Cybersecurity market intelligence · Transaction diligence · Verified AI
RiskOne is a standing intelligence system for investors and operators — every material claim source-tagged, confidence-banded, and re-verified on a clock. Built for the few engagements where being right matters more than being fast, and delivered fast anyway.
Opinions do not keep score. RiskOne does.
Coverage
Every entity that matters sits in a standing census — watched daily for material change. The ones that matter most carry full structural profiles: ownership, capital stack, technology position, trajectory. Explore the segments:
MDR, MXDR, SOAR, IR and DFIR — and the shift to agentic security operations.
731 under census → 185 structurally profiled · re-verified continuously
DSPM, DLP, encryption, PKI, and post-quantum readiness — data security as engineering.
254 under census → 8 structurally profiled · re-verified continuously
AppSec and the software supply chain — SAST/SCA/ASPM, API security, secrets, AI-generated code.
210 under census → 17 structurally profiled · re-verified continuously
Workforce, customer, and machine identity — IAM, PAM, ITDR, passwordless. Non-human identities now outnumber human ones.
208 under census → 27 structurally profiled · re-verified continuously
ZTNA, SASE/SSE, WAF, NDR, DNS — the network control points, relocated to the cloud edge.
194 under census → 16 structurally profiled · re-verified continuously
Vulnerability management, attack-surface management, pen testing, BAS — continuous threat exposure management.
187 under census → 8 structurally profiled · re-verified continuously
The services layer — Big-4 cyber arms, GSIs, integrators, VARs, incident response.
175 under census → 31 structurally profiled · re-verified continuously
Securing AI models, runtimes, and agents — LLM firewalls, AI governance, AI red teaming.
173 under census → 20 structurally profiled · re-verified continuously
Threat intelligence platforms, OSINT, dark-web monitoring, brand and deepfake protection.
129 under census → 12 structurally profiled · re-verified continuously
EDR/EPP, mobile, UEM, and the enterprise browser — the browser is the new enterprise OS.
116 under census → 9 structurally profiled · re-verified continuously
SIEM, analytics, telemetry routing, and security data lakes — the SOC's fixed data layer.
96 under census → 20 structurally profiled · re-verified continuously
CNAPP code-to-cloud platforms — posture, workloads, entitlements, container and Kubernetes runtime.
92 under census → 9 structurally profiled · re-verified continuously
Phishing and BEC defense across email and the collaboration stack — Slack, Teams, Zoom.
44 under census → 6 structurally profiled · re-verified continuously
Tracking an entity we have not profiled yet? Request coverage →
+ 529 entities under census in emerging domains, not yet broken out
Abstract rendering — entities are never identified · as of 2026-08-10
The connected universe
Coverage is a graph, not a list — every profile is wired to the people, owners, products, and transactions around it.
Signals & intelligence
Publicly-reported market events on tracked entities, from the daily news sweep. External sources only — analyst findings, deliverables, and client material never appear here.
Databricks has officially completed the acquisition of Panther (announced June 16 2026). Panther brings 100+ out-of-the-box data integrations, detection-as-code capabilities, and agentic SOC workflows. Combined with Databricks Lakewatch…
Source →Above Security received a strategic investment from the CrowdStrike Falcon Fund during Black Hat USA 2026. Signals CrowdStrike expansion of AI-SOC partner ecosystem.
