ThreatBook
Beijing-based vendor selling threat intelligence and detection tools to enterprises and governments.
On the record
Checkpoint: Any new funding disclosure or liquidity event, which would end a 4-year capital silence
The call
ThreatBook holds real ground in China's regulated and government-linked accounts but has raised no disclosed capital since 2022 while its new agentic pivot faces Microsoft, Google, and a CrowdStrike-led alliance already shipping the same layer.
ThreatBook sells security threat data and automated threat hunting tools, especially in China and Asia where it has deep government connections and trust that Western companies like Microsoft and Google cannot easily match. However, Microsoft, Google, and CrowdStrike have all released competing AI-powered security tools in 2026 that do similar threat hunting work automatically, and ThreatBook was not included in their partnerships. The company has not announced new funding in over four years despite having roughly 500 employees, which raises questions about whether it can stay independent or will need to be acquired. The big question is whether ThreatBook's strength in Asia can protect it from these American tech giants and Chinese rivals stealing its customers outside its home region.
Why
01
AI pressure: Microsoft agentic SOC, Google SecOps agentic hunting, ExtraHop/CrowdStrike Agentic SOC Alliance. Microsoft, Google, and a CrowdStrike/ExtraHop alliance already ship agentic SOC triage, the same layer ThreatBook's new Flocks agents target, without ThreatBook in the mix. Could AI do the core job? Only partly.
02
Bigger players: Qi An Xin. This Chinese rival has the same regional data and government access ThreatBook relies on, competing directly inside China without any geopolitical block. Could a giant copy it? Probably.
03
What protects it. Government-trust relationships (INTERPOL exercise role, ICBC as customer) that Western platform giants cannot easily obtain inside China.
What would change this call
ThreatBook discloses a new funding round or acquisition by end of 2026. Would resolve the 4+ year capital stall and signal investor confidence.
ThreatBook named in China's cybersecurity vendor procurement suspensions. Would show domestic government-trust moat weakening.
ThreatBook's Flocks/agentic products win named enterprise customers outside China/APAC-gov core. Would show the agentic pivot gaining share against Microsoft, Google, CrowdStrike.
ThreatBook named in China's cybersecurity vendor procurement suspensions. Would show domestic government-trust moat weakening.
ThreatBook's Flocks/agentic products win named enterprise customers outside China/APAC-gov core. Would show the agentic pivot gaining share against Microsoft, Google, CrowdStrike.
Key numbers
- Series E raised 500M yuan (~$76M) in 2021
- Only ~300 of ~3,000 tool users were paying (10%)
- Sole cybersecurity partner in INTERPOL STEALTHNET exercise
Named risks
- No disclosed funding round since March 2022, a 4+ year capital-raise gap.
- Excluded from the July 2026 Western Agentic SOC Alliance standardizing the category.
- Sector-wide China military procurement bans on domestic cybersecurity vendors since 2024.
- Revenue and headcount figures remain unverified with no audited financial disclosure.
- Geopolitical exposure as a Chinese-origin vendor amid ongoing US-China tech tension.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Qi An Xin | contesting | Domestic Chinese giant with same regional/government data access, outscales ThreatBook as of 2026 |
| Microsoft | gaining on | Shipped native agentic SOC architecture April 9, 2026 into SIEM/XDR stacks customers already own |
| Google SecOps | gaining on | Entered private preview of agentic threat hunting and detection engineering April 26, 2026 |
| CrowdStrike/ExtraHop Agentic SOC Alliance | gaining on | Launched July 22, 2026 alliance with Dropzone AI and ReversingLabs, excluding ThreatBook |
| Beijing TopSec and other domestic peers | contesting | Sector faces China military procurement bans on 10+ vendors since 2024, per July 16, 2026 report |
Questions people ask
- Is ThreatBook profitable in 2026?
- No audited financials are public. A 2021 TechCrunch report found only about 300 of roughly 3,000 companies using ThreatBook were paying customers. No revenue disclosure has followed since, so profitability cannot be confirmed as of mid 2026.
- Has ThreatBook raised funding recently?
- No. ThreatBook's most recent disclosed round was a Series E Extension around March 28, 2022, backed by investors including Hillhouse Capital, Northern Light Venture Capital, and CICC Capital. No new round has been reported in over four years as of mid 2026.
- Could AI replace ThreatBook's core service?
- ThreatBook's tier-1 triage and IOC correlation workflows, the exact tasks its own Flocks agents target, overlap with agentic SOC features Microsoft shipped April 9, 2026 and Google SecOps previewed April 26, 2026, both built into platforms customers may already own.
- Who is ThreatBook's biggest competitor?
- Domestically, Qi An Xin shares the same China-market government access and outscales ThreatBook. Globally, ExtraHop, CrowdStrike, Dropzone AI, and ReversingLabs formed an Agentic SOC Alliance on July 22, 2026 that did not include ThreatBook.
- Who owns ThreatBook?
- ThreatBook is privately held and venture-backed, founded in 2015 and led by CEO Feng Xue, described in a 2021 TechCrunch profile as a former Amazon executive. Disclosed investors include Hillhouse Capital, Northern Light Venture Capital, and CICC Capital.
- Is ThreatBook on any US sanctions or export control list?
- As of July 24, 2026, searches of the OFAC SDN list, the US Entity List, and the DoD Section 1260H list found no ThreatBook listing; those searches instead surfaced other Chinese firms such as Sichuan Silence and Qihoo 360.
Timeline
- 2026-07-22ExtraHop launches Agentic SOC Alliance with CrowdStrike, Dropzone AI, ReversingLabs; ThreatBook not a founding member
- 2026-07-16SecurityWeek reports China military procurement bans on 10+ domestic cybersecurity vendors since 2024
- 2026-05-11ThreatBook rebrands to The Agentic Security Company, launches Flocks and SafeSkill
- 2026-04-27ThreatBook is sole cybersecurity technical partner in INTERPOL STEALTHNET exercise
- 2026-04-26Google SecOps agentic threat hunting and detection engineering enter private preview
- 2026-04-09Microsoft publishes agentic SOC architecture blog
- 2026-02-26ThreatBook claims 5.0/5 Gartner Peer Insights rating for Endpoint Protection Platforms
- 2025-09-29ThreatBook globally launches ATI, claiming 14B+ daily attack records tracked
- 2025-06-04ThreatBook named only Chinese vendor in Gartner's first-ever NDR Magic Quadrant
- 2022-03-28ThreatBook closes Series E Extension, most recent disclosed funding round
Revision history
26 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- ThreatBook Launches Best-of-Breed Advanced Threat Intelligence Solution (2025-09-29)
- Former Amazon exec gives Chinese firms a tool to fight cyber threats (2021-04-07)
- Valuation, Funding Rounds & Stock Price (2022-03-27)
- ThreatBook Stock Price, Funding, Valuation, Revenue (2022-03-27)
- Management and Employees List (2026-07-04)
- The Agentic Security Company (2026-07-04)
- Products, Competitors, Financials (2026-04-27)
- Sole Cybersecurity Partner ThreatBook in Successful STEALTHNET Exercise (2026-04-27)
- ThreatBook - Overview, News & Similar companies (2026-07-04)
- ThreatBook Selected in the First-ever Gartner Magic Quadrant for NDR (2025-06-04)
- ThreatBook Launches Disruptive AI-Native Agentic SecOps Platform (2026-05-11)
- From Intelligence to Fortified Defense (2025-09-29)