Arco Cyber
Arco Cyber is a UK-based cybersecurity assurance firm providing a continuous controls monitoring platform that unifies data from multiple security tools. It serves over 800 organisations—primarily those without dedicated CISO resources—across mid-market and enterprise segments. Acquired by Sophos in February 2026.
- Company typePrivate
- Founded2022
- HeadquartersLondon, United Kingdom
- Headcount1–10
- GTM typeB2B
- OfferingSoftware
What Arco Cyber does
Arco Cyber is a UK-based cybersecurity assurance company founded in 2022 that provides a continuous controls monitoring (CCM) platform designed to aggregate and unify data from multiple security tools into a single source of truth. The platform uses an agentless data fabric to ingest, normalise, and analyse information across endpoint, identity, vulnerability management, email, network, HR, and security awareness systems, then continuously scans for gaps, weaknesses, and vulnerabilities across an organisation's security stack. Its core product is complemented by modular offerings including Arco Core (a sub-£10,000 cyber maturity assessment toolkit with multi-framework alignment to NIST CSF, CIS v8, CE+, and NCSC CAF), Arco Complete (CISO-focused executive reporting), Arco Performance (KPI and security baseline tracking), and Arco Free (a freemium compliance alignment tool), with integrations across Microsoft Defender, Tenable, Palo Alto Networks, KnowBe4, Mimecast, Duo, Workday, SpyCloud, and ThreatSpike.
The company serves over 800 organisations—primarily mid-market and enterprise entities lacking dedicated CISO resources—across healthcare (NHS-aligned CAF/DSPT), private equity portfolio diligence, retail, and other verticals. Revenue is generated through annual subscription licensing (Arco Core, platform licensing, and MSP/MSSP enablement including white-labelled delivery) plus professional services covering advisory, onboarding, and discovery engagements; go-to-market combines direct enterprise sales with a managed service provider channel model. The company is privately held and bootstrapped, operated by co-founders Matthew Helling (CEO), Adam Louca (CSO), and Graham Sawell (CTO), alongside an interim COO, engineering and consulting directors, and a fractional CFO. In February 2026, Sophos acquired Arco Cyber for undisclosed terms and integrated the technology into Sophos Central as the foundation of Sophos CISO Advantage, combining agentic AI, automation, and human expertise to deliver strategic security leadership and compliance reporting at scale, with a phased rollout beginning in the UK before expanding to North America and Europe within 12 months.
Arco Cyber firmographics
Firmographics- Name
- Arco Cyber
- Legal name
- Arco Cyber Limited
- Website
- https://arcocyber.com
- Company type
- Private
- Founded year
- 2022
- Operating status
- Acquired
- Headcount range
- 1–10 employees
- Short description
- Arco Cyber is a UK-based cybersecurity assurance firm providing a continuous controls monitoring platform that unifies data from multiple security tools. It serves over 800 organisations—primarily those without dedicated CISO resources—across mid-market and enterprise segments. Acquired by Sophos in February 2026.
- Ownership category
- akta.pro rank
Arco Cyber industry classification
Industry- Product category
- Cybersecurity Compliance & Continuous Controls Monitoring Software
- NAICS
- Computer Systems Design and Related Services (5415), Custom Computer Programming Services (541511)
- SIC
- Services-Computer Programming Services (7371)
- akta.pro primary industry
- Continuous Controls Monitoring (CCM) (HDADAHAE)
- akta.pro secondary industries
- Cloud Compliance, Audit & Continuous Controls Monitoring (CCM/GRC) (HDABAHAI), Controls & Continuous Compliance Monitoring (HDADAIAH)
Keywords
Where Arco Cyber is headquartered
LocationHeadquarters
- HQ city
- London
- HQ country
- United Kingdom
- HQ region
- Europe
Offices2 records
Markets served
Arco Cyber business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Operations, Marketing or Sales
Revenue model
- Arco Core Subscription: Annual subscription for cyber maturity assessment and improvement toolkit with multi-framework alignment, peer benchmarking, and control assessment capabilities
- Platform Licensing: Cloud platform licensing for continuous control validation and risk assurance, providing visibility into control effectiveness and remediation priorities
- Consulting Services: Professional services including discovery meetings, onboarding support, and advisory services delivered through team of advisors with over 40 years of collective experience
- MSP/MSSP Enablement: White-labelled platform and tools enabling managed service providers to deliver cyber assurance services to their customers, creating recurring revenue opportunities
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Arco Core - Complete cyber maturity assessment and improvement toolkit |
Go-to-market motion2 records
Distribution channels3 records
Marketing channels4 records
Arco Cyber product offering
Product offeringCore offering
Arco Cyber builds and sells a Continuous Controls Monitoring (CCM) platform that aggregates and normalises data from an organisation's existing security tools into a unified model, delivering real-time visibility into control effectiveness, gap detection, multi-framework compliance reporting (NIST CSF, CIS v8, CE+, NCSC CAF), peer benchmarking, and outcome-driven metrics for CISOs and security leaders. The platform is offered as annual subscriptions, including the sub-£10,000 Arco Core toolkit, and is also white-labelled for MSPs/MSSPs to deliver cyber assurance services.
