All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
DTEX Systems sells InTERCEPT, software that records employee activity on work computers and scores it for signs of insider threats and data loss. Its customers are large enterprises and government agencies, which can also subscribe to its i3 investigation services. DTEX was founded in 2000. CapitalG, Alphabet's growth fund, led its $50 million Series E. DTEX is extending its monitoring to generative AI tools and AI agents in AI Risk Management, a private-preview product. InTERCEPT for Government has a FedRAMP Moderate authorization, the U.S. government's cloud security approval. An agency requiring that authorization would need an equally authorized product to replace DTEX.
| Description | DTEX Systems runs an endpoint behavioral intelligence platform that unifies insider risk management, risk-adaptive data loss prevention, user and entity behavior analytics, user activity monitoring, and AI activity oversight to surface human, data, and AI risk before it becomes a breach. | [f1] |
|---|---|---|
| Founded | 2000 | [f2] |
| HQ | Saratoga, California, US | [f3] |
| Funding | $138M total | [f4] |
| Latest funding | Series E, $50M (March 2024) | [f4] |
| Product | What it does |
|---|---|
| DTEX InTERCEPT | Endpoint behavioral intelligence platform consolidating insider risk management, risk-adaptive DLP, UEBA, and user activity monitoring, with a FedRAMP-authorized government variant. |
| DTEX AI Risk Management | Connects human behavior, AI activity, and data exposure at the endpoint to uncover shadow AI use and risky AI agent activity, offered as a private preview. |
| DTEX i3 Investigative Services | Insider Intelligence and Investigations services and threat research that help enterprises mature their insider risk programs and respond to incidents. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
DTEX collects endpoint behavioral telemetry to baseline workforce activity, score insider and AI-driven risk, surface anomalies early, and drive i3 investigations, while its risk-adaptive DLP enforces data controls. The company is mapped to the Cyber Defense Matrix. [f1]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | DTEX names security leaders and insider-risk programs as its buyers, and its government page ties the problem to federal rules for monitoring user activity on classified networks. DTEX promotes a sponsored report on insider-risk costs and a Forrester study on savings. The cited record contains no separate corroboration of the incident-cost estimates. [s6, s9, s1] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | DTEX documents its platform in detail. It correlates more than 500 metadata elements into one risk score (s2), pseudonymizes data that investigators can reverse when needed (s13), and buffers endpoint data for replay (s16). MITRE confirms a research collaboration with DTEX (s26), and DTEX reports GigaOm leader ratings (s8), but no independent technical evaluation of its detection appears in the cited sources. [s2, s13, s16, s26, s8] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | DTEX is extending its endpoint sensor to generative AI tools and AI agents, a credible enabler. AI Risk Management was a private preview in DTEX's June 2026 announcement, and its capability page still invites preview sign-ups. DTEX cites Gartner's warning about risks from AI-agent behavior on its homepage. Buyer demand for the preview product is plausible, though only indirectly evidenced in the cited sources. [s3, s16, s1] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | Forbes reported that Mohan Koo founded DTEX in Australia in 2000 to build endpoint security software for the Australian government (s24). CEO Marshall Heilman spent 17 years at Mandiant, most recently as Global CTO (s5), and CTO Rajan Koo is a named inventor on a DTEX patent (s29). That is experienced in-domain leadership, but the cited sources show no prior exit or independently recognized publication record. [s24, s5, s29] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 | The FedRAMP Marketplace lists DTEX InTERCEPT for Government as FedRAMP Certified with two authorization letters. DTEX says the Federal Trade Commission sponsored that authorization. DTEX also reports direct platform access for AWS customers and an agreement with Google Cloud, while SiliconANGLE relayed the company's 2024 account of an 800,000-device financial services deployment and a U.S. agency deal, naming neither customer. The growth figures are the company's own and its case studies describe customers by industry, which holds the score below the top. [s27, s18, s14, s17, s23, s12] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | DTEX closed