Penacity

What Penacity does

Penacity is a privately held, Service Disabled Veteran Owned Small Business (SDVOSB) cybersecurity firm founded in 2016 and headquartered in Hanover, Maryland, within the Baltimore-Washington defense and federal procurement corridor. The company delivers managed security, compliance, and assessment services built around three core pillars: a subscription-based SOC-as-a-Service (SOCaaS) platform that provides 24/7/365 monitoring of infrastructure logs, devices, clouds, networks, and assets with machine learning-assisted anomaly detection, operated from dual SOCs in the United States and United Kingdom; Certified Third-Party Assessor Organization (C3PAO) services for Cybersecurity Maturity Model Certification (CMMC) and NIST SP 800-171, including the proprietary PHASE Enclave product that targets CMMC Level 2 certification within approximately 90 days; and professional security testing services spanning web application, internal/external network, wireless, social engineering, and operational technology (ICS/SCADA) penetration tests.

Penacity's primary customer segments are U.S. federal and state government agencies and Defense Industrial Base (DIB) contractors requiring CMMC and NIST compliance for DoD contracts, with a secondary commercial segment spanning SMB to large enterprises needing managed security without in-house teams. Revenue is generated through annual subscription-based SOCaaS contracts, project-based compliance and assessment engagements, ad-hoc penetration testing, and a portfolio of add-on services (identity management via a Keeper Security partnership, proprietary DarkWeb Scanner, unified threat management/firewall, and email security gateway). The go-to-market is direct enterprise field sales with quote-based pricing and no public rate cards, supplemented by participation in the Buy Maryland Cybersecurity Tax Credit program that can offset up to 50% of NIST program costs for eligible Maryland businesses.

The firm employs 11–50 staff across its Hanover headquarters and operations, and is led by CEO & President Dr. Timothy Schilbach alongside a small executive team. Its C3PAO accreditation and veteran-owned status are central regulatory and brand differentiators, while its UK SOC presence supports global MDR delivery; no external institutional funding, parent company, acquisitions, or restructuring events are disclosed in the available materials.

Name

Penacity

Legal name

Penacity

Website

https://penacity.us

Company type

Private

Founded year

2016

Operating status

Operating

Headcount range

11–50 employees

Short description

Penacity is a Maryland-based, SDVOSB cybersecurity firm delivering 24/7 SOC-as-a-Service, C3PAO-accredited CMMC/NIST assessments (including the PHASE Enclave 90-day certification product), and penetration testing to U.S. federal and state agencies and Defense Industrial Base contractors, with US–UK SOC operations and quote-based enterprise sales.

Ownership category

akta.pro rank

Product category

Managed Cybersecurity Services

NAICS

Computer Systems Design and Related Services (54151), Security Systems Services (56162)

akta.pro primary industry

Managed Detection & Response (MDR) & SOC Services (HDADAGAG)

akta.pro secondary industries

Security Operations Center (SOC) as a Service (BPAEADAB), Cybersecurity Operations Outsourcing (SOC / SecOps) (BPAEAMAG), Security Audits & Compliance (ISO 27001, SOC 2, PCI DSS, HIPAA, SOX) (BPAKADAC)

Keywords

• Managed security services
• Cybersecurity compliance
• CMMC assessments
• Penetration testing
• Security operations center

Headquarters

HQ city

Hanover

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Infrastructure, Marketing or Sales

Revenue model

1. SOC-as-a-Service (SOCaaS) Subscription: Recurring subscription-based monitoring service providing 24/7 security operations center capabilities. Customers pay subscription fees for continuous monitoring without investing in hardware, software, or licenses.
2. CMMC and NIST Compliance Assessments: Professional assessment services for CMMC certifications and NIST 800-171 attestations. One-time or periodic certification/attestation engagements.
3. Penetration Testing Services: Ad-hoc security testing services including web application testing, internal/external penetration tests, social engineering campaigns, and OT security tests. Billed based on scope and hours needed.
4. Ad-hoc Security Services: Additional services including identity management, email security, unified threat management (firewall solutions), and dark web scanning available as add-ons to core SOCaaS subscription.

Pricing tiers

Go-to-market motion2 records

Distribution channels3 records

Marketing channels4 records

Core offering

Penacity is a cybersecurity firm providing a subscription-based SOC-as-a-Service (SOCaaS) platform that delivers 24/7/365 monitoring and active defense of client infrastructure, alongside CMMC and NIST 800-171 compliance assessments conducted under its Certified Third-Party Assessor Organization (C3PAO) authorization, the PHASE Enclave 90-day fast-track CMMC certification pathway, and penetration testing services covering web, network, wireless, social engineering, and OT/SCADA environments. It also delivers adjunct managed security services including proprietary DarkWeb scanning, identity management via a Keeper Security partnership, unified threat management, and an advanced email security gateway to U.S. federal and state government agencies, Defense Industrial Base contractors, and commercial clients.

Product overview

Penacity is a cybersecurity firm offering a portfolio of managed security services and compliance solutions. The core offering is SOC-as-a-Service (SOCaaS), a subscription-based 24/7 monitoring platform that uses machine learning to defend client infrastructure. Complementary services include CMMC Assessments (delivered by the firm's C3PAO status) with the PHASE Enclave rapid-certification module, Penetration Testing (covering web applications, internal/external networks, wireless, and social engineering), and various add-on security services including Identity Management (via Keeper), DarkWeb Scanning, Unified Threat Management, and Email Security Gateway. Federal cyber support services encompass SOC operations, IV&V, digital forensics, and DevSecOps engineering. The firm also offers compliance implementations for NIST, FEDRAMP, ISO, HIPAA, and PCI/DSS.

