Cybersecurity market intelligence · Transaction diligence · Verified AI
RiskOne is a standing intelligence system for investors and operators — every material claim source-tagged, confidence-banded, and re-verified on a clock. Built for the few engagements where being right matters more than being fast, and delivered fast anyway.
Opinions do not keep score. RiskOne does.
Coverage
Every entity that matters sits in a standing census — watched daily for material change. The ones that matter most carry full structural profiles: ownership, capital stack, technology position, trajectory. Explore the segments:
MDR, MXDR, SOAR, IR and DFIR — and the shift to agentic security operations.
503 under census → 129 structurally profiled · re-verified continuously
DSPM, DLP, encryption, PKI, and post-quantum readiness — data security as engineering.
155 under census → 6 structurally profiled · re-verified continuously
ZTNA, SASE/SSE, WAF, NDR, DNS — the network control points, relocated to the cloud edge.
143 under census → 13 structurally profiled · re-verified continuously
Workforce, customer, and machine identity — IAM, PAM, ITDR, passwordless. Non-human identities now outnumber human ones.
127 under census → 17 structurally profiled · re-verified continuously
Securing AI models, runtimes, and agents — LLM firewalls, AI governance, AI red teaming.
124 under census → 10 structurally profiled · re-verified continuously
Threat intelligence platforms, OSINT, dark-web monitoring, brand and deepfake protection.
110 under census → 7 structurally profiled · re-verified continuously
Vulnerability management, attack-surface management, pen testing, BAS — continuous threat exposure management.
109 under census → 6 structurally profiled · re-verified continuously
The services layer — Big-4 cyber arms, GSIs, integrators, VARs, incident response.
109 under census → 26 structurally profiled · re-verified continuously
AppSec and the software supply chain — SAST/SCA/ASPM, API security, secrets, AI-generated code.
92 under census → 10 structurally profiled · re-verified continuously
EDR/EPP, mobile, UEM, and the enterprise browser — the browser is the new enterprise OS.
88 under census → 8 structurally profiled · re-verified continuously
SIEM, analytics, telemetry routing, and security data lakes — the SOC's fixed data layer.
84 under census → 10 structurally profiled · re-verified continuously
CNAPP code-to-cloud platforms — posture, workloads, entitlements, container and Kubernetes runtime.
69 under census → 5 structurally profiled · re-verified continuously
Phishing and BEC defense across email and the collaboration stack — Slack, Teams, Zoom.
16 under census → 4 structurally profiled · re-verified continuously
Tracking an entity we have not profiled yet? Request coverage →
+ 297 entities under census in emerging domains, not yet broken out
Abstract rendering — entities are never identified · as of 2026-06-12
The connected universe
Coverage is a graph, not a list — every profile is wired to the people, owners, products, and transactions around it.
Signals & intelligence
Publicly-reported market events on tracked entities, from the daily news sweep. External sources only — analyst findings, deliverables, and client material never appear here.
Data and AI security company Cyera raised $600M Series G at $12B valuation; led by Evolution Equity Partners with Cyberstarts, Temasek, Accel, Blackstone, AT&T Ventures, Coatue, Spark Capital. Total funding now exceeds $2B. Valuation…
Source →Pi, an agentic AI security platform automating software protection from design to deployment, raised $35M total ($25M Series A + prior seed) led by Brightmind Partners and Third Point Ventures, backed by CrowdStrike CEO George Kurtz and…
Source →Aryon Security, Israeli cloud-security startup founded by Matzov (elite IDF cyber unit) alumni, raised $29M Series A led by Brightmind Partners; participation from Datadog, Skinos Ventures (Shlomo Kramer), Blumberg Capital, Viola…
Source →BOD 26-04 requires federal civilian agencies to prioritize vulnerability remediation by four risk criteria (asset exposure, KEV status, exploit automation, post-exploitation impact); deadlines from 3 days (highest risk) to 60 days;…
Source →New June 2026 announcement (distinct from April Cloud Next preview and May Google AI Threat Defense). Triage & Investigation Agent autonomously investigates alerts and is now generally available — first-party hyperscaler agentic L1/L2…
Source →Cycurion (NASDAQ: CYCU, tracked Target) closed its acquisition of Secuvant LLC (Panoptic continuous threat & vulnerability visibility platform) on 2026-06-02; PR 2026-06-09. Consideration ~$2.875M ($875K cash + 888,888 preferred shares…
Source →Updated with each census sweep · as of 2026-06-12
Market intelligence
Traditional coverage is a $1M-a-year stack of analysts and subscriptions that applies someone else's framework on someone else's schedule. RiskOne replaces it with a system that runs continuously against your thesis: a daily census across the cybersecurity universe, structural profiles of every entity that matters, and ranked screens you can put in front of a board or an investment committee — with the evidence chain visible on every line.
