WillItSurvive

Israeli firm that infiltrates dark web forums to sell cyber threat intelligence and ransomware tracking.

Losing its protection
Assessed 21 July 2026 · Evidence as of 21 July 2026
The structural protection is eroding.
On the recordSince 21 July 2026 · Checkable from next 12 months · Every call on the record Checkpoint: Whether KELA lands a fresh institutional funding round or gets acquired amid CTI consolidation wave
The call

KELA has real dark web data and a growth story, but it is small, uncapitalized since 2018, and sits in a category giants and AI are both closing in on.

Kela buys access to hacker forums and dark web sites to track ransomware gangs, stolen credentials, and criminal activity, then sells that intelligence to banks and companies that need to know what threats exist. The company built real knowledge by spending a decade infiltrating these spaces, which is genuinely hard for newcomers to copy. But now CrowdStrike, Google, and Microsoft all offer similar threat tracking bundled into their larger security products, which customers already buy, and AI tools are automating the detective work that Kela's analysts do by hand. The deciding factor is whether Kela can raise fresh money to grow on its own in the next year, or whether it gets bought by a bigger company, which would signal that standing alone became too difficult.

Why
01
AI pressure: LLM/agentic AI automating analyst triage and threat-brief writing. KELA already replaced parts of its own analyst workflow with 'Digital Cyber Analysts' agents, proving the job is automatable by anyone. Could AI do the core job? Only partly.
02
Bigger players: Recorded Future (Mastercard), Google/Mandiant, CrowdStrike, Microsoft. These players bundle threat intel into platforms customers already buy, squeezing standalone CTI vendors like KELA out of budget lines. Could a giant copy it? Yes, easily.
03
What protects it. A decade of infiltrated criminal forums and trusted personas gives KELA real data, but rivals now claim similar depth, so it protects less than it used to.
What would change this call
KELA announces a fresh institutional funding round within 12 months. Would show continued independence and investor confidence after a 7+ year funding drought.
KELA is acquired by a larger security or data company. Would confirm an exit path rather than standalone growth, matching the Recorded Future/Mastercard and Dataminr/ThreatConnect pattern.
CrowdStrike, Google, or Microsoft explicitly market bundled CTI features at KELA's mid-market segment. Would show giants directly targeting KELA's customer base rather than competing indirectly.
Key numbers
  • No institutional funding since $50M round (2018-05-16)
  • Revenue estimated $12.8M to $22.3M (2026-07-06)
  • Claimed 101% YoY growth, absolute figures unverified (2026-03-31)
Named risks
  • AI automation of manual analyst triage and threat-brief writing erodes core service value. Severity: high
  • Category consolidation (Recorded Future to Mastercard, ThreatConnect to Dataminr) pressures standalone vendors toward acquisition or squeeze. Severity: high
  • Platform giants (CrowdStrike, Google, Microsoft) bundle CTI into tools already purchased, shrinking standalone budget. Severity: high
  • No confirmed institutional funding since 2018 limits capital for AI R&D and competitive response. Severity: medium
  • Brand confusion with unrelated, better-funded 'Kela Technologies' defense-tech startup muddies investor and media perception. Severity: low
Rivals, as read in July 2026
RivalDirectionEvidence
Recorded Futurelosing toAcquired by Mastercard, giving it far greater capital and distribution than KELA, as of 2026-06-24
CrowdStrikecontestingFalcon Adversary Intelligence bundles CTI into a platform customers already buy, per 2026-06-24 buyer's guide
Google/MandiantcontestingGoogle Threat Intelligence folds CTI into Mandiant offering, competing for same budget, 2026-06-24
MicrosoftcontestingDefender Threat Intelligence bundled into Microsoft security stack, per 2026-06-24 comparison
FlashpointcontestingNamed direct peer in cybercrime/dark web CTI, also marketing 'finished intelligence' moat, 2026-07-15
Questions people ask
Is KELA profitable in 2026?
KELA is privately held and discloses no profit or loss figures. It took its only known institutional funding, $50M from Vector Capital, in May 2018 and has raised no confirmed round since. Its March 2026 press release claims 101% YoY growth, but that is a vendor-reported figure, not audited profitability data.
Could AI replace KELA's threat intelligence analysts?
Partly. KELA itself launched 'Digital Cyber Analysts,' agentic AI agents automating triage, IOC extraction and threat briefs, in April 2025, calling it the industry's first agentic AI for threat intel. That signals the manual analyst workflow is automatable, though forum infiltration and persona-building still require human tradecraft.
Who owns KELA the cyber threat intelligence company?
KELA is privately owned. San Francisco private equity firm Vector Capital took a minority stake via a $50M investment in May 2018, the company's first institutional funding after nine years of operation. Founder Nir Barak became Chairman in April 2021 when David Carmiel took over as CEO.
Who is KELA's biggest competitor?
Recorded Future, now owned by Mastercard, is KELA's closest direct rival in cybercrime threat intelligence, alongside Flashpoint and Cybersixgill. CrowdStrike, Google/Mandiant, and Microsoft also bundle competing threat intelligence into platforms customers already buy, per a June 2026 buyer's guide comparison.
Has KELA raised any new funding recently?
No confirmed institutional round has been reported since Vector Capital's $50M minority investment in May 2018. In March 2026 KELA's own press release claimed 101% year-over-year growth tied to enterprise demand for AI-driven cyber defense, but this is a company-reported growth rate, not a disclosed funding event.
What does KELA actually do?
KELA is an Israeli cybercrime threat intelligence and external threat exposure management vendor founded in 2009 by Nir Barak, tracking dark web forums, ransomware operations and compromised credentials. Its April 2026 State of Cybercrime report tracked 7,549 ransomware victims and 2.86 billion compromised credentials in 2025.
Timeline
  • 2026-04-29KELA's State of Cybercrime 2026 report tracks 7,549 ransomware victims, 2.86B compromised credentials in 2025
  • 2026-03-31KELA press release claims 101% YoY growth from AI-driven cyber defense demand
  • 2026-03-28KELA reports 3,662 H1 2025 ransomware victims, 2.67M infostealer infections, 200% surge in AI-tool forum mentions
  • 2025-10-22Report cites 34% YoY surge in ransomware attacks on critical infrastructure, Q1-Q3 2025
  • 2025-04-10KELA launches agentic AI 'Digital Cyber Analysts' (Alex), calling it first-of-kind for threat intel
  • 2025-04-03KELA careers page states company has 'more than 80 people (and growing)'
  • 2021-04-29David Carmiel becomes CEO; founder Nir Barak moves to Chairman
  • 2018-05-16Vector Capital makes $50M minority investment, KELA's first institutional funding
  • 2009KELA founded by Nir Barak, an Israeli intelligence veteran
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources