北京微步在线科技有限公司

What 北京微步在线科技有限公司 does

ThreatBook (北京微步在线科技有限公司), founded in 2015 and headquartered in Beijing, is a privately-held cybersecurity firm that has operated as an integrated threat intelligence and security operations platform built on firsthand APAC adversary data collected since inception. The company operates a six-product platform anchored by its Advanced Threat Intelligence (ATI) backbone, which tracks 200+ APT groups and 1,000+ cybercrime groups with 80M+ malicious IPs identified daily and 14B+ attack records per day. Core offerings include ThreatBook TDP (network detection and response with less than 0.03% false positive rate, recognized in the 2025 Gartner Magic Quadrant for NDR), DRPS (digital risk protection), OneDNS (secure enterprise DNS), Flocks (open-source agentic SOC platform coordinating seven specialist agents across 150+ integrated tools), and SafeSkill (AI agent security with 10,000+ verified skills). The platform is augmented by XGPT, a proprietary autonomous AI security research system credited by Apple for discovering CVEs in macOS, iOS, and NGINX.

ThreatBook serves enterprise customers primarily through a direct field sales motion with regional teams across APAC and the Middle East, supplemented by an MSSP channel partner program and product-led growth via open-source Flocks and free tools including ThreatBook Investigator. Revenue derives from subscription-based threat intelligence services and term-based software product licenses across the platform, with professional services bundled for MSSP and service provider deployments; pricing is quote-based and not publicly disclosed. The customer base spans large global enterprises across financial services (BlackRock, Ant Group, KPMG), technology (Tencent, ByteDance), automotive (BMW, Honda), retail and consumer goods (Starbucks, Lululemon, Estée Lauder, Herbalife, Watsons), professional services (KPMG), hospitality (Airbnb), and asset management, with 420,000+ security practitioners using ThreatBook tools globally. The company maintains offices in Beijing, Singapore, Hong Kong, Abu Dhabi, and Riyadh, and rebranded in 2025 as 'The Agentic Security Company' to reflect its strategic focus on agentic AI security solutions.

Name

北京微步在线科技有限公司

Legal name

Beijing MicroStep Online Technology Co., Ltd. (北京微步在线科技有限公司)

Website

https://threatbook.cn

Company type

Private

Founded year

2015

Operating status

Operating

Headcount range

11–50 employees

Short description

ThreatBook (北京微步在线科技有限公司) is a Beijing-founded private cybersecurity firm delivering APAC-first threat intelligence, network detection, DNS security, and agentic SOC capabilities to enterprise customers globally through a six-product platform.

Ownership category

akta.pro rank

Product category

Cybersecurity Software

NAICS

Computer Systems Design and Related Services (5415)

SIC

Services-Computer Integrated Systems Design (7373)

akta.pro primary industry

Threat Intelligence Services (BPAEADAC)

akta.pro secondary industries

Security Architecture & Engineering Advisory (Zero Trust, IAM, Network) (BPAKADAF), Vulnerability Management, Pen Testing & Attack Surface Management (ASM) (HLACAJAN), Application Security Engineering (DevSecOps, AppSec Remediation) (BPAEAFAI)

Keywords

• Threat intelligence platform
• Network detection response
• Agentic security operations
• Digital risk protection
• DNS security services

Headquarters

HQ city

Beijing

HQ country

China

HQ region

Asia

Offices5 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Marketing or Sales, Operations, Infrastructure

Revenue model

1. Subscription-based Threat Intelligence Services: ThreatBook provides subscription-based threat intelligence services for fixed or recurring periods, subject to subscription fees. Software subscriptions include non-exclusive, non-transferable licenses for internal business purposes.
2. Software Product Licenses: Enterprise software products (TDP, ATI, DRPS, OneDNS, SafeSkill) provided via subscription orders with term-based access.
3. Trial Products: Products available for 30-day evaluation periods. Functionality may be limited during trial with usage required to cease unless converted to paid subscription.
4. Professional Services: Professional services and support may be bundled with enterprise deployments, particularly for MSSP and service provider partners.

Go-to-market motion4 records

Distribution channels4 records

Marketing channels8 records

Core offering

ThreatBook operates an integrated agentic security operations platform built on firsthand Asia-Pacific threat intelligence collected in-house since 2015. The platform centers on Advanced Threat Intelligence (ATI) and spans Network Detection & Response (TDP), secure enterprise DNS (OneDNS), Digital Risk Protection (DRPS), an open-source agentic SOC platform (Flocks), and an AI agent security product (SafeSkill), serving 420,000+ security practitioners globally.

Product overview

ThreatBook (北京微步在线科技有限公司) is a six-product integrated security platform built on its Advanced Threat Intelligence (ATI) backbone. The core products are ThreatBook ATI (threat intelligence), ThreatBook TDP (network detection and response), and DRPS (digital risk protection), supplemented by OneDNS (secure DNS), Flocks (open-source agentic SOC with 7 specialist agents), and SafeSkill (AI agent security). The platform is enhanced by XGPT, ThreatBook's autonomous AI security research system. ThreatBook Investigator provides free IOC lookup. The company serves 420,000+ security practitioners and is recognized in the 2025 Gartner Magic Quadrant for NDR.

