Cybersecurity market intelligence · Transaction diligence · Verified AI
RiskOne is a standing intelligence system for investors and operators — every material claim source-tagged, confidence-banded, and re-verified on a clock. Built for the few engagements where being right matters more than being fast, and delivered fast anyway.
Opinions do not keep score. RiskOne does.
Coverage
Every entity that matters sits in a standing census — watched daily for material change. The ones that matter most carry full structural profiles: ownership, capital stack, technology position, trajectory. Explore the segments:
MDR, MXDR, SOAR, IR and DFIR — and the shift to agentic security operations.
733 under census → 186 structurally profiled · re-verified continuously
DSPM, DLP, encryption, PKI, and post-quantum readiness — data security as engineering.
257 under census → 9 structurally profiled · re-verified continuously
Workforce, customer, and machine identity — IAM, PAM, ITDR, passwordless. Non-human identities now outnumber human ones.
216 under census → 38 structurally profiled · re-verified continuously
AppSec and the software supply chain — SAST/SCA/ASPM, API security, secrets, AI-generated code.
212 under census → 18 structurally profiled · re-verified continuously
ZTNA, SASE/SSE, WAF, NDR, DNS — the network control points, relocated to the cloud edge.
197 under census → 16 structurally profiled · re-verified continuously
Vulnerability management, attack-surface management, pen testing, BAS — continuous threat exposure management.
188 under census → 8 structurally profiled · re-verified continuously
Securing AI models, runtimes, and agents — LLM firewalls, AI governance, AI red teaming.
178 under census → 24 structurally profiled · re-verified continuously
The services layer — Big-4 cyber arms, GSIs, integrators, VARs, incident response.
176 under census → 31 structurally profiled · re-verified continuously
Threat intelligence platforms, OSINT, dark-web monitoring, brand and deepfake protection.
129 under census → 12 structurally profiled · re-verified continuously
EDR/EPP, mobile, UEM, and the enterprise browser — the browser is the new enterprise OS.
116 under census → 9 structurally profiled · re-verified continuously
SIEM, analytics, telemetry routing, and security data lakes — the SOC's fixed data layer.
96 under census → 20 structurally profiled · re-verified continuously
CNAPP code-to-cloud platforms — posture, workloads, entitlements, container and Kubernetes runtime.
92 under census → 10 structurally profiled · re-verified continuously
Phishing and BEC defense across email and the collaboration stack — Slack, Teams, Zoom.
44 under census → 6 structurally profiled · re-verified continuously
Tracking an entity we have not profiled yet? Request coverage →
+ 540 entities under census in emerging domains, not yet broken out
Abstract rendering — entities are never identified · as of 2026-10-07
The connected universe
Coverage is a graph, not a list — every profile is wired to the people, owners, products, and transactions around it.
Signals & intelligence
Publicly-reported market events on tracked entities, from the daily news sweep. External sources only — analyst findings, deliverables, and client material never appear here.
Accenture's $4.18B bet on industrial cybersecurity closes: $3.25B majority stake in Dragos + outright acquisition of NetRise and runZero. Combined platform serves critical infrastructure (power, pipelines, manufacturing). OT…
Source →Armadin -- $255.5M Series B at >$2.5B (AI-native offensive security, US)
Source →ShinyHunters exploited CVE-2026-35273 bypass in Oracle PeopleSoft to breach FBI job portal, stealing employee personal data. Accenture contractor failed to apply required patch. FBI removed the contractor. Mandiant investigated attack…
Source →<p>Anthropic is integrating the CVP and Project Glasswing into a single offering, with three levels of access to its most capable AI models.</p> <p>The post <a href="">Anthropic Introduces 3-Tier Cyber
Source →Airbus / Quarkslab -- sovereign cyber acquisition completes (France)
Source →Series B funding brings the AI-powered offensive security startup's total capital to roughly $445 million only seven months after its public launch. Andreessen Horowitz and Accel co-led; new investors Bain Capital Ventures and Redpoint…
Source →<p>The FBI has removed an Accenture contractor over a data breach that exposed personal information of thousands of bureau employees.</p> <p>The post <a href="">FBI Blames Contractor’s Missed Patch for Shi
Source →Kevin Mandia, best known as the founder of Mandiant, has a new startup that is using agent swarms to test and protect enterprises.
Source →A new Windows botnet (x47.c) weaponizes xAI Grok API to choose from predefined persistence actions, using AI to maintain stealth. Represents first known botnet using xAI's model for autonomous decision-making in malicious…
Source →Updated with each census sweep · as of 2026-10-07
Market intelligence
Traditional coverage is a $1M-a-year stack of analysts and subscriptions that applies someone else's framework on someone else's schedule. RiskOne replaces it with a system that runs continuously against your thesis: a daily census across the cybersecurity universe, structural profiles of every entity that matters, and ranked screens you can put in front of a board or an investment committee — with the evidence chain visible on every line.
Transaction diligence
For private-equity sponsors and acquirers in the cybersecurity market: a deal-cycle suite built on the same living dossiers — triage one-pagers for Monday pipeline calls, deep-dive competitive dossiers, IC memos with every claim linked to falsifiable assertions, CFO packs with the valuation multiple implied by technology ownership, and a simulated pressure-test from the five people who will actually challenge the deal.
Verified AI
Most AI programs ask for trust up front and never check it again. Published red-team results say adaptive prompt injection wins more often than not — so we don't negotiate with the model, and we don't grant trust by policy. We architect so trust is earned: sensitive data physically cannot reach a frontier model — local redaction before anything leaves, a deterministic egress gate that classifies every call, and a tamper-evident audit chain of exactly what left and why. Then the trust is re-verified on every call, because sensitive work fails closed to local models instead of leaking.
This is a reference architecture we run in production — not a slide. We bring the same rigor to your AI estate, and we audit vendor AI claims the way an underwriter would: demonstrated, claimed-only, or theater.
Detection & response advisory
RiskOne's principal has built detection and response products adopted by two of the largest banks in the United States, by government, and across the Fortune 500 — each time as an operator inside those environments first, learning the biggest unmet needs firsthand and building the products that defined what came next.
That operator-builder base, paired with the standing intelligence engine, is what we bring to clients: where the market is moving, what buyers will actually pay for, and how to aim a development effort so it lands — grounded in public detection-efficacy evidence rather than analyst quadrants.
Methodology
Most diligence arrives as a finished document — conclusions detached from their evidence, current as of the day it was written, stale by the time it is read. RiskOne deliverables keep the chain attached. Three links, visible on every assertion:
Every claim carries its source class — public, triangulated, expert judgment, or privileged — and privileged material never crosses into a client-facing deliverable. The MNPI firewall is structural, not procedural.
High, medium, or low — earned, visible, and auditable. No false-precision scores, no decimal-point theater. If the evidence doesn't support a band, the claim says so.
Findings expire. Every claim re-verifies on a standing cadence — material events trigger immediate re-verification, and nothing is allowed to go stale. Predictions are scored after the fact; the system's calibration is itself a tracked metric.
Who this serves
Sponsors, growth investors, and corporate development teams putting capital to work in the cybersecurity market.
CEOs and product leaders of security companies deciding what to build, buy, or exit next.
Directors, CISOs, and the committees who must stand behind security and AI decisions.
Engage
RiskOne works with a focused slate of marquee clients each quarter — investors, acquirers, and operating executives in the cybersecurity market. Outline the decision you need to make and the timeline it is on.