Product overview
Arco Cyber offers a modular cybersecurity assurance platform centred on the Arco Cyber Platform as its core product, which provides continuous controls monitoring by aggregating data from multiple security tools into a unified view. The platform is complemented by specialized modules: Arco Core (a sub-£10,000 maturity assessment toolkit for framework alignment and benchmarking), Arco Complete (CISO-focused comprehensive security solution with executive reporting), Arco Performance (security metrics and KPI tracking), and Arco Free (free compliance automation tool). Following the February 2026 acquisition by Sophos, these capabilities were integrated into Sophos CISO Advantage, combining Arco's control validation technology with Sophos's MDR and security operations offerings to deliver AI-powered cybersecurity governance at scale.
Differentiator
Problem solved
Functional benefit
Brands
- Arco Core: A complete cyber maturity assessment and improvement toolkit for under £10,000, providing multi-framework alignment, peer benchmarking, and control assessment capabilities.
Products and services
- Arco Cyber Platform Continuous Controls Monitoring (CCM) platform that aggregates and unifies cybersecurity data from multiple tools into a single dashboard, giving organisations visibility into control effectiveness, exposure areas, and remediation priorities. Built for CISOs, security leaders, and the MSPs/MSSPs serving them.
- Arco Core Cyber maturity assessment and improvement toolkit, priced under £10,000, providing multi-framework alignment, peer benchmarking, control-effectiveness assessment, and threat data-driven prioritisation with MITRE ATT&CK mapping for CISOs and security teams.
- Arco Complete Comprehensive cybersecurity solution offering 360-degree visibility, real-time threat detection, compliance assurance, data protection, threat intelligence, and executive-level reporting tailored for CISOs and security teams.
- Arco Performance Performance module that lets organisations set and track critical security performance and risk indicators, establishing baselines and monitoring control effectiveness over time for continuous improvement.
- Arco Free Free compliance alignment tool that automates compliance processes, allowing security teams to align with industry-standard frameworks without manual, spreadsheet-based workflows.
- Sophos CISO Advantage Solution combining agentic AI, automation, and human expertise to deliver strategic security leadership, risk management, and compliance at scale, distributed via the Sophos Central platform to MSPs/MSSPs and end customers.
Quantifiable outcome
- 40% of cyber insurance claims denied due to non-compliance - Arco Cyber helps ensure policy term compliance
- +2 more outcomes
Companies that use Arco Cyber
Customer profileNamed customers2 records
Segments5 records
Ideal customer profiles5 records
Arco Cyber technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Integration10 records
AI capability6 records
Feature9 records
Arco Cyber partnerships and signals
Strategic signalPartnerships
Two partnerships are on record, tiered core.
- SophoscoreSophos acquired Arco Cyber in February 2026 as part of its CISO Advantage strategy. Arco Cyber operates as a dedicated team advancing Sophos' CISO Advantage initiative within the Sophos Central platform, integrating its technology alongside advisory services and MDR functions. The acquisition strengthens Sophos' expansion beyond threat detection into cybersecurity governance, risk management, and executive-level assurance.
- McArthurGlen GroupcoreFeatured as a case study customer - leading owner, developer, and manager of designer outlets in Europe that partnered with Arco Cyber to enhance cybersecurity posture while optimising cybersecurity spending.
Scale indicators6 records
Recent moves6 records
Expansion highlights6 records
Arco Cyber competitors and assessment
Company assessmentBroad incumbents
- Tenable: Tenable is a broad vulnerability management and exposure management platform with continuous assessment capabilities across the security stack. As a Tenable integration partner, Arco complements but also competes with Tenable's exposure management suite in the same enterprise buyer accounts.
- Tugboat Logic (OneTrust): Tugboat Logic, now part of OneTrust, offers continuous compliance monitoring, control mapping, and audit-ready evidence collection. As a broader GRC incumbent, it competes with Arco in the continuous controls monitoring and mid-market compliance automation space.
