All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
CyCraft's incident record is unusually public: Wired reported its investigation of Chinese hackers who pillaged seven Taiwanese chip firms, and The Register reported its analysis of a supply-chain attack on software used by 80 percent of Taiwan's financial institutions. That research, three U.S. MITRE evaluations, and a 2026 public listing give the Taiwan detection-and-response maker a well-documented external record. The risk: expansion spends that credibility. CyCraft is stretching one proven detection platform into an LLM guardrail and a counter-drone line with no customers disclosed in the cited record. Its named proof points concentrate in Taiwan's government, defense, and finance sectors, so a buyer outside Asia weighs a supplier whose verifiable references are regional.
| Description | CyCraft Technology is a Taiwan-based, publicly listed (TWSE Innovation Board, 7823) cybersecurity vendor whose XCockpit platform combines endpoint detection, identity attack-surface management, and external attack-surface management for threat detection and response. | [f1] |
|---|---|---|
| Founded | 2017 | [f2] |
| HQ | New Taipei City, Taiwan | [f3] |
| Subsidiaries | CyCraft Japan (Japan subsidiary (株式会社 CyCraft Japan), Tokyo.) , CyCraft Singapore Pte. Ltd. (Singapore subsidiary.) | |
| Latest funding | Series B, US$5.65M (2019) | [f4] |
| Product | What it does |
|---|---|
| XCockpit | AI threat exposure management platform combining external attack-surface management, identity attack-surface management, and endpoint detection and automated forensics in one console. |
| XecGuard | AI security guardrail product that screens prompts and outputs for large language model and generative AI applications. |
| XecDefend | Defense-grade AI offering that the vendor describes as applying its cyber technology to the counter-drone domain. |
| CyberTotal | Cloud threat intelligence service that aggregates and scores indicators to enrich detection and investigation across the platform. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
CyCraft XCockpit inventories external assets and identity privilege paths, then detects and helps respond to endpoint and network intrusions using autonomous AI analysis, and is mapped to the Cyber Defense Matrix. [f5]
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Orchestration Tools Agentic orchestration tools, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients on user devices. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Gateways & Routers MCP proxies and gateways, LLM routers, outbound AI-service traffic, shadow AI egress, and model-registry traffic. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, AIBOM, and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
CyCraft XecGuard screens prompts and outputs for large language model and generative AI applications, and is mapped to the AI Defense Matrix. XecGuard and XecART are presented via demo or contact only, with no public trial or pricing. [f5]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score |
|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 4/5 |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs, demos, and third-party validation. | 4/5 |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 4/5 |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 |
Unlock the Full Analysis
The reasoning for the scores, the strategy deep dive, the business risks, and more. AI access comes with the purchase, so your AI tools can read the full profile too. You keep 12 months of access.
One-time purchase: $20 per profile.
UnlockReading several? Unlock the entire catalog.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
press the advantage
| Dimension | Score |
|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 2/3 |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 |
Unlock the Full Analysis
The reasoning for the scores, the strategy deep dive, the business risks, and more. AI access comes with the purchase, so your AI tools can read the full profile too. You keep 12 months of access.
One-time purchase: $20 per profile.
UnlockReading several? Unlock the entire catalog.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | TWSE Market Insights: New listed company CyCraft-KY (7823) | regulatory | 2026-06-28 |
| f2 | CyCraft: AI Cybersecurity Startup Raised US$5.65M in Series B Funding | official | 2026-06-24 |
| f3 | CyCraft: About (Taiwan headquarters) | official | 2026-06-24 |
| f4 | PR Newswire APAC: CyCraft Raised US$5.65M in Series B Funding | press | 2026-06-24 |
| f5 | TWSE Market Insights: New listed company CyCraft-KY (7823) | regulatory | 2026-06-24 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | TWSE Market Insights: New listed company CyCraft-KY (7823) “CyCraft Technology Corporation is a leading AI-native cybersecurity software company from Taiwan and the only vendor in the country to have passed the U.S. MITRE ATT&CK evaluation three times and been named in Gartner cybersecurity research reports seven times.” | regulatory | 2026-06-28 |
