From scam victims reach enterprise white hats: map of di cybersecurity landscape (2026)
Thirteen categories, from help for scam victims to enterprise security testing, with reported losses, funding wey dem announce, market forecasts by publisher, and an honest status of where Mithril dey fit.
Dis article na machine translation.
## For di leaders: three takeaways
- **Fraud na business risk and e na consumer risk too.** Reported losses to di FBI IC3 reach $20.877 billion for 2025, and many losses never dey reported ([FBI](https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions)).
- **Security testing dey move toward AI-driven tools while established vendors dey consolidate.** Google complete di acquisition of Wiz for March 2026, and NetSPI and Synack agree to merge ([Alphabet](https://abc.xyz/investor/news/news-details/2026/Google-Completes-Acquisition-of-Wiz-2026-ta7OaU2uA0/default.aspx); [NetSPI](https://www.netspi.com/newsroom/press-release/netspi-and-synack-to-merge-forming-a-leading-offensive-cybersecurity-platform/)). Expect roadmaps and contracts to change, and ask every provider how e dey make sure say e dey test only systems wey you own or wey you get authorization to test.
- **Skills still dey di constraint.** ISC2 estimate a global workforce gap of 4.8 million people for 2024, and 59% of respondents to di 2025 study report critical or significant skills needs ([ISC2 2024](https://www.prnewswire.com/news-releases/growth-of-cybersecurity-workforce-slows-in-2024-as-economic-uncertainty-persists-302244585.html); [ISC2 2025](https://www.isc2.org/Insights/2025/12/2025-ISC2-Cybersecurity-Workforce-Study)). Plan training alongside tools.
## Di landscape for one look
Dis post dey map companies and public services for two bands. Di victim side dey cover help before and after online fraud and account takeover. Di enterprise side dey cover wetin dem often sell as “white hat as a service”: security testing of systems wey a company own. Each organization dey grouped by wetin e talk say e dey do for di own official site, checked for October 2026.
Loss figures below na reported losses: wetin victims tell di FBI, di FTC, or di police. Dem no be di total harm, and dem no be Mithril data.
[[figure:chaos-map]]
Di victim side, seven groups:
- **Fraud and scam prevention:** Sardine, Alloy, Charm Security, Resistant AI, Hawk, Pindrop, Whoscall (Gogolook), ScamAdviser.
- **Victim support and recovery:** Mithril Your records (E dey on), Aura, LifeLock (Gen Digital), Identity Theft Resource Center, IdentityTheft.gov (FTC), IC3 (FBI), AARP Fraud Watch Network.
- **Identity verification:** Persona, Socure, Veriff, Incode, TRUSTDOCK, Liquid.
- **OSINT, threat intelligence and blockchain investigation:** Mithril public evidence search (E dey on), Recorded Future, Flashpoint, Silent Push, BforeAI, Netcraft, TRM Labs, Chainalysis, Elliptic.
- **Trust and safety, digital risk and deepfakes:** Doppel, Outtake, Bolster AI, Blackbird.AI, Reality Defender, GetReal Security, Adaptive Security, Alice (wey dem bin call ActiveFence; [alice.io](https://alice.io/)).
- **AI security and developer AI:** HiddenLayer, Lakera (wey now dey part of [Check Point](https://www.checkpoint.com/press-releases/check-point-acquires-lakera-to-deliver-end-to-end-ai-security-for-enterprises/)), Noma Security, Protect AI (wey now dey part of Palo Alto Networks, [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)), GMO Flatt Security, Mithril System One Coding (E dey on, pilot).
- **Evidence preservation:** Mithril Your records with SHA-256 fingerprints (E dey on), Hunchly, Page Vault, Axon.
Di enterprise side, six groups:
- **AI pentesting and offensive security:** Mithril Whitehat as a Service (E dey for plan), XBOW, Horizon3.ai, Pentera, RunSybil, Terra Security, Wiz Red Agent (Google).
- **Pentest as a service (PTaaS) and crowdsourced testing:** HackerOne, Bugcrowd, Synack, NetSPI, Cobalt.
- **Application security (SAST and DAST):** Mithril DAST and SAST (E still dey development), Snyk, Semgrep, Checkmarx, Veracode, StackHawk, Invicti.
- **Attack graph and exposure management:** Mithril attack paths and ontology graph (E still dey development), XM Cyber, Wiz (Google), JupiterOne.
- **Security training and cyber ranges:** Mithril Dojo (E dey on), Hack The Box, TryHackMe, Immersive, SANS Institute.
- **Digital forensics and incident response (DFIR):** Mithril forensic report import (E still dey development), Cado Security (Darktrace), Binalyze, Magnet Forensics, Cellebrite.