a $50 million Series E to expand engineering and go-to-market (s22, s23), and it has since shipped products and earned FedRAMP certification (s14, s27). DTEX reports bookings growth, and SiliconANGLE relays a doubling of recurring revenue without specifics (s14, s23). Total funding figures conflict, $138 million per the company against $95.2 million per Tracxn (s22, s23). Forbes reported DTEX profitable in 2013 (s24), but no current revenue or margin confirms output per dollar. [s22, s23, s14, s27, s24] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 | SiliconANGLE calls DTEX an insider risk management company in its own voice and describes InTERCEPT as consolidating data loss prevention, user behavior analytics, and user activity monitoring, all established budget lines. DTEX's pages display GigaOm leader ratings in insider risk management and data loss prevention. Buyers can identify its product categories from those ratings. The cited record contains no independent confirmation that DTEX defines those categories. [s23, s8, s1] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | DTEX baselines behavior by role, department and geography (s2) and sends risk scores into customers' SIEM, SOAR and ticketing systems (s10, s11), which adds friction to replacing it. MITRE makes its Inside-R Protect research available under a non-exclusive licence (s26). DTEX holds FedRAMP certification and granted patents (s27, s29), but the cited sources show no data flywheel or workflow dependence that a bundled rival could not eventually replicate. [s2, s10, s11, s26, s27, s29] |
DTEX sells software that monitors workforce activity on endpoints to identify insider risk before an incident. Its pages address security leaders, and its why-DTEX page describes insider risk management and SOC teams running the product through SIEM-first workflows. The company promotes a sponsored report on insider-risk costs and a Forrester study on savings.
Government is a defined segment with its own rules. DTEX's government page cites the National Insider Threat Task Force and Committee on National Security Systems requirements for monitoring user activity on classified networks. The site's industry list also names critical infrastructure, financial services, pharma and life sciences, healthcare, and telecommunications.
DTEX now applies the same problem framing to generative AI and AI agents. Its AI Risk Management page invites sign-ups for a private preview that monitors AI prompts, unsanctioned AI tools, and agent activity alongside employee behavior. [s1, s6, s9, s3]
DTEX InTERCEPT is built on an endpoint forwarder and a behavioral analytics engine. DTEX says the forwarder collects activity on and off the network, gathers more than 500 metadata elements, and collects 3 to 5 megabytes of data per user per day. Its risk models score whether actions look malicious, non-malicious, or compromised.
The platform combines insider risk management, risk-adaptive data loss prevention, behavior analytics, and user activity monitoring. SiliconANGLE describes InTERCEPT as consolidating data loss prevention, user behavior analytics, and user activity monitoring into a single platform. DTEX's patented pseudonymization masks names and other identifiers in activity data, and Google Patents lists Dtex Systems as assignee of patents on anonymizing activity records and inferring document sensitivity.
AI coverage and agent features are the newest layer. DTEX says its sensor captures AI prompt content and intent on or off the network. AI Risk Management was a private preview in DTEX's June 2026 announcement, and DTEX describes its Deep Researcher agent as a private preview for select customers. Its multi-agent triage software gathers evidence on alerts and validates findings before passing risk to analysts.
Outside evaluation reaches readers mostly through DTEX's own pages. DTEX displays GigaOm leader ratings for insider risk management and data loss prevention. It also reports an AWS Security Competency it says followed technical validation of the platform architecture. [s2, s23, s1, s29, s30, s4, s3, s21, s8, s16]
DTEX positions one platform against separate data loss prevention, activity monitoring, and behavior analytics tools. Its why-DTEX page pitches consolidating multiple legacy DLP, UAM, AI security, and UEBA tools, and the Forrester Total Economic Impact study DTEX promotes reports $3.29 million in technology stack consolidation savings.
The federal authorization gives DTEX standing in government deals. DTEX InTERCEPT for Government is FedRAMP Certified at the Moderate class, which lets agencies that require that authorization buy it, and DTEX ties the product to federal user-activity-monitoring mandates.
