What unit42 gmbh does

Unit 42 is the threat research, incident response, and security consulting division of Palo Alto Networks (NASDAQ: PAN), established in 2014 and headquartered in Santa Clara, California. It conducts primary cybersecurity research across multiple domains including cloud security, malware analysis, vulnerability research, threat actor tracking, and incident response, publishing technical analyses, threat briefs, trend reports, and an annual Global Incident Response Report. The team maintains a constellation-based naming system for tracking named threat actor groups such as Screening Serpens, Boggy Serpens, Stately Taurus, Muddled Libra, and CL-CRI-1131.

The division generates revenue through three streams: professional security consulting services (incident response, threat intelligence, strategic advisory) sold as quote-based enterprise engagements; managed detection and response capabilities delivered as part of Palo Alto Networks' Cortex security operations platform; and recurring subscription-based research reports and intelligence feeds that drive demand for the parent company's broader security portfolio. Core proprietary capabilities include a behavioral clustering model for cloud identity detection from audit logs, GenAI prompt attack research, perturbation probing diagnostics for LLM safety, SPIFFE/SPIRE identity misuse analysis, and supply chain security research (e.g., ChainDrop npm worm). Unit 42 distributes content through its website, the Threat Vector podcast, social media (Twitter/X @Unit42_Intel, LinkedIn, YouTube, Facebook), email newsletters, and industry events, while consulting and emergency incident response services are delivered through Palo Alto Networks' global enterprise sales organization and a dedicated direct-response contact channel.

Note: input data contains a conflicting firmographic record describing "unit42 gmbh" as an Austria-based product lifecycle management consulting firm founded 2012; the detailed source material consistently describes Palo Alto Networks' Unit 42 cybersecurity division founded 2014. Analysis is grounded in the latter, more detailed and source-rich dataset per precedence rules favoring primary/first-party and most specific sources.

Name

unit42 gmbh

Legal name

Palo Alto Networks, Inc.

Website

https://unit42.com

Company type

Public

Founded year

2014

Operating status

Operating

Short description

Unit 42 is Palo Alto Networks' threat research, incident response, and security consulting division, providing enterprise cybersecurity research, named threat actor tracking, incident response services, and threat intelligence supporting the broader Palo Alto Networks security platform.

Ownership category

akta.pro rank

Product category

Cybersecurity Threat Intelligence and Incident Response Services

NAICS

Other Computer Related Services (541519), Security Systems Services (except Locksmiths) (561621)

SIC

Services-Computer Programming Services (7371)

akta.pro primary industry

Threat Intelligence Services (BPAEADAC)

akta.pro secondary industries

Cloud Security Logging, SIEM/SOAR & Threat Detection (HDABAHAL), Breach & Attack Simulation (BAS) (HDADAHAD)

Keywords

• Threat intelligence
• Incident response
• Cybersecurity consulting
• Vulnerability research
• Malware analysis

Headquarters

HQ city

Grambach

HQ country

Austria

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Security Consulting Services: Unit 42 provides professional security consulting services including incident response, threat intelligence, and strategic security advisory to enterprise clients.
2. Managed Detection & Response: Unit 42 offers managed detection and response services as part of Cortex security operations, providing continuous monitoring and threat response capabilities.
3. Research Reports and Intelligence Feeds: Unit 42 publishes threat research reports and trend reports that support Palo Alto Networks' product and service ecosystem, driving demand for the company's broader security platform.

Go-to-market motion2 records

Distribution channels2 records

Marketing channels5 records

Core offering

Unit 42 provides threat intelligence research, incident response services, and cybersecurity consulting to enterprise clients as Palo Alto Networks' dedicated threat research division. The team conducts ongoing malware analysis, vulnerability research, and threat actor tracking while publishing threat research reports and offering emergency response services through Palo Alto Networks' enterprise sales channels.

Product overview

Unit 42 is the threat research division of Palo Alto Networks, offering threat intelligence, incident response services, and cybersecurity research rather than standalone products. The research team provides organizations with insights into emerging threats, malware analysis, vulnerability research, and threat actor tracking. Unit 42's work supports Palo Alto Networks' broader security portfolio including the Cortex AI-driven SOC platform (Cortex XSIAM, Cortex XDR, Cortex XSOAR, Cortex Xpanse), Prisma Cloud security platform, Prisma SASE/Access solutions, and PAN-OS-based network security infrastructure. The Unit 42 ATOMs platform provides automated threat intelligence resources. The company also publishes regular research reports including the annual Global Incident Response Report and maintains tracking of named threat actor groups.

