What The Volatility Foundation does

The Volatility Foundation is an independent 501(c)(3) non-profit organization, established formally in 2014 with the framework first released publicly in July 2007, that maintains and promotes The Volatility Framework, an open-source memory forensics platform written in Python. The Framework enables analysis of runtime system state from volatile storage (RAM) and supports Windows, Linux, Mac, and Android across 32-bit and 64-bit architectures, including KASLR kernel support. Its extensible plugin architecture has accumulated more than 100 community-contributed plugins over 12 annual Plugin Contests, covering malware analysis, credential recovery, network artifact extraction, kernel rootkit detection, and process investigation. Core development is led by a small group of long-tenured developers (including Michael Ligh, Andrew Case, and Jamie Levy), with the Foundation providing organizational support, IP protection, and training/program coordination.

The Foundation monetizes through three streams: paid memory forensics training (in-person courses in cities including Arlington, VA and Amsterdam, plus a self-paced online format since January 2021), monetary donations via PayPal, and sustaining/corporate sponsorships (notably Volexity as sustaining sponsor, plus episodic contributions from Airbnb, Facebook, and Magnet Forensics tied to the Plugin Contest). The framework itself is free and open source under a permissive license, distributed via GitHub. Customer segments include federal law enforcement and government agencies (the framework has been used on prominent criminal cases including guilty pleas), digital forensic and incident response practitioners (hundreds trained since 2012), and academic research institutions (notably a collaboration with LSU's Center for Computation and Technology since 2019). GTM is community-led and event-driven: annual Plugin Contest, in-person training (FTSCon), industry conference presence (Black Hat, DFRWS, OSDFCon), and community engagement via GitHub, Slack, the Vol-Users mailing list, and multi-platform social channels.

Name

The Volatility Foundation

Legal name

The Volatility Foundation

Website

https://volatilityfoundation.org

Company type

Private

Founded year

2007

Operating status

Operating

Headcount range

1–10 employees

Short description

The Volatility Foundation is a 501(c)(3) non-profit that maintains The Volatility Framework, the world's most widely used open-source memory forensics platform for analyzing RAM in Windows, Linux, Mac, and Android systems used by law enforcement, military, academia, and commercial investigators.

Ownership category

akta.pro rank

Headquarters

HQ city

Elkridge

HQ country

United States

HQ region

North America

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Marketing or Sales, Operations

Revenue model

1. Training Courses: The Volatility Foundation offers paid memory forensics training courses taught by the core Volatility developers. Courses include Malware and Memory Forensics with Volatility, available in-person and self-paced online formats. Registration is handled via email to memoryanalysis.net.
2. Donations and Sponsorships: As a 501(c)(3) non-profit organization, The Volatility Foundation accepts monetary donations via PayPal and maintains sustaining sponsors. Donations support the mission of improving, promoting, and steering the development of Volatility.

Pricing tiers

Go-to-market motion2 records

Distribution channels3 records

Marketing channels7 records

Core offering

The Volatility Foundation is a 501(c)(3) non-profit that maintains and promotes The Volatility Framework, a free, open source memory forensics platform written in Python. The framework analyzes the runtime state of systems from volatile storage (RAM) and supports Windows, Linux, Mac, and Android across 32-bit and 64-bit architectures. The Foundation supplements the free software with instructor-led and online memory forensics training courses and runs an annual Plugin Contest.

Product overview

The Volatility Foundation maintains and promotes The Volatility Framework, the world's most widely used open-source memory forensics platform. The portfolio consists of two main framework versions: Volatility 3 (current production release) and Volatility 2.6 (legacy version), both available on GitHub. The Foundation supplements the open-source tool with instructor-led and online training courses for memory forensics practitioners, and runs an annual Plugin Contest that encourages community contributions with cash prizes. The framework is free and open source, maintained by a non-profit 501(c)(3) organization.