The AI capabilities DTEX is adding are its least mature line. AI Risk Management was a private preview in DTEX's June 2026 announcement, so buyers comparing AI-usage controls meet DTEX at an earlier stage than its insider-risk products. [s6, s27, s9, s16, s3]
DTEX sells through a go-to-market organization and cloud partnerships, and to federal agencies under a FedRAMP authorization. DTEX reports direct access to its platform for AWS customers and an Enterprise Agreement with Google Cloud.
The federal listing is the traction signal a government record confirms. The FedRAMP Marketplace lists DTEX InTERCEPT for Government as FedRAMP Certified as of September 11, 2025, with two authorization letters. DTEX says the Federal Trade Commission sponsored that authorization.
DTEX's growth and deal figures are the company's own. It reports new annual contract value bookings up 101% and total contract value up 198% year over year. SiliconANGLE relayed the company's 2024 account of an unnamed financial services company covering more than 800,000 user devices and mission-critical servers and a multimillion-dollar U.S. agency deal, noting the company did not reveal more specifics. DTEX's case studies describe customers by industry, such as a global bank and a federal agency. [s19, s14, s17, s27, s18, s23, s12]
DTEX pairs its founders with a chief executive with experience as Mandiant's Global CTO. Forbes reported that Mohan Koo founded the company in Australia in 2000, and he remains President and Co-founder. CEO Marshall Heilman spent 17 years at Mandiant through its acquisition by Google, most recently as Global CTO, according to DTEX's leadership page.
Independent records show the technical and research bench. Google Patents lists CTO Rajan Koo as an inventor on DTEX's patents, and MITRE describes a research partnership with DTEX on insider-risk programs for Five Eyes critical infrastructure. CyberScoop reported in July 2026 on DTEX research into North Korea's IT worker scheme, led by investigator Michael Barnhart.
Advisers and investors add security and capital-market ties. DTEX says Kevin Mandia joined its advisory board, and SiliconANGLE reported that CapitalG partner James Luo would join the board with the 2024 round. [s24, s5, s29, s26, s25, s14, s23]
DTEX's government edition is FedRAMP Certified at the Moderate class. The FedRAMP Marketplace lists DTEX InTERCEPT for Government under package FR2410060106 as FedRAMP Certified on the agency path, with two authorization letters. DTEX says the Federal Trade Commission sponsored the authorization.
DTEX lists SOC 2 Type II and Australia's Infosec Registered Assessors Program on its government page and a DTEX Trust Center in its site footer. It is also a CVE Numbering Authority. The CVE Program lists DTEX as a CVE Numbering Authority whose scope covers all DTEX products, including its forwarders and analytics server.
Privacy controls are part of the product because it records employee activity. DTEX says its patented pseudonymization masks personal identifiers in activity data, and its privacy page says investigators can reverse that masking when an investigation escalates. [s27, s18, s9, s1, s28, s13]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Above Security | competes with | Competes for the same insider-risk program buyer. | |
| Microsoft | competes with | Competes for insider-risk budget in Microsoft 365 accounts, where DTEX also collects productivity data through an integration. | N/AMicrosoft is scored by product line, not as a whole company, so there is no company-wide column to compare. Open its profile to compare a specific product. |
| Proofpoint | competes with | Competes for insider-threat and information-protection budget in the same enterprise accounts. | |
| Teramind | competes with | Competes for the user-activity-monitoring end of the insider-risk market. |
Add analyzed competitors to compare them side by side with DTEX Systems.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
press the advantage
DTEX Systems sells endpoint software that monitors employee activity for insider risk, plus investigation services, to enterprises and government agencies. Its government edition is FedRAMP Certified at the Moderate class, so an agency that requires that authorization would need an equally authorized product to replace it. DTEX owns granted patents on masking identities in activity records and on judging how sensitive a document is. A customer that leaves would replace the software on its computers. A rival displacing DTEX would face its federal authorization, its patents, and the work of reinstalling software.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 2/3 | Most of what DTEX sells is software the customer's team operates. DTEX i3 adds investigators, threat hunting, and a dedicated-analyst option under subscription models, so code and investigative expertise blend in the offering. The software stays the core of the product, and no source shows DTEX accepting accountability for customer outcomes. