Cyolo

• Claroty or another cyber-physical systems platform vendor could bundle secure remote access into platform renewals, collapsing the standalone purchase Cyolo depends on.
• Privileged access incumbents such as BeyondTrust already hold enterprise agreements with the same buyers, and could win Cyolo’s compliance-driven deals through those relationships.
• Cyolo has disclosed no capital raise since June 2022, so a flat extension, down round, or quiet sale would reveal that the claimed growth did not convert into financial strength.
• The growth metrics are vendor-stated, and public churn of a named anchor customer such as Tata Chemicals or Rapac Energy would undercut the traction story those accounts carry.
• TD SYNNEX distributes thousands of products, and a distributor shift toward a rival secure remote access vendor would cut the channel reach Cyolo’s go-to-market motion depends on.
• Buyers consolidating onto IT-side zero-trust platforms could fold OT access into enterprise agreements with vendors such as Zscaler, shrinking Cyolo’s addressable deals to fully air-gapped sites.

Cyolo sells visibility and control over remote connections into industrial environments. The buyers it names are OT and security teams who must let employees, third-party vendors, and OEMs reach critical systems without disrupting production. The homepage lists agentless third-party access, OEM support access, privileged access control, and regulatory compliance as the four jobs the product performs.

Independent coverage corroborates the demand. Industrial Cyber reported in February 2026 that industrial cybersecurity spending is shifting toward secure remote access. Cyolo’s own announcement that same month says Gartner published a Market Guide dedicated to CPS secure remote access and listed Cyolo among the Representative Vendors. The vendor also displays a series of Gartner recognitions across 2025 on its homepage.

Almog Apirion frames the problem as too much access rather than too little. In the company’s 2026 momentum announcement he argued that most industrial organizations already have remote access and now need to see and control what users do while connected. That framing matches the product’s emphasis on supervision, session recording, and approval workflows over pure connectivity. [s1, s17, s12, s6]

Cyolo PRO (Privileged Remote Operations) is the company’s product, a remote access platform built around OT constraints. The product page describes identity-based authentication, zero-trust connectivity, and oversight controls for OT and CPS environments, with deployment on-prem, air-gapped, or cloud-connected. The architecture has two components, an IDAC (ID Access Controller) that acts as the brain and a Gateway that customers place on-prem or in the cloud, and the decentralized design keeps credentials, keys, and policies inside the customer’s boundary.

Identity modernization for legacy systems is the distinctive capability claim. Cyolo states the product adds MFA, credential vaulting, and password rotation to systems that cannot support them natively, including end-of-life Windows machines and dated PLCs and HMIs, without infrastructure changes. The agentless model extends access to third-party vendors who decline to install software on personal devices.

Version 7.0 widens the product beyond access mediation into OT visibility. The 2026 release added session intelligence that turns recordings into searchable transcripts, passive OT asset and traffic discovery through a Fabric Controller that reads telemetry from existing switches, and consolidated dashboards. Industrial Cyber relays the same capability list, and the earlier Intelligent Supervision release announced per-session risk scoring and AI monitoring that would pause a suspicious session, capabilities the cited announcement states in future tense rather than as shipped.

Public depth stops at the marketing layer. Cyolo’s documentation portal redirects to a customer login, no public API reference or self-service tier exists, and the company promotes a SANS Institute product briefing rather than an independently initiated evaluation. Named case studies with concrete outcomes, including Rapac Energy and Tata Chemicals, provide the external validation instead. [s2, s7, s18, s8, s4, s1]

Cyolo positions against VPNs, jump boxes, and IT-centric remote access tools rather than against named rivals. Its homepage argues that access tooling built for IT disrupts OT operations, and its product page contrasts Cyolo PRO with legacy secure remote access on deployment flexibility, legacy-system identity support, and oversight controls.

The competitive field spans specialists and adjacent incumbents. Dispel and Xona sell secure remote access for OT and ICS directly. Claroty approaches the same industrial buyer with a broader cyber-physical systems platform, and privileged access incumbents such as BeyondTrust sell remote privileged access to the same enterprises from the IT side. Zero-trust access vendors such as Zscaler hold the corporate remote-access budget line, and some buyers fold OT access into it.