Emerging players
- Panorays: Panorays provides third-party cyber risk management and continuous security posture assessment of vendors, with framework alignment. It is an emerging player in the cyber risk and continuous control monitoring category that partially overlaps with Arco's risk profiling and compliance alignment.
- Balbix: Balbix uses AI to continuously assess cyber risk and control effectiveness across an organisation's security stack, prioritising remediation. It is an emerging player in the same continuous risk and control posture space that Arco targets, with comparable outcome-driven metrics capabilities.
Direct peers
- Drata: Drata automates compliance evidence collection and continuous control monitoring across frameworks such as SOC 2, ISO 27001, and HIPAA. It targets the same mid-market CISO buyer as Arco and is a direct competitor in the continuous controls monitoring and automated compliance space.
- Axonius: Axonius is a cybersecurity asset management and continuous controls monitoring platform that aggregates data from across the security stack to identify gaps and policy violations. It competes with Arco on agentless data ingestion, control effectiveness visibility, and gap detection across multi-vendor environments.
- Apptega: Apptega is a cybersecurity compliance and risk management platform enabling continuous control assessment, framework mapping, and MSP/MSSP partner enablement. It overlaps with Arco on multi-framework alignment, MSP channel focus, and continuous controls monitoring.
- Vanta: Vanta is a leading compliance automation and continuous monitoring platform targeting mid-market organisations without dedicated GRC staff, mapping controls to frameworks like SOC 2, ISO 27001, NIST, and HIPAA. It competes directly with Arco's compliance alignment, control assessment, and continuous monitoring capabilities for the same CISO-less buyer.
- Hyperproof: Hyperproof is a GRC platform offering continuous control monitoring, framework alignment (NIST, ISO, FedRAMP), and evidence automation for security and compliance teams. It competes with Arco in the continuous compliance monitoring and control validation category for mid-market and enterprise buyers.
- Secureframe: Secureframe provides continuous compliance monitoring and framework alignment (SOC 2, ISO 27001, HIPAA, PCI, NIST) for mid-market companies, with MSP channel enablement. It directly overlaps with Arco Core's multi-framework alignment and continuous monitoring capabilities.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks6 records
Key highlights7 records
Customer concentration
Arco Cyber social profiles
Digital presenceArco Cyber compliance and trust
Trust signalCompliance4 records
Arco Cyber financial estimates
Financial estimateRevenue estimate
Valuation estimate
Arco Cyber leadership team
Management profileNumber of profiles
Profiles12 records
Arco Cyber funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Arco Cyber M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Arco Cyber
What does Arco Cyber do?
Arco Cyber builds and sells a Continuous Controls Monitoring (CCM) platform that aggregates and normalises data from an organisation's existing security tools into a unified model, delivering real-time visibility into control effectiveness, gap detection, multi-framework compliance reporting (NIST CSF, CIS v8, CE+, NCSC CAF), peer benchmarking, and outcome-driven metrics for CISOs and security leaders. The platform is offered as annual subscriptions, including the sub-£10,000 Arco Core toolkit, and is also white-labelled for MSPs/MSSPs to deliver cyber assurance services.
Is Arco Cyber a public or private company?
Arco Cyber is a private company. It is classified as corporate owned and is currently acquired.
When was Arco Cyber founded?
Arco Cyber was founded in 2022. It employs 1 to 10 people.
Where is Arco Cyber based?
Arco Cyber is headquartered in London, United Kingdom, in the Europe region.
How does Arco Cyber make money?
Four revenue lines are on record. Arco Core Subscription is the primary driver. The others are platform Licensing, consulting Services and MSP/MSSP Enablement.
Who are Arco Cyber's main competitors?
Broad incumbents on record are Tenable and Tugboat Logic (OneTrust). Emerging players are Panorays and Balbix. Direct peers are Drata, Axonius, Apptega, Vanta, Hyperproof and Secureframe.
Does Arco Cyber have an API?
No public API is recorded for Arco Cyber.
What industry is Arco Cyber in?
Arco Cyber's product category is Cybersecurity Compliance & Continuous Controls Monitoring Software. Its primary akta.pro industry code is HDADAHAE, Continuous Controls Monitoring (CCM), with a secondary code of HDABAHAI, Cloud Compliance, Audit & Continuous Controls Monitoring (CCM/GRC). Its NAICS code is 5415 and its SIC code is 7371.