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | A departing customer would replace forwarders across its endpointsand rewire the risk-score feeds DTEX sends to SIEM, SOAR, and ticketing tools. DTEX documents data retrieval from the platform through its integrations, so the record does not show how much history a customer would lose. Those costs are data history, integrations, and learned workflows. A federal customer whose agency requires that authorization would also need an equally authorized replacement. The switching mechanism is documented, and the cited record does not size the migration. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 2/3 | DTEX InTERCEPT for Government is FedRAMP Certified at the Moderate class with two authorization letters. A replacement would need the required authorization where procurement demands it. Obtaining it takes time but remains feasible. The SOC 2 Type II DTEX lists is an attestation competitors can obtain. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | DTEX collects more than 500 metadata elements from endpoints, scores intent with behavioral risk models, and masks identities with a patented method. Google Patents records DTEX patents on anonymizing activity records and inferring document sensitivity. Combining endpoint collection, machine learning, and privacy controls at enterprise scale takes years of specialized expertise. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | DTEX builds and sells for regulated enterprises and governments. Its government edition is FedRAMP Certified under an authorization a federal agency sponsored, and its government page addresses rules for monitoring user activity on classified networks. Its industry list names critical infrastructure, financial services, healthcare, and pharma and life sciences. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | DTEX is a platform that collects endpoint activity, scores it centrally, and sends risk scores to the customer's SIEM, SOAR, and ticketing tools, which makes it more than a single-use application. Its risk-adaptive data loss prevention adjusts policies on user activity, and the cited record shows no application whose requests depend on DTEX to proceed. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 | Google Patents lists Dtex Systems as assignee of granted patents on anonymizing activity records and on inferring document sensitivity, the method DTEX says underpins its risk-adaptive data loss prevention. That is intellectual property the record evidences and DTEX owns. The patents cover methods, and the record names no customer data DTEX pools across tenants, so the asset supports some advantage short of an irreplaceable one. |
DTEX targets large enterprises and government agencies that run insider-risk programs. Its site lists critical infrastructure, financial services, manufacturing, pharma and life sciences, healthcare, government, technology, and telecommunications as industries, and its why-DTEX page addresses security leaders.
Insider-risk program owners are a core buyer, and SOC teams also operate the product. DTEX's why-DTEX page describes insider risk management and SOC teams using it through SIEM-first workflows, so a purchase can involve both groups.
Federal agencies are a distinct segment. The FedRAMP Moderate certification for DTEX InTERCEPT for Government lets agencies that require that authorization buy it, and DTEX's government page ties the product to rules for monitoring user activity on classified networks.
AI governance is an expansion aimed at the same buyers, still at the preview stage. DTEX described AI Risk Management as a private preview in June 2026, and its capability page still invites preview sign-ups.
DTEX's core capability is behavioral analytics on endpoint telemetry. DTEX says its forwarder collects activity on and off the network and more than 500 metadata elements, and its risk models score intent across malicious, non-malicious, and compromised actions. The platform combines insider risk management, risk-adaptive data loss prevention, behavior analytics, and activity monitoring.
DTEX builds its AI features on the same endpoint sensor. Its shadow AI page says the sensor inspects AI usage at the endpoint, capturing prompt content and intent, and adds API integrations with Copilot, ChatGPT, and Gemini. Its multi-agent triage software gathers evidence on alerts and validates findings before analysts see them.
Outside evaluations reach readers through DTEX's own pages. DTEX displays GigaOm leader ratings for insider risk management and data loss prevention, and it reports a Forrester Total Economic Impact finding of 75% faster investigations. Google Patents independently records Dtex Systems as assignee of patents on anonymizing activity records and inferring document sensitivity.
DTEX sells through a go-to-market organization and cloud partnerships, and to federal agencies under a FedRAMP authorization. DTEX reports direct access to its platform for AWS customers and an Enterprise Agreement with Google Cloud.