Cyolo’s visible differentiators are architectural. The decentralized model keeps secrets inside the customer’s boundary, the same software runs in air-gapped sites where cloud-routed access services cannot operate, and the identity retrofit reaches equipment PAM tools typically skip. None of this blocks a well-resourced incumbent, but together the constraints raise the engineering bar above a quarterly feature release. [s1, s2, s22, s23, s24]

Cyolo runs a channel-first go-to-market. The partners page states the company is built to work hand-in-hand with partners, and Cyolo called the TD SYNNEX distribution agreement the cornerstone of the Cyolo PRO launch, opening that distributor’s integrators, VARs, and MSSPs as a route to industrial buyers. Technology partnerships extend the reach, with Dragos co-positioning Cyolo PRO alongside its OT monitoring platform, an IBM QRadar integration that the technology-integrations page describes as correlating secure-access data with threat intelligence for OT and IT visibility, and an NVIDIA cybersecurity AI integration aimed at managed service providers.

Named customers span energy, water, manufacturing, and insurance. Rapac Energy, Tata Chemicals, Lillehammer Municipality, Italian manufacturer Maddalena, and PIB Insurance appear in published case studies, with concrete outcomes that include Maddalena cutting secure remote access costs by 70% and a smart-energy operator connecting over 2,000 users to more than 150 systems.

The growth numbers are the company’s own. Cyolo reported more than doubling its global customer base in 2025, a five-fold increase over two years, expansion accounting for 45% of 2025 growth, and an approximately 80% compound annual growth rate. Industrial Cyber relayed those figures without independent verification, and Cyolo discloses no revenue or customer count, so the traction story combines vendor-stated metrics with named case studies. [s5, s10, s9, s11, s25, s4, s6, s17]

Cyolo’s three co-founders are CEO Almog Apirion, CTO Dedi Yarkoni, and Chief Architect Eran Shmuely. Press coverage of the Series A identifies all three, and Almog describes himself as a recovering CISO who built the product he could not find as a buyer. SecurityWeek quotes the same founding story in its Series B coverage.

The executive layer extends well past the founders. The company page lists a chief strategy officer, a CFO, a chief customer officer, and vice presidents for global sales, marketing, R&D, product, customer success, and systems engineering, and the February 2026 announcement expanded the go-to-market roles of Joe O’Donnell, Asa Kedar, and Mark Edge.

Domain pedigree shows up in research more than in exits. A Cyolo security researcher is a named contributor to OWASP’s Non-Human Identities Top 10, and the company’s head of security research disclosed a Microsoft RDP Gateway vulnerability, CVE-2023-35332, through coordinated disclosure. No founder exit appears, and the disclosed work targets a third-party product rather than Cyolo PRO, so the record speaks to security-research craft rather than category-defining standing.

The investors and the public registry round out the picture. Glilot Capital led the Series A and National Grid’s venture arm led the Series B alongside Merlin Ventures, Flint Capital, and Differential Ventures, while CB Insights also lists IBM Ventures among the backers, a tie that matches the company’s IBM QRadar integration. The Israeli Corporations Authority records Cyolo Security Ltd as an active private company incorporated in January 2020. [s16, s3, s14, s6, s20, s15, s28, s29, s27, s26]

Cyolo’s trust pitch is architectural. The product page states that the decentralized design keeps all credentials, keys, policies, and other secrets inside the customer’s trusted boundaries at all times, which directly answers the vendor-compromise concern an inline access broker raises.

Public trust artifacts are missing. No trust center, SOC 2 attestation, ISO certification, or penetration test summary appears on the public site, while the footer does link a vulnerability disclosure policy, and the documentation portal requires a customer login. The footer also links a regulatory-compliance page that maps Cyolo capabilities to mandates its customers must meet, such as NIS2, IEC 62443, and ISO 27001, so compliance appears in the marketing as something the product helps customers achieve rather than something the vendor evidences about itself.

Cyolo still sells to compliance demand. The homepage names access control, supervision, session recording, and segmentation as requirements of industry and regional mandates that the product implements, which positions the company for regulated buyers whose audits ask for exactly those controls. [s2, s1, s30]

Add analyzed competitors to compare them side by side with Cyolo.

Cyolo targets industrial enterprises and critical infrastructure operators. The published customer set, under the names the case-studies page itself uses, includes Rapac Energy, Tata Chemicals, Lillehammer Municipality and its water and wastewater operations, Italian manufacturer Maddalena, and PIB Insurance, a roster that matches the company’s manufacturing-heavy messaging.

The sale runs through two personas at once. Cyolo pitches operations leaders on uptime and simplicity while pitching IT and security leaders on visibility, control, and zero-trust enforcement, a pairing the homepage compresses into built for OT, backed by IT. The featured Tata Chemicals testimonial comes from an IT manager who emphasizes session recording and manager-approval workflows for vendor access, which shows the oversight persona inside the buying group.

