All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Bolster finds phishing sites, fake apps and impersonating social accounts that copy a company's brand and has them taken down. It sells to the companies being impersonated, and its named customers include SoFi, McAfee, Uber, Dropbox, LinkedIn, Coinbase and Captivate IQ. Akamai chose Bolster's technology to power an Akamai product against AI-driven fraud. It reported more than 120 customers in May 2024, when M12, Microsoft's venture fund, led its 14 million dollar Series B. Founded in 2017, it has raised about 40 million dollars, and Gartner Peer Insights lists it at 51 to 200 employees. Bolster says it completes 75% of takedowns within minutes because registrars and hosting providers accept its requests through its API. Bolster depends on those providers continuing to accept its requests.
| Description | Bolster finds phishing sites, fake mobile apps and social-media impersonations of a customer's brand, then files takedown requests with registrars, hosting providers and platforms to have them removed. | [f1] |
|---|---|---|
| Founded | 2017 | [f2] |
| HQ | Santa Clara, California, United States | [f3] |
| Latest funding | Series B, 14 million dollars, May 2024 | [f3] |
| Product | What it does |
|---|---|
| Domain Monitoring and Takedowns | Scans registrations and live pages for lookalike domains, typosquatted URLs and fake websites that copy a customer's brand, and opens takedowns on what it finds. |
| Automated Takedown | Files removal requests through APIs with hosting providers and registrars, sends evidence-based reports where no API exists, and rechecks removed sites for revivals. |
| Bolster AI Signals | Aggregates the fraud and impersonation activity the platform observes into reporting for security leaders, with plain-language questions over the collected data. |
| Social Media Monitoring and Takedowns | Detects fake company pages, scam posts and executive impersonation across social platforms and pursues removal of the accounts behind them. |
| Customer Abuse Mailbox | Takes in phishing mail that customers report to a brand, separates real threats from noise and opens takedowns on the infrastructure behind them. |
| App Store Monitoring and Takedowns | Watches global app stores for fraudulent mobile apps that impersonate a brand and works with Apple, Google and other stores to have them removed. |
| Dark Web Monitoring | Scans dark web forums, Telegram channels and underground marketplaces for stolen brand assets and leaked customer credentials. |
| Marketplace Monitoring and Takedowns | Detects counterfeit listings, unauthorized sellers and fraudulent goods on online marketplaces and pursues their removal, with monitoring for reappearance. |
| Fraudulent Ads Monitoring and Takedowns | Finds paid search, sponsored and social advertisements impersonating a brand, traces the redirect chain and landing page behind them, and files removals. |
| Deepfake Detection | Lets an analyst check suspicious images and video inside an impersonation investigation and links the media to the domains and accounts spreading it. |
| CheckPhish | Free URL and email scanner with typosquat monitoring, open to anyone with an account and offering an API, sitting alongside the paid platform. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
Domain Monitoring and Takedowns finds fake websites aimed at a customer's users, Automated Takedown removes them through registrars and hosting providers and works with app stores on fraudulent apps, and Dark Web Monitoring surfaces leaked credentials. These are mapped to the Cyber Defense Matrix. [f1]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Bolster names the buyer and the moment precisely, covering the enterprise whose customers, not employees, are the target of lookalike domains, fake apps and impersonating accounts. Independent trade press documented one such wave when scammers registered CrowdStrike-themed domains during the July 2024 outage, though the counts in those articles are Bolster's own measurements quoted in a company statement. [s1, s4, s28, s29] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | The product pages describe mechanism rather than outcome, naming typosquat variant generation, DNS record checks for live web content and mail capability, natural language processing with optical character recognition and image comparison, and takedown requests carried over partner interfaces with evidence-bearing email where no interface exists. No third-party technical evaluation of that detection appears in the reviewed sources, so a buyer has only the vendor's own account of that depth. [s4, s5, s6] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | The enabler Bolster names is generative AI cutting the cost of building convincing fake sites and messages, which its chief executive stated in November 2024. The reviewed sources record one buyer-review channel in detail. Gartner Peer Insights runs a brand protection software market where reviewers rated Bolster 17 times, and no regulatory driver or budget-line