Differentiator

Problem solved

Functional benefit

Brands

• PHASE Enclave: A fast-track solution to CMMC Level 2 Certification within as little as 90 days. Allows organizations to rapidly adopt and comply with all CMMC requirements and get certified.

Products and services

• SOC-as-a-Service (SOCaaS) A subscription-based security operations center service that manages and monitors infrastructure logs, devices, clouds, networks, and assets, providing 24/7/365 active defense with machine learning–enabled anomaly detection, targeted at federal/state agencies, defense contractors, and commercial organizations lacking in-house SOC capabilities.
• CMMC Assessments Official Cybersecurity Maturity Model Certification (CMMC) Level 1, 2, and 3 assessments and attestations conducted as a Certified Third-Party Assessor Organization (C3PAO) for Defense Industrial Base contractors seeking eligibility for Department of Defense contracts.
• PHASE Enclave A fast-track structured CMMC Level 2 certification framework that allows Defense Industrial Base organizations to rapidly adopt and comply with all CMMC requirements and achieve certification within as little as 90 days.
• Penetration Testing Services Ad-hoc security testing services including internal and external penetration tests, web application security tests, wireless security tests, social engineering campaigns, and OT security tests against ICS and SCADA systems, scoped and priced per engagement.
• NIST 800-171 Compliance Services End-to-end services to achieve and maintain NIST SP 800-171 compliance, including implementation support and attestations for organizations seeking federal contracting eligibility, with Maryland-based clients eligible for up to 50% tax credit through the Buy Maryland Cybersecurity program.
• Federal Cyber Support Services Strategic consulting, technology services, and information security services for U.S. government organizations, including SOC support, IV&V, governance/risk/certification, digital forensics, SIEM integration, and secure cloud/DevSecOps engineering.
• DarkWeb Scanning Proprietary dark web scanning service that discovers compromised credentials and sensitive information exposed on dark web forums, available as an add-on to core SOCaaS subscriptions and standalone monitoring.
• Identity Management Service Identity and access management service leveraging a Keeper Security partnership to secure company identities, manage passwords and sensitive credentials, and provide continuous logon monitoring, delivered as an add-on to core SOCaaS subscriptions.
• Unified Threat Management Service Managed firewall solution delivered via remote ethernet devices and wireless options, configured, maintained, and monitored by the SOC with endpoint protection integration, available as an add-on security service.
• Advanced E-Mail Gateway Email security service that scans inbound and outbound email for malware and other security threats, using cloud sandbox analysis combined with 24/7 SOC monitoring and defense, delivered as an add-on to core SOCaaS subscriptions.

Quantifiable outcome

• CMMC Level 2 certification in as little as 90 days with PHASE Enclave
• +1 more outcomes

Named customers3 records

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration2 records

AI capability3 records

Feature3 records

Scale indicators3 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• Expel: Cloud-native MDR provider combining a managed SOC with transparent alerting and KPIs, targeting mid-market and enterprise customers. Overlaps with Penacity's SOCaaS subscription model and machine-learning-assisted monitoring.
• ReliaQuest: Enterprise-focused MDR/managed SOC provider integrating telemetry across endpoint, network, and cloud. Competes with Penacity for federal and commercial 24/7 monitoring and detection engineering mandates.
• Arctic Wolf Networks: Pure-play MDR/managed detection and response provider offering 24/7 SOC services to mid-market and enterprise customers. Directly comparable to Penacity's SOCaaS subscription offering, with significantly larger scale and broader geographic footprint.
• Summit 7: Cybersecurity firm specializing in CMMC/NIST compliance, managed security, and federal cloud/DevSecOps engineering for Defense Industrial Base contractors — closely mirrors Penacity's PHASE Enclave, CMMC assessment, and NIST 800-171 offering.
• eSentire: MDR-focused MSSP delivering 24/7 SOC-as-a-service, threat hunting, and incident response across endpoint, network, and cloud — directly analogous to Penacity's core SOCaaS, identity, and email security managed services.
• Binary Defense: MDR and SOC-as-a-service provider with strengths in managed detection, digital forensics, and incident response — areas Penacity also covers through SOCaaS and federal cyber support offerings.
• Redspin (by Nyx Assocs): Authorized CMMC C3PAO and cybersecurity operations provider focused on defense industrial base compliance, assessments, and managed security. Directly comparable to Penacity's CMMC and SOCaaS services for DIB customers.

Broad incumbents

• CrowdStrike: Endpoint security platform with a Falcon Complete fully managed MDR service; CrowdStrike is a broad incumbent that competes with Penacity's SOCaaS by bundling managed services with its endpoint detection platform for federal and commercial customers.
• Palo Alto Networks: Broad cybersecurity platform whose Unit 42 division delivers managed detection, response, and consulting. Comparable as an incumbent offering overlapping SOC, incident response, and compliance-adjacent services at significantly larger scale.
• Booz Allen Hamilton: Major federal consulting contractor with a sizeable cyber practice delivering SOC operations, IV&V, digital forensics, and DevSecOps to federal agencies — directly overlapping Penacity's federal cyber support offerings, but at an enterprise scale.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/penacity-llc
• Xx.com/penacityllc
• Facebookfacebook.com/PenacityLLC

Compliance9 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Penacity