Reach is international for a company of this stage. Case studies span operators in several countries, the site localizes into German, Spanish, French, and Italian, and the TD SYNNEX distribution agreement is global. The cyolo.io navigation lists per-industry solution pages for Manufacturing, Energy & Utilities, and AI Data Centers, and whether those pages amount to vertical packaging or industry messaging stays open. No deal-size or segment signals are public.

The newest public proof of demand is current. The record-year announcement arrived in February 2026, the Gartner Market Guide naming Cyolo as a Representative Vendor carries a February 4, 2026 publication date, the v7.0 release followed within weeks, and the cited pages carry 2025 Gartner Hype Cycle mentions. A buyer checking for momentum finds evidence from the past two quarters rather than launch-era references.

Cyolo documents its capabilities at the feature level rather than the slogan level. The product page enumerates identity-based authentication with MFA for legacy systems, credential vaulting and password rotation, just-in-time access, supervised access, session recording, per-application policies with time and geo-location parameters, agentless third-party connections, and multi-tenant management across hundreds of sites.

Cyolo applies AI to the oversight burden its own product creates. Cyolo says Intelligent Supervision will score each remote session for risk and oversee sessions in progress, with the capability presented prospectively in the cited announcement, while the released v7.0 session intelligence converts recorded sessions into searchable transcripts so teams stop reviewing hours of footage. The announced NVIDIA integration points the same direction for managed service providers, with availability stated prospectively in the cited announcement. AI is a feature stack on a conventional access product here, and the supervised asset is the human or machine session rather than an AI system.

No proprietary data advantage is evidenced or claimed in the reviewed materials. The architecture keeps credentials, keys, and policies inside each customer’s boundary, which is the trust pitch, and no cross-customer dataset is shown to accumulate from it, though the session-risk metadata the product generates is the kind of signal a vendor could aggregate. Whether the new asset-discovery telemetry follows the same residency design is an inference the cited pages do not yet confirm.

External validation of the capability claims is thin. Industrial Cyber re-reports the vendor’s capability lists, and no independent benchmark, red-team result, or technical customer write-up appears in the public record. The case studies carry outcome claims, including a 70% cost reduction at Maddalena, but the vendor publishes those itself.

Cyolo describes itself as channel-first and structures launches accordingly. The TD SYNNEX agreement, which Cyolo called the cornerstone of the Cyolo PRO launch, opens a global distributor’s integrators, VARs, MSSPs, and carriers as a route to industrial buyers, and the CyoloVerse partner program frames technology alliances such as Dragos. The partners page recruits with revenue-expansion language and a named partner testimonial about removing VPN friction.

Technology alliances place Cyolo next to vendors the buyer already trusts. Dragos pairs Cyolo PRO with its OT network monitoring platform under a joint security-controls story, the technology-integrations page pairs Cyolo with IBM QRadar to correlate secure-access data with threat intelligence, and the NVIDIA cybersecurity AI integration, which Cyolo announced for global availability in Q2 2025, targets managed service providers. Each alliance is also a dependency, since none of these partners sells Cyolo exclusively.

The selling motion has moved past the founders. Mark Edge runs global sales, Joe O’Donnell holds the strategy and channel portfolio, and Asa Kedar owns customer success, with all three roles expanded in the February 2026 announcement while Almog Apirion still fronts the public narrative. For a company four years past its last disclosed raise, a hired go-to-market organization is stage-appropriate rather than premature, though undisclosed revenue means the ratio of sales capacity to repeatable proof cannot be checked.

Distribution breadth is partly evidenced. Cyolo lists AWS Marketplace, Azure Marketplace, Okta, and IBM Application Exchange entries, though it publishes no partner counts and the growth metrics that would prove channel productivity are vendor-stated. The visible reach, marketplace listings plus one global distributor and named alliances, is real but reproducible by a funded rival.

Cyolo publishes no pricing. Every product path on the site ends in a demo request, no packaging tiers appear, and the charging unit is undisclosed, so a buyer cannot tell whether Cyolo charges per user, per site, per application, or per connected asset.

The opacity is consistent with the motion. Channel-mediated enterprise deals into regulated industrial buyers are negotiated against downtime and compliance risk rather than metered consumption, and hidden price sheets usually accompany exactly that posture. Multi-tenancy, which lets one software instance serve multiple client organizations, suggests the economics also support service providers reselling access as a managed offering.

