TheHive Project
StrangeBee SAS (TheHive Project) provides a collaborative security case management platform with Cortex automation for SOC, CERT, CSIRT, and MSSP teams globally. The platform centralizes alerts, automates incident response, and integrates 300+ security tools across 3,500+ users in 50+ countries via on-premises, SaaS, and IaaS deployments.
- Company typePrivate
- Founded2018
- HeadquartersParis, France
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What TheHive Project does
StrangeBee SAS, operating commercially as TheHive Project, is a Paris-based cybersecurity software company founded in 2018 by the original creators of TheHive and Cortex. The company provides a collaborative security case management platform, TheHive, designed to centralize alert intake, streamline investigations, and automate incident response workflows for Security Operations Centers (SOC), Computer Emergency Response Teams (CERT/CSIRT), and Managed Security Service Providers (MSSP). The platform is tightly coupled with Cortex, an automated analysis and response engine that executes observables analysis, IOC checks, and responder actions, and integrates with 300+ third-party security tools including MISP for threat intelligence sharing.
The product portfolio is delivered through three deployment models: on-premises (TheHive), fully managed SaaS on dedicated AWS infrastructure (TheHive Cloud Platform), and Infrastructure-as-a-Service cloud images on AWS and Azure marketplaces (TheHive Cloud Images). A recently launched TheHive MCP Server bridges the platform to large language models for AI-augmented SOC workflows. The stack is reinforced by TheHive Academy training and professional services. The platform is trusted by 3,500+ analysts across 50+ countries, with named enterprise customers spanning aerospace and defense (Thales), automotive (General Motors), telecommunications (BT Business), banking (CERT Arkéa), technology (IDEMIA, Pipedrive), agriculture technology (Krone), education (University of St Andrews), and government (State of South Dakota).
The company monetizes through recurring subscriptions across all three deployment models, supplemented by implementation services and training. The open-source community edition drives top-of-funnel adoption via Discord and Mastodon, while enterprise conversions flow through direct sales with a demo-request motion. G2 (4.4/5) and Gartner Peer Insights recognition, combined with marquee enterprise references, support commercial credibility. The company is privately held with no disclosed institutional funding or parent organization.
TheHive Project firmographics
Firmographics- Name
- TheHive Project
- Legal name
- StrangeBee SAS
- Website
- https://thehive-project.org
- Company type
- Private
- Founded year
- 2018
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- StrangeBee SAS (TheHive Project) provides a collaborative security case management platform with Cortex automation for SOC, CERT, CSIRT, and MSSP teams globally. The platform centralizes alerts, automates incident response, and integrates 300+ security tools across 3,500+ users in 50+ countries via on-premises, SaaS, and IaaS deployments.
- Ownership category
- akta.pro rank
TheHive Project industry classification
Industry- Product category
- Security Operations / Incident Response Software
- NAICS
- Other Computer Related Services (541519)
- SIC
- Services-Computer Programming, Data Processing, Etc. (7370)
- akta.pro primary industry
- Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ)
- akta.pro secondary industries
- Responsible AI, Security & Privacy Platforms (Safety, Guardrails, PII) (HDAEANAG), Identity Threat Detection & Response (ITDR) (HDAEAJAH)
Keywords
Where TheHive Project is headquartered
LocationHeadquarters
- HQ city
- Paris
- HQ country
- France
- HQ region
- Europe
Offices1 record
Markets served
TheHive Project business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Infrastructure, Marketing or Sales, Operations
Revenue model
- TheHive Software Subscriptions (On-prem): On-premises deployment of TheHive with licensing or subscription fees for enterprise and mid-market security teams (SOC, CERT, CSIRT, MSSP).
- TheHive Cloud Platform (SaaS): Fully managed SaaS version of TheHive running in a dedicated and secure AWS cloud environment, offered as a subscription service.
- TheHive Cloud Images (IaaS): Infrastructure-as-a-Service offering on AWS and Azure marketplaces for self-managed cloud deployments.
- Professional Services & Support: Implementation services, training (Academy), and support services delivered by StrangeBee to help organizations deploy and use TheHive effectively.
- TheHive Academy Training: Courses developed and delivered by the creators of TheHive, providing training on the platform's capabilities.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | TheHive On-Premises (self-hosted) |
| Subscription | Annual | TheHive Cloud Platform (SaaS on AWS) |
| Subscription | Monthly | TheHive Cloud Images (IaaS) |
Go-to-market motion3 records
Distribution channels6 records
Marketing channels10 records
TheHive Project product offering
Product offeringCore offering
TheHive is a collaborative security case management platform that centralizes alerts from multiple sources, supports deep investigation of observables, and automates incident response through the tightly integrated Cortex engine. StrangeBee sells it as on-premises software, as a managed SaaS on AWS (TheHive Cloud Platform), and as IaaS Cloud Images on AWS and Azure marketplaces, with paid implementation services and TheHive Academy training layered on top.
