Thales

Security for AI Data SecurityApplication SecurityIdentity Access also known as Thales Cyber Security Products, Thales Cloud Protection and Licensing, Thales CPL

Market readinessHow well the company can compete in its security market, scored across eight dimensions against public evidence. Established: Market readiness of 25 to 30, the typical band where most analyzed companies land.
DefensibilityHow well the company holds its position if competitors catch up on features, scored across seven dimensions against public evidence. Defensible: Defensibility of 15 or above. A position that stays hard for rivals to replicate.
Founded 1968
Last updated 2026-09-24

All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.

Executive Summary

This analysis is scoped to Thales cyber security line.

In cyber security, Thales sells enterprises and governments CipherTrust software, which discovers and protects sensitive data, and Luna and payShield hardware security modules, devices that generate and store encryption keys. It also sells Imperva website and API protection, identity and access management, and an AI Security Fabric that blocks malicious prompts to AI applications. Founded as Thomson-CSF in 1968 and listed on Euronext Paris, Thales bought Imperva in 2023 for $3.6 billion. Its named customers include Sabre, Lunit and Availity. Thales says it has more than 6,000 cybersecurity experts. Because the modules store customer keys in certified hardware, that line is harder for cloud providers to displace than Imperva, which competes with their native security tools.

Sourced Details

Description The cyber security business of Thales Group sells data protection, hardware security modules, application and API security, and identity and access management, anchored by the CipherTrust Data Security Platform, Luna and payShield HSMs, and the Imperva portfolio. [f1]
Founded 1968 [f2]
HQ Meudon, France (Thales Group); cyber security products in San Jose, California [f3]
Subsidiaries Imperva (Acquired from Thoma Bravo (closed December 2023, $3.6B enterprise value) and merged into the Thales Cloud Protection and Licensing business line.)
Latest funding Publicly traded (Euronext Paris HO); acquired Imperva (closed Dec 2023) at a $3.6B enterprise value [f4]

Products

Product What it does
CipherTrust Data Security Platform A platform to discover, classify, encrypt, tokenize, and control access to sensitive data across cloud and on-premises stores, with centralized cryptographic key management.
Luna and payShield Hardware Security Modules Tamper-resistant hardware that generates and protects cryptographic keys as a root of trust, with general-purpose (Luna) and payment (payShield) lines built for FIPS and PCI DSS requirements.
Imperva Application and Data Security Web application firewall, DDoS protection, bot and API security, and the Data Security Fabric for monitoring and protecting data across databases and cloud stores.
AI Security Fabric Runtime security for LLM-powered and agentic AI applications, covering prompt injection, jailbreaking, model manipulation, and retrieval-augmented generation data exposure.
Identity and Access Management Workforce and customer identity and access management, including authentication, single sign-on, and access policy across cloud and on-premises applications.

Matrix Coverage

Cyber Defense Matrix

IdentifyProtectDetectRespondRecover
Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware.
Applications Software, interactions, and application flows on the devices.
Networks Connections and traffic flowing among devices and apps, plus communication paths.
Data Content at rest, in transit, or in use across devices, apps, and networks.
Users The people using the devices, apps, networks, and data.

CipherTrust and the Luna and payShield HSMs encrypt, tokenize, and key-protect sensitive data, the Imperva portfolio protects web applications, APIs, and databases, and the access management line governs user identities, defending the data, application, and user assets of the Cyber Defense Matrix. [f5]

AI Defense Matrix

GovernIdentifyProtectDetectRespondRecover
AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain.
AI Coding and Orchestration Tools AI coding tools and agentic orchestration tools on user devices, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients.
AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD.
AI Traffic Paths to external and self-hosted AI services, MCP tool channels, agent-to-agent calls, model-registry downloads, and egress to unapproved AI services. AI gateways, LLM routers, and MCP gateways steer traffic along those paths. The steering decisions and their inputs belong here too: routing policies, MCP server registries, and agent naming and discovery services.
AI Model Model weights, fine-tuning checkpoints, model cards, registries, an AI bill of materials (AIBOM), and the third-party LLMs your enterprise consumes.
Training Data Datasets used for training, fine-tuning, and continued learning.
Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history.
AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools.

The AI Security Fabric inspects prompts and responses of LLM applications at runtime and protects enterprise data before retrieval-augmented applications ingest it. These capabilities are mapped to the AI Defense Matrix. [f6]

Market Readiness

How well the company can compete in its security market, scored across eight dimensions against public evidence.

