Coalfire
Compliance auditor and pen-tester for FedRAMP, CMMC, PCI, and HITRUST clients.
On the record
Checkpoint: CMMC Phase II reform task force review outcome, following July 13 suspension
The call
Coalfire's accreditations still make it required work today, but AI audit tools and pending FedRAMP/CMMC rule changes could redraw who is allowed to sign off.
Coalfire checks whether companies meet strict government security and compliance rules, then signs off on their paperwork so they can work with the federal government or handle sensitive data. Right now, it is hard to replace because the government only trusts a small number of approved inspectors like Coalfire to do this work, but that edge is weakening: AI tools like Drata and Coalfire's own Audit AI can do the inspection work much faster and cheaper, which means fewer hours Coalfire can bill. The biggest question is whether the government will still require a human like Coalfire to sign off on everything, or whether AI-generated reports will eventually be enough, especially since major rules are being rewritten right now.
Why
01
AI pressure: Drata's agentic GRC platform and Coalfire's own Audit AI tool. Agentic GRC software automates evidence review and checks, cutting the billable hours behind Coalfire's audits. Could AI do the core job? Only partly.
02
Bigger players: Google Cloud Compliance Manager and AWS native compliance tools. If hyperscaler compliance tools get accredited to self-certify, clients could skip independent assessors like Coalfire. Could a giant copy it? No, they are blocked.
03
What protects it. FedRAMP, CMMC, and PCI still require a human third-party signature that only accredited assessors can provide.
What would change this call
CMMC Phase II reform task force publishes its findings, expected around mid-September 2026. Shows whether the mandatory independent-assessor requirement survives, which underpins Coalfire's moat.
FedRAMP Consolidated Rules 2026 (CR26) finalized and its treatment of third-party assessors. Shows whether Coalfire's 3PAO role stays required or gets bypassed by cloud-native compliance tools.
Apax Partners announces a sale, secondary buyout, or dividend recap of Coalfire. Shows whether the six-year private equity hold is ending and how the business is being valued on exit.
FedRAMP Consolidated Rules 2026 (CR26) finalized and its treatment of third-party assessors. Shows whether Coalfire's 3PAO role stays required or gets bypassed by cloud-native compliance tools.
Apax Partners announces a sale, secondary buyout, or dividend recap of Coalfire. Shows whether the six-year private equity hold is ending and how the business is being valued on exit.
Key numbers
- Revenue estimated at $210.1M
- Headcount 1,030-1,089, hiring down 21% into Q4
- Apax Partners has owned Coalfire since April 2020
Named risks
- CMMC Phase II suspension on July 13, 2026 creates uncertainty for federal defense-compliance revenue.
- FedRAMP 2026 restructuring away from sponsor authorization model could reshape demand for core assessment services.
- Agentic GRC tools including Coalfire's own Audit AI compress billable manual-review hours underpinning services revenue.
- Hiring activity has slowed and headcount growth has stalled after 2021 to 2024 expansion.
- Apax Partners' ownership since 2020 approaches a typical PE exit window, raising possibility of a sale or recapitalization disrupting strategy.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Drata | contesting | Partnered March 10, 2026 for continuous trust, but agentic GRC compresses Coalfire's billable review hours |
| A-LIGN | contesting | Named as direct SOC 2 and compliance-audit peer in industry comparisons through mid-2026 |
| Schellman | contesting | Frequently compared head-to-head with Coalfire as an audit partner alternative, 2026 |
| Google Cloud (native compliance tooling) | gaining on | Coalfire integrated with Google Cloud Compliance and Audit Manager April 21, 2026, ceding some workflow to hyperscaler-native tools |
| Booz Allen Hamilton | contesting | Ranked alongside Coalfire in federal penetration-testing and advisory comparisons, 2026 |
Questions people ask
- Is Coalfire profitable in 2026?
- Coalfire does not disclose financials, as it is a private, PE-backed company owned by Apax Partners since April 2020. No profit or revenue figures have been publicly confirmed by the company itself as of July 2026, only third-party estimates that Coalfire has not verified.
- Who owns Coalfire?
- Apax Partners has owned Coalfire since completing its acquisition from The Carlyle Group and The Chertoff Group on April 23, 2020. Coalfire's own January 2026 press release still describes itself as backed by funds advised by Apax Partners LLP.
- Could AI replace Coalfire's compliance auditors?
- Not fully as of 2026: FedRAMP, CMMC, and PCI frameworks require a human third-party assessor of record, which AI cannot self-certify. Coalfire's own Audit AI, launched May 5, 2026, automates evidence review (claimed up to 200% faster) but still sits under a human signatory.
- Is Coalfire losing ground to Drata?
- Coalfire and Drata became partners rather than pure rivals, announcing a strategic partnership on March 10, 2026 combining Drata's continuous monitoring with Coalfire's independent assessment. But agentic GRC platforms like Drata are compressing the billable manual-review hours Coalfire has traditionally sold.
- What happened to CMMC Phase II and how does it affect Coalfire?
- The Department of War suspended CMMC Phase II requirements, which had been due November 10, 2026, on July 13, 2026, launching a 60-day CMMC Reform Task Force review. Coalfire, a CMMC C3PAO, publicly urged clients not to slow down compliance prep despite the suspension.
- Who is Coalfire's biggest competitor?
- Coalfire is most often compared to A-LIGN and Schellman in SOC 2 and compliance-audit work, and to Secureworks, Booz Allen Hamilton, Mandiant, Kroll, NCC Group, and Optiv in penetration testing, per industry comparison pieces published through mid-2026.
Timeline
- 2026-07-13Department of War suspends CMMC Phase II requirements, launches 60-day Reform Task Force review
- 2026-06-16Coalfire publishes analysis of FedRAMP 2026 structural shift away from sponsor authorization model
- 2026-05-19Coalfire launches CMMC Partner Assurance Network (CPAN) for Defense Industrial Base readiness
- 2026-05-13Coalfire wins provisional accreditation as auditor for AIUC-1 AI-agent certification standard
- 2026-05-05Coalfire launches Audit AI within Compliance Essentials, claims up to 200% faster manual review
- 2026-04-21Coalfire announces integration partnership with Google Cloud Compliance and Audit Manager
- 2026-03-10Coalfire announces strategic partnership with Drata; GuardianAI wins 2026 CSO Award
- 2026-01-06Brad Little named Coalfire CEO, succeeding Tom McAndrew who moves to advisory role
- 2020-04-23Apax Partners completes acquisition of Coalfire from Carlyle Group and Chertoff Group
- 2015The Carlyle Group invests in Coalfire via its US Equity Opportunity Fund I
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Coalfire Appoints Brad Little as Chief Executive Officer (2026-01-06)
- Apax Partners Completes Coalfire Acquisition (2020-04-23)
- Funds advised by Apax Partners to acquire Coalfire from The Carlyle Group and The Chertoff Group (2019-12-13)
- Coalfire - Headcount, Funding & Open Jobs (2026-07-08)
- Coalfire Stock Price, Funding, Valuation, Revenue & Financial Statements (2021-05-31)
- Coalfire - Overview, News & Similar companies (2026-07-08)
- The Coalfire Story (2026-05-29)
- Join Our Mission & Elevate Your Cybersecurity… (2024-10-07)
- Coalfire Announces Strategic Partnership with Drata to Deliver Continuous Trust (2026-03-10)
- Coalfire to Operationalize Cloud Compliance with Google Cloud (2026-04-21)
- Coalfire Systems Number of Employees 2026 (2026-06-29)
- Coalfire's GuardianAI Open Framework Wins 2026 CSO Award for Advancing Secure AI Adoption (2026-03-10)