Red Canary
Managed detection and response provider, now a Zscaler subsidiary since August 2025.
On the record
Checkpoint: Zscaler discloses whether Red Canary stays a distinct brand or folds into unified SOC platform
The call
Red Canary built real detection expertise but now exists inside Zscaler's balance sheet, with headcount shrinking and its independent future unclear.
Red Canary sells monitoring and alert services that help companies find hackers and malware on their networks. It built a real business over ten years with serious detection expertise, but now faces direct competition from much larger companies like CrowdStrike, Microsoft, and Palo Alto Networks that offer similar services bundled into their own platforms and can undercut Red Canary's pricing. After Zscaler bought Red Canary in August 2025, the company has cut about 30 percent of its workforce, so the biggest question is whether Red Canary stays a recognizable independent team inside Zscaler or gets absorbed completely into Zscaler's broader product, which would destroy its standalone value.
Why
01
AI pressure: Agentic AI triage in CrowdStrike Falcon Complete, Microsoft Defender Experts, Palo Alto XSIAM. AI now handles alert triage and log correlation that used to justify paying a human-driven MDR team. Could AI do the core job? Only partly.
02
Bigger players: CrowdStrike, Microsoft, Palo Alto Networks. Platform vendors bundle MDR into products customers already own, undercutting Red Canary's vendor-neutral pitch. Could a giant copy it? Probably.
03
What protects it. A decade of detection engineering data and workflow lock-in across nearly 1,000 customer security teams.
What would change this call
Zscaler discloses or withholds Red Canary standalone customer retention/NRR figures in earnings calls. Disclosure suggests ring-fenced unit; silence suggests absorption or trouble.
Red Canary headcount trend past June 2026 (per filings or workforce trackers). Continued decline signals dissolution; stabilization signals preserved independent unit.
Whether 'Red Canary' brand name persists in Zscaler product pages/marketing through 2026. Name retained implies crown-jewel status; renamed to 'Zscaler SOC' implies feature absorption.
Red Canary headcount trend past June 2026 (per filings or workforce trackers). Continued decline signals dissolution; stabilization signals preserved independent unit.
Whether 'Red Canary' brand name persists in Zscaler product pages/marketing through 2026. Name retained implies crown-jewel status; renamed to 'Zscaler SOC' implies feature absorption.
Key numbers
- $140M ARR at fiscal year end
- Headcount fell 30% YoY, 476 to 356
- Zscaler paid roughly $675M for acquisition
Named risks
- Headcount fell 30% YoY (476 to 356) through June 2026, signaling possible absorption into Zscaler.
- Only about half of Red Canary's customers fall within Zscaler's core served markets, per execs (May 2025).
- Platform-native MDR bundling from CrowdStrike, Microsoft, Palo Alto erodes vendor-neutral differentiation.
- Standalone financials no longer disclosed separately once folded into Zscaler's quarterly earnings.
- Agentic AI automating tier-1 triage internally could further reduce analyst headcount needs.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| CrowdStrike (Falcon Complete) | contesting | Shipped rival MDR while partnership with Zscaler deepened post-Aug 2025 acquisition |
| Microsoft (Defender Experts) | gaining on | Named as shipped competing MDR product taking share, per Frost & Sullivan, Mar 2024 |
| Palo Alto Networks (Cortex XSIAM) | gaining on | Shipped SOC platform competing directly as of 2026-06-23 (Crustdata) |
| Arctic Wolf | contesting | Listed as direct MDR peer competitor as of 2026-06-23 |
| SentinelOne (Vigilance) | contesting | Shipped MDR/XDR offering competing with Red Canary as of 2026-06-23 |
Questions people ask
- Is Red Canary still an independent company?
- No. Zscaler (NASDAQ: ZS) completed its acquisition of Red Canary on August 1, 2025, for a deal valued at roughly $675 million in cash and equity, making Red Canary a wholly owned subsidiary operating as a distinct business unit.
- Is Red Canary profitable?
- Red Canary reported positive operating margins for the first time in company history in Q3 FY25 (quarter ending December 31, 2024), alongside enterprise segment growth exceeding 50% year over year, according to its own company results release.
- Is Red Canary laying people off?
- Headcount data shows a decline from roughly 476 employees in April 2024 to 356 by June 2026, a reported 30% year-over-year drop per Crustdata tracking, occurring during Zscaler's post-acquisition integration period.
- Could AI replace Red Canary's analysts?
- Red Canary already markets agentic AI delivering up to 10x faster threat investigation while claiming 99 to 99.6% detection accuracy as of May 2025, automating tier-1 triage, though human judgment and liability cover for incident response remain harder to automate.
- Who is Red Canary's biggest competitor?
- Platform-native MDR offerings from CrowdStrike (Falcon Complete), Microsoft (Defender Experts), and Palo Alto Networks (Cortex XSIAM) directly compete with Red Canary, alongside dedicated MDR peers like Arctic Wolf and SentinelOne Vigilance.
- What is Red Canary's revenue?
- Red Canary disclosed annual recurring revenue surpassing $140 million as of its fiscal year end, January 31, 2025, up from $100 million ARR in April 2023, per the company's own Q4 FY25 results announcement.
Timeline
- 2026-06-23Headcount reported at 356, down 30% YoY from 476 in April 2024 (Crustdata)
- 2026-04-28Red Canary website lists approximately 400 employees
- 2026-04-22Red Canary launches Managed Phishing Response using agentic AI plus human review
- 2025-08-01Zscaler completes acquisition of Red Canary, becomes wholly owned subsidiary
- 2025-05-27Zscaler announces definitive agreement to acquire Red Canary for ~$675 million
- 2025-03-06Red Canary reports $140M ARR for FY25, up from $100M in April 2023
- 2024-12-12Q3 FY25: first positive operating margins in company history, enterprise growth >50% YoY
- 2024-10-02Q2 FY25: new business bookings up 48% YoY, enterprise bookings up 86% YoY
- 2024-03-01Red Canary expands cloud support to AWS, Azure, and GCP
- 2021-02-28Series C funding round values Red Canary at approximately $633.9M post-money
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Zscaler Completes Acquisition of Red Canary (2025-07-31)
- Zscaler To Become 'Leading Player In The SOC Market'
- Red Canary Wraps Up Fiscal Year 2025 (2025-03-06)
- Red Canary record Q3 (2024-12-12)
- Red Canary Reports Strong Q2 FY25 (2024-10-02)
- Zscaler press release (2025-05-26)
- Crustdata: Red Canary Headcount (2026-06-23)
- Red Canary (2026-04-28)
- Zscaler To Acquire MDR Trailblazer Red Canary
- Red Canary Expands Its Security Data Lake (2025-03-03)
- Red Canary What's New (2026-04-22)
- Zscaler Moves to Acquire Red Canary MDR Service (2025-05-30)