What BehinRahkar Group does

BehinRahkar Group (legal name Behin Rahkar Touse'e Pishro, سهامی خاص) is an Iranian private cybersecurity company founded in 2008 and headquartered in Tehran. It builds and operates a fully indigenous, integrated cybersecurity platform composed of five core products: CoreLog (SIEM with AI/ML-based log correlation), CoreInspect (agentless Cyber Security Asset Management), CoreTIS (threat intelligence with 7 million+ indicators), CoreTrap (honeypot and deception technology), and CoreUCM (unified case management mapped to MITRE ATT&CK). The platform is designed to operate offline without internet connectivity, and is aligned with international frameworks including MITRE ATT&CK, NIST CSF, IEC 62443, and CIS Controls v8.0, while tailoring threat intelligence and deployment models to Iranian infrastructure. The company also delivers 24/7 managed security services (MSSP), SOC implementation, Blue Team and Purple Team exercises, and security consulting.

The business model combines one-time perpetual (lifetime) software licensing with capacity-based expansion pricing alongside recurring professional services revenue from SOC buildouts and managed monitoring. Go-to-market is exclusively direct enterprise sales within Iran, with quote-based, multi-year contracts targeting critical infrastructure operators — notably oil and gas (National Iranian Oil Company, South Pars, multiple petrochemical complexes), energy (Tavanir and seven regional electricity companies), telecommunications (Irancell, Rightel), banking and insurance, government ministries (Communications, Cooperatives/Labor, Cartographic Organization), manufacturing (Mobarakeh Steel), healthcare retail (Refah Chain Stores), and airports (Imam Khomeini Airport City). Marketing is built on content channels (blog, news magazine, public vulnerability database) and social platforms including Telegram, LinkedIn, Facebook, and Instagram; there is no reseller or channel partner network.

The company holds knowledge-based enterprise status from the Vice Presidency for Science and Technology and multiple certifications from Iranian regulators, including OFA operational, testing, secure implementation, and deployment licenses, plus SAMTA authorization and ISO 9001:2015 quality certification (2025). It has accumulated recognition through awards such as the Dr. Nourbakhsh Award for banking SOC implementation and recognition as Best Indigenous SIEM at the National Defense Exhibition. No external funding, M&A, headcount disclosure, or international expansion is reported in available data; the company operates solely within the Iranian domestic market.

Name

BehinRahkar Group

Legal name

Behin Rahkar Touse'e Pishro (Sahami Khas)

Website

https://behinrahkar.com

Company type

Private

Founded year

2008

Operating status

Operating

Headcount range

51–100 employees

Short description

BehinRahkar Group is an Iranian private cybersecurity company, founded in 2008 and headquartered in Tehran, that builds and sells an indigenous five-product suite (SIEM, asset management, threat intelligence, deception, and case management) plus MSSP and SOC services to domestic critical infrastructure operators in oil and gas, energy, telecom, banking, and government.

Ownership category

akta.pro rank

Product category

Cybersecurity Software

NAICS

Security Systems Services (except Locksmiths) (561621), Computer Systems Design and Related Services (54151), Custom Computer Programming Services (541511), Software Publishers (51321), Other Computer Related Services (541519)

SIC

Services-Computer Programming, Data Processing, Etc. (7370), Services-Computer Integrated Systems Design (7373), Services-Prepackaged Software (7372)

akta.pro primary industry

Managed Security Services (MSSP) & 24/7 SOC Operations (BPAKAHAA)

akta.pro secondary industries

Managed Detection & Response (MDR) & SOC Services (HDADAGAG), Security Operations Center (SOC) as a Service (BPAEADAB), Data Security & Privacy Managed Services (DLP/Encryption) (BPAEADAL)

Keywords

• Security information event management
• Threat intelligence platform
• Cyber asset management
• Deception technology honeypots
• Managed security services

Headquarters

HQ city

Tehran

HQ country

Iran

HQ region

Middle East

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Operations, Marketing or Sales