Differentiator

Problem solved

Functional benefit

Products and services

• The Volatility Framework (Volatility 3) Free, open source Python-based memory forensics platform for analyzing the runtime state of systems from volatile storage (RAM); supports Windows, Linux, Mac, and Android across 32-bit and 64-bit architectures with KASLR kernel support. Used by law enforcement, military, academia, and commercial investigators.
• Volatility 2.6 (Legacy) Legacy version of The Volatility Framework, supporting Windows, Linux, Mac, and Android memory analysis; maintained for backward compatibility with existing investigations and plugins.
• Volatility Training (Malware and Memory Forensics with Volatility) Memory forensics training courses endorsed and taught by the Volatility Foundation team, covering Windows, Linux, Mac, and Android memory analysis. Offered as in-person public courses (Arlington VA, Amsterdam, San Diego, London) and self-paced online via memoryanalysis.net.

Quantifiable outcome

• Hundreds of investigators trained through official courses since 2012
• +2 more outcomes

Named customers3 records

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration1 record

Feature4 records

Partnerships

Two partnerships are on record, tiered core and minor.

• Louisiana State University (LSU) Center for Computation and TechnologycoreStrategic or Co-development PartnerCollaboration with Dr. Golden G. Richard III at LSU CCT for research and development in memory forensics, which has been ongoing since 2019 and has been described as a huge success.
• Hex-RaysminorStrategic or Co-development PartnerHex-Rays provided inspiration and template for the Volatility Plugin Contest, modeled after the Hex-Rays Plugin Contest.

Scale indicators5 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Volexity: Volexity is a security firm specializing in incident response and memory forensics, and is The Volatility Foundation's sustaining sponsor. Its Surge Collect Pro memory acquisition tool is referenced in Volatility training, making it a tightly coupled peer across both technology and community.
• Autopsy (Basis Technology): Autopsy is an open-source digital forensics platform built on The Sleuth Kit. It targets the same practitioner base with a free, community-driven model and is the closest open-source counterpoint to Volatility in adjacent forensic categories.

Broad incumbents

• Magnet Forensics: Magnet Forensics (AXIOM, MAGNET RAM Capture) builds commercial digital forensics suites that include memory analysis. As a prior Plugin Contest sponsor and competitor with a broader paid platform, it is a directly relevant incumbent peer.
• Cellebrite: Cellebrite is a dominant commercial digital forensics vendor (UFED, Premium) used heavily by law enforcement, the same primary customer segment as Volatility. It competes for forensic practitioner budget across mobile, computer, and cloud investigations.
• OpenText (EnCase): OpenText's EnCase is an enterprise-grade forensic investigation platform widely deployed in corporate and government IR. It competes with Volatility in the memory and disk forensic analysis categories while offering a much wider portfolio.
• Exterro (FTK): Exterro's FTK (Forensic Toolkit) is a commercial investigation suite that, like EnCase, competes with Volatility's open-source approach. It is widely used by enterprise and law-enforcement forensic labs.
• Oxygen Forensics: Oxygen Forensics provides commercial mobile and computer forensic suites used by law enforcement and enterprise investigators. It competes for forensic practitioner tooling budgets against Volatility's open-source position.

Others

• Hex-Rays: Hex-Rays (IDA Pro) is a disassembler often used alongside Volatility for malware analysis and reverse engineering. Its Plugin Contest served as the direct template for the Volatility Plugin Contest, making it a key ecosystem peer.
• SANS Institute: SANS Institute offers forensics training and the SIFT Workstation, an open forensic toolkit. While not a direct product competitor, SANS channels the same practitioner learning budgets that Volatility's training program targets.

Emerging players

• Sumuri: Sumuri specializes in Mac and mobile forensics, including training and tooling (Recon, PALADIN). It shares Volatility's niche focus on Apple-platform forensics and offers training that parallels the Foundation's paid courses.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/volatility
• GitHubgithub.com/volatilityfoundation
• YouTubeyoutube.com/@VolatilityFoundation
• LinkedInlinkedin.com/company/the-volatility-foundation

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about The Volatility Foundation