SpyCloud, Inc.
| Private | |
| ISIN | 🆔 |
| Industry | Cybersecurity |
| Founded 📆 | August 2016 |
| Founders 👔 | Ted Ross · Alen Puzic · David Endler |
Area served 🗺️ | |
Key people | Ted Ross (CEO & Co-Founder) · Alen Puzic (Co-Founder & CIO) |
| Products 📟 | Identity threat protection · Account takeover prevention · Session identity protection · Cybercrime investigations |
| Members | |
Number of employees | 250+ |
| 🌐 Website | spycloud |
| 📇 Address | |
| 📞 telephone | |
SpyCloud is an American cybersecurity company headquartered in Austin, Texas. Founded in August 2016, the company specializes in recapturing stolen identity data, including credentials, session cookies, authentication tokens, and malware-exfiltrated device data, from criminal underground sources and providing enterprises with automated tools to detect and remediate identity exposures before attackers can exploit them.
SpyCloud is primarily known for its darknet data recapture methodology, its IDLink identity correlation technology, and its participation in coordinated law enforcement operations targeting cybercrime infrastructure. The company serves more than 600 organizations worldwide, including seven of the Fortune 10, across financial services, technology, healthcare, e-commerce, telecom, and government.
History
SpyCloud was founded in August 2016 in Austin, Texas by Ted Ross, Alen Puzic, and David Endler. At founding, Ross served as CEO and Endler as CIO; Puzic served as a co-founding technical executive. Endler later departed the company to establish Runtime Ventures. Ross continues to serve as CEO, and Puzic serves as co-founder and Chief Information Officer.
Ross previously held roles at TippingPoint, HP Security Research, and Exodus Intelligence. Endler is a noted security researcher who previously led X-Force at IBM.
The company made its public debut at FinovateFall 2017 in New York, where it won Best of Show.[1]
Funding
SpyCloud has raised more than $200 million in total capital across multiple rounds.[2]
- Series B (2019): $21 million, including investment from Microsoft venture fund M12 and Centana Growth Partners.[3]
- Series C (2020): $30 million.[4]
- Series D (August 2023): $110 million, led by Riverwood Capital.[5]
- Growth financing (June 2024): $35 million, led by CIBC Innovation Banking.[6]
Products and technology
SpyCloud's platform is built around a proprietary data repository of recaptured identity records sourced from data breaches, infostealer malware logs, and successful phishing attacks. As of 2026, the company reported holding more than 65.7 billion distinct recaptured identity records across more than 200 data types, including credentials, session cookies, authentication tokens, and device fingerprints.[7]
The company's core analytical technology, IDLink, correlates fragmented identity data across multiple sources, including email addresses, usernames, passwords, and device identifiers, to build holistic identity profiles.Cite error: Closing </ref> missing for <ref> tag
Solution areas
SpyCloud organizes its products into three solution areas:
- Enterprise Protection: Monitors employee credentials and session cookies for exposure; automates remediation through integrations with Microsoft Active Directory, Microsoft Entra ID, and Okta. Products include Workforce Threat Protection, Endpoint Threat Protection, Supply Chain Threat Protection, and Identity Guardians.
- Consumer Protection: API-based products for financial services, e-commerce, and telecom companies to detect stolen consumer credentials and session tokens. Products include Consumer Threat Protection, Session Identity Protection, and Financial Threat Protection.
- Cybercrime Investigations: A platform enabling cyber threat intelligence analysts, security operations teams, fraud investigators, and law enforcement to investigate threat actor attribution, insider risk, and financial crime.
