ReliaQuest

• GreyMatter works from telemetry produced by other vendors' tools, so an endpoint or identity vendor whose signal it reads can offer the same agentic layer inside a contract the customer already holds. ReliaQuest's own dark web collection, acquired with Digital Shadows, does not depend on those vendors.
• Every accuracy, coverage and volume figure ReliaQuest publishes for its agentic teammates is unverified in the reviewed sources, so a buyer evaluating the automation ReliaQuest charges for has only the company's own measurement of it.
• The revenue and customer figures behind a $3.4 billion valuation are published by ReliaQuest on its own pages, and no source outside the company in the reviewed record repeats or checks them.
• A lender's 2025 annual report lists ReliaQuest preferred stock it acquired in December 2023 accruing 16.60 percent in kind. That is one holder's position, and no other outside figure in the reviewed record speaks to what ReliaQuest's capital costs.

ReliaQuest sells into the alert queue. An enterprise security team runs tools from many vendors, each producing alerts, and the triage work that follows is what ReliaQuest argues automation should absorb. GreyMatter connects telemetry from across those technologies and takes the routine investigation off the queue.

The pain is credible and the figures attached to it measure ReliaQuest's own throughput. The company reports 78 million alerts a year investigated and resolved by its agentic teammates, and coverage of every alert across more than 300 technologies at 99.4 percent accuracy. No reviewed source outside the company sizes the underlying alert burden.

The buyer is a large enterprise with a fragmented stack rather than a small team buying its first control. A CyberScoop article names Southwest Airlines and Campbell Soup Company among the customers, ReliaQuest's own case studies name Donnelly Financial Solutions, Lowe's and Circle K, and its leadership pages put the base above 1,000 customers served from six operations centers. [s1, s2, s3, s4, s8]

GreyMatter is a layer over tools the customer already bought. It normalizes incoming data through what ReliaQuest calls a patented Universal Translator, looks for threats at the source rather than after data lands in a SIEM, and runs containment actions down to isolating a host, blocking an IP or banning a hash.

The AI is organized as personas rather than single-task bots. ReliaQuest describes six agentic personas using more than 200 agent skills and 400 AI tools, covering investigation and response, detection engineering, threat hunting, threat intelligence, IT engineering and operational technology engineering. It picks among AI models per task rather than committing to one vendor's model, and it says its own engineers keep quality control in the loop as the behavior is tuned.

Digital risk protection is the capability with its own collection behind it. GreyMatter DRP watches the open, deep and dark web, uncovering brand impersonation, data leaks and targeted attacks, and can drive takedowns of spoofed domains. ReliaQuest describes its wider intelligence as more than 50 feeds combined with its own collection systems and human-led research.

Every capability figure above comes from ReliaQuest. The reviewed sources carry no independent technical evaluation of GreyMatter, no public documentation site, and no third-party benchmark of the accuracy or coverage claims. [s2, s3, s4, s7, s13]

ReliaQuest competes on working through the customer's existing tools rather than replacing them. Its own pages also put GreyMatter against specific line items in the stack, saying it removes the cost of maintaining separate automation, orchestration and threat intelligence products and lets a customer skip the SIEM. What it sells is a subscription licence to the platform, priced per endpoint.

Its own category language and its analyst placement point at different markets. ReliaQuest markets GreyMatter as an agentic AI security operations platform, while the recognition it leads with is a Visionary placement in the 2026 Gartner Magic Quadrant for Cyberthreat Intelligence Technologies. Independent outlets place it more simply, a SecurityWeek article calling it a security operations vendor.

An acquisition sits behind the threat intelligence side. ReliaQuest announced a $160 million agreement to acquire Digital Shadows in June 2022, a deal a SecurityWeek article states adds contextual threat intelligence data to GreyMatter, and ReliaQuest's own sub-processor page now describes Digital Shadows as a ReliaQuest company. [s2, s5, s6, s7, s9, s17]

Named enterprise customers are the strongest part of the record. ReliaQuest publishes case studies for Donnelly Financial Solutions, Lowe's, Circle K and Southwest Airlines, each carrying a named security executive, and a CyberScoop article names Southwest Airlines and Campbell Soup Company.

The commercial motion is a platform sale with a structured trial in front of it. GreyMatter's core platform is priced per endpoint, with add-ons priced by mailboxes, employee count or data volume, and ReliaQuest runs proof-of-value engagements against success criteria agreed with the buyer beforehand.