Established 27 /40 Established: Market readiness of 25 to 30, the typical band where most analyzed companies land.
Dimension Score Rationale
Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. 3/5 Thales names a clear buyer and problem: organizations protecting critical applications, data and identities, with HSMs sold to enterprises, financial institutions, governments and cloud providers (s1, s4). KuppingerCole independently puts breach costs at $4.88 million globally (s14), but that is one independent quantification rather than several, so the pain is credible and not yet corroborated across multiple non-vendor sources. [s1, s4, s14]
Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. 4/5 The line documents specific capabilities: CipherTrust unifies discovery, classification, protection and key management (s3), the HSMs keep keys inside FIPS-validated hardware (s4), and Imperva covers WAF, DDoS, bot and API protection (s8). External validation comes from NIST’s active FIPS 140-3 Level 3 certificate for the Luna K7 module (s17), KuppingerCole’s market-leader placement (s14), and Sabre’s CISO crediting Imperva with protection against attacks across its 4,000 sites (s26). KuppingerCole lists Thales beside IBM and Oracle. [s3, s4, s8, s14, s17, s26]
Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. 3/5 The one independent demand signal dated within the last twelve months is CRN Asia’s report that Singapore’s government released post-quantum readiness guidance (s28), a regulatory driver for the HSM line. The other demand evidence is in Thales’s voice: its survey that 73% of AI-using organizations invest in AI-specific security tools (s19), and an executive saying customers are budgeting for Luna 8 (s28). KuppingerCole’s data security analysis dates from March 2025 (s14), outside the last twelve months. [s14, s19, s28]
Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. 3/5 Named leaders run the line on the record, including Sebastien Cano as Senior Vice President of the cyber security products business, Todd Moore for data security products, and Tim Chang for Imperva Application Security (s5, s27, s18). SecurityWeek reported that Imperva had more than 1,400 employees (s12). The captured record describes current roles rather than prior builds or exits, and the 6,000-expert figure on Thales’s cyber site is not broken down by line (s1). [s1, s5, s12, s18, s27]
GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. 4/5 Several named customers speak on the record: Sabre runs Imperva Application Security across about 4,000 web services and APIs (s26), and Educational Foundation Freiburg and Lunit credit CipherTrust and Thales protection (s1). Thales also names Availity as a OneWelcome identity customer (s5) and shows partnership motion through Imperva for Google Cloud and a 2026 Google Cloud partner award (s18). The one independent scale figure is dated: SecurityWeek reported Imperva’s trailing-twelve-month revenue in 2022 at more than half a billion dollars (s12). [s1, s5, s12, s18, s26]
Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. 3/5 Thales launched Luna 8 as a network appliance (s27). An executive says its first units ship in December (s28). Thales’s first two AI Security Fabric products are available (s5), and Thales launched Imperva for Google Cloud (s18). Line economics are unconfirmed. The current sales figure AeroTime reports covers the whole Cyber & Digital segment, down 2.8% to 1.8 billion euros (s22), and the parent’s capital is context for the line. [s5, s18, s22, s27, s28]
Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. 4/5 Hardware security modules, data security platforms, web application and API protection, and access management are established categories buyers place without coaching. KuppingerCole independently names Thales among data security platform market leaders (s14), and Thales displays Gartner’s Visionary placement for access management and Omdia’s Leader placement for data security posture management (s1). Thales is one of several named leaders and does not define a category. [s1, s14]
Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. 3/5 The HSM line resists absorption: keys never leave FIPS-validated hardware (s4), and NIST lists an active FIPS 140-3 Level 3 certificate for the Luna K7 module (s17). The application lines face platform competition that Thales’s own Google Cloud launch names, framing native cloud security tools as the alternative buyers weigh (s18). Cloud providers could eventually overcome the barriers to replacing the line’s certified hardware. [s4, s17, s18]
Business Risks Cloud platforms could expand native web application and API protection, pressuring the Imperva lines that Thales now runs inside Google Cloud…
  • Cloud platforms could expand native web application and API protection, pressuring the Imperva lines that Thales now runs inside Google Cloud.
  • Cyber sales could stall if the second-quarter 2026 return to growth does not hold.
  • Luna 8 adoption could lag if its FIPS 140-3 Level 3 and Common Criteria assessments, still in progress at launch, take longer to complete.
  • The AI Security Fabric could stay a two-product first release if the planned 2026 additions, including an MCP security gateway, do not ship.
  • Luna 7 customers could delay moving to Luna 8, since a Thales executive says HSM migration testing typically takes weeks and months.
Problem & Market Thales sells cyber security to organizations that must protect critical applications, data, identities and the cryptographic keys behind them…

Thales sells cyber security to organizations that must protect critical applications, data, identities and the cryptographic keys behind them. Its hardware security modules are sold to enterprises, financial institutions, governments and cloud providers, and its payShield line targets payment card transactions.

