Arena: Market Conditions Before Cybereason
Large enterprise security teams · 2012 · United States
Changing technical requirements
By the early 2010s a large organization had to assume that a determined attacker would get past its preventive tools CYX-12. A company such as Lockheed Martin ran more than 120,000 endpoints and servers, and an intrusion left its traces spread across many of them CYX-12. Analysts received isolated alerts and had to work out which events belonged to the same attack, where it started, how the attacker communicated, and which machines and users it had reached CYX-11 CYX-12. A usable system had to collect that evidence and help analysts decide which events formed one operation CYX-12 CYX-11.
How each step happened
Step 1 of 5 · 2011–15
Attack stories, on premises or in the cloud
CrowdStrike, founded in 2011 by former McAfee executives, put its product in the cloud from the first day CYX-1 CYX-13. A single agent under 35 MB ran on Windows, Mac and Linux machines and sent every customer's activity to one shared database, the Threat Graph CYX-1. George Kurtz argued that incumbents could not move to the cloud and still make their numbers, which left the opening to a company with no installed base CYX-13. Detection and response shipped in June 2013, and by 2019 the Threat Graph processed more than one trillion endpoint events a week CYX-1.
Cybereason, founded in 2012 by three veterans of Israel's Unit 8200 intelligence unit, aimed at the analyst's problem CYX-2 CYX-5. Its Malop Hunting Engine, launched in February 2014, linked isolated malicious events into one attack story showing the timeline, root cause, adversary activity, communications and affected endpoints and users CYX-12. That view answered the analyst's hardest question, which events belonged together. Cybereason sold it to run on the customer's own premises or as a cloud service, so an on-premises installation kept one customer's events in its own system, while CrowdStrike pooled every customer's activity CYX-12 CYX-2 CYX-1.
Rivals CrowdStrike launched endpoint detection and response as a cloud service in June 2013 on an agent under 35 MB CYX-1.
Step 2 of 5 · 2013–19
Buyers reached through partners
CrowdStrike also sold breach response. When a company was attacked, its incident responders came in, and that work led to software subscriptions. Its 2019 filing reported that, for customers acquired after February 1, 2017, each $1.00 spent on services produced $2.97 of annual recurring revenue CYX-1. It found buyers at the moment they most needed endpoint detection, through a channel it controlled. By January 2019 it had 2,516 subscription customers, including 44 of the Fortune 100 CYX-1.
Cybereason reached buyers through partners. Lockheed Martin was a customer deploying it on more than 120,000 endpoints and servers, invested in its $25 million round in May 2015, and in February 2016 launched Wisdom EDR, powered by Cybereason CYX-12 CYX-11. SoftBank put $50 million into the October 2015 round, and in 2016 Cybereason set up a company to serve Japan with SoftBank as funding partner CYX-6 CYX-7. Japan became its strongest position: by 2021 Lior Div claimed a 35% share there, with the United States half the business CYX-8. Globes later tied a cut in its valuation partly to an "over-focus on the Japanese market at the expense of the US and other international markets" CY3.
Rivals CrowdStrike turned incident response engagements into subscriptions at $2.97 of annual recurring revenue per $1.00 of services for customers won after February 2017 CYX-1.
Step 3 of 5 · 2017–21
Growth bought with SoftBank capital
CrowdStrike sold more onto the agent its customers already ran. The share of subscription customers using four or more cloud modules rose from 30% to 47% in the year to January 2019, and dollar-based net retention reached 147% CYX-1. By October 31, 2021, 68% of its 14,687 subscription customers used four or more modules, and annual recurring revenue reached $1.51 billion, up 67% in a year CYX-9.
Cybereason grew on SoftBank's money. SoftBank put in $100 million in June 2017 and, as the only investor, $200 million in August 2019, bringing total funding to $400 million when the company had about 500 staff CYX-6 CYX-4. In 2021 it raised $275 million at a valuation Globes put at $2.73 billion CYX-6 CY3. Contrary Research estimated its price at about $50 per endpoint a month, against about $15 for CrowdStrike Falcon Enterprise, more than three times as much CYX-7. From February 2021 it built partnerships with managed security providers, a channel where CrowdStrike and SentinelOne were also adding partners CYX-3. In November 2021 Div reported $120 million of annual recurring revenue, less than a twelfth of CrowdStrike's a month earlier CYX-8 CYX-9.
Rivals CrowdStrike reached $1.51 billion of annual recurring revenue on October 31, 2021, with 68% of customers on four or more modules CYX-9.
Step 4 of 5 · 2021–24
Listing dropped, staff cut, buyer sought
CrowdStrike's June 2019 listing raised $612 million, and scale let it widen the platform beyond the endpoint CYX-13. By January 2025 its next-generation SIEM, cloud security and identity protection products together passed $1.3 billion of annual recurring revenue, and 67% of customers used five or more modules CYX-10. In 2021 its CTO, Michael Sentonas, said IDC ranked CrowdStrike first worldwide and that it rarely met Cybereason in deals CYX-8.
Cybereason tried the same widening with less money. It launched an extended detection product built on Google's Chronicle in December 2021 and confidentially filed for a US listing that targeted more than $5 billion CYX-7 CYX-5. Contrary Research called Microsoft Defender its most direct competitor CYX-7. When the listing market closed in 2022, it cut about 100 staff in June and about 200 in October after over-hiring at high wages, and its partner push slowed CYX-6 CYX-7 CYX-3. It dropped the listing and hired JPMorgan to find a buyer CYX-3. Lior Div stepped down in April 2023; SoftBank's Eric Gan replaced him and raised $100 million from existing investors at about $300 million, a 90% cut from 2021 CY3 CYX-7. Gartner named Cybereason a Leader in 2022, and in 2024 ranked it above only Broadcom CYX-7 CY3.
Rivals CrowdStrike built next-generation SIEM, cloud security and identity protection into more than $1.3 billion of annual recurring revenue by January 2025 CYX-10.
Step 5 of 5 · 2024–25
Rescue round, then sold to LevelBlue
CrowdStrike's customers stayed through its worst failure. On July 19, 2024 a faulty content update to its Falcon sensor crashed certain Windows systems, yet for the fiscal year to January 2025 it reported 97% gross retention and annual recurring revenue of $4.24 billion, up 23% CYX-10. With five or more modules on one agent for most customers, leaving meant replacing all of them together CYX-10.
Cybereason spent its last independent year raising money. In November 2024 it signed a merger agreement with Trustwave that would have left SoftBank the majority investor, and the agreement was terminated in March 2025 CYX-6. In February 2025 Eric Gan sued SoftBank and Liberty Strategic Capital, saying the company was close to bankruptcy without new capital; he left in March, and the same investors put in $120 million CYX-6 CY3. The workforce had fallen from 1,374 in March 2022 to less than half that CY3. On November 25, 2025 LevelBlue, a managed security provider that had already bought Trustwave, completed its acquisition of Cybereason, citing Japan, "where Cybereason is among the leading cybersecurity providers" CY4.
Rivals CrowdStrike kept 97% gross retention and grew annual recurring revenue 23% to $4.24 billion in the fiscal year that included the July 2024 outage CYX-10.