Revenue model

1. Product Licensing (Core Suite): Perpetual license model for the Core product family (CoreLog SIEM, CoreTIS, CoreInspect, CoreTrap, CoreUCM). The company explicitly states licenses are lifetime (mادام‌العمر) and do not require annual renewal, with new licenses required only when device capacity is exceeded.
2. Professional Services (SOC Implementation, Security Consulting, MSSP): Managed Security Service Provider (MSSP) services including SOC implementation, security consulting, Blue Team, and Purple Team services. 24/7 monitoring and incident response services for organizations without internal SOC capabilities.
3. Support and Maintenance Services: Offline product update capabilities and ongoing technical support. The company notes that the system operates without requiring internet connectivity and supports offline updates.

Pricing tiers

Go-to-market motion2 records

Distribution channels3 records

Marketing channels9 records

Core offering

BehinRahkar Group develops and sells an indigenous Iranian cybersecurity software platform composed of five core products: CoreLog (SIEM with AI/ML correlation), CoreTIS (threat intelligence platform), CoreInspect (cyber security asset management), CoreTrap (deception/honeypot technology), and CoreUCM (unified case management). The company also delivers professional managed security services including SOC implementation, Blue Team and Purple Team operations, security consulting, and 24/7 MSSP monitoring for organizations without internal security operations capabilities.

Product overview

BehinRahkar Group offers an integrated cybersecurity product suite consisting of five core products: CoreLog (SIEM) as the central security analytics platform, CoreInspect (CSAM) for asset management, CoreTIS for threat intelligence, CoreTrap for deception technology, and CoreUCM for incident case management. The products are designed to work together as an integrated ecosystem, with CoreLog providing log collection and correlation, CoreTIS enriching data with threat intelligence, CoreInspect providing asset visibility, CoreTrap detecting attackers early through deception, and CoreUCM orchestrating the incident response workflow. The company also provides managed security services (MSSP), SOC implementation, blue team, purple team, and security consulting services.

Differentiator

Problem solved

Functional benefit

Brands

• CoreInspect: Cyber Security Asset Management (CSAM) system for automated identification, classification and inventory of digital assets
• CoreLog
• CoreTIS
• CoreTrap
• CoreUCM

Products and services

• CoreLog SIEM Security Information and Event Management (SIEM) platform that uses AI and machine learning algorithms for real-time event correlation, threat detection, and incident response. Supports over 250 predefined parsers for diverse log sources and 1800+ security use cases aligned with the MITRE ATT&CK framework.
• CoreInspect (CSAM) Cyber Security Asset Management (CSAM) system that uses Least Privilege Access methodology for agentless asset discovery without traditional IP range scanning. Automatically discovers, classifies, and inventories all digital assets in an organization, with capability to discover 10,000 IP addresses in seconds with minimal network overhead. Provides coverage for CIS Controls 1, 2, and 3 (Version 8.0).
• CoreTIS Threat Intelligence Advanced threat intelligence platform with 50+ analysis modules, 7 million+ threat indicators, and access to proprietary honeypot data from data centers across Iran. Supports over 100 feeds across 7 categories (IP, Domain, URL, File Hash, SSL Certificate, Email, User Agent) and includes 1500+ attack simulation scenarios with CPE-based vulnerability alerting.
• CoreTrap Deception Technology Honeypot and deception technology with 99.9% threat detection accuracy and sub-60-second attack identification. Supports Breadcrumbs and Decoy Entities at Application, Service, Device, Network, and VM levels with API-first architecture.
• CoreUCM Unified Case Management Unified incident response and case management system integrated with the MITRE ATT&CK framework, enabling centralized management of the complete incident response lifecycle with automated and semi-automated workflows based on event type, threat level, and user roles. Connects CoreLog, CoreTIS, and CoreInspect for unified security operations.
• Security Consulting Services Professional security consulting services for organizations assessing cyber risk, designing security architectures, and aligning with international frameworks (MITRE ATT&CK, NIST CSF, CIS Controls). Includes security assessments and advisory engagements.
• SOC Implementation Services End-to-end Security Operations Center implementation services for organizations building internal SOC capabilities, including deployment of CoreLog SIEM, CoreTIS, CoreInspect, CoreTrap, and CoreUCM with process design, use-case development, and team training.
• Blue Team Services Defensive security operations services focused on threat detection, monitoring, and incident response. Provided as part of the company's MSSP offerings for organizations without internal security operations capabilities.
• Purple Team Services Integrated offensive-defensive security exercises combining Red Team attack simulation with Blue Team defense to validate detection and response capabilities. Provided as a professional security service to enterprise customers.