The problem has independent weight. KuppingerCole describes data security platforms as increasingly critical for organizations protecting sensitive information across environments, and it puts breach costs at $4.88 million globally. Thales extends the same data buyer into AI with its AI Security Fabric, which protects LLM-powered applications and the enterprise data retrieval-augmented applications ingest. [s1, s4, s5, s14]

Product Capabilities The line spans data, keys, applications, identities and AI applications…

The line spans data, keys, applications, identities and AI applications. The CipherTrust Data Security Platform unifies discovery, classification, protection and key management, and the Luna and payShield HSMs keep keys inside tamper-resistant, FIPS-validated hardware. The Imperva portfolio covers web application firewall, DDoS, bot and API protection, and the OneWelcome Identity Platform and SafeNet Trusted Access handle authentication.

Two recent launches extend it. Luna 8 is a network appliance with a Thales-designed cryptographic processor. A Thales executive says its first units ship in December. Its FIPS 140-3 Level 3 and Common Criteria assessments were still in progress at launch. The AI Security Fabric’s first two products are AI Application Security, which screens prompts and responses at runtime, and AI RAG Security, which protects enterprise data before retrieval-augmented applications ingest it. [s3, s4, s5, s7, s8, s27, s28, s29]

Competitive Positioning Thales competes across several established categories at once…

Thales competes across several established categories at once. KuppingerCole names IBM, Oracle and Thales as market leaders in data security platforms. In hardware security modules, Entrust bought the nCipher HSM line that Thales divested in 2019 as a condition of its Gemalto purchase.

The application lines compete inside cloud platforms as well as against other vendors. Thales describes native cloud security tools as alternatives in its Imperva for Google Cloud launch announcement. Imperva inspects traffic in Google Cloud’s load-balancing path. Thales offers an enterprise secrets management solution powered by Akeyless. [s3, s14, s16, s18]

Go-to-Market & Traction Thales creates demand directly and sells largely through partners…

Thales creates demand directly and sells largely through partners. Andy Zollo, who leads application and data security, told CRN Asia that all go-to-market and sales run through the Thales partner ecosystem. Thales also launched Imperva for Google Cloud and won a 2026 Google Cloud partner award in the sovereign cloud category.

Named customers speak on the record across lines. Sabre, which hosts about 4,000 web services and APIs, uses Imperva Application Security, and its CISO credits Thales with protection against the attacks in that traffic. Educational Foundation Freiburg uses CipherTrust key management for Microsoft 365, Lunit credits Thales with protecting its AI technology, and Thales names Availity as a OneWelcome identity customer.

Neither available scale figure shows the line’s current size on its own. SecurityWeek reported that Imperva had more than half a billion dollars in trailing-twelve-month revenue in 2022 and over 1,400 employees. AeroTime reports that Thales’s Cyber & Digital segment sales fell 2.8% to 1.8 billion euros in the six months to June 2026, with cyber activities returning to growth in the second quarter. [s1, s5, s12, s18, s22, s26, s28]

Team & Credibility Named leaders run the line’s product groups…

Named leaders run the line’s product groups. Sebastien Cano is Senior Vice President of the cyber security products business, Todd Moore leads data security products, Andy Zollo leads application and data security, and Tim Chang is general manager of Imperva Application Security. Thales’s cyber site cites more than 6,000 cybersecurity experts, a figure it does not break down by product line.

The line was assembled through acquisition. Thales bought HSM vendor nCipher in 2008 and divested it to Entrust in 2019, bought Vormetric in 2016, and completed the Imperva purchase ahead of schedule, its second-largest acquisition after Gemalto. Thales runs the cyber line inside a group that generated 22.22 billion euros in 2025 revenue, 72 percent of it from military activities. [s1, s5, s8, s16, s18, s27, s28]

Trust Readiness Thales’s HSMs carry independent product validation…

Thales’s HSMs carry independent product validation. NIST lists an active FIPS 140-3 Level 3 certificate for the Thales Luna K7 Cryptographic Module, and Thales markets its HSMs for standards including FIPS, Common Criteria and PCI DSS. Its Data Protection on Demand service documentation states ISO 27001:2022 certification and a SOC 2 certification, with the ISO scope extended to its managed CipherTrust service.

