SpyCloud, Inc.

Overview

SpyCloud is an Austin, Texas, cybersecurity company founded in 2016 with an unusual premise: instead of only defending corporate perimeters, it fights cybercrime by recapturing criminals’ own stolen data — credentials, session cookies, and personal information traded in the criminal underground — and handing it back to the companies whose employees and customers it exposes (Finovate). Its platform watches for exposed logins so organizations can reset passwords, revoke sessions, and remediate malware infections before stolen access is weaponized into account takeover, ransomware, or fraud (IBS Intelligence; SecurityWeek).

The “exact match” thesis

Co-founder and CEO Ted Ross arrived at the idea after noticing the rising tide of third-party data breaches and concluding that the available defenses were mismatched to the problem. Most solutions were heuristic or behavior-based — “prone to false positives,” in his telling — while what was needed was simpler: compare the credentials a company actually uses against the credentials criminals actually hold, an exact match, with “no false positives, no calls to the help desk” (Finovate). Ross had previously built a threat-sharing platform, where he saw that most threat feeds revolved around indicators of compromise — artifacts that require a trained security professional to create and use — while companies wanted defenses that were easy to understand, easy to operationalize, and effective (Finovate).

The company debuted publicly at FinovateFall 2017, winning Best of Show for its Exposed Credential Monitoring and Alert Service: corporate exposure notifications, an Active Directory monitor that compared newly stolen credentials against active users, and an API that checked customer logins for exposed credentials (Finovate).

HUMINT tradecraft: social-engineering the criminals

SpyCloud’s most distinctive claim — and the detail almost no SERP result covers — is methodological. Because many sources of stolen credentials cannot be reached by automated tools or web crawlers, the company says it uses a combination of technical innovation and human intelligence: its research team social-engineers threat actors to infiltrate and maintain connections to covert criminal groups, aiming to recover stolen information before it is posted to a public forum or sold underground (Finovate; Finovate). Ross declined to detail the tradecraft for operational-security reasons, but described the goal plainly: “to recover this information before it can be used against our customers” (Finovate).

The scale was already striking in 2017: Ross said the company was ingesting about 40 million new credentials every week, after deduplication, and had credentials for “just about every enterprise with a digital presence” — finding 10 new breached databases from private sources every working day (Finovate). By 2020 its repository held over 100 billion assets including more than 21 billion passwords (IBS Intelligence); by late 2021, more than 145 billion breached assets, 30 billion email addresses, and 25 billion passwords, drawn from more than 50 new breach sources a week (Finovate).

From pandemic fraud to the passwordless era

The company’s funding history tracks the attack landscape. In August 2020 it raised a $30 million Series C led by Centana Growth Partners, with M12 (Microsoft’s venture fund), Altos Ventures, Silverton Partners, and March Capital participating, to expand product and engineering as pandemic-era fraud surged (IBS Intelligence). Its researchers had uncovered 139,000 new virus-themed web domains in the pandemic’s early days and were tracking criminals posing as government agencies and running credential-stuffing attacks against food delivery apps (IBS Intelligence). “Criminals work together to steal information and find creative ways to monetize it,” Ross said. “As a result, even the most careful and sophisticated organizations are vulnerable” (IBS Intelligence).

In late 2021 the company launched its Identity Risk Engine: businesses place it at their most critical fraud points — account opening, login, transactions — and a single API query on an email address or phone number returns a risk score built from the recaptured data, aimed at account takeover, identity fraud, new-account fraud, and synthetic identities (Finovate). Then in August 2023 came the largest round: a $110 million growth round led by Riverwood Capital, after more than $58 million raised across four earlier rounds, earmarked for global expansion and authentication-bypass prevention — defenses designed for the passkeys and passwordless era, where stolen sessions and cookies matter as much as stolen passwords (SecurityWeek).

What this profile does not claim

The company’s larger data-volume figures (a “trillion assets,” “12 billion new pieces of data per month,” “25 billion assets per month”) and its law-enforcement cooperation claims (FBI, Europol, named takedowns) appear only in company-issued materials, which were not consulted; this profile uses only figures reported by independently read press. Customer-penetration claims (Fortune 10 counts, protected-account totals) are likewise company statements and are not asserted as verified fact. Co-founder Alen Puzic’s name does not appear in the independently read sources, so the profile credits only CEO Ted Ross as co-founder rather than asserting a complete founding team. Post-2023 developments — including the company’s 2024–2026 product and funding history — were outside the independently read sources and are deliberately omitted.