WillItSurvive

Cogito Group

Australian firm running government PKI, identity credentials and cybersecurity services.

Defensible for now
Assessed 26 July 2026 · Evidence as of 26 July 2026
Real protection, with named pressure against it.
On the recordSince 26 July 2026 · Checkable from 2026-04-29 · Every call on the record Checkpoint: Jellyfish CA NIAP certification outcome and any translation into new government or Five Eyes contracts
The call

Cogito Group sits safely behind Australia's sovereignty and clearance rules for its core government PKI work, while its unproven SecureSME push into the open commercial market carries none of that protection.

Cogito Group provides digital security and identity services, mostly to the Australian government and military. It is hard to replace for government work because Australian law requires local staff with security clearances and onshore operations, which keeps out giant global competitors like Entrust. The risk is that the company is tiny with unclear finances, depends on government contract renewals that could pause, and is trying to grow a new product for small businesses where it faces bigger rivals and has no special protection.

Why
01
AI pressure: None apparent. AI copilots could squeeze consulting margins on routine PKI work, but cleared, onshore identity issuance stays a human, accredited job for now. Could AI do the core job? Unlikely.
02
Bigger players: Entrust. Entrust dominates open commercial PKI globally but cannot bid on Australian sovereign government work needing Gatekeeper accreditation and cleared staff. Could a giant copy it? No, they are blocked.
03
What protects it. Gatekeeper accreditation plus NV1/NV2 cleared staff and onshore-only delivery lock out foreign PKI vendors from government contracts.
What would change this call
Outcome of the next Australian Government Defence/PKI panel retender. Shows whether Cogito keeps its sovereign government contract base.
Jellyfish CA achieves NIAP certification around April 2026 and wins new contracts. Would show the sovereignty moat translating into fresh government or Five Eyes business.
SecureSME reports paying customers or ARR within 6 months. Would show the SME expansion strategy gaining real traction beyond government work.
Key numbers
  • Revenue estimated ~$6.5M (unconfirmed aggregator figure) (2026-07-06)
  • Founded 2011 as systems integration business (2025-11-24)
  • 2014 multi-year Defence Level 3 PKI contract won (2014-09-10)
Named risks
  • Heavy reliance on Defence/government PKI contracts subject to periodic retender cycles. Severity: high
  • SecureSME expansion enters crowded, unprotected SME identity market against much larger vendors. Severity: medium
  • Financial and headcount data wildly inconsistent across aggregators, indicating opacity. Severity: medium
  • Small team size, roughly 20 to 50 staff by most estimates, limits capacity for scaling. Severity: medium
Rivals, as read in July 2026
RivalDirectionEvidence
EntrustcontestingRanked global PKI market leader by ABI Research (2025-11-18) but barred from Australian sovereign PKI by Gatekeeper rules
KeyfactorcontestingRanked joint market leader in Enterprise PKI by ABI Research, 2025-11-18, no overlap in Cogito's accredited niche
DigiCertcontestingNamed global market leader alongside Keyfactor and Entrust, ABI Research, 2025-11-18
Okta and Microsoft Entra IDcontestingDominate workforce identity market Cogito's SecureSME now enters, per 2026-04-01 comparison
Questions people ask
Is Cogito Group profitable?
Cogito Group is a private, Australian-owned firm and does not publish financial statements. No confirmed revenue or profitability figures exist from primary sources; only unverified aggregator estimates circulate, so profitability cannot be independently confirmed as of 2026.
Who owns Cogito Group?
Cogito Group is privately held and Australian owned, with no public ticker. No venture funding rounds, institutional investors, or parent company have been found; one aggregator (Crustdata, 2026-06-24) oddly labels it public, conflicting with all other sources.
Could AI replace Cogito Group?
Not for its core business. Cogito holds Australian Government Gatekeeper accreditation and its staff carry NV1/NV2 clearances for sovereign PKI work, requirements no AI model can satisfy. AI could erode surrounding consultancy and configuration tasks, but not the accredited, cleared core.
Is Cogito Group the same company as Cogito Corp, the emotion AI startup?
No. Cogito Group is an Australian PKI and identity firm founded in 2011. The similarly named Cogito Corp is a US Boston/MIT-founded emotion AI call-center company acquired by Verint Systems in October 2024; the two are unrelated businesses.
Who is Cogito Group's biggest competitor?
Entrust is the largest global rival by scale, ranked a market leader in ABI Research's November 2025 Enterprise PKI vendor ranking. However Entrust and other foreign giants are structurally barred from Australian sovereign government PKI work that requires Gatekeeper accreditation and cleared onshore personnel.
Has Cogito Group been acquired or does it have a buyer?
No evidence of any acquisition or ownership change for the Australian Cogito Group has been found as of 2026; company materials describe it as Australian owned and internationally operated with over a decade of operation since 2011.
Timeline
  • 2026-04-29Jellyfish CA v7.0 listed as NIAP Compliant Product (vendor-claimed certification date)
  • 2025-11-24SecureSME named InnovationAus 2025 Awards finalist; reported as 2025 launch
  • 2018-11-05Keyfactor/CSS signs reseller agreement with Cogito Group
  • 2014-09-10Cogito Group wins multi-year Department of Defence Level 3 PKI contract
  • 2011-01Cogito Group established as professional-services and systems-integration business
Revision history
26 July 2026
First assessed. Defensible for now. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources