1, 2, and 3 assessments delivered by ecfirst as an authorized C3PAO under Cyber-AB. Uses the proprietary CMMC Assessment Playbook methodology to ensure consistent assessments. Targets DoD Defense Industrial Base contractors seeking CMMC certification to remain eligible for DoD contracts.
• CMMC RPO Readiness Services Readiness and consulting services for defense contractors preparing for CMMC certification. Targets DoD contractors seeking to scope, remediate, and become assessment-ready for CMMC.
• HITRUST Certification Assessment Services Authorized External Assessor services for HITRUST e1, i1, and r2 certification levels, including AI Cyber Risk Management assessment. Targets organizations requiring HITRUST CSF certification across multiple authoritative sources.
• HIPAA Compliance Services HIPAA compliance assessments, risk analysis, policy development, and ongoing compliance management for healthcare organizations of all sizes. Includes HIPAA risk assessment, security rule implementation, breach notification, and regulatory certification requirements. Targets hospitals, laboratories, pharmacies, and healthcare service bureaus.
• Cybersecurity Assessment and Penetration Testing Services Cybersecurity assessments including vulnerability assessments, network and web application penetration testing, social engineering exercises, red team exercises, online tracking assessments, and AI penetration testing for LLM applications, RAG environments, AI agents, custom ML models, and AI-enabled APIs. Targets organizations requiring cybersecurity posture validation.
• AI Risk Assessment AI Risk Assessment service aligned with NIST AI RMF and ISO standards for evaluating AI system risk posture. Targets organizations deploying AI-enabled systems, LLM applications, RAG environments, AI agents, and AI-integrated business workflows.
• AI Cyber Defense Academy AI Cyber Defense Academy program focused on AI risk management training and certification, including AI penetration testing and AI vulnerability intelligence. Targets organizations and professionals implementing AI systems.
• AI Cyber Risk Professional (aiCRP) Certification Industry-first certification training program for AI cyber risk management covering NIST AI RMF, EU AI Act, and AI security testing. Targets professionals and organizations implementing AI-enabled systems.
• Certified HIPAA Professional (CHP) Training Program Professional certification training program for HIPAA expertise, offered in virtual, instructor-led, and self-study formats. Targets healthcare compliance professionals and practitioners.
• Certified HIPAA Administrator (CHA) Training Program Professional certification training program for HIPAA Administrators, offered in instructor-led ($1,195), online course with exam ($995), and virtual instructor-led ($695) formats. Exam retake $395. Certification valid for three years with renewal at $695. Targets healthcare administrators and compliance professionals.
• Certified Security Compliance Specialist (CSCS) Training Program Professional certification training for security compliance specialists. Targets cybersecurity and compliance professionals across regulated industries.
• Certified CMMC Security Assessor (CCSA) Training Program Professional certification training program for CMMC Security Assessors. Targets professionals pursuing CMMC assessor credentials.
• Certified CMMC Professional (CCP) Training Program Professional certification training program for CMMC Professionals, delivered as an ISACA Accredited Training Organization. Targets defense contractors and consultants preparing for CMMC implementation.
• Certified CMMC Assessor (CCA) Training Program Professional certification training program for CMMC Assessors, delivered as an ISACA Accredited Training Organization. Targets professionals pursuing CMMC assessor credentials.
• HIPAA Playbook Comprehensive HIPAA Playbook serving as a one-stop resource for healthcare compliance. Targets healthcare organizations navigating HIPAA requirements.
• CMMC Playbook Comprehensive CMMC Playbook serving as a one-stop resource for CMMC certification success. Targets defense contractors seeking CMMC implementation and certification guidance.
• HIPAA Compliance Toolkit Toolkit package containing HIPAA policies, procedures, and templates for healthcare compliance programs. Targets healthcare organizations that need ready-to-customize HIPAA documentation.
• CMMC Level 1 Toolkit Toolkit package containing CMMC Level 1 policies, procedures, and templates for defense contractors seeking Level 1 certification. Targets DoD contractors handling Federal Contract Information (FCI).
• CMMC Level 2 Toolkit Toolkit package containing CMMC Level 2 policies, procedures, and templates for defense contractors seeking Level 2 certification. Targets DoD contractors handling Controlled Unclassified Information (CUI).
• NIST SP 800-171 r2 Toolkit Toolkit package containing NIST SP 800-171 r2 controls, policies, and templates for defense contractor compliance. Targets organizations protecting Controlled Unclassified Information in non-federal systems.
• NIST SP 800-53 r5 Toolkit Toolkit package containing NIST SP 800-53 r5 controls, policies, and templates for federal information system compliance. Targets federal agencies and contractors building security and privacy programs.
• PCI DSS Toolkit Toolkit package containing PCI DSS policies, procedures, and templates for payment card industry compliance. Targets merchants and service providers handling payment card data.
• GDPR Toolkit Toolkit package containing GDPR policies, procedures, and templates for data protection compliance. Targets organizations processing personal data of EU residents.
• ISO 27001 Toolkit Toolkit package containing ISO 27001 policies, procedures, and templates for information security management system implementation. Targets organizations pursuing ISO 27001 certification.
• 23 NYCRR 500 Toolkit Toolkit package containing 23 NYCRR 500 policies, procedures, and templates for financial services cybersecurity compliance. Targets financial services companies operating in New York under Banking Law, Insurance Law, or Financial Services Law.
• Incident Response Toolkit Toolkit package containing incident response playbooks, policies, and templates for cybersecurity incident management. Targets organizations requiring incident response program documentation.
• CCPA Toolkit Toolkit package containing CCPA policies, procedures, and templates for California consumer privacy compliance. Targets organizations subject to California Consumer Privacy Act requirements.
• Managed Compliance Services Ongoing managed compliance services providing continuous program oversight across multiple frameworks. Targets organizations requiring outsourced compliance management.
• Threat Intelligence Services Threat intelligence services for monitoring emerging cybersecurity threats, adversary tactics, and vulnerability intelligence. Targets organizations requiring proactive threat awareness.

