GreyNoise Intelligence
GreyNoise sells internet scanning noise and threat intel from a global honeypot sensor network.
On the record
Checkpoint: Whether GreyNoise closes a Series B or shows headcount/traffic reversal
The call
GreyNoise has real data and government relationships but shows stalled growth, making it a candidate for acquisition or feature absorption by bigger security platforms.
GreyNoise runs a network of sensors in 80+ countries that watch for hackers scanning the internet and selling this information to government agencies and companies. It is hard to copy because building thousands of sensors worldwide takes years and money, and the U.S. military already pays for its data. However, the company has not raised new funding in over four years, its staff shrank, and its website traffic dropped sharply, which suggests customers are leaving or staying quiet. The biggest risk is not that artificial intelligence will replace GreyNoise, but that CrowdStrike, Palo Alto Networks, or Microsoft will buy the company or build their own version of this service inside their existing products, turning GreyNoise from an independent company into just one feature inside a much larger platform.
Why
01
AI pressure: None apparent. GreyNoise is building agentic tools and MCP servers on its own data rather than being replaced by AI models. Could AI do the core job? Unlikely.
02
Bigger players: CrowdStrike, Palo Alto Networks, Microsoft. If any of these ship a native sensor grid with noise filtering, GreyNoise's enterprise wedge gets absorbed as a feature. Could a giant copy it? Probably.
03
What protects it. A 5,000+ honeypot sensor network across 80+ countries plus sticky government contracts, including a DoD deal.
What would change this call
GreyNoise announces a Series B or acquisition within 12 months. Would show renewed investor confidence after 49+ months without new funding.
CrowdStrike or Palo Alto Networks ships a native internet-scanning telemetry feature. Would show GreyNoise's core product being absorbed as a feature by a platform giant.
Headcount or open roles shrink further, or a layoff round is announced. Would confirm capital discipline turning into decline rather than stabilization.
CrowdStrike or Palo Alto Networks ships a native internet-scanning telemetry feature. Would show GreyNoise's core product being absorbed as a feature by a platform giant.
Headcount or open roles shrink further, or a layoff round is announced. Would confirm capital discipline turning into decline rather than stabilization.
Key numbers
- No new funding round in 49+ months since June 2022
- Headcount down 6.2% YoY, only 1 open role
- Web traffic down 69.1% quarter over quarter
Named risks
- No Series B or new funding disclosed since June 2022, over four years without a confirmed capital raise.
- Platform giants (CrowdStrike, Palo Alto, Microsoft) could build native scanning telemetry and absorb GreyNoise's function.
- No audited public revenue figures exist, making financial health hard to verify externally.
- Reliance on CrowdStrike partnership for distribution creates dependency on a much larger platform's roadmap.
- Government/defense contract concentration exposes revenue to procurement cycles and policy shifts.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| CrowdStrike | contesting | Integrated with CrowdStrike Falcon Next-Gen SIEM Feb 2026 rather than being displaced by it |
| Palo Alto Networks | losing to | Named as a platform giant that could build native scanning telemetry, risking GreyNoise absorption |
| Microsoft | losing to | Cited as a platform incumbent capable of shipping in-house noise-filtering, threatening GreyNoise's wedge |
| Shodan | contesting | Comparable internet-scanning data source competing on adjacent ground-truth intelligence |
| Horizon3.ai, Silent Push, Criminal IP | contesting | Listed as direct competitors in threat-intel/vulnerability data as of June 2026 |
Questions people ask
- Is GreyNoise Intelligence profitable in 2026?
- GreyNoise has not disclosed audited revenue or profitability figures. Its last confirmed funding was a $15M Series A in June 2022, and no Series B or acquisition has been publicly confirmed as of July 2026, leaving its financial health unverified by outside sources.
- Who owns GreyNoise Intelligence?
- GreyNoise is privately held and venture-backed. Founder Andrew Morris started it in September 2017; investors include CRV, Radian Capital, StoneMill Ventures, Paladin Capital Group, and In-Q-Tel, the CIA's strategic investment arm, per a 2022 Series A announcement.
- Could AI replace GreyNoise Intelligence?
- Unlikely to fully replace it. GreyNoise's moat is a physical Global Observation Grid of 5,000+ deception sensors across 80+ countries generating first-party scanning data an LLM cannot conjure. The company itself ships AI, including Sift (Oct 2023) and an MCP Server (Sept 2025) for agentic SOC workflows.
- Who is GreyNoise Intelligence's biggest competitive threat?
- Platform giants like CrowdStrike, Palo Alto Networks, and Microsoft pose the largest risk, not through direct product competition but by potentially building native internet-scanning telemetry in-house. GreyNoise instead integrated with CrowdStrike's Falcon Next-Gen SIEM in February 2026 rather than being displaced.
- Has GreyNoise Intelligence raised a Series B?
- As of July 2026, no Series B has been publicly disclosed. GreyNoise's most recent confirmed funding round remains its $15M Series A, announced June 14, 2022 and led by Radian Capital with participation from CRV and Paladin Capital Group.
- Does GreyNoise Intelligence have government contracts?
- Yes. GreyNoise was awarded a five-year U.S. Department of Defense production contract with a $30M ceiling, announced November 15, 2021. It also counts In-Q-Tel, the CIA's investment arm, as a backer and serves over 50 government agencies as of April 2025.
Timeline
- 2026-04-06C2 Detection module launched for outbound compromise detection
- 2026-04-01Published 2026 State of the Edge Report on compromised residential IPs
- 2026-04Project Swarm collective-defense community sensor initiative announced
- 2026-03-16Appointed Mike Habte as Director of Federal Sales
- 2026-02Launched CrowdStrike Falcon Next-Gen SIEM integration
- 2025-09-17Launched MCP Server for agentic SOC / AI-driven workflows
- 2025-04Launched Global Observation Grid product
- 2025-01Launched GreyNoise for Vulnerability Prioritization
- 2024-02-13Andrew Morris steps down as CEO; Ash Devata named new CEO
- 2022-06-14Closed $15M Series A led by Radian Capital
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Anti-Threat Intelligence Firm GreyNoise Scores Investment From CIA-backed In-Q-Tel (2023-01-23)
- GreyNoise Intelligence, Headcount, Funding & Open Jobs (2026-06-20)
- GreyNoise Raises $15 Million in Series A Funding (2022-06-14)
- Ash Devata Appointed as New CEO of GreyNoise Intelligence (2024-02-13)
- Management and Employees List
- GreyNoise Intelligence Information
- GreyNoise Selected by Cyber Defense Magazine's Global Infosec Awards 2025 (2025-04-28)
- GreyNoise Announces US Department of Defense Contract (2021-11-15)
- Real-Time Network Threat Intelligence (2026-06)
- Pricing, Request a quote
- GreyNoise Wins the Golden Trifecta (2025-03-19)
- Read GreyNoise press releases (2026-04-28)