What Amossys does

Amossys is a French cybersecurity pure-player specializing in offensive and defensive security services, security product evaluation and certification, and a proprietary SaaS platform for adversary emulation. The firm's core products and services include the SEAL (Security Evaluation & Analysis Lab), one of only two French laboratories holding ANSSI CESTI licensing and COFRAC accreditation (n°1-10015) for security product certification under CSPN, Critères Communs, and EUCC substantial and elevated schemes; the M&NTIS Platform, a SaaS solution that executes attack scenarios in simulated IT environments to test the effectiveness of defense products and supervision architectures; CWATCH, a managed SOC/CERT service with 24/7 emergency hotline; offensive security services (penetration testing, red teaming); Cyber Threat Intelligence; and the Almond Institute for cybersecurity training and e-learning (BYCE). The company also holds PASSI qualification, PCI QSA status since 2010, SWIFT CSP listing, and ANJ auditor authorization.

Amossys operates through a sales-led go-to-market targeting enterprise, government, defense, critical infrastructure (OIV/OES), and software vendor clients across France and Switzerland via a seven-office network anchored in Rennes (R&D and SEAL lab) and Paris (Sèvres). Revenue is generated through project-based professional services engagements (audits, pen tests, red team operations, compliance assessments for PCI DSS, GDPR, ISO 27001, SWIFT CSP, and ANJ), recurring managed services subscriptions (CWATCH, M&NTIS Platform), per-evaluation SEAL certification fees, and training contracts through Almond Institute. The firm is led by Alexandre Deloup as Director of SEAL, employs approximately 400 cybersecurity experts as part of the Almond group, and has published research including CVE-2025-66406 on Step CA and an OWASP LLM vulnerability series.

Amossys was acquired by Almond in February 2023 and legally merged into Almond on December 31, 2025, becoming Almond's Rennes establishment while retaining its team, premises, processes, and sovereign expertise. The Amossys brand was retired in favor of the unified Almond identity effective January 1, 2026. The Almond group also includes sister company Board of Cyber, developer of the Security Rating® solution, creating a vertical stack that combines product certification, threat intelligence, managed SOC, and organizational cyber maturity scoring.

Name

Amossys

Legal name

Amossys

Website

https://amossys.fr

Company type

Private

Founded year

2010

Operating status

Operating

Headcount range

51–100 employees

Short description

Amossys, now operating as Almond following a December 2025 legal merger, is a French sovereign cybersecurity pure-player providing ANSSI-accredited product certification (SEAL), adversary emulation SaaS (M&NTIS), managed SOC/CERT services, and offensive security consulting to enterprise, government, defense, and software vendor clients across France and Switzerland.

Ownership category

akta.pro rank

Product category

Cybersecurity Services

NAICS

Other Scientific and Technical Consulting Services (54169), Management Consulting Services (54161)

SIC

Services-Management Consulting Services (8742), Services-Engineering, Accounting, Research, Management (8700)

akta.pro primary industry

Cybersecurity & Identity Consulting (BPAHAEAG)

Keywords

• Cybersecurity consulting services
• Penetration testing services
• Security product certification
• Managed security operations
• Cyber threat intelligence

Headquarters

HQ city

Rennes

HQ country

France

HQ region

Europe

Offices7 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Professional Cybersecurity Services: Consulting missions, security audits, penetration tests, red team operations, compliance assessments (PCI DSS, GDPR, ISO 27001, SWIFT CSP, ANJ), and delegated RSSI/CISO services. Revenue is generated through project-based engagements with enterprise and government clients. These are the primary revenue streams for Amossys/Almond.
2. Managed Security Services & SaaS: SOC/CERT managed services (CWATCH), managed detection and response, external vigilance subscriptions, and SaaS platform access (M&NTIS Platform). Revenue is generated through recurring subscription and usage-based contracts.
3. Security Product Evaluation & Certification: Security product evaluations and certifications conducted by the SEAL (CESTI) laboratory under ANSSI-approved CSPN, Critères Communs, and EUCC schemas. Vendors pay for evaluation services to obtain security certifications (e.g., CSPN, EUCC). Revenue is project-based per evaluation.
4. Training & Certification: Cybersecurity training programs delivered through Almond Institute, including awareness, instructor-led courses, e-learning (BYCE), coaching, and Cyber Game. Revenue is generated through per-course or subscription-based training contracts.