Quantifiable outcome

• Asset discovery of 10,000 IPs in seconds with minimal network overhead
• +4 more outcomes

Named customers15 records

Segments9 records

Ideal customer profiles5 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration4 records

AI capability5 records

Feature5 records

Scale indicators8 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• Rapid7: Rapid7 provides SIEM, vulnerability management, and managed detection and response services. Comparable to BehinRahkar's CoreLog SIEM, CoreInspect asset management, and MSSP offering, serving mid-market and enterprise customers with similar feature scope.
• Arctic Wolf: Arctic Wolf is a pure-play MDR/SOC-as-a-service provider. Compares directly to BehinRahkar's MSSP services for organizations without internal SOC capabilities, serving a similar buyer profile (mid-market enterprises needing outsourced monitoring).
• Exabeam: Exabeam is an AI-driven SIEM and XDR vendor using behavioral analytics and machine learning, conceptually parallel to CoreLog's AI/ML correlation engine. Comparable in target buyer (enterprise security teams) and feature scope (detection, investigation, response).
• LogRhythm: LogRhythm is a SIEM platform with integrated SOAR and case management, closely mirroring BehinRahkar's CoreLog + CoreUCM combination. Comparable in target customers (mid-market and enterprise security operations centers) and feature positioning.

Broad incumbents

• Trend Micro: Trend Micro offers a broad cybersecurity portfolio spanning endpoint, network, and SIEM/XDR, with a strong presence in the Middle East. Comparable to BehinRahkar's multi-product platform strategy and customer segments in enterprise and government markets.
• Splunk (Cisco): Splunk is a leading SIEM and observability platform serving large enterprises and MSSPs. Comparable to CoreLog in log aggregation, correlation, and SOC analytics, with a substantially larger global install base and threat intelligence ecosystem.
• Palo Alto Networks: Palo Alto Networks offers an integrated cybersecurity platform spanning SIEM (Cortex XSIAM), XDR, deception, and threat intelligence. Closely comparable to BehinRahkar's full-stack product strategy, but at a global scale with significantly larger R&D and threat intelligence budgets.
• IBM (QRadar SIEM): IBM's QRadar is a global SIEM incumbent competing with CoreLog across enterprise security operations. Comparability is strongest in the SIEM layer and SOC analytics, though IBM operates globally with a much broader portfolio and BehinRahkar focuses exclusively on the Iranian domestic market.
• CrowdStrike: CrowdStrike is a leader in endpoint protection, XDR, and managed detection and response. Comparable to BehinRahkar's combination of CoreLog SIEM, CoreTrap deception, and CoreTIS threat intelligence, with a stronger focus on endpoint telemetry and a global MDR service.

Regional players

• HelpAG: HelpAG is a regional MSSP and cybersecurity solutions provider headquartered in the UAE serving the Middle East. Comparable to BehinRahkar's MSSP/SOC services and government/critical infrastructure focus, though HelpAG operates across the broader Middle East rather than exclusively in Iran.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights6 records

Customer concentration

• Facebookfacebook.com/BehinRahkarCo
• LinkedInlinkedin.com/company/behinrahkar
• Instagraminstagram.com/behinrahkar/?hl=en

Compliance9 records

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about BehinRahkar Group