Product overview
StrangeBee offers a platform-plus-modules architecture centered around TheHive, a collaborative security case management platform trusted by 3,500+ SOC, CERT, CSIRT, and MSSP analysts in 50+ countries. The platform integrates with Cortex, an automated analysis and response engine that provides observable analysis and responder automation. The ecosystem includes 300+ integrations and is available in three deployment models: on-premises (TheHive), SaaS (TheHive Cloud Platform on AWS), and IaaS (TheHive Cloud Images). The MCP Server enables LLM integration for modern SOC workflows.
Differentiator
Problem solved
Functional benefit
Products and services
- TheHive Collaborative security case management platform that centralizes alerts from multiple sources, supports deep investigation of observables, and orchestrates incident response through the Cortex engine. Designed for SOC, CERT, CSIRT and MSSP analysts and offered as on-premises software with a subscription license.
- TheHive Cloud Platform SaaS version of TheHive delivered in a secure, dedicated AWS cloud environment for organizations that want the full TheHive case management and automation capability without operating the underlying infrastructure. Sold on an annual subscription basis.
- TheHive Cloud Images IaaS version of TheHive delivered as pre-built cloud images on AWS Marketplace and Azure Marketplace, enabling customers to deploy TheHive on their preferred cloud infrastructure with marketplace-based billing.
- Cortex Automated analysis and response engine that powers TheHive, performing observable and IOC analysis and triggering responders for actions such as IP blocking, proxy blacklisting and phishing site takedown. Sold as a standalone engine that integrates with TheHive and other security stacks.
- TheHive MCP Server Model Context Protocol (MCP) server that connects TheHive to large language models, enabling AI-augmented investigation, triage and response within SOC workflows. Targets security teams adopting LLM-based tooling for incident response.
Quantifiable outcome
- 3,500+ SOC, CERT, CSIRT & MSSP analysts use the platform worldwide
- +5 more outcomes
Companies that use TheHive Project
Customer profileNamed customers11 records
Segments4 records
Ideal customer profiles2 records
TheHive Project technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Integration1 record
AI capability3 records
Feature8 records
TheHive Project partnerships and signals
Strategic signalPartnerships
One partnership is on record.
- MISP (Malware Information Sharing Platform)coreTheHive has tight integration with MISP, enabling seamless threat intelligence sharing and IOC (Indicators of Compromise) exchange. Organizations like BT Business and CERT Arkéa use TheHive with MISP for threat intelligence-driven incident response. This integration is a cornerstone of TheHive's threat investigation capabilities.
Scale indicators4 records
Recent moves5 records
Expansion highlights5 records
TheHive Project competitors and assessment
Company assessmentMarket position
Weaknesses4 records
Competitive moat4 records
Key risks5 records
Key highlights7 records
Customer concentration
TheHive Project social profiles
Digital presenceTheHive Project financial estimates
Financial estimateRevenue estimate
Valuation estimate
TheHive Project leadership team
Management profileNumber of profiles
TheHive Project funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
TheHive Project M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about TheHive Project
What does TheHive Project do?
TheHive is a collaborative security case management platform that centralizes alerts from multiple sources, supports deep investigation of observables, and automates incident response through the tightly integrated Cortex engine. StrangeBee sells it as on-premises software, as a managed SaaS on AWS (TheHive Cloud Platform), and as IaaS Cloud Images on AWS and Azure marketplaces, with paid implementation services and TheHive Academy training layered on top.
Is TheHive Project a public or private company?
TheHive Project is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was TheHive Project founded?
TheHive Project was founded in 2018. It employs 11 to 50 people.
Where is TheHive Project based?
TheHive Project is headquartered in Paris, France, in the Europe region.
How does TheHive Project make money?
Five revenue lines are on record. TheHive Software Subscriptions (On-prem) is the primary driver. The others are theHive Cloud Platform (SaaS), theHive Cloud Images (IaaS), professional Services & Support and theHive Academy Training.
Does TheHive Project have an API?
No public API is recorded for TheHive Project.
What industry is TheHive Project in?
TheHive Project's product category is Security Operations / Incident Response Software. Its primary akta.pro industry code is HDADAGAJ, Attack Detection & Response for Cloud/SaaS (SOC for Cloud), with a secondary code of HDAEANAG, Responsible AI, Security & Privacy Platforms (Safety, Guardrails, PII). Its NAICS code is 541519 and its SIC code is 7370.