## Victim side: reported losses dey keep rising
[[figure:reported-losses]]
Di FBI Internet Crime Complaint Center (IC3) receive 1,008,597 complaints for 2025, up from 859,532 for 2024. Reported losses na $20.877 billion, 26% more than di year before ([IC3 2025 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf); [FBI release, April 6, 2026](https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions)).
Cryptocurrency complaints account for more than $11 billion of reported losses, and complaints wey mention AI for nearly $893 million. People wey get 60 years and over report about $7.7 billion, up 37% ([FBI](https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions)).
Di FTC receive about 3 million fraud reports for 2025, with $15.9 billion in reported losses, up from over $12 billion for 2024. Investment scams na $7.9 billion and imposter scams more than $3.5 billion ([FTC, March 25, 2026](https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-testifies-joint-economic-committee-agencys-efforts-combat-fraud)). Social media scams na $2.1 billion ([FTC, April 27, 2026](https://www.ftc.gov/news-events/news/press-releases/2026/04/new-ftc-data-show-people-have-lost-billions-social-media-scams)).
For Japan: di National Police Agency count ¥325.74 billion (3,257.4億円) in losses from special fraud and social-media investment and romance fraud for 2025, up 63.6% ([NPA, PDF](https://www.npa.go.jp/bureau/criminal/souni/tokusyusagi/sagi_keihatsu2025.pdf)). Special fraud alone na 27,832 cases and about ¥142.31 billion ([NPA](https://www.npa.go.jp/bureau/safetylife/sos47/new-topics/260605/01.html)).
## Victim side: who di products dey built for
[[figure:positioning]]
Most products here dey sell to organizations: banks, platforms, enterprises, and investigators. Fewer dey built for an individual, and fewer still for di period after a loss.
## Victim side: funding wey dem announce for adjacent categories
[[figure:adjacent-funding]]
Di table dey list di latest round wey dem announce for public and wey we fit source for 22 companies near dis space, as of October 2026.
Di announced amounts dey add up to about $1.50 billion. Dat na a sum of announced amounts (di tally wey we do) across all 22 rounds for di table, no be a market figure. Di rounds no be comparable equity rounds: Pindrop $100 million na a loan (debt), Aura round dey mix equity and debt, Netcraft announce “over $100 million” and dem count am at $100 million, and di Alice (wey dem bin call ActiveFence) and Chainalysis rounds date from 2021 and 2022.
| Company | Amount wey dem announce | Type | When dem announce am | Category |
| --- | --- | --- | --- | --- |
| Persona | [$200M](https://www.prnewswire.com/news-releases/persona-raises-200m-at-2b-valuation-to-build-the-verified-identity-layer-for-an-agentic-ai-world-302442649.html) | Series D (equity) | 2025-04-30 | Identity |
| Chainalysis | [$170M](https://www.chainalysis.com/blog/series-f/) | Series F (equity) | 2022-05-12 | OSINT / threat intel |
| Aura | [$140M](https://www.aura.com/press/release/aura-completes-series-g-funding-round-raises-140-million-in-equity-and-debt) | Series G (equity and debt) | 2025-03-24 | Support for victims |
| Netcraft | [over $100M (counted as $100M)](https://www.spectrumequity.com/news/netcraft-secures-first-funding-with-over-100m-from-spectrum-equity-names-experienced-technology-executive-ryan-woodley-as-new-ceo/) | First funding wey come from outside | July 2023 | OSINT / threat intel |
| Noma Security | [$100M](https://noma.security/blog/noma-security-raises-100m-to-drive-adoption-of-ai-agent-security/) | Series B (equity) | 2025-07-31 | AI security |
| Pindrop | [$100M](https://techcrunch.com/2024/07/17/deepfake-detecting-firm-pindrop-lands-100m-loan-to-grow-its-offerings/) | Loan (debt), no be equity | 2024-07-17 | Fraud / social engineering |
| Alice (wey dem bin call ActiveFence) | [$100M](https://techcrunch.com/2021/07/26/activefence-comes-out-of-the-shadows-with-100m-in-funding-and-tech-that-detects-online-harm/) | Series A and B wey dem combine (equity) | 2021-07-26 | Trust and safety / deepfake |
| Adaptive Security | [$81M](https://www.prnewswire.com/news-releases/adaptive-security-raises-81-million-series-b-to-stop-ai-powered-cyber-threats-302643174.html) | Series B (equity) | 2025-12-16 | Fraud / social engineering |