Scale beyond the named accounts rests on ReliaQuest's own disclosure. Its leadership pages put 2025 revenue above $400 million with more than 1,000 customers and 1,200 staff across six operations centers, and no reviewed source outside the company corroborates any of those figures or reports a growth rate. [s1, s3, s6, s8]

A CyberScoop article records that Brian Murphy founded ReliaQuest in 2007, and ReliaQuest's own pages carry him as founder and chief executive today. Nineteen years running one security operations business is a long in-domain record, and the reviewed sources attach no earlier company build or exit to his name.

The bench beneath him is published in full. ReliaQuest's April 2023 release names Colin O'Connor as president of field operations and Brian Foster as president of product and technical operations leading the GreyMatter platform team, and its July 2019 release names a chief marketing officer and a vice president of engineering hired that year.

Outside bodies credit the research organization by name. A joint FBI and CISA advisory on LummaC2 records that ReliaQuest contributed to it, and a Register article records ReliaQuest researchers publishing on a threat group registering lookalike domains. Two credited appearances are a public signal rather than a sustained publication record. [s8, s3, s14, s15, s11, s10]

ReliaQuest's contractual commitments are the clearest trust evidence in the record. Its Platform and Support Agreement commits the company to an annual SOC 2 Type 2 attestation and to maintaining ISO/IEC 27001 certification, and gives the customer a right to request the report and the certificate at any time during the term.

The conventional trust endpoints are absent. A probe on 2026-09-04 of trust.reliaquest.com, security.reliaquest.com and a random control subdomain found none resolving, and /trust, /security and /compliance each returned 404, so the reader of that commitment reaches it through the agreement rather than through a portal at those addresses.

ReliaQuest was itself attacked in August 2026, and how it described the outcome is on the record. The Register reports the company saying a social engineering attack on 22 August was unsuccessful beyond temporarily exposing one identity, and that device trust controls stopped the attacker reaching applications or systems. The same article reports that SOCRadar found no validated data samples or evidence of customer impact, and that the attacker disputes ReliaQuest's account. The reviewed record does not settle the disagreement. [s5, s16, s10]

Add analyzed competitors to compare them side by side with ReliaQuest.

ReliaQuest sells to the large enterprise rather than the team buying its first control. Its named accounts are Donnelly Financial Solutions, Lowe's, Circle K and Southwest Airlines, and a CyberScoop article adds Campbell Soup Company, calling the group major enterprises.

The segment is defined by tool sprawl rather than by industry. GreyMatter's pitch is that it connects telemetry from across all of a customer's technologies, which only pays off where a customer already runs many products, and ReliaQuest markets it against multi-cloud and multi-SIEM environments.

ReliaQuest sizes the base itself, above 1,000 customers and more than $400 million of 2025 revenue, served from operations centers in Tampa, Las Vegas, Salt Lake City, Dublin, London and Pune. No reviewed source outside the company corroborates those figures.

GreyMatter's distinguishing move is where it looks rather than what it finds. It detects at the source instead of waiting for data to land in a SIEM, and it normalizes what arrives through a translation layer ReliaQuest describes as patented, which is what lets one investigation reason across products from different vendors.

The AI is structured as roles rather than tasks. ReliaQuest describes six agentic personas that use more than 200 agent skills and 400 AI tools, spanning investigation and response, detection engineering, threat hunting, threat intelligence, IT engineering and operational technology engineering. It selects among AI models per task rather than depending on one model vendor, and it says its own engineers keep human quality control in the tuning loop.

Threat intelligence is the capability with its own collection behind it. ReliaQuest describes more than 50 feeds across the deep, dark and open web, combined with proprietary collection systems and human-led research. It agreed to acquire Digital Shadows, a threat intelligence company, in June 2022 for $160 million, and now describes Digital Shadows as a ReliaQuest company.

What the reviewed sources cannot do is check any of it. The accuracy figure of 99.4 percent, the coverage of more than 300 technologies and the volume of 78 million alerts a year are ReliaQuest's own, and no independent technical evaluation or benchmark of GreyMatter appears in the record.

The go-to-market runs on named enterprise references. ReliaQuest publishes case studies for Donnelly Financial Solutions, Lowe's, Circle K and Southwest Airlines, each with a named security executive attached, which is the currency a large-enterprise buyer weighs most.

A structured trial sits in front of the purchase. ReliaQuest runs proof-of-value engagements with trial periods and success criteria agreed with the buying team before the engagement starts, which suits a platform whose value depends on how much of the customer's existing stack it can reach.