| s2 | BusinessNext: CyCraft (7823) pre-IPO briefing, 2025 revenue NT$369M (translated from Chinese) “2025年全年度營收預估會來到新台幣3.69億元，年增23％，且第四季單季營收預估達1.17億元 (translation: 2025 full-year revenue is estimated at NT$369 million, up about 23 percent year over year, with fourth-quarter revenue of NT$117 million)” | press | 2026-06-28 |
| s3 | CommonWealth Magazine: Singapore Turns to Taiwan (Xecure Lab sale to Verint) “Xecure Lab, which at the time had paid-in capital of NT$2.95 million, was ultimately sold for 100 times that amount to Israel-based Verint in early 2014.” | press | 2026-06-28 |
| s4 | CommonWealth Magazine: Singapore Turns to Taiwan (named Taiwan customers) “Over the past six months, six Taiwanese financial institutions, including Bank of Taiwan, the Joint Credit Information Center, and Fubon Financial Holdings, have sought the help of CyCarrier, as has the IC design company that most prizes confidentiality, MediaTek.” | press | 2026-06-28 |
| s5 | Wired: Chinese Hackers Have Pillaged Taiwan's Semiconductor Industry “researchers from the Taiwanese cybersecurity firm CyCraft plan to present new details of a hacking campaign that compromised at least seven Taiwanese chip firms over the past two years ... CyCraft has previously given this group of hackers the name Chimera.” | press | 2026-06-28 |
| s6 | The Register: China's APT10 cyber-spies targeted Taiwanese financial firms (Operation Cache Panda) “China's state-sponsored snoops conducted a two-month campaign against Taiwanese financial services firms, according to CyCraft ... The cyber-spies installed backdoors using QuasarRAT ... the application targeted is used by 80 per cent of Taiwan's financial institutions.” | press | 2026-06-28 |
| s7 | CyCraft: XCockpit Threat Exposure Management Platform “Next-gen Threat Exposure Management Platform. Anticipate Attack Paths. Monitor for Warning Signs. Discern Security Vulnerabilities.” | official | 2026-06-28 |
| s8 | PR Newswire APAC: CyCraft Raised US$5.65M in Series B Funding (2019) “CyCraft, announced that it has closed US$5.65 million in Series B funding from Pavilion Capital and the CID Group ... In total, this round of funding brings CyCraft's total funding to date to US$8.15 million.” | press | 2026-06-28 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | TWSE Market Insights: New listed company CyCraft-KY (7823) “the only vendor in the country to have passed the U.S. MITRE ATT&CK evaluation three times ... deployed across hundreds of leading organizations spanning government, defense, financial services, semiconductors, and high-tech manufacturing, with more than 90% customer renewal rate.” | press | 2026-07-08 |
| s2 | Wired: Chinese Hackers Have Pillaged Taiwan's Semiconductor Industry “researchers from the Taiwanese cybersecurity firm CyCraft plan to present new details of a hacking campaign that compromised at least seven Taiwanese chip firms over the past two years.” | press | 2026-07-08 |
| s3 | The Register: China's APT10 cyber-spies targeted Taiwanese financial firms (Operation Cache Panda) “Operation Cache Panda went after software used by majority of industry players” | press | 2026-07-08 |
| s4 | CommonWealth Magazine: Singapore Turns to Taiwan (Xecure Lab sale to Verint) “Xecure Lab, which at the time had paid-in capital of NT$2.95 million, was ultimately sold for 100 times that amount to Israel-based Verint in early 2014.” | press | 2026-07-08 |
| s5 | CyCraft: XCockpit Threat Exposure Management Platform (EN homepage) “Analysis based on the context of the case and autonomous case management increases the productivity of your cybersecurity team and enhances cyber resilience.” | official | 2026-07-08 |
| s6 | CyCraft: About (leadership team and founder background) “曾於 2011 年與吳明蔚 (Benson Wu) 共同創立臺灣第一家專門研發 APT 防禦產品的新創公司艾斯酷博 (Xecure Lab)，並於 2014 年受到美國 NASDAQ 上市的以色列資安公司威瑞特 (Verint) 肯定與併購。” | official | 2026-07-08 |
| s7 | CyCraft: XecGuard, The LLM Firewall for Trustworthy, Agentic AI “XecGuard is a robust Guardrail API engineered to secure Large Language Models and AI Agents. XecGuard provide multi-layered defense, including Prompt Injection Protection.” | official | 2026-07-08 |
| s8 | CyCraft: Recognition and Awards (analyst mentions) “Recognized as an apex MDR service provider by a leading research organization for two consecutive years.” | official | 2026-07-08 |
| s9 | PR Newswire APAC: CyCraft Raised US$5.65M in Series B Funding (2019) “CyCraft also announced the formal launch of its AI-driven SecOps Platform which enables future-embracing security partners in Taiwan, Japan and Singapore to offer advanced MDR (managed detection and response) and AI-driven managed security services.” | press | 2026-07-08 |
| s10 | CyCraft: XCockpit Endpoint Security Posture Management “Monitor endpoint threats and AD privileged account activity, detect prevalent hacker attack techniques in real time, and identify any signs of an attack.” | official | 2026-07-08 |
| s11 | CyCraft: CyberTotal threat intelligence platform | official | 2026-07-08 |
| s12 | TWSE Market Insights: CyCraft SOC-as-a-Service delivery beyond software licensing “Beyond software licensing, CyCraft also delivers an AI-powered SOC-as-a-Service, automating the majority of monitoring and first-response tasks” | press | 2026-07-08 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Do not republish its content or share access without the operator's permission.