signal appears beside it. [s10, s16] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | Bolster states Rod Schultz led product and engineering at Dust Identity before becoming chief executive in November 2024, and Abhilash Garimella is quoted by name as vice president of research in independent trade coverage. Co-founders Abhishek Dubey and Shashi Prakash built the company from 2017 and appear nowhere on the current leadership page. [s3, s10, s27, s28] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 | Named customers speak in security roles, including SoFi intelligence analyst Megan Capdeville, a McAfee employee describing the two teams working as one operations centre, and a CaptivateIQ security manager, with a former Booking.com chief information security officer adding a testimonial. TechCrunch independently named Dropbox, Uber, LinkedIn and Coinbase as clients. The customer count above 120 is the company's own figure from May 2024. [s17, s18, s24, s27, s9] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | The 14 million dollar Series B of May 2024 is proportional to a company TechCrunch put at about 40 million dollars raised in total, and shipping has continued with no later round in the reviewed sources, with the CheckPhish plugin for Microsoft Security Copilot announced in June 2025 and the news index listing launches of Signals, marketplace protection and advertising monitoring. Efficiency itself is unconfirmed, as no revenue, margin or growth figure appears in the reviewed sources. [s27, s19, s9, s20] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 | Gartner Peer Insights places Bolster in its brand protection software market and records the vendors reviewers weighed against it, and ZeroFox devotes a comparison page to Bolster, so a buyer-review platform and a rival both file it in the same slot. Bolster's own pages use several labels for that slot, running from brand protection to digital risk protection services. [s16, s14, s6, s7] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Absorbing this would take more than a feature release, because the work runs on standing relationships with registrars and hosting providers that accept Bolster's removal requests, on evidence packages for the ones that do not, and on an operations team behind the automation. The reviewed record establishes no exclusive access to any of those channels. [s5, s24, s14] |
Attackers copy a company's brand on infrastructure the company does not own, and Bolster sells the removal of what they build. Its pages cover lookalike and typosquatted domains, fake websites, counterfeit mobile apps, impersonating social accounts, fraudulent advertisements and marketplace listings, plus leaked credentials surfacing on dark web forums and Telegram channels.
The attacks it removes reach a company's customers and not only its employees, which is what separates this work from email security. Bolster states the case plainly on its homepage, and its Signals pages describe security teams that cannot connect fraud data to cyber risk and chief information security officers who lack a view above individual alerts.
What the pain costs a buyer is quantified mainly by the vendor. Independent trade coverage documented one wave concretely, when scammers registered CrowdStrike-themed domains during the July 2024 outage, but the counts in those articles came from a Bolster statement rather than from the outlets' own measurement. [s1, s6, s19, s21, s28, s29]
The detection side is described as mechanism rather than outcome. Bolster generates typosquat variants of a customer's domains, checks each for registration, a DNS A record signalling live web content and a mail record signalling email capability, and applies natural language processing, optical character recognition and image comparison to catch pages that copy a brand without copying its name.
The removal side runs on other companies' abuse processes. Bolster says registrars and hosting providers that have adopted its interface accept takedown requests through it, that providers without it receive automated emails carrying up to 25 evidence attributes, that confirmed URLs go to global blocklists, and that language models draft the follow-up correspondence a slower case requires.
Speed and accuracy are the company's own measurements. The homepage claims that automated takedowns eliminate 75 percent of threats in under 60 seconds, the domain page claims detection in as little as 60 seconds and takedown in as little as two minutes, and no third-party test of either appears in the reviewed sources. [s1, s4, s5]
A buyer-review platform and a rival file Bolster in the same category. Gartner Peer Insights lists it in brand protection software with 17 ratings averaging 4.6, and records that reviewers weighed Allure Security, Cyberthint and ZeroFOX before buying. ZeroFox runs a dedicated comparison page arguing that Bolster is narrow, does not offer executive protection and suits small businesses rather than enterprise risk. Bolster's own site lists Executive Impersonation among its solutions.