Differentiator

Problem solved

Functional benefit

Brands

• ThreatBook ATI: Advanced Threat Intelligence - the intelligence platform powering all products with firsthand APAC adversary data
• ThreatBook TDP
• ThreatBook OneDNS
• ThreatBook DRPS
• Flocks
• SafeSkill
• OneSEC
• OneSandbox
• OneDNS
• OneSIG
• ThreatBook Investigator
• XGPT

Products and services

• ThreatBook ATI
• ThreatBook TDP Full-traffic Network Detection & Response (NDR) platform with less than 0.03% false positive rate. Recognized in 2025 Gartner Magic Quadrant for NDR, providing visibility across network traffic, encrypted threats, and lateral movement detection for enterprise security operations.
• OneDNS Secure Enterprise DNS service that blocks threats at the DNS layer before they reach endpoints, powered by live ATI feeds for real-time threat blocking. Targets enterprise IT and security teams.
• DRPS Digital Risk Protection service for monitoring external attack surface and brand exposure across dark web, domain squatting, and brand impersonation threats. Designed for enterprise security and brand protection teams.
• Flocks Open-source, locally deployed agentic SecOps platform coordinating 7 specialist agents across 150+ integrated tools for autonomous triage, investigation, and response. No data leaves the enterprise environment. Designed for enterprise SOC teams seeking autonomous security operations.
• SafeSkill AI agent security product that scans MCP, plugins, and AI skills before enterprise deployment. Provides 10,000+ verified Skills for vetting AI agent capabilities and preventing supply chain risks in AI ecosystems. Targets enterprises deploying AI agents at scale.
• ThreatBook Investigator Free IOC lookup and analysis tool for threat investigation. Provides instant access to threat intelligence on IPs, domains, file hashes, and threat actor profiles for security practitioners.

Quantifiable outcome

• 85x Alert Noise Reduction via multi-dimensional IP reputation
• +5 more outcomes

Named customers14 records

Segments8 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

AI capability7 records

Feature8 records

Scale indicators11 records

Recent moves6 records

Expansion highlights6 records

Broad incumbents

• SentinelOne: AI-powered endpoint and XDR platform with Singularity Threat Intelligence. Competes with ThreatBook's endpoint (OneSEC) and broader detection offerings, though at much greater scale and with US-headquartered operations and channel.
• Trellix: Enterprise security vendor formed from the FireEye/McAfee heritage, offering XDR, threat intelligence and email security. Competes with ThreatBook in NDR and threat intelligence categories as part of a broader legacy enterprise platform.
• Palo Alto Networks (Unit 42): Global cybersecurity leader with the Unit 42 threat intelligence arm, Cortex XDR/XSIAM platform and NDR offerings. Competes directly with ThreatBook across TI and NDR categories as part of a much broader security platform.
• CrowdStrike: Leading cloud-native endpoint security and XDR platform with an integrated threat intelligence module (CrowdStrike Intelligence). Overlaps with ThreatBook TDP/NDR and TI capabilities but operates at vastly larger scale with a much broader portfolio.

Direct peers

• Mandiant (Google Cloud): Acquired by Google Cloud in 2022, Mandiant is the benchmark enterprise threat intelligence and incident response vendor. Directly comparable to ThreatBook on APAC-relevant threat intelligence, adversary tracking and IR services, though with broader geographic coverage and significantly larger R&D scale.
• Recorded Future: Threat intelligence platform owned by Mastercard, providing adversary, vulnerability and brand intelligence to enterprises. Closest direct competitor to ThreatBook ATI in subscription-based TI services and IOC analytics, with similar breadth across adversary group tracking.
• Darktrace: AI-driven cybersecurity company focused on autonomous threat detection and response, comparable to ThreatBook's agentic SOC (Flocks) strategy. Both emphasize AI-first SOC operations, with Darktrace pioneering the self-learning approach ThreatBook is now pursuing.
• NSFOCUS: China- and US-headquartered cybersecurity vendor providing network security, DDoS protection, vulnerability management and threat intelligence. Comparable to ThreatBook in combining network detection, threat intelligence and vulnerability research across APAC markets.
• Qi An Xin Technology: Largest China-headquartered cybersecurity vendor, offering threat intelligence, endpoint, network and cloud security to Chinese enterprises and government. Closest Chinese peer to ThreatBook with overlapping APAC threat intelligence and SOC platform offerings, though larger scale and broader portfolio.
• Kaspersky: Global threat intelligence and endpoint/network security vendor with deep Kaspersky Intelligence Reporting. Most comparable to ThreatBook in being a non-Western origin threat intelligence vendor with global enterprise customers and similar geopolitical exposure in Western markets.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat6 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/ThreatBookLabs
• GitHubgithub.com/AgentFlocks/flocks
• YouTubeyoutube.com/@ThreatBook
• LinkedInlinkedin.com/company/%E5%8C%97%E4%BA%AC%E5%BE%AE%E6%AD%A5%E5%9C%A8%E7%BA%BF%E7%A7%91%E6%8A%80%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Subsidiaries1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about 北京微步在线科技有限公司