The open question is the unit. Sites and connected vendors look like the natural way to size this problem, and if buyers do size it that way, a vendor charging by some other unit invites procurement friction. Nothing public answers how Cyolo contracts scale across the hundreds of sites the product claims to span.

Deployment flexibility is the product’s central operational claim. Cyolo PRO deploys on-prem, fully offline, or cloud-connected from the same Docker-based software, with the IDAC controller and Gateway placed to fit the environment, and Cyolo states that no infrastructure changes are required. The agentless model removes software installation for third-party users.

Operational integration runs in both directions. Cyolo PRO connects inward to any identity provider and to OT switches for the new asset discovery, and outward to SIEM, SOAR, and ITSM platforms, with v7.0 adding consolidated dashboards for active sessions, identity sources, and approval workflows. Rapac Energy’s case study headline claims weeks of work saved securing OT and SCADA systems.

Inline delivery cuts both ways. Vendor connections run through Cyolo daily, so an outage interrupts remote operations rather than just degrading a detection layer, and the company’s uptime messaging acknowledges that bar. The reviewed public pages carry no SLA, no regional data-residency options, and no support-model detail, so operational depth cannot be inspected externally.

Cyolo’s strongest trust argument is what it never holds. The decentralized architecture keeps credentials, keys, policies, and other secrets inside the customer’s trusted boundaries at all times, so a compromise of Cyolo exposes less than a compromise of a cloud-routed access broker would. For industrial buyers wary of vendor-side incidents, that is a procurement-relevant property.

Compliance evidence about Cyolo’s own posture is thinner than the supervision it sells. The reviewed pages surface a vulnerability disclosure policy and a regulatory-compliance page, yet no public trust center, no SOC 2 or ISO attestation, and no penetration test summary appear, a notable gap for a vendor selling supervision and auditability to regulated buyers. The regulatory-compliance page maps Cyolo capabilities to mandates its customers must meet, such as NIS2, IEC 62443, and ISO 27001, which is framework-alignment marketing for customers rather than an attestation of Cyolo’s own controls. Procurement teams may receive attestations privately, but the public record leaves that question open.

Compliance is sold as a customer outcome rather than evidenced as a vendor posture. The homepage markets access control, supervision, session recording, and segmentation as mandate requirements the product implements for customers, while the company publishes no equivalent evidence about its own operations.

Cyolo now markets a Secure Connectivity Platform spanning remote access, microsegmentation, and asset discovery, an expanding OT suite that still completes other vendors’ stacks rather than serving as a platform others build on. Integrations run inward to identity providers and OT switches and outward to SIEM, SOAR, and ITSM tooling, and the Dragos pairing slots Cyolo into the access layer of a broader OT security architecture.

Buyers can encounter Cyolo without meeting a Cyolo seller. TD SYNNEX puts the product in front of thousands of integrators, VARs, MSSPs, and carriers, Dragos co-positions it inside critical infrastructure accounts, and the announced NVIDIA integration aims at managed service providers building OT security offerings. That is genuine indirect distribution, though Cyolo publishes no integration or partner counts, and a funded rival could sign comparable agreements.

Version 7.0 pushes into adjacent territory. Passive asset and traffic discovery overlaps the visibility product of partner Dragos, which converts the access product into a beachhead for broader OT security spend and simultaneously strains the partnerships the channel motion depends on.

Cyolo’s founding trio pairs a former CISO with technical co-founders. CEO Almog Apirion is a former CISO who says he started the company after failing to find a remote-access product that met his standards as a buyer, and co-founders Dedi Yarkoni and Eran Shmuely hold the CTO and chief architect roles. All three remain in post six years after founding.

The leadership bench is broad for a private company of this size. Beyond the founders, the company page names a chief strategy officer, a CFO, a chief customer officer, and vice presidents for global sales, marketing, R&D, product, customer success, human resources, and global systems engineering, thirteen named leaders in all. The February 2026 announcement expanded the go-to-market remits of Joe O’Donnell, Asa Kedar, and Mark Edge.

The investor table doubles as a go-to-market asset. National Grid Partners, the venture arm of a major energy utility, led the Series B, Glilot Capital led the Series A through its early-growth fund, and Merlin Ventures, a cybersecurity investor, holds Cyolo in its portfolio. Strategic money from an energy operator aligns the cap table with the critical-infrastructure buyer Cyolo sells to.

Headcount and seniority below the named layer stay undisclosed. The last public employee figure is 27 at the 2021 Series A, no current engineering or sales headcount appears in the record, and the reviewed sources do not show a prior founder exit, so execution capacity beyond the named roster is an open question.