Bolster answers in the same register. Its own blog runs comparison posts against ZeroFox and against Netcraft, framing the choice as automation with analysts on edge cases against analyst-mediated validation, and it states that Akamai uses its technology inside a Brand Guardian offering.
Category vocabulary is where the placement blurs. Bolster's pages sell brand protection, digital risk protection services, phishing and scam protection and typosquatting protection, and its own brand protection page defines that category around trademarks and intellectual property while its case studies describe security operations work. [s16, s14, s23, s31, s6, s7, s18, s24]
Three of the five testimonials on the customers page carry security titles, one an intellectual-property title and one a system administrator. The two case studies name security roles as well. SoFi intelligence analyst Megan Capdeville is quoted by name on a 20 percent workload reduction, and McAfee's Kelly Brown estimates half of phishing triage gone and describes the two operations teams working as one. A Gartner Peer Insights reviewer in a government organisation describes takedowns run for their agencies.
Independent reporting corroborates the customer base. TechCrunch named Dropbox, Uber, LinkedIn and Coinbase as clients in May 2024, when the company also stated it supported more than 120 customers. Distribution has since widened through Microsoft, whose Security Copilot has carried CheckPhish as a plugin since June 2025.
Not every reference is a security buyer. Uber's vice president of intellectual property gives one of those testimonials, which fits a product whose own category page defines brand protection around trademarks and counterfeits, so the budget a deal comes from is not fixed. [s17, s18, s24, s27, s9, s20, s16]
The company was built by its founders and is now run by people who arrived later. Bolster's team page says security researchers founded it, and its November 2024 release records that co-founder Abhishek Dubey handed the chief executive role to Rod Schultz, whose stated background is more than 25 years across Apple, Adobe, Zoom and a product and engineering role at Dust Identity.
Neither co-founder is on the leadership page now. It lists Schultz, chief financial officer Jeff Klinkrodt, a vice president of engineering, a vice president of research and security operations and a chief marketing officer, with Thomvest, Crosslink and Cervin holding board seats alongside an independent director.
One research name is visible outside the company's own pages. Abhilash Garimella is quoted as vice president of research in Security Boulevard and SC Media coverage of the CrowdStrike-outage scams, which is the kind of standing that repeat coverage builds. [s3, s10, s28, s29]
Assurance is self-published. The site footer carries a badge image the page labels a certificate, the news index carries an announcement that Bolster attained SOC2 Type II compliance, and a probe of the usual trust surfaces reached nothing further than a marketing page.
Integration into a security stack is documented. The integrations page counts 46 integrations across categories that include security information and event management, orchestration, email, single sign-on, hosting providers and registrars, and the Microsoft Security Copilot plugin authenticates with a CheckPhish API key.