DTEX offers its government edition to federal agencies under a FedRAMP authorization. The FedRAMP Marketplace lists DTEX InTERCEPT for Government with two authorization letters, and DTEX says the Federal Trade Commission sponsored its authorization in 2025.
Published threat research also brings DTEX in front of buyers. DTEX says its i3 team has given more than 100 intelligence briefings on North Korean threat groups, and CyberScoop covered a July 2026 DTEX report on how North Korea's IT worker scheme moves money.
DTEX's growth figures are the company's own. It reports new annual contract value bookings up 101% and total contract value up 198% year over year, and its case studies describe customers by industry, such as a global bank and a federal agency.
DTEX invites demo requests. No DTEX page in the reviewed sources lists a price, and the dtex.ai pricing address returns a page-not-found message. The site's navigation offers a demo request instead.
DTEX's value case is tool consolidation. The Forrester Total Economic Impact study DTEX promotes reports $3.29 million in technology stack consolidation savings and $705K in insider-risk efficiencies over three years. DTEX's why-DTEX page pitches replacing multiple legacy DLP, UAM, AI security, and UEBA tools.
DTEX delivers software the customer runs, built on endpoint forwarders and a central analytics platform. DTEX says the forwarders deploy in minutes, collect 3 to 5 megabytes of data per user per day, and give enterprise-wide visibility within a day of deployment.
DTEX designs privacy controls into its data collection. Its privacy page says minimizing collection and masking data is critical because privacy laws vary, and investigators can reverse its pseudonymization when an investigation escalates.
The i3 team adds human investigators to the software. DTEX describes i3 as insider threat intelligence, insider-risk services, and threat hunting, offers subscription models and a dedicated analyst, and quotes a customer who values its managed service model.
DTEX's government edition is FedRAMP Certified at the Moderate class. The FedRAMP Marketplace lists DTEX InTERCEPT for Government under package FR2410060106 as FedRAMP Certified on the agency path, with two authorization letters, and DTEX says the Federal Trade Commission sponsored it.
DTEX lists SOC 2 Type II and Australia's Infosec Registered Assessors Program on its government page and a DTEX Trust Center in its site footer.
DTEX is also a CVE Numbering Authority. The CVE Program lists DTEX in that role, with a scope covering all DTEX products, including its forwarders for Mac, Linux, and Windows.
DTEX exchanges data with the security and productivity tools enterprises already run. Its integrations page says DTEX sends aggregated risk scores to SIEM, SOAR, and ticketing systems and collects productivity data from Google Workspace and Microsoft 365. Its Splunk page says Splunk ingests DTEX data, including insider-threat indicators.
Cloud partnerships widen distribution. DTEX reports direct access to its platform for AWS customers, an AWS Security Competency in data protection, and an Enterprise Agreement with Google Cloud.
Research work ties DTEX to the insider-risk community. MITRE describes a non-exclusive licensing agreement under which MITRE and DTEX provide review and assessment services and research for Five Eyes critical infrastructure. DTEX's i3 research hub publishes threat advisories based on real-world investigations.
Forbes reported that Mohan Koo founded DTEX in Australia in 2000, and he remains President and Co-founder. CEO Marshall Heilman spent 17 years at Mandiant through its acquisition by Google, most recently as Global CTO, according to DTEX's leadership page.
CTO Rajan Koo has a record as both inventor and investigator. Google Patents lists him as an inventor on DTEX's document-sensitivity patent, and DTEX says he has led insider-threat investigations that ended in prosecutions and exonerations.
DTEX's investigators publish research that outside press covers. CyberScoop reported in July 2026 on DTEX research into North Korea's IT worker scheme, led by investigator Michael Barnhart, and MITRE describes a research partnership with DTEX. DTEX says Kevin Mandia joined its advisory board.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | DTEX Platform overview | official | 2026-06-21 |
| f2 | Forbes on the Dtex Systems Series A (February 25, 2015) | press | 2026-06-21 |
| f3 | DTEX company profile (Exa company research) | official | 2026-06-21 |
| f4 | Lot Fourteen on the DTEX $50M Series E (March 5, 2024) | press | 2026-06-21 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.