| Doppel | [$70M](https://www.prnewswire.com/news-releases/doppel-raises-70m-series-c-to-meet-rising-demand-for-ai-driven-social-engineering-defense-302619463.html) | Series C (equity) | 2025-11-19 | Fraud / social engineering |
| Sardine | [$70M](https://www.sardine.ai/press/pr/fraud-and-compliance-productivity) | Series C (equity) | 2025-02-11 | Fraud / social engineering |
| TRM Labs | [$70M](https://www.trmlabs.com/resources/blog/trm-labs-announces-70m-series-c-to-scale-ai-solutions-to-disrupt-criminal-networks-and-counter-national-security-threats) | Series C (equity) | 2026-02-04 | OSINT / threat intel |
| Protect AI (wey now dey part of Palo Alto Networks) | [$60M](https://www.geekwire.com/2024/samsung-salesforce-invest-in-60m-round-for-seattle-cybersecurity-startup-protect-ai/) | Series B (equity) | 2024-08-01 | AI security |
| HiddenLayer | [$50M](https://www.hiddenlayer.com/news/hiddenlayer-raises-50m-in-series-a-funding-to-safeguard-ai) | Series A (equity) | 2023-09-19 | AI security |
| Outtake | [$40M](https://techcrunch.com/2026/01/28/ai-security-startup-outtake-raises-40m-from-iconiq-satya-nadella-bill-ackman-and-other-big-names/) | Series B (equity) | 2026-01-28 | Fraud / social engineering |
| Reality Defender | [$33M](https://www.prnewswire.com/news-releases/reality-defender-expands-series-a-to-33-million-to-enhance-ai-detection-capabilities-302283098.html) | Series A, total wey dem expand (equity) | 2024-10-22 | Trust and safety / deepfake |
| Resistant AI | [$25M](https://resistant.ai/blog/resistant-ai-raises-25-million-in-series-b-funding-to-empower-ai-agents-to-fight-fraud-and-fincrime) | Series B (equity) | 2025-10-13 | Fraud / social engineering |
| Blackbird.AI | [$20M](https://www.prnewswire.com/news-releases/blackbirdai-raises-20m-in-series-b-funding-to-empower-organizations-with-narrative-and-perception-risk-intelligence-301851388.html) | Series B (equity) | 2023-06-15 | Trust and safety / deepfake |
| Lakera | [$20M](https://www.prnewswire.com/news-releases/lakera-raises-20m-series-a-to-secure-generative-ai-applications-302204874.html) | Series A (equity) | 2024-07-24 | AI security |
| GetReal Security | [$17.5M](https://forgepointcap.com/perspectives/getreal-security-raises-17-5m-series-a-led-by-forgepoint-capital-to-address-rapidly-growing-threats-associated-with-generative-ai-and-malicious-digital-media/) | Series A (equity) | 2025-03-26 | Trust and safety / deepfake |
| BforeAI | [$15M](https://www.prnewswire.com/news-releases/bforeai-announces-15-million-in-series-a-funding-led-by-syn-ventures-302125023.html) | Series A (equity) | 2024-04-24 | OSINT / threat intel |
| Silent Push | [$10M](https://www.silentpush.com/press-releases/series-b-funding-announcement/) | Series B (equity) | 2025-09-12 | OSINT / threat intel |
| Charm Security | [$8M](https://www.prnewswire.com/news-releases/charm-security-emerges-from-stealth-to-combat-scams-and-social-engineering-exploiting-human-vulnerabilities-securing-8m-in-seed-funding-from-team8s-venture-creation-fund-302409642.html) | Seed (equity) | 2025-03-25 | Fraud / social engineering |
By category, di same tally (sum of announced amounts, di tally wey we do) na: fraud and social-engineering defense $394M (Sardine, Charm Security, Resistant AI, Pindrop, Doppel, Adaptive Security, Outtake); OSINT and threat intelligence $365M (Chainalysis, Netcraft, TRM Labs, BforeAI, Silent Push); AI security $230M (Noma Security, Protect AI, HiddenLayer, Lakera); identity $200M (Persona); trust and safety and deepfakes $170.5M (Alice, wey dem bin call ActiveFence; Reality Defender, Blackbird.AI, GetReal Security); victim support $140M (Aura).
Dem leave out: Socure, ChillStack, and TRUSTDOCK, because we no fit confirm a comparable announced amount in US dollars.
## Di enterprise side: white hat as a service
[[figure:positioning-enterprise]]
For di enterprise side, “white hat as a service” dey cover several kinds of work wey a company dey buy to test di own systems: autonomous or AI-assisted penetration testing, pentest services and bug bounty programs wey vetted human researchers dey run, code and running-application scanning (SAST and DAST), attack-path analysis, training, and forensics after an incident. All of am na for systems wey di customer own or get authorization to test.