Corroboration of scale is thinner than the logos suggest. A CyberScoop article names Southwest Airlines and Campbell Soup Company, and the revenue, customer-count and headcount figures come from ReliaQuest's own leadership pages, which no reviewed source outside the company corroborates. One outside record touches the financing behind that motion: a Sixth Street Specialty Lending filing with the Securities and Exchange Commission lists ReliaQuest preferred stock acquired in December 2023 that accrues 16.60 percent in kind, which is one lender's position rather than the company's financing picture.

GreyMatter's core platform is priced per endpoint, which ties the bill to the size of the estate being watched rather than to how much data the customer sends. Add-on capabilities are priced on their own scope, by mailboxes for phishing analysis, by employee count for digital risk protection, and by data volume for the in-transit detection product.

The endpoint basis sits alongside the SIEM economics ReliaQuest sells against. The platform detects at source so that less data reaches the SIEM, and the core price does not move with that volume, though the in-transit product is priced by data volume.

No list price, tier or discount schedule appears in the reviewed sources, so the buyer learns the structure from ReliaQuest's own FAQ and the amount from a quote.

What ReliaQuest delivers is a platform the customer licenses, with its expertise built into how that platform behaves. The contract grants a subscription licence for the Order Term, the price is per endpoint, and the agentic teammates carry much of the routine investigation. ReliaQuest people are in the loop as well.

Human expertise enters at two points. ReliaQuest says active engineers and cyber experts continuously guide and refine AI behavior with guardrails, human quality control and feedback loops, and it describes the teammates as built on more than ten years of the company's own incident response data. Its Digital Shadows sub-processor page, current as of February 2023, also puts service delivery and security operations colleagues in the alert-triage path for those customers.

That places ReliaQuest between a pure software vendor and a managed service. The reviewed agreement carries no commitment to accept accountability for a customer's security outcome. What the record shows is a licensed platform with the company's own people working alongside it.

The reviewed public sources put the trust commitments in the agreement rather than on a portal. ReliaQuest's Platform and Support Agreement commits it to an annual SOC 2 Type 2 attestation and to maintaining ISO/IEC 27001 certification, and gives the customer the right to request the report and the certificate at any point in the term.

The conventional trust endpoints are absent. A probe on 2026-09-04 found that neither trust.reliaquest.com nor security.reliaquest.com resolves, that a random control subdomain does not resolve either, and that /trust, /security and /compliance each return 404, so the reader of that commitment reaches it through the agreement rather than through a portal at those addresses.

Its own August 2026 incident is the most concrete operational evidence in the record. A Register article records ReliaQuest saying a social engineering attack on 22 August was unsuccessful beyond temporarily exposing one identity, and that device trust controls kept the attacker out of applications and systems. The same article reports that SOCRadar found no validated data samples or evidence of customer impact, and that the attacker disputes ReliaQuest's account. The reviewed record does not settle the disagreement.

The ecosystem is the product's foundation rather than an extension of it. A CyberScoop article states that GreyMatter integrates with over 200 cybersecurity tools, and ReliaQuest's own pages put the agentic coverage at more than 300 technologies, which is what makes a single investigation possible across products bought from different vendors.

That breadth is also the dependency. The telemetry GreyMatter works from is produced by network, cloud and endpoint products other companies sell, so the platform's reach is bounded by what those vendors expose and by what the customer keeps paying them for.

One input comes from outside that dependency. ReliaQuest's dark web and digital risk collection watches the open, deep and dark web and drives takedowns of spoofed domains, and it runs that business having agreed in June 2022 to acquire Digital Shadows for $160 million, a company it now describes as its own.

A CyberScoop article records that Brian Murphy founded ReliaQuest in 2007, and ReliaQuest's own pages carry him as founder and chief executive today. Nineteen years leading one security operations business is unusual tenure, and the reviewed sources attach no earlier company build or exit to his name.

The named bench sits under him and is published in full. ReliaQuest's own pages carry bios for a chief technology officer with more than 30 years in information security, a president of field operations who joined as a sales intern in 2008, and a chief information officer who held the same role at ConnectWise. Its July 2019 release announced a chief marketing officer and a vice president of engineering hired that year, a month after GreyMatter itself was announced, and its April 2023 release moved the chief operating officer and the chief product officer into president roles.

Outside bodies credit the research organization by name. A joint FBI and CISA advisory on LummaC2 records that ReliaQuest contributed to it, and a Register article records ReliaQuest researchers publishing on a threat group registering lookalike domains.