Kroll
Kroll is a risk advisory firm doing cyber incident response, valuations, and court-appointed settlement work.
On the record
Checkpoint: Refinancing of $1.9B term loan plus $450M second-lien debt, both due 2027
The call
Kroll's court-appointed and regulatory-independence roles keep AI tools and Big Four firms out, but its 2027 debt refinancing under a negative Moody's outlook is the real test of its financial footing.
Kroll investigates fraud, conducts forensic work, manages settlements, and serves as an expert witness in court cases. The company is hard to replace because courts and regulators won't let the Big Four accounting firms (Deloitte, PwC, KPMG, EY) do this work due to conflicts of interest, and AI tools cannot be appointed by courts or held legally responsible for their findings the way Kroll can. The big question is whether Kroll can refinance its $2.35 billion debt load before 2027; if that goes badly, the company may be forced into painful cost-cutting or a sale on weak terms, which would hurt stock investors even though the core business itself remains valuable.
Why
01
AI pressure: AI-native detection and triage tools like CrowdStrike Charlotte AI and Mandiant's AI-assisted forensics. AI can automate phishing triage and first-pass forensic scans, squeezing Kroll's commodity detection revenue but not its court-appointed work. Could AI do the core job? Unlikely.
02
Bigger players: CrowdStrike and Mandiant (Google) on cyber detection; Big Four barred from audit-adjacent work by independence rules. CrowdStrike and Mandiant already win commodity managed detection deals; Big Four still can't touch Kroll's court-appointed and audit-independence roles. Could a giant copy it? No, they are blocked.
03
What protects it. Courts and regulators appoint Kroll directly for settlement administration and expert testimony, roles no AI model or Big Four firm can legally fill.
What would change this call
Outcome of Kroll's $1.9B term loan plus $450M second-lien refinancing due 2027. Shows whether lenders still trust Kroll's cash flow or are pricing in distress.
Moody's next rating action on Kroll following the refinancing. A downgrade would confirm financial stress is worsening, not stabilizing.
Whether CrowdStrike or Mandiant announce advisory or expert-witness engagements beyond detection/MDR. Would show competitors moving into Kroll's liability-bearing, court-appointed niche.
Moody's next rating action on Kroll following the refinancing. A downgrade would confirm financial stress is worsening, not stabilizing.
Whether CrowdStrike or Mandiant announce advisory or expert-witness engagements beyond detection/MDR. Would show competitors moving into Kroll's liability-bearing, court-appointed niche.
Key numbers
- $2.35B in term and second-lien debt due 2027
- Moody's B3 rating, outlook cut to negative
- Revenue estimated at ~$1.4B
Named risks
- 2027 maturity of $1.9B term loan plus $450M second lien amid negative Moody's outlook since June 2025.
- Private credit refinancing market may price debt unfavorably, forcing distressed terms or covenant pressure.
- Kroll's own August 2023 cloud breach exposing FTX claimant data undercuts its cyber credibility.
- AI-native platforms commoditizing detection and triage could compress margins on Kroll's MDR revenue.
- Revenue figures are unverified private estimates ranging from $500M to $1.8B, obscuring true financial health.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Big Four (Deloitte, PwC, KPMG, EY) | gaining on | SEC auditor independence rules structurally bar Big Four from Kroll's core valuation and advisory work for audit clients |
| CrowdStrike | contesting | Kroll migrated 500,000+ endpoints to CrowdStrike's Falcon Complete MDR under a partnership announced Dec 2, 2025 |
| Mandiant (Google Cloud) | contesting | Competes directly with Kroll in cyber incident response and forensic vendor selection as of 2026 |
| FTI Consulting | contesting | Named peer competitor across risk and financial advisory services per industry comparisons, 2026 |
| Palo Alto Networks Unit 42 | contesting | Competes on commodity detection layer pressuring MDR margins across the incident response market |
Questions people ask
- Is Kroll profitable in 2026?
- Kroll does not disclose audited financials as a private company. What is public: it carries a $1.9B term loan plus $450M second lien due 2027, and Moody's moved its outlook to negative on a B3 rating in June 2025, signaling elevated leverage stress rather than confirmed unprofitability.
- Who owns Kroll?
- Kroll is privately owned by a consortium led by Stone Point Capital and Further Global Capital Management, with NB Private Equity Partners and a retained minority stake from prior owner Permira, following a $4.2B acquisition announced January 22, 2020.
- Could AI replace Kroll's services?
- AI is automating commodity detection and triage, Kroll migrated over 500,000 endpoints to CrowdStrike's AI-native Falcon Complete MDR in December 2025. But Kroll's court-appointed settlement administrator and expert witness roles carry legal liability that AI models cannot bear.
- Who is Kroll's biggest competitor?
- In cyber incident response, CrowdStrike and Mandiant (Google Cloud) compete on detection technology, but Kroll partnered with CrowdStrike in December 2025 rather than fight it. In core advisory work, Big Four firms are structurally barred by SEC auditor independence rules from competing with Kroll's audit clients.
- Is Kroll financially stable to join as an employee?
- Kroll's own newsroom cites over 6,500 professionals and it kept acquiring firms through July 2026, including ABC economics. However Moody's assigned a negative outlook to Kroll's B3 rating in June 2025 ahead of a 2027 debt maturity of $1.9B plus $450M, a real financial overhang.
- Has Kroll had a data breach?
- Yes. In August 2023 Kroll suffered unauthorized access to its cloud systems that exposed personal data of FTX and other bankruptcy claimants it was administering, an ironic incident for a firm whose business is cyber incident response.
Timeline
- 2026-07-15Kroll acquires ABC economics to expand competition and regulatory economics practice
- 2026-04-20Kroll publishes research on AI adoption outpacing security governance
- 2025-12-02Kroll announces multi-year MDR partnership, migrates 500,000+ endpoints to CrowdStrike
- 2025-11-16Kroll completes acquisition of Madison Pacific Group for APAC trustee expansion
- 2025-09-01Kroll acquires Kirby Healy, expanding restructuring practice into Ireland
- 2025-08-08Kroll seeks private-credit refinancing of $1.9B term loan and $450M second lien
- 2025-06-01Moody's revises Kroll outlook to negative while affirming B3 rating
- 2025-02-01Kroll acquires Locust Hill Advisors, launching Equity Capital Markets Advisory
- 2023-08-01Kroll suffers cloud breach exposing FTX and other bankruptcy claimants' data
- 2022-02-01Duff & Phelps completes full rebrand to the Kroll name
- 2020-01-22Stone Point led consortium agrees to acquire Kroll for $4.2B
Revision history
21 July 2026
First assessed. Defensible for now. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Duff & Phelps to Be Acquired by Global Investor Consortium for $4.2 Billion (2020-01-22)
- Direct Lenders Expected to Push on Pricing for Kroll's 2027 Debt Refi (2025-08-08)
- Kroll - Overview, News & Similar companies (2026-07-16)
- Revenue, Competitors, Alternatives
- Stone Point (2026-03-24)
- Who is eligible for AT&T data breach settlement? (2025-08-15)
- 23andMe data breach settlement of $46.75 million approved (2026-07-09)
- Kroll Completes Acquisition of Madison Pacific Group (2025-11-16)
- Kroll Launches 2025 Global Business Sentiment Survey Findings (2025-06-11)
- Employee Count & Headcount Data (2026-06-29)
- Kroll Inc. (2026-06-15)
- Kroll Migrates to CrowdStrike Falcon Complete Next-Gen MDR (2025-11-26)