## Enterprise side: where di 2025–2026 rounds go
[[figure:enterprise-funding]]
For di set of enterprise companies wey we survey, di 2025–2026 venture rounds go to AI-driven offensive testing: XBOW announce a $120 million Series C for March 2026 and $35 million of additional Series C financing for May 2026 ([XBOW, March 18, 2026](https://xbow.com/news/xbow-raises-120m-to-scale); [XBOW, May 6, 2026](https://xbow.com/news/xbow-secures-additional-35m-from-strategic-investors)); Horizon3.ai a $100 million Series D for June 2025 ([Horizon3.ai](https://horizon3.ai/news/press-release/horizon3-ai-raises-100m-to-cement-leadership-in-autonomous-security/)); Pentera a $60 million Series D for March 2025 ([Pentera](https://pentera.io/press-release/pentera-60m-funding-security-validation-growth/)); RunSybil $40 million in total funding for March 2026 ([RunSybil](https://www.runsybil.com/blog/runsybil-raises-40m-to-build-the-ai-native-platform-for-offensive-security)); and Terra Security a $30 million Series A for September 2025 ([Terra Security](https://www.terra.security/blog/terra-security-raises-30m-series-a-to-redefine-penetration-testing-with-agentic-ai)). Together dat na $385 million, a sum of announced amounts (di tally wey we do), with XBOW two announcements counted separately. For application security, Semgrep announce a $100 million Series D for February 2025 ([Semgrep](https://www.prnewswire.com/news-releases/semgrep-announces-100m-series-d-funding-to-advance-ai-powered-code-security-302367780.html)). Dis na our sample, no be di whole market.
Older categories see consolidation instead of new rounds. Google agree for March 2025 to acquire Wiz for $32 billion, subject to closing adjustments ([Alphabet Form 8-K, March 18, 2025](https://www.sec.gov/Archives/edgar/data/1652044/000165204425000027/goog-20250318.htm)), and complete di acquisition on March 11, 2026 ([Alphabet](https://abc.xyz/investor/news/news-details/2026/Google-Completes-Acquisition-of-Wiz-2026-ta7OaU2uA0/default.aspx)). NetSPI and Synack announce a definitive agreement to merge on September 2, 2026, backed by KKR; di merger dey expected to close for October 2026, and we never see am confirmed as closed ([NetSPI](https://www.netspi.com/newsroom/press-release/netspi-and-synack-to-merge-forming-a-leading-offensive-cybersecurity-platform/)). Darktrace announce a proposed acquisition of Cado Security on January 9, 2025 ([Darktrace](https://www.darktrace.com/news/darktrace-announces-proposed-acquisition-of-cado-security-a-cloud-investigation-and-response-specialist)).
## Market forecasts, one publisher after another
[[figure:market-size]]
Gartner forecast worldwide end-user spending on information security of $213 billion for 2025 and $240 billion for 2026, up 12.5%, from $193 billion for 2024 ([Gartner press release, July 29, 2025](https://www.gartner.com/en/newsroom/press-releases/2025-07-29-gartner-forecasts-worldwide-end-user-spending-on-information-security-to-total-213-billion-us-dollars-in-2025)). These na Gartner forecasts.
Deloitte Center for Financial Services forecast say fraud losses wey generative AI enable for di US fit reach $40 billion by 2027, from $12.3 billion for 2023, a 32% compound annual growth rate ([Deloitte, May 29, 2024](https://www.deloitte.com/us/en/insights/industry/financial-services/deepfake-banking-fraud-risk-on-the-rise.html)). Dis na a forecast.
## Enterprise segment forecasts and di skills gap
[[figure:segment-forecasts]]
Enterprise segment forecasts dey come from different publishers, with different definitions, base years and horizons. Dem dey listed side by side and dem no dey added up.
| Segment | Estimate wey be base | Wetin dem forecast | CAGR | Publisher, date |
| --- | --- | --- | --- | --- |
| Testing wey dey penetrate | $1.98B (2025) | $4.39B (2031) | 14.2% | [MarketsandMarkets, March 2026](https://www.marketsandmarkets.com/PressReleases/penetration-testing.asp) |
| How dem dey manage exposure | $2.2B (2024) | $7.6B (2029) | 28.3% | [MarketsandMarkets, March 2024](https://www.prnewswire.com/news-releases/exposure-management-market-worth-7-6-billion-by-2029---exclusive-report-by-marketsandmarkets-302090329.html) |
| Forensics wey dey digital | $12.94B (2025) | $22.81B (2030) | 12.0% | [MarketsandMarkets, May 2025](https://www.marketsandmarkets.com/PressReleases/digital-forensics.asp) |
| Training for cybersecurity | dem no state am for di release | $13.70B (2030) | 17.4% (2024–2030) | [Grand View Research, March 2024](https://www.grandviewresearch.com/press-release/global-cyber-security-training-market) |
| Security for application | $41.16B (2026) | $66.03B (2031) | 9.9% | [MarketsandMarkets, March 2026](https://www.prnewswire.com/news-releases/application-security-market-worth-66-03-billion-by-2031--marketsandmarkets-302713211.html) |
All five na global market estimates wey dem publish for press releases. Di publishers scopes dey overlap (for example, penetration testing and application security), and dat na one more reason make person no add dem.
Di skills gap na di other half of di story. ISC2 estimate a global cybersecurity workforce gap of 4.8 million people for 2024, up 19% year on year, against a workforce of about 5.5 million. Di top skills gaps wey respondents name na AI (34%), cloud security (30%), zero trust (27%), digital forensics and incident response (25%) and application security (24%) ([ISC2, September 2024](https://www.prnewswire.com/news-releases/growth-of-cybersecurity-workforce-slows-in-2024-as-economic-uncertainty-persists-302244585.html)). For ISC2 2025 study of 16,029 respondents, 59% report critical or significant skills needs, and 88% don experience at least one significant consequence of a skills shortage ([ISC2, December 2025](https://www.isc2.org/Insights/2025/12/2025-ISC2-Cybersecurity-Workforce-Study)).
## Table wey dey compare
### Capabilities, from sources wey dey public
Company entries dey based on each company own pages or announcements. If a company no dey for a row, e mean say we no find am for di sources wey we check, no be say e no get di capability. Mithril column dey use three statuses: **E dey on** (dem dey offer am and e dey work), **E still dey development** (dem build am for code, dem no dey offer am) and **E dey for plan**.
| Capability | Mithril status | Wey dem describe for public (examples) |
| --- | --- | --- |
| White-hat services wey human dey do (pentest, bug bounty) | E dey for plan: Whitehat as a Service | [HackerOne](https://www.hackerone.com/product/bug-bounty-platform) (bug bounty community), [Bugcrowd](https://www.bugcrowd.com/press-release/bugcrowd-secures-102-million-in-strategic-growth-funding-to-scale-ai-powered-crowdsourced-security-platform/), Synack and NetSPI (dem agree to merge September 2026, [announcement](https://www.netspi.com/newsroom/press-release/netspi-and-synack-to-merge-forming-a-leading-offensive-cybersecurity-platform/)), [Cobalt](https://www.globenewswire.com/news-release/2020/08/20/2081369/0/en/Cobalt-io-raises-29-million-to-expand-its-Pentest-as-a-Service-platform-and-transform-software-security-testing.html) |
| Offensive testing wey AI-agent or autonomous system dey do | E still dey development: agent runtime and a gated research model; dem no dey offer am | [XBOW](https://xbow.com/news/xbow-raises-120m-to-scale), [Horizon3.ai NodeZero](https://horizon3.ai/nodezero/), [Pentera](https://www.securityweek.com/security-validation-firm-pentera-banks-60m-series-d/) (validation), [HackerOne Agentic PTaaS](https://www.hackerone.com/press-release/hackerone-introduces-agentic-ptaas-deliver-continuous-expert-verified-pentesting), [Wiz Red Agent](https://www.wiz.io/blog/wiz-red-agent-is-ga) |
| Testing of application wey dey run (DAST-type) | E still dey development: dem test am only for local; no hosted service | [XBOW](https://xbow.com/news/xbow-raises-120m-to-scale), [Snyk API & Web](https://snyk.io/product/dast-api-web/), [Wiz Red Agent](https://www.wiz.io/blog/wiz-red-agent-is-ga) |
| Code analysis (SAST) | E still dey development: Python only, dem test am for local; no hosted service | [HackerOne Code](https://www.hackerone.com/product/code), [Snyk Code](https://snyk.io/product/snyk-code/), [Wiz SAST](https://www.wiz.io/blog/introducing-wiz-sast-where-code-risk-meets-cloud-context) |
| Attack path or attack graph analysis | E still dey development: cloud attack paths; no hosted service | [Horizon3.ai](https://horizon3.ai/nodezero/), [Pentera](https://www.securityweek.com/security-validation-firm-pentera-banks-60m-series-d/), [Wiz](https://www.wiz.io/lp/wiz-security-graph), [XM Cyber](https://xmcyber.com/platform/attack-graph-analysis/) |
| Security graph or data model | E still dey development: ontology graph | [Wiz Security Graph](https://www.wiz.io/lp/wiz-security-graph) |
| Integration ecosystem | E still dey development: adapters for 17 products and formats, na only sample-data tests; di goal na 100+, no be a current count | [Wiz](https://www.wiz.io/blog/wiz-integration-network-reaches-300) (300 partner integrations, July 2026), [XM Cyber](https://xmcyber.com/platform/attack-graph-analysis/) (dem no state any count) |
| Training and cyber ranges | E dey on: Dojo, training on synthetic material, no be a certification | [Hack The Box](https://www.hackthebox.com/) (labs and ranges), [Immersive](https://www.businesswire.com/news/home/20221007005544/en/Immersive-Labs-Secures-%2466-Million-in-New-Capital-and-Expands-its-Leadership-Team-to-Accelerate-Growth), [TryHackMe](https://tryhackme.com/about) |
| Forensics and incident response | E still dey development: import of reports from tools wey already dey, with SHA-256 provenance | Cado Security ([Darktrace](https://www.darktrace.com/news/darktrace-announces-proposed-acquisition-of-cado-security-a-cloud-investigation-and-response-specialist)), [Binalyze](https://www.moltenventures.com/news/molten-leads-19-million-series-a-in-binalyze) |