Commercial terms are not public either, so a buyer cannot compare cost without entering a sales process. No price or packaging tier appears in the reviewed sources, and Bolster's own comparison post describes module and brand-based pricing without metering on takedown volume, which is a description rather than a rate card. [s22, s25, s20, s23, s19, s1]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| ZeroFox | competes with | ZeroFox publishes a comparison page against Bolster, and Gartner Peer Insights records that reviewers weighed ZeroFOX before buying. | |
| Netcraft | competes with | Bolster publishes a blog post positioning itself against Netcraft, and states there that teams move from Netcraft to Bolster. | |
| Allure Security | competes with | Gartner Peer Insights reports that 47 percent of reviewers considered Allure Security before purchasing from Bolster. | |
| Cyberthint | competes with | Gartner Peer Insights reports that 47 percent of reviewers considered Cyberthint before purchasing from Bolster. |
Add analyzed competitors to compare them side by side with Bolster.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
press the advantage
Bolster's advantage is operational. Registrars and hosting providers accept its removal requests through an interface it built. The ones that have not adopted it get evidence packages of up to 25 attributes, confirmed URLs go to blocklists, and the company keeps watching removed sites for revivals. CheckPhish, created in 2018 and free today, feeds its detection models and puts the product in front of buyers, and Bolster says more than a fifth of the Fortune 500 has registered for it. The cited record shows no exclusive access to those abuse desks, and the scanning corpus is described but never shown to produce results competitors cannot match. The free tool's reach is a head start rather than a lock.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 2/3 | Bolster ships software and staffs the work behind it: a McAfee security specialist describes the Bolster operations team as an extension of its own security operations centre, and the homepage describes an AI-powered, SOC-backed takedown service. Code and expertise blend at the mixed level, and the customer still operates the product and owns the outcome. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Forwarding an abuse mailbox to Bolster and accumulating takedown history in it create meaningful friction of exactly the kind rung two names, data history plus integrations plus learned workflows. The cited record documents no mechanism beyond that and does not size the migration, so the score matches the friction the record documents. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | The assurance the reviewed sources carry is a footer badge image and the company's own 2022 announcement of SOC2 Type II compliance, the kind of artifact a funded competitor obtains through ordinary enterprise-market preparation. A probe of the trust surfaces reached no portal, report or further certification, and no cited source names a requirement that blocks replacement of this product. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Detection runs generated domain permutations, DNS record checks, natural language processing, optical character recognition and image comparison continuously across the web, and language models draft the takedown correspondence. That combination of machine learning and real-time systems is the specialised-expertise level, and Bolster states it has been training on structured phishing data since 2017. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | The named buyers are regulated enterprises and public bodies: SoFi is a bank, McAfee and Uber are large enterprises, Booking.com's former chief information security officer endorses the product, and a Gartner Peer Insights reviewer in a government organisation describes takedowns run for their agencies. That is the class the top level names. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | Bolster is a platform other tools draw on rather than infrastructure they run on. It publishes 46 integrations across security information and event management, orchestration, email and single sign-on, and CheckPhish is reachable by API and inside Microsoft Security Copilot, but no cited source shows another application depending on it to function. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 | Bolster states it has trained models on more than 100TB of structured URL, domain, text and email data since 2017, that CheckPhish scans augment them, and that its detection and takedown process is patented, which together read as an accumulated advantage a well-funded rival could assemble with time. The cited record does not show that corpus producing detections competitors cannot reach. |
Bolster sells to the enterprise whose customers are being impersonated, and the named references cluster in consumer-facing brands with large user bases: SoFi in banking, McAfee in security software, Uber, Dropbox, LinkedIn and Coinbase as clients TechCrunch listed, and CaptivateIQ among smaller software companies.
Inside those accounts the budget is shared. McAfee runs its abuse mailbox work out of security operations, an intelligence analyst owns the programme at SoFi, and the Signals pages address chief information security officers who need a view above single alerts. The customers page also carries a testimonial from Uber's vice president of intellectual property, and Bolster's own brand protection page defines that category around trademarks and counterfeits.
Selling into security, fraud and trademark budgets at once changes who Bolster is compared against. A security buyer weighs Bolster against digital risk protection platforms, while a trademark buyer weighs it against enforcement services, and Gartner Peer Insights records reviewers who considered Allure Security, Cyberthint and ZeroFOX before buying.
Detection is described concretely enough to evaluate. Bolster generates typosquat permutations of a customer's domains, checks each for registration, a DNS A record signalling live content and a mail record signalling email capability, then applies natural language processing, optical character recognition and image comparison so a page that copies a brand without copying its name still surfaces.
The AI claim extends into the removal workflow, which is less common. Bolster says language models draft the requests and the replies that hosting providers and registrars ask for, which is where a manual process usually stalls, and that confirmed URLs go to global blocklists to stop the same site returning.
The efficacy numbers are the vendor's own. A 99.999 percent accuracy figure, 75 percent of takedowns under 60 seconds and no manual intervention in 95 percent of cases all come from company pages and releases, and the reviewed sources carry no independent test of detection quality or removal speed.