Differentiator

Problem solved

Functional benefit

Brands

• Unit 42 ATOMs: Tools and automation resources published by Unit 42 for security practitioners.
• Unit 42 Threat Actor Groups

Products and services

• Unit 42 Threat Research Ongoing threat intelligence and research publications covering emerging cyber threats, malware analysis, vulnerability research, and threat actor group tracking. Provides enterprise security teams with timely analysis of attack techniques and defensive strategies.
• Unit 42 Incident Response Services Professional incident response and managed detection and response services for organizations experiencing active cyber attacks. Provides expert-led investigation, threat actor attribution, containment, and remediation support delivered through Palo Alto Networks' enterprise sales organization and direct emergency response contact.
• ATOMs (Automated Threat Orchestration and Machine Learning) Tools and automation resources published by Unit 42 for security practitioners, providing automated threat orchestration capabilities to support threat analysis and response workflows.
• Unit 42 Security Consulting Strategic security advisory and consulting engagements delivered to enterprise clients through Palo Alto Networks, covering threat hunting, security posture assessment, and strategic guidance on emerging threats including AI-related risks.

Quantifiable outcome

• 2026 report: Attacks are 4X faster, with data exfiltration in less than 1 hour in some cases; 65% of initial access driven by identity-based techniques; 87% of attacks unfolded across multiple attack surfaces.

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability4 records

Feature4 records

Partnerships

One partnership is on record.

• Cyber Threat AlliancecoreStrategic or Co-development PartnerUnit 42 works with the Cyber Threat Alliance, a nonprofit organization for sharing threat intelligence among cybersecurity providers. Kathi Whitbey serves as a contributor to the Cyber Threat Alliance, representing Unit 42's involvement in industry-wide threat intelligence sharing initiatives.

Scale indicators1 record

Recent moves7 records

Expansion highlights6 records

Direct peers

• Mandiant (Google Cloud): Mandiant is the closest direct competitor, providing incident response, threat intelligence, and managed defense services to enterprise and government clients. Acquired by Google in 2022, it competes head-to-head with Unit 42 on global IR retainers and adversary-tracking research.
• CrowdStrike Services: CrowdStrike's Services division offers incident response, proactive services, and threat intelligence aligned with the Falcon platform. Overlaps directly with Unit 42's IR and MDR offerings and publishes comparable adversary-tracking research.
• Secureworks: Secureworks provides managed detection and response, incident response, and threat intelligence services to enterprise customers. Direct overlap with Unit 42's managed services and consulting offerings, with comparable adversary-research output.
• Kroll Cyber Risk: Kroll's Cyber Risk practice delivers incident response, digital forensics, breach notification, and threat intelligence to enterprises and law firms. Highly comparable on the IR and forensic advisory side, though broader in scope beyond pure cybersecurity.
• NCC Group: NCC Group operates a global cyber security practice spanning threat intelligence, incident response, and managed detection. Comparable in adversary-tracking capability and cross-border IR reach, particularly in EMEA markets.
• Rapid7: Rapid7 offers managed detection and response, incident response, and threat intelligence services layered on its Insight platform. Comparable in MDR/IR service model and produces widely read threat research content.
• Trustwave: Trustwave provides managed security services, incident response, database security, and threat intelligence to enterprise clients. Direct overlap with Unit 42 on MDR and IR services, with strong presence in mid-market and EMEA.

Emerging players

• Bishop Fox: Bishop Fox specializes in offensive security, red teaming, and vulnerability research with adjacent incident response capabilities. Smaller and more niche than Unit 42 but overlapping on continuous threat exposure research content.
• Recorded Future (Mastercard): Recorded Future provides threat intelligence as a service, now owned by Mastercard. Overlaps with Unit 42 on adversary tracking and vulnerability intelligence, though its focus is more on intelligence platform subscriptions than hands-on IR services.

Broad incumbents

• Microsoft Threat Intelligence / DART: Microsoft's Detection and Response Team (DART) and Microsoft Threat Intelligence compete with Unit 42 on enterprise IR and global adversary tracking. As a broad incumbent, Microsoft bundles IR into its larger security and cloud ecosystem.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xtwitter.com/Unit42_Intel
• YouTubeyoutube.com/user/paloaltonetworks
• Facebookfacebook.com/PaloAltoNetworks
• LinkedInlinkedin.com/company/unit42-gmbh

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about unit42 gmbh