| Support for di victim side | E dey on: Your records | Aura, LifeLock (Gen Digital), IdentityTheft.gov (FTC), Identity Theft Resource Center |
### Companies for one look
| Company | Wetin e talk say e dey do | Latest public funding or event |
| --- | --- | --- |
| XBOW | Offensive testing of applications wey dey autonomous | [$120M Series C](https://xbow.com/news/xbow-raises-120m-to-scale) (March 2026) and [$35M additional Series C](https://xbow.com/news/xbow-secures-additional-35m-from-strategic-investors) (May 2026) |
| Horizon3.ai | NodeZero pentesting wey dey autonomous | [$100M Series D](https://horizon3.ai/news/press-release/horizon3-ai-raises-100m-to-cement-leadership-in-autonomous-security/) (June 2025) |
| Pentera | Security validation wey dey automated | [$60M Series D](https://pentera.io/press-release/pentera-60m-funding-security-validation-growth/) (March 2025) |
| RunSybil | Offensive security platform wey na AI-native | [$40M total funding](https://www.runsybil.com/blog/runsybil-raises-40m-to-build-the-ai-native-platform-for-offensive-security) (March 2026) |
| Terra Security | Agentic pentesting with a human for di loop | [$30M Series A](https://www.terra.security/blog/terra-security-raises-30m-series-a-to-redefine-penetration-testing-with-agentic-ai) (September 2025) |
| HackerOne | Bug bounty community; Agentic PTaaS (January 2026) | [$49M Series E](https://www.hackerone.com/press-release/hackerone-caps-growth-year-49-million-investment) (January 2022) |
| Bugcrowd | Security wey crowd dey source | [$102M strategic growth funding](https://www.bugcrowd.com/press-release/bugcrowd-secures-102-million-in-strategic-growth-funding-to-scale-ai-powered-crowdsourced-security-platform/) (February 2024) |
| Synack | Security testing by researchers wey dem vet | [$52M Series D](https://www.businesswire.com/news/home/20200528005407/en/Synacks-%2452-Million-Investment-Fuels-Future-of-Remote-Security-Testing-from-Worlds-Elite-Hackers) (May 2020); [merger agreement with NetSPI](https://www.netspi.com/newsroom/press-release/netspi-and-synack-to-merge-forming-a-leading-offensive-cybersecurity-platform/) (dem announce am September 2026; dem expect say e go close October 2026) |
| Cobalt | Pentest as a service | [$29M Series B](https://www.globenewswire.com/news-release/2020/08/20/2081369/0/en/Cobalt-io-raises-29-million-to-expand-its-Pentest-as-a-Service-platform-and-transform-software-security-testing.html) (August 2020) |
| Snyk | Developer security, including SAST and DAST | [$196.5M Series G](https://snyk.io/news/snyk-closes-196-5-million-series-g-funding-at-7-4-billion-valuation/) (December 2022) |
| Semgrep | Code security wey AI dey power | [$100M Series D](https://www.prnewswire.com/news-releases/semgrep-announces-100m-series-d-funding-to-advance-ai-powered-code-security-302367780.html) (February 2025) |
| StackHawk | DAST wey developer come first | [$20.7M Series B](https://www.prnewswire.com/news-releases/stackhawk-raises-20-7-million-in-series-b-funding-for-developer-first-application-and-api-security-testing-as-market-demand-soars-for-better-security-301545922.html) (May 2022) |
| Wiz (Google) | Cloud security, Security Graph, Red Agent, SAST | [Acquired by Google for $32B](https://www.sec.gov/Archives/edgar/data/1652044/000165204425000027/goog-20250318.htm) (dem agree March 2025, subject to closing adjustments); [completed](https://abc.xyz/investor/news/news-details/2026/Google-Completes-Acquisition-of-Wiz-2026-ta7OaU2uA0/default.aspx) (March 2026) |
| XM Cyber | Attack graph analysis | [Acquired by Schwarz Group](https://gruppe.schwarz/en/press/archive/2021/schwarz-group-acquires-israeli-hybrid-cloud-cybersecurity-innovator-xm-cyber) (November 2021) |
| JupiterOne | Cyber asset graph | [$70M Series C](https://www.prnewswire.com/news-releases/jupiterone-achieves-valuation-of-over-1b-with-70m-series-c-funding-to-fuel-innovation-in-cybersecurity-and-democratize-access-for-all-301559956.html) (June 2022) |
| Hack The Box | Hacking labs and ranges | [$55M Series B](https://www.carlyle.com/media-room/news-release-archive/carlyle-leads-55m-series-b-investment-round-in-hack-the-box) (January 2023) |
| Immersive | Training for cyber workforce | [$66M](https://www.businesswire.com/news/home/20221007005544/en/Immersive-Labs-Secures-%2466-Million-in-New-Capital-and-Expands-its-Leadership-Team-to-Accelerate-Growth) (October 2022) |
| TryHackMe | Labs wey beginner fit use | [No outside investment](https://tryhackme.com/about) (di company site) |