Quantifiable outcome

• 25+ years of cybersecurity expertise with thousands of assessments delivered
• +1 more outcomes

Named customers10 records

Segments5 records

Ideal customer profiles5 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability6 records

Feature4 records

Partnerships

Seven partnerships are on record, tiered core and minor.

• WellLinkcoreGTM or Marketing Partner · 7 August 2025WellLink and ecfirst Launch Cybersecurity & AI Risk Training Initiative to deliver combined cybersecurity training programs.
• DataSure24minorGTM or Marketing Partner · 6 September 2024ecfirst and DataSure24 present a CMMC Assessment and Certification webinar on October 16, 2024.
• Virtual AuditorcoreStrategic or Co-development Partner · 30 June 2020Partnership announcement with Virtual Auditor to deliver combined compliance and audit services.
• The Center for Health AffairscoreStrategic or Co-development Partner · 26 May 2020The Center for Health Affairs & ecfirst Partner to Help Hospitals Navigate COVID-19 Cyber Risk through joint consulting and training initiatives.
• CulindacoreStrategic or Co-development Partner · 2 May 2019ecfirst partnered with Culinda for Medical IoT Cybersecurity Solution, combining ecfirst's compliance expertise with Culinda's IoT security technology.
• (ISC)²minorGTM or Marketing Partner · 11 November 2015ecfirst & (ISC)²® Offer HIPAA & Cyber Security Programs for CPE Credits, combining certification and training programs.
• QE IndiaminorChannel Partner/ Reseller/ Distributor · 31 October 2013QE India and ecfirst Partner to Deliver Information Security Services across India.

Scale indicators2 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Schellman: Schellman is a leading US-based assessment and attestation firm offering SOC 2, ISO 27001, HITRUST, PCI DSS, and FedRAMP assessments. Highly comparable to ecfirst as a multi-framework compliance assessor with strong certifications practice.
• Coalfire: Coalfire is a major cybersecurity advisory firm providing CMMC, HITRUST, PCI DSS, FedRAMP, and penetration testing services. Direct competitor to ecfirst in federal/defense compliance assessments and pen testing.
• A-LIGN: A-LIGN is a cybersecurity compliance and audit firm offering SOC 2, ISO 27001, HITRUST, PCI DSS, and penetration testing. Comparable to ecfirst across multiple compliance frameworks and audit services.
• Pivot Point Security: Cybersecurity consulting firm specializing in HITRUST, ISO 27001, SOC 2, and CMMC assessments. Direct comparable to ecfirst's assessment and HITRUST practice.

Emerging players

• Vanta: Compliance automation SaaS platform covering SOC 2, ISO 27001, HIPAA, and more. Competes with ecfirst more on the automated evidence/assessment tooling side than manual consulting — an emerging threat to traditional assessor models.
• Kieri Compliance Solutions: Specialized CMMC C3PAO and readiness services provider. Direct competitor in CMMC assessments at the narrower end of the market.
• Cybersec Brigade: CMMC-focused advisory firm offering readiness, training, and assessments to defense contractors. Comparable focused niche play in CMMC vs. ecfirst's broader compliance portfolio.

Broad incumbents

• HITRUST (assessor ecosystem): HITRUST Alliance is the standards body that authorizes external assessors like ecfirst. While not a competing firm, it shapes the addressable market and direct peer set of HITRUST-authorized assessors.
• Linnaeus (now part of Deloitte): Linnaeus / Deloitte Advisory provides CMMC and NIST compliance services alongside broader GRC consulting. Overlaps with ecfirst in CMMC assessments but operates as part of a much larger advisory portfolio.
• BAE Systems Applied Intelligence (US Cyber): Large defense and cybersecurity firm providing CMMC, compliance, and cyber risk services to defense industrial base. Adjacent competitor with broader portfolio and significantly larger scale than ecfirst.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat5 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/ecfirst
• Facebookfacebook.com/ecfirst
• LinkedInlinkedin.com/company/pabrai

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about ecfirst