Source →<p>The incident involved a testing environment set up by Irregular, similar to what Anthropic reported last week.</p> <p>The post <a href="">Meta AI Hacked External Systems During Cybersecurity Testing</a> appe
Source →OpenAI has announced that it's pausing some "internal activities" involving its upcoming artificial intelligence (AI) model Astra after an internal evaluation found it had made significant advancements in agentic coding and…
Source →Oligo Security raised $60 million to accelerate product innovation and expand go-to-market operations. The company focuses on runtime application security monitoring, identifying exploitable vulnerabilities in running applications and…
Source →Obsidian Security raised $85 million Series D at a $1.1 billion unicorn valuation, led by Crescent Cove Advisors with participation from Greylock Partners and Menlo Ventures. Total funding now exceeds $200M. Obsidian secures NHI and AI…
Source →<p>The payments giant says BioCatch’s behavioral and device intelligence will help financial institutions combat account takeovers, scams and other forms of digital fraud.</p> <p>The post <a href="">Visa to
Source →Switzerland's federal IT office says hackers exploited vulnerabilities to breach its Microsoft SharePoint servers and compromised approximately 200 accounts. [...]
Source →Palo Alto Networks / Protect AI — AI/ML security (MLSecOps) tuck-in
Source →Meta has become the latest AI company to confirm that one of its models hacked a real organization during cybersecurity testing, as similar incidents continue to emerge following OpenAI'sOpenAI's initial disclosure that its agents…
Source →Updated with each census sweep · as of 2026-08-10
Market intelligence
Traditional coverage is a $1M-a-year stack of analysts and subscriptions that applies someone else's framework on someone else's schedule. RiskOne replaces it with a system that runs continuously against your thesis: a daily census across the cybersecurity universe, structural profiles of every entity that matters, and ranked screens you can put in front of a board or an investment committee — with the evidence chain visible on every line.
Transaction diligence
For private-equity sponsors and acquirers in the cybersecurity market: a deal-cycle suite built on the same living dossiers — triage one-pagers for Monday pipeline calls, deep-dive competitive dossiers, IC memos with every claim linked to falsifiable assertions, CFO packs with the valuation multiple implied by technology ownership, and a simulated pressure-test from the five people who will actually challenge the deal.
Verified AI
Most AI programs ask for trust up front and never check it again. Published red-team results say adaptive prompt injection wins more often than not — so we don't negotiate with the model, and we don't grant trust by policy. We architect so trust is earned: sensitive data physically cannot reach a frontier model — local redaction before anything leaves, a deterministic egress gate that classifies every call, and a tamper-evident audit chain of exactly what left and why. Then the trust is re-verified on every call, because sensitive work fails closed to local models instead of leaking.
This is a reference architecture we run in production — not a slide. We bring the same rigor to your AI estate, and we audit vendor AI claims the way an underwriter would: demonstrated, claimed-only, or theater.
Detection & response advisory
RiskOne's principal has built detection and response products adopted by two of the largest banks in the United States, by government, and across the Fortune 500 — each time as an operator inside those environments first, learning the biggest unmet needs firsthand and building the products that defined what came next.
That operator-builder base, paired with the standing intelligence engine, is what we bring to clients: where the market is moving, what buyers will actually pay for, and how to aim a development effort so it lands — grounded in public detection-efficacy evidence rather than analyst quadrants.
Methodology
Most diligence arrives as a finished document — conclusions detached from their evidence, current as of the day it was written, stale by the time it is read. RiskOne deliverables keep the chain attached. Three links, visible on every assertion:
Every claim carries its source class — public, triangulated, expert judgment, or privileged — and privileged material never crosses into a client-facing deliverable. The MNPI firewall is structural, not procedural.
High, medium, or low — earned, visible, and auditable. No false-precision scores, no decimal-point theater. If the evidence doesn't support a band, the claim says so.
Findings expire. Every claim re-verifies on a standing cadence — material events trigger immediate re-verification, and nothing is allowed to go stale. Predictions are scored after the fact; the system's calibration is itself a tracked metric.
Who this serves
Sponsors, growth investors, and corporate development teams putting capital to work in the cybersecurity market.
CEOs and product leaders of security companies deciding what to build, buy, or exit next.
Directors, CISOs, and the committees who must stand behind security and AI decisions.
Engage
RiskOne works with a focused slate of marquee clients each quarter — investors, acquirers, and operating executives in the cybersecurity market. Outline the decision you need to make and the timeline it is on.