| Cado Security | Cloud forensics | [Darktrace announced acquisition](https://www.darktrace.com/news/darktrace-announces-proposed-acquisition-of-cado-security-a-cloud-investigation-and-response-specialist) (January 2025) |
| Binalyze | DFIR platform | [$19M Series A](https://www.moltenventures.com/news/molten-leads-19-million-series-a-in-binalyze) (September 2023) |
## Where Mithril dey fit
Mithril, from Kotoba Labs Inc., dey build one white-hat platform wey start with di victim and wey dem mean say e go reach enterprises. Today di tools for di victim and learning side na E dey on. Di enterprise testing na E still dey development, and Whitehat as a Service for enterprises na E dey for plan: no such service dey offered, and no public customer results dey. Mithril documentation still dey describe di new site as a candidate implementation, so check each page before you rely on am.
| Capability | Status | Wetin dat mean today |
| --- | --- | --- |
| Your records | E dey on | After you sign in, a person dey keep dated, text-only notes; each note wey dem save dey show di save time and SHA-256 fingerprint, and na only dat person fit read am. People dey file their own reports; Mithril no dey investigate, identify anyone, recover money, or file anything for anyone ([mithril.fund](https://mithril.fund/)). |
| Phishing check and public evidence search | E dey on | A public domain check (if e miss, dat no be a safety verdict) and a read-only search over a dated public security snapshot, wey you fit use without signing in ([endpoint reference](https://docs.mithril.fund/reference/endpoints)). |
| System One Coding | E dey on (pilot) | A registered free pilot of a staged coding harness; di docs talk say e no be an availability guarantee ([docs](https://docs.mithril.fund/system-one-coding)). |
| Dojo | E dey on | An AI-agent white-hat learning path and short video lessons, wey dey use fictional text and synthetic data, plus team training packages wey dem quote per customer. E no dey test real third-party systems, and completion records no be a certification ([Dojo](https://app.mithril.fund/dojo)). |
| Security suite (DAST, SAST, cloud attack paths and other checks) | E still dey development | Dem build am for code and test am for local; dem no dey offer am as a service and e no dey hosted. Di docs list these as intended capabilities wey need an authorized scope, real input data, tenant isolation and execution evidence before dem fit advertise dem as available ([security services](https://docs.mithril.fund/reference/security-services)). |
| Forensic report import | E still dey development | Import of reports from forensic tools wey already dey, into an evidence store with SHA-256 provenance; di public product list dey mark each format “e never dey verified” ([list](https://api.mithril.fund/v1/forensics/products)). |
| Ontology graph | E still dey development | A public explorer na a candidate; tenant graphs never connect yet ([graph docs](https://docs.mithril.fund/graph)). |
| Managed models, including a security-research route | E still dey development | Di research route dey require a research-scope declaration and e dey fail closed until di route dey connected ([models](https://docs.mithril.fund/reference/models)). Guarded inference with content moderation and refusal auditing na E dey for plan and e need a measured, dated verification first ([guardrails](https://docs.mithril.fund/reference/guardrails-firewall)). |
| Third-party integrations | E still dey development | See below. |
| Whitehat as a Service for enterprises | E dey for plan | No service dey yet. |
| Forensics driven by managed models | E dey for plan | Dem never build am. |
| Ethical-hacker ranking | E dey for plan | Di Dojo page talk say ranking dey for preparation. |
| Researcher identity enrollment | E dey for plan | Dem never offer am yet ([registration state](https://mithril.fund/ekyc.md)). |
Mithril build adapters for 17 security products and forensic report formats. Dem never verify any one against a live account yet: testing so far dey use sample data only, and four of di forensic formats dey stored as files rather than parsed. Di goal na 100+; dat na an aim, no be a current count.
Any scanning, DAST-style or SAST-style, na only for systems wey di customer own or get authorization to test. Mithril no dey offer testing of anybody else systems.
## Wetin dis mean for victims
If you don lose money or an account, start a dated record now and keep di originals. Di FBI dey ask for di scammer name, how dem contact you, dates, how you pay, where di money go, and a description of your interactions ([FBI](https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions)).