Transaction diligence
For private-equity sponsors and acquirers in the cybersecurity market: a deal-cycle suite built on the same living dossiers — triage one-pagers for Monday pipeline calls, deep-dive competitive dossiers, IC memos with every claim linked to falsifiable assertions, CFO packs with the valuation multiple implied by technology ownership, and a simulated pressure-test from the five people who will actually challenge the deal.
Verified AI
Most AI programs ask for trust up front and never check it again. Published red-team results say adaptive prompt injection wins more often than not — so we don't negotiate with the model, and we don't grant trust by policy. We architect so trust is earned: sensitive data physically cannot reach a frontier model — local redaction before anything leaves, a deterministic egress gate that classifies every call, and a tamper-evident audit chain of exactly what left and why. Then the trust is re-verified on every call, because sensitive work fails closed to local models instead of leaking.
This is a reference architecture we run in production — not a slide. We bring the same rigor to your AI estate, and we audit vendor AI claims the way an underwriter would: demonstrated, claimed-only, or theater.
Detection & response advisory
RiskOne's principal has built detection and response products adopted by two of the largest banks in the United States, by government, and across the Fortune 500 — each time as an operator inside those environments first, learning the biggest unmet needs firsthand and building the products that defined what came next.
That operator-builder base, paired with the standing intelligence engine, is what we bring to clients: where the market is moving, what buyers will actually pay for, and how to aim a development effort so it lands — grounded in public detection-efficacy evidence rather than analyst quadrants.
Methodology
Most diligence arrives as a finished document — conclusions detached from their evidence, current as of the day it was written, stale by the time it is read. RiskOne deliverables keep the chain attached. Three links, visible on every assertion:
Every claim carries its source class — public, triangulated, expert judgment, or privileged — and privileged material never crosses into a client-facing deliverable. The MNPI firewall is structural, not procedural.
High, medium, or low — earned, visible, and auditable. No false-precision scores, no decimal-point theater. If the evidence doesn't support a band, the claim says so.
Findings expire. Every claim re-verifies on a standing cadence — material events trigger immediate re-verification, and nothing is allowed to go stale. Predictions are scored after the fact; the system's calibration is itself a tracked metric.
Who this serves
Sponsors, growth investors, and corporate development teams putting capital to work in the cybersecurity market.
CEOs and product leaders of security companies deciding what to build, buy, or exit next.
Directors, CISOs, and the committees who must stand behind security and AI decisions.
The firm
RiskOne is an independent intelligence practice. Its principal has spent three decades inside security operations — from military CERT operations and global security operations centers, through the founding era of SIEM and network forensics, to the CTO seat of one of the industry's largest security integrators — and has taught information security to CISOs and executive teams as faculty since 2008.
Financial services leads the world in security operations, and he has been part of that charge at multiple of the institutions that set the bar — building and fielding detection capabilities inside the largest US banks. That is the standard the practice holds every engagement to.
The practice is highly focused and AI-augmented by design: a standing intelligence system multiplies expert judgment, so depth scales with focus rather than headcount. And it keeps score in public terms — claims are sourced, confidence is banded, predictions are calibrated after the fact. The methodology is the credential.
Engage
RiskOne works with a focused slate of marquee clients each quarter — investors, acquirers, and operating executives in the cybersecurity market. Outline the decision you need to make and the timeline it is on.