Pricing tiers

Go-to-market motion1 record

Distribution channels3 records

Marketing channels6 records

Core offering

Amossys is a French pure-play cybersecurity firm that delivers offensive and defensive security services, ANSSI-accredited security product evaluation and certification through its SEAL (CESTI) laboratory, managed SOC/CERT services (CWATCH), cyber threat intelligence, and a proprietary SaaS adversary emulation platform (M&NTIS). Following its 2023 acquisition by Almond and the legal merger completed on December 31, 2025, Amossys now operates as the Rennes establishment of the Almond group, retaining its sovereign cybersecurity expertise and serving enterprise, government, and defense clients across France and Switzerland.

Product overview

Amossys, now operating under the Almond brand following a December 2025 merger, offers a comprehensive cybersecurity portfolio comprising the M&NTIS Platform (adversary emulation SaaS), SEAL (ANSSI-approved certification laboratory), CWATCH (managed SOC/CERT services), Offensive Security services, Cyber Threat Intelligence, and the Almond Institute training center. The company also provides specialized compliance services including PCI DSS, GDPR, and SWIFT CSP evaluations, as well as cloud security solutions integrated with Microsoft and Google Cloud platforms.

Differentiator

Problem solved

Functional benefit

Brands

• SEAL (Security Evaluation & Analysis Lab): Cybersecurity evaluation and analysis laboratory, CSPN and Common Criteria certified, authorized CESTI by ANSSI
• M&NTIS Platform
• CERT / CWATCH
• Almond Institute

Products and services

• M&NTIS Platform Proprietary SaaS adversary emulation platform that executes realistic attack scenarios in simulated IT environments to generate network and system traces, enabling organizations to test the effectiveness of detection, investigation, and reaction processes deployed by their security teams.
• SEAL (Security Evaluation & Analysis Lab) ANSSI-licensed CESTI laboratory and COFRAC-accredited facility (accreditation n°1-10015) offering security evaluation and certification services for software and network equipment products under CSPN, Critères Communs, and EUCC schemes, plus offensive analysis and product security hardening.
• CWATCH (SOC/CERT) Managed Security Operations Center and Computer Emergency Response Team service providing 24/7 monitoring, detection, incident response, and CERT emergency hotline for clients experiencing security incidents.
• Offensive Security Services Technical audit services including penetration testing (black box, gray box, white box), Red Team operations, and security assessments for web applications, heterogeneous environments, and complete information systems.
• Cyber Threat Intelligence (CTI) Strategic, tactical, operational, and technical intelligence services that collect and analyze cyber data from multiple internal and external sources to model threats and inform defensive decisions.
• Almond Institute Training center offering cybersecurity awareness, instructor-led training, e-learning (BYCE), coaching, and Cyber Game programs for employees, management, and IT/security professionals.
• Compliance Services Multi-standard compliance services including GDPR/DPO assistance, PCI DSS audits (PCI QSA Company since 2010), SWIFT CSP evaluations, ANJ (gaming authority) audits, ISO 27001 advisory, and multi-framework compliance consulting.
• Resilience Operation Center (ROC) Operational resilience services for managing and recovering from major incidents and cyber crises, helping organizations restore impaired capabilities and optimize resilience.
• CWATCH on Azure Sentinel Managed SIEM services built on Microsoft Azure Sentinel platform for security monitoring and incident management.
• CWATCH on Chronicle/SOAR Managed SIEM and SOAR services built on Google Chronicle platform, providing security event correlation and automated response capabilities.
• Almond Defender for Cloud Cloud security services integrated with Google Cloud platform for securing cloud infrastructure and digital technology environments.
• BYCE Cybersecurity e-learning platform offering digital training modules for employee awareness and skill development, holding the France Cybersecurity label.

Quantifiable outcome

• Tranquil IT achieved 40% annual organic license revenue growth for WAPT after obtaining CSPN certification with Amossys.
• +2 more outcomes

Named customers3 records

Segments4 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature4 records

Partnerships

Ten partnerships are on record, tiered core and minor.