Law enforcement involvement
Tycoon 2FA takedown (2026)
In March 2026, SpyCloud participated as a private sector partner in a coordinated law enforcement operation led by Europol and Microsoft to dismantle Tycoon 2FA, a phishing-as-a-service (PhaaS) platform used to conduct adversary-in-the-middle phishing attacks capable of bypassing multi-factor authentication.[8][9][10]
The operation resulted in the seizure of more than 300 domains tied to the platform and legal action against multiple individuals, including the platform's primary developer. SpyCloud contributed victimology data to the operation; geographic analysis by SpyCloud Labs indicated the United States had the largest concentration of identified victims (179,264), followed by the United Kingdom (16,901) and Canada (15,272). The overwhelming majority of targeted accounts were enterprise-managed, confirming the platform primarily targeted business environments.[8][10]
Other private sector partners in the operation included Cloudflare, Proofpoint, Intel 471, Trend Micro, Resecurity, eSentire, and Coinbase.[9][10]
Research
SpyCloud publishes an annual Identity Exposure Report providing quantitative analysis of trends in credential theft, infostealer infections, and phishing-sourced identity data. The 2026 edition, published March 19, 2026, reported 65.7 billion distinct identity records recaptured, 8.6 billion stolen session cookies recaptured in 2025, 642 million exposed credentials from 13.2 million infostealer infections in 2025, and a 400 percent year-over-year increase in successful phishing attacks.[11]
SpyCloud Labs, the company's internal threat research division, publishes technical analyses of criminal infrastructure and tooling. Labs researchers have published research on infostealer malware families, phishing-as-a-service platforms, and session hijacking techniques, and contributed investigative intelligence to the 2026 Tycoon 2FA law enforcement operation.
Recognition
- Won Best of Show at FinovateFall 2017 in New York.[12]
- EY Entrepreneur of the Year 2024 Gulf South Award Finalist — Ted Ross, CEO.[13]
See also
References
- ↑ "FinovateFall 2017 Best of Show Winners Announced". Finovate. September 12, 2017. Retrieved June 2026. Check date values in:
|access-date=(help) - ↑ "SpyCloud Archives". Finovate. 29 July 2024. Retrieved June 2026. Check date values in:
|access-date=(help) - ↑ "SpyCloud Archives". Finovate. 29 July 2024. Retrieved June 2026. Check date values in:
|access-date=(help) - ↑ "After Tripling Revenue, SpyCloud Raises $30 Million Series C Round to Protect the Internet from Fraud". Centana Growth Partners. August 18, 2020. Retrieved June 2026. Check date values in:
|access-date=(help) - ↑ "SpyCloud bags $110M to help companies respond to login credential leaks faster". SiliconAngle. August 23, 2023. Retrieved June 2026. Check date values in:
|access-date=(help) - ↑ "SpyCloud Receives $35M in Growth Financing". FinSMEs. June 6, 2024. Retrieved June 2026. Check date values in:
|access-date=(help) - ↑ "2026 Annual Identity Exposure Report". SpyCloud. March 19, 2026. Retrieved June 2026. Check date values in:
|access-date=(help) - ↑ 8.0 8.1 "Europol-Led Operation Takes Down Tycoon 2FA Phishing-as-a-Service". The Hacker News. March 5, 2026. Retrieved June 2026. Check date values in:
|access-date=(help) - ↑ 9.0 9.1 "Tycoon 2FA Phishing Platform Dismantled in Global Takedown". SecurityWeek. March 4, 2026. Retrieved June 2026. Check date values in:
|access-date=(help) - ↑ 10.0 10.1 10.2 "Defending the gates: How a global coalition disrupted Tycoon 2FA". Microsoft On the Issues. March 5, 2026. Retrieved June 2026. Check date values in:
|access-date=(help) - ↑ "2026 Annual Identity Exposure Report". SpyCloud. March 19, 2026. Retrieved June 2026. Check date values in:
|access-date=(help) - ↑ "FinovateFall 2017 Best of Show Winners Announced". Finovate. September 12, 2017. Retrieved June 2026. Check date values in:
|access-date=(help) - ↑ "EY Announces Ted Ross as Entrepreneur Of The Year 2024 Gulf South Finalist". SpyCloud Newsroom. Retrieved June 2026. Check date values in:
|access-date=(help)
External links
Category:Companies based in Austin, Texas Category:Companies established in 2016 Category:Privately held companies of the United States
This article "SpyCloud" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:SpyCloud. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.