Imperva’s record includes a disclosed breach and a disclosed flaw, both in products that customers route web traffic through. Krebs on Security reported in August 2019 that an Imperva breach exposed email addresses, scrambled passwords, API keys and SSL certificates for a subset of Cloud WAF users. Krebs quoted Rich Mogull, a founder of cloud security firm DisruptOps, saying that an attacker holding those API keys and certificates could undermine the security of traffic to and from a customer’s websites. NVD also records CVE-2023-50969, which let a crafted POST request bypass rules in the Imperva SecureSphere WAF 14.7.0.40. [s4, s15, s17, s20, s21]

Competitors Entrust, IBM, Oracle, Akeyless, Cloudflare…
Company Relationship Note Compare
Entrust competes with Sells hardware security modules, including the nCipher line Thales divested to it in 2019. N/AWe scored these companies at different scopes, so the totals measure different things.
IBM competes with Named with Thales among data security platform market leaders by KuppingerCole. N/AIBM is scored by product line, not as a whole company, so there is no company-wide column to compare. Open its profile to compare a specific product.
Oracle competes with Named with Thales among data security platform market leaders by KuppingerCole.
Akeyless adjacent Powers the CipherTrust Secrets Management offering Thales sells for enterprise secrets. N/AWe scored these companies at different scopes, so the totals measure different things.
Cloudflare competes with Competes for web application and API protection buyers with the Imperva line. N/AWe scored these companies at different scopes, so the totals measure different things.

Add analyzed competitors to compare them side by side with Thales.

Strategy Deep Dive

A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.

Defensibility

Defensible 15 /21 Defensible: Defensibility of 15 or above. A position that stays hard for rivals to replicate. press the advantage

Thales’s hardware security modules store the encryption keys of enterprises, financial institutions, governments and cloud providers inside tamper-resistant, FIPS-validated hardware. NIST lists an active FIPS 140-3 Level 3 certificate for the Luna K7 module, an independent record of that validation. Customer applications call on the modules to encrypt, sign and authenticate. Sabre uses Imperva, Thales’s web protection product, on the traffic across its 4,000 sites and to decide which bots may access them, which makes Imperva part of how those sites run. Imperva is more exposed to cloud providers than the hardware modules, because it competes with their native security tools, the alternative Thales describes in its Imperva for Google Cloud launch.

Dimension Score Rationale
Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. 1/3 Thales sells software and hardware the customer’s team operates and whose outcomes it owns: CipherTrust, the Luna and payShield HSMs, Imperva Application Security, and the identity services (s3, s4, s8). Luna Cloud HSM and CDSPaaS are hosted versions of the same products, which Thales runs as infrastructure while the customer keeps ownership of the outcomes (s4, s21).
Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. 2/3 Hardware key custody is documented: Thales markets FIPS-validated HSMs where keys never leave the secure boundary (s4). A Thales executive says migration testing for moves onto Luna 8 takes weeks and months (s28). The cited sources do not quantify migration away from Thales.
Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. 2/3 NIST lists an active FIPS 140-3 Level 3 certificate for the Luna K7 module (s17), and Thales markets its HSMs for FIPS, Common Criteria and PCI DSS requirements (s4). The validation attaches to the module rather than to a customer mandate, so replacing it takes material time and audit work but stays feasible, and no captured source shows a requirement that binds customers to Thales specifically.
Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. 3/3 The line combines hardware engineering, real-time systems and machine learning. Luna 8 runs on a Thales-designed cryptographic processor (s27), and the Luna K7 module holds a FIPS 140-3 Level 3 validation (s17). Imperva protects Sabre’s traffic across about 4,000 sites against attacks such as SQL injection (s26), AI Application Security analyzes every input and output in real time (s6), and CipherTrust uses machine learning to classify sensitive data (s3).
Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. 3/3 Thales builds and sells the line for regulated enterprises and governments: its HSMs are sold to enterprises, financial institutions, governments and cloud providers (s4), payShield targets payment card transactions (s4), and its identity pages address digital banking access (s7). Thales framed the Imperva purchase as expanding capabilities for enterprises and governments (s8).
Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. 3/3 Customers route traffic and cryptographic calls through several of the line’s components. Sabre’s CISO describes Imperva deciding which bots may access its sites (s26), and Krebs on Security reported in 2019 that Incapsula cloud WAF customers route all their website traffic through it (s20). Imperva for Google Cloud inspects traffic in the load-balancing path (s18), and HSMs perform the encryption, signing and authentication applications call on (s4). Customers depend on these components for traffic and cryptographic operations routed through them.
Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. 1/3 Thales cites 20,000 patents across the group (s8), a parent-level figure the cited record does not attribute to this line, and no captured source names a retained dataset or content licence the line accumulates. Imperva’s WAF policies are updated daily by a threat research team (s18). The cited sources do not describe how Thales accumulates this policy content or whether it retains content unavailable from public sources.
Strategic Market Segmentation Thales aims the line at regulated and large organizations that must protect applications, data, identities and cryptographic keys…