• Board of CybercoreStrategic or Co-development PartnerBoard of Cyber is the sister company and partner of Almond/Amossys, having developed the Security Rating® solution. Almond operates a Security Rating® Service Center staffed by operational cybersecurity consultants who provide daily support to clients using the Board of Cyber platform for organizational cyber maturity assessment.
• ANSSI (Agency for Information Systems Security)coreOthersANSSI is the French government's cybersecurity authority that licenses CESTI laboratories (like SEAL/Amossys), issues security certifications (CSPN, Critères Communs, EUCC), and publishes security guidance. Amossys/SEAL holds ANSSI CESTI license, ANSSI PASSI qualification, and ANSSI Security Visa support.
• COFRAC (Comité Français d'Accréditation)coreOthersCOFRAC is the French accreditation body. The SEAL laboratory at Amossys holds COFRAC accreditation n°1-10015, confirming technical competence for security product evaluations under CSPN and Critères Communs schemas.
• Campus CyberminorStrategic or Co-development PartnerCampus Cyber is associated member of Almond/Amossys, working to promote French cybersecurity excellence by federating talent and sector actors around shared innovation projects in a common location.
• CLUSIFminorStrategic or Co-development PartnerCLUSIF is a leading French digital security association. Almond is a 2025 member of CLUSIF, which brings together all economic sectors around cybersecurity.
• CESINminorStrategic or Co-development PartnerCESIN is a forum for information security and digital experts to exchange and cooperate. Almond has been a sponsor since its creation and continues as a 2025 member.
• AFCDPminorStrategic or Co-development PartnerAFCDP is the French association of data protection officers. Almond is a 2025 member of AFCDP.
• PCI Security Standards CouncilcoreOthersPCI SSC is the governing body of the PCI DSS standard. Almond/Amossys is a PCI QSA (Qualified Security Assessor) Company since 2010, authorized to conduct PCI DSS certification audits.
• ANJ (Autorité Nationale des Jeux)minorOthersANJ is the French National Gaming Authority. Almond is authorized by ANJ as an auditor for certification audits of online gaming operators.
• SWIFTminorOthersSWIFT lists Almond in its directory of independent evaluation service providers related to the Customer Security Programme (CSP) and Customer Security Controls Framework (CSCF). Almond can assist clients with independent assessments under SWIFT CSP.

Scale indicators4 records

Recent moves9 records

Expansion highlights6 records

Direct peers

• Orange Cyberdefense: The cybersecurity arm of Orange, one of the largest pure-play cybersecurity services and managed SOC providers in France and Europe. Directly comparable given overlapping offensive security, SOC/CERT, threat intelligence, and sovereign positioning for French/European regulated clients.
• Devoteam: European IT consulting firm with a strong cybersecurity and cloud security practice in France. Closely comparable on consulting-led delivery, hyperscaler partnerships (AWS, Google Cloud, Microsoft), and enterprise/government client mix.
• Wavestone: French-headquartered pure-play consulting firm with a leading cybersecurity and digital trust practice. Directly comparable on cybersecurity advisory, regulatory compliance (GDPR, NIS, ISO 27001), and large French/European enterprise and government engagements.
• Wallix: French cybersecurity vendor specializing in privileged access management (PAM) and identity security, certified by ANSSI. Comparable as a sovereign French cybersecurity specialist with a product + services model serving regulated enterprises.
• Stormshield: European (French) cybersecurity vendor providing ANSSI-certified firewalls, endpoint protection, and data security solutions. Comparable as a sovereign European security product company with ANSSI-qualified offerings and CSPN/Common Criteria certifications.

Broad incumbents

• Thales: Global defense and digital identity/security conglomerate with deep French sovereign credentials, offering cybersecurity services, encryption, and certified security products. Competes for the same defense, OIV, and government cybersecurity budgets as Almond/Amossys at a much larger scale.
• Capgemini: Global IT services leader with a sizable cybersecurity consulting and managed services practice across Europe. Competes on enterprise cybersecurity transformation, compliance, and managed SOC mandates, often against Almond/Amossys in large RFPs.
• Sopra Steria: Major European IT services firm headquartered in France with a dedicated cybersecurity practice serving defense and public-sector clients. Comparable in client base (French government, OIV) and in offering a mix of consulting, integration, and managed security.

Others

• Board of Cyber: Sister company within the Almond group, developing the Security Rating solution used to score organizational cyber maturity. Listed as OTHERS given its affiliate/ecosystem relationship rather than direct competition, but materially connected via Almond's Security Rating Service Center.

Regional players

• Sekoia.io: French cybersecurity SaaS vendor providing an XDR/SOC platform with threat intelligence. Comparable as a French sovereign cybersecurity product company, though more product-led than Almond/Amossys' services-led model; regional overlap in France and Europe.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• GitHubgithub.com/amossys
• YouTubeyoutube.com/channel/UCrP6z8ag7KXsnSJ6zE471uA
• LinkedInlinkedin.com/company/amossys
• Instagraminstagram.com/almond_eu
• Xx.com/amossys

Compliance13 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Amossys