The motion is enterprise sales fed by a free tool. Bolster created CheckPhish in 2018 and it is open to anyone today, scanning URLs and emails, monitors typosquats across more than 1300 top-level domains, and asks a user who wants volume scanning or API access to create an account, with multi-domain monitoring routed to the sales team.
Distribution now runs through Microsoft as well. M12, Microsoft's venture fund, led the May 2024 round, and in June 2025 CheckPhish became a plugin inside Microsoft Security Copilot that authenticates with a CheckPhish API key, putting the scanner in front of analysts already working in that console.
Proof of the paid motion comes mostly from the vendor's own case studies, which do name people and numbers: a 20 percent workload reduction at SoFi, half of phishing triage at McAfee, and more than 120 customers as of May 2024. TechCrunch supplies the independent corroboration by naming four clients.
No price appears in the reviewed sources. The captured pages end at a demo request or a contact-sales link, and none of them carries a packaging tier or a rate.
What the record does describe is the shape of the pricing rather than its level. Bolster's own comparison post states that pricing is module- and brand-based with no metering on takedown volume, which matters in this category because per-takedown fees make a bad month expensive.
For a buyer the consequence is that cost comparison requires entering a sales process, and the one published claim about the model appears in a post comparing Bolster with a rival.
Delivery is software plus an operations team. Bolster describes an AI-powered, SOC-backed takedown service, and a McAfee security specialist describes that team as an extension of its own security operations centre, in constant communication rather than a ticket queue.
Onboarding is light by the vendor's account. SoFi's case study puts deployment at under a day, and McAfee's says an abuse mailbox forwarding to a mirror inbox can be fully operational within 12 hours, with neither case study describing software installed inside the customer's environment.
The operational dependency sits outside the customer and outside Bolster. Removal happens when a registrar, host, app store or platform acts, so throughput depends on interfaces those providers offer and on evidence packages persuading the ones that do not.
Assurance is self-published. The site footer carries a badge image the page labels a certificate, the news index carries an announcement that Bolster attained SOC2 Type II compliance, and a probe of the usual trust surfaces found no portal behind either.
For a product that ingests a customer's abuse mailbox and reported phishing mail, that is a thin package. The reviewed sources name no further certification, no federal authorization and no published audit report, and none of the customer stories describes a security review of the vendor.
Nothing in the record suggests a compliance requirement that a buyer must satisfy by choosing this vendor, so assurance here is a purchasing hurdle to clear rather than an argument for the product.
Bolster is built to work inside a security stack rather than replace one. Its integrations page counts 46 integrations spanning security information and event management, orchestration, email, single sign-on, collaboration tools, hosting providers, registrars and threat intelligence.
Two of those relationship types do different work. Registrar and hosting-provider interfaces are how removals execute, and those are the relationships specific to this business, while the security tooling integrations are how findings reach an analyst.
The ecosystem also reaches outward through Microsoft. CheckPhish inside Security Copilot puts Bolster scanning in a console those teams already use, and Bolster states that Akamai uses its technology inside a Brand Guardian offering, which is a technology supply relationship the record does not detail further.
Bolster's founding story and its current leadership are two different sets of people. The team page says security researchers founded the company, and the November 2024 release records co-founder Abhishek Dubey handing the chief executive role to Rod Schultz, whose stated background covers Apple, Adobe, Zoom and a product and engineering role at Dust Identity.
The current page lists Schultz, a chief financial officer, a vice president of engineering, a vice president of research and security operations and a chief marketing officer, and names neither co-founder. Thomvest, Crosslink and Cervin hold board seats alongside one independent director.
Research is the function with an outside footprint. Abhilash Garimella is quoted by name as vice president of research in Security Boulevard and SC Media coverage, and no prior exit appears in the appointment release or on the team page.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Bolster homepage: what the platform detects and removes | official | 2026-08-18 |
| f2 | Bolster release: Rod Schultz appointed chief executive, November 2024 | official | 2026-08-18 |
| f3 | Bolster release: 14 million dollar Series B led by M12, May 2024 | official | 2026-08-18 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.