- [Account takeover: a timeline and evidence list](/account-takeover-timeline-evidence-list?lang=en)
- [Crypto fraud: a remittance table](/crypto-fraud-remittance-table?lang=en)
- [IC3 complaint worksheet](/ic3-complaint-worksheet?lang=en) (for di US FBI Internet Crime Complaint Center)
- [Mithril docs](https://mithril.fund/docs)
Report to your bank or payment provider, di platform where e happen, and your police or national reporting service. For di US dat include [IC3](https://www.ic3.gov) and di FTC for [ReportFraud.ftc.gov](https://reportfraud.ftc.gov) (checked 2026-10-06).
## Summary for one page
[[figure:summary]]
## Di sources
- FBI IC3, [2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) (PDF)
- FBI, [press release, April 6, 2026](https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions)
- FTC, [testimony release, March 25, 2026](https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-testifies-joint-economic-committee-agencys-efforts-combat-fraud)
- FTC, [social media scams release, April 27, 2026](https://www.ftc.gov/news-events/news/press-releases/2026/04/new-ftc-data-show-people-have-lost-billions-social-media-scams)
- National Police Agency (Japan), [page dated 2026-06-05](https://www.npa.go.jp/bureau/safetylife/sos47/new-topics/260605/01.html) and [2025 fraud statistics](https://www.npa.go.jp/bureau/criminal/souni/tokusyusagi/sagi_keihatsu2025.pdf) (PDF)
- Gartner, [press release, July 29, 2025](https://www.gartner.com/en/newsroom/press-releases/2025-07-29-gartner-forecasts-worldwide-end-user-spending-on-information-security-to-total-213-billion-us-dollars-in-2025)
- Deloitte, [Deepfake banking fraud risk on the rise, May 29, 2024](https://www.deloitte.com/us/en/insights/industry/financial-services/deepfake-banking-fraud-risk-on-the-rise.html)
- ISC2, [2024 workforce study release](https://www.prnewswire.com/news-releases/growth-of-cybersecurity-workforce-slows-in-2024-as-economic-uncertainty-persists-302244585.html) and [2025 workforce study](https://www.isc2.org/Insights/2025/12/2025-ISC2-Cybersecurity-Workforce-Study)
- MarketsandMarkets: [penetration testing](https://www.marketsandmarkets.com/PressReleases/penetration-testing.asp), [exposure management](https://www.prnewswire.com/news-releases/exposure-management-market-worth-7-6-billion-by-2029---exclusive-report-by-marketsandmarkets-302090329.html), [digital forensics](https://www.marketsandmarkets.com/PressReleases/digital-forensics.asp), [application security](https://www.prnewswire.com/news-releases/application-security-market-worth-66-03-billion-by-2031--marketsandmarkets-302713211.html); Grand View Research: [cybersecurity training](https://www.grandviewresearch.com/press-release/global-cyber-security-training-market)
- Alphabet, [Form 8-K on the Wiz agreement, March 18, 2025](https://www.sec.gov/Archives/edgar/data/1652044/000165204425000027/goog-20250318.htm) and [Google completes acquisition of Wiz](https://abc.xyz/investor/news/news-details/2026/Google-Completes-Acquisition-of-Wiz-2026-ta7OaU2uA0/default.aspx); Check Point, [acquisition of Lakera](https://www.checkpoint.com/press-releases/check-point-acquires-lakera-to-deliver-end-to-end-ai-security-for-enterprises/); NetSPI, [merger announcement](https://www.netspi.com/newsroom/press-release/netspi-and-synack-to-merge-forming-a-leading-offensive-cybersecurity-platform/); Darktrace, [Cado Security announcement](https://www.darktrace.com/news/darktrace-announces-proposed-acquisition-of-cado-security-a-cloud-investigation-and-response-specialist)
- Funding: di linked announcement for each table row. Company descriptions: each organization official site, checked for October 2026.
For Japan: Parts wey include text from di National Police Agency (Japan) na summary and rearrangement by di editors (created by editing and processing). Sources: di National Police Agency (Japan) website "[令和７年における特殊詐欺及びＳＮＳ型投資・ロマンス詐欺の認知・検挙状況等について（確定値）](https://www.npa.go.jp/bureau/safetylife/sos47/new-topics/260605/01.html)" and di [PDF summary](https://www.npa.go.jp/bureau/criminal/souni/tokusyusagi/sagi_keihatsu2025.pdf) (both checked 2026-10-06). Terms of use dey follow di National Police Agency (Japan) [Terms of use](https://www.npa.go.jp/rules/index.html) (Public Data License (Version 1.0) (PDL1.0), checked 2026-10-06). Di processed text no dey presented as if di National Police Agency (Japan) create am.
## Di corrections
Company descriptions and placements dey based on public pages and fit don dey out of date. If something here no correct, contact us through [mithril.fund](https://mithril.fund) and we go correct am.