Thales aims the line at regulated and large organizations that must protect applications, data, identities and cryptographic keys. It sells its HSMs to enterprises, financial institutions, governments and cloud providers, points payShield at payment card transactions, and addresses digital banking access in its identity pages.

The AI Security Fabric extends the same buyer into AI. Its first release protects homegrown applications that use LLMs and the enterprise data that retrieval-augmented applications ingest, so a data protection team that already runs CipherTrust has a Thales option for AI pipelines.

Product Capabilities & AI Advantages The line covers data protection, cryptographic hardware, application protection and identity…

The line covers data protection, cryptographic hardware, application protection and identity. CipherTrust unifies data discovery, classification, protection and key management, the HSMs keep keys inside tamper-resistant hardware, the Imperva portfolio covers WAF, DDoS, bot and API protection, and OneWelcome and SafeNet Trusted Access handle authentication.

The AI Security Fabric is the AI-specific entry. AI Application Security screens prompts and responses for prompt injection, jailbreaking and system prompt leakage at runtime. AI RAG Security discovers and protects sensitive data before retrieval-augmented applications ingest it, using encryption and key management. Thales plans to add data leakage prevention, an MCP security gateway and runtime access control in 2026.

The AI entry builds on products Thales already sells. RAG Security uses encryption and key management, the functions CipherTrust centralizes, and Thales documents tokenization integrated with Amazon Bedrock Guardrails.

Sales Engagement & Go-to-Market Thales creates demand directly and sells largely through partners…

Thales creates demand directly and sells largely through partners. Andy Zollo, who leads application and data security, told CRN Asia that all go-to-market and sales run through the Thales partner ecosystem while Thales creates the demand. Thales also launched Imperva for Google Cloud and won a 2026 Google Cloud partner award in the sovereign cloud category.

Named customers speak on the record. Sabre uses Imperva Application Security across about 4,000 web services and APIs, Educational Foundation Freiburg uses CipherTrust key management for Microsoft 365, Lunit credits Thales with protecting its AI technology, and Thales names Availity as a OneWelcome customer.

The Imperva purchase added an established business. Thales agreed to buy Imperva from Thoma Bravo at a $3.6 billion enterprise value, and SecurityWeek reported Imperva’s 2022 revenue at more than half a billion dollars.

Pricing Model Thales’s product pages for CipherTrust, the HSMs, identity and Imperva Data Security Fabric state no prices, and Thales describes HSM cost in terms of drivers…

Thales’s product pages for CipherTrust, the HSMs, identity and Imperva Data Security Fabric state no prices, and Thales describes HSM cost in terms of drivers. Its HSM page lists deployment model, licensing, performance and capacity requirements, integration effort, scalability, staffing, support and ongoing administration as the factors that set the cost.

Thales offers some products as a service. Luna Cloud HSM and payShield Cloud HSM are available through its Data Protection on Demand marketplace, and CDSPaaS delivers CipherTrust capabilities as a fully managed, multi-tenant cloud service.

Product Delivery & Operations Thales delivers the line as appliances, software and hosted services…

Thales delivers the line as appliances, software and hosted services. Luna 8 is a network appliance, CipherTrust runs on premises and in the cloud, and Luna Cloud HSM, payShield Cloud HSM and CDSPaaS run as hosted services on Thales’s Data Protection on Demand platform.

Thales places several products in the operating path, so availability matters. Sabre’s CISO says the products protecting its application sites must stay available with the highest uptime possible, across about 4,000 web services and APIs it hosts for customers. Thales says Luna 8 uses the same interfaces as its predecessor, so existing customers can migrate without changing their applications.

Earning Customers' Trust Thales’s HSMs carry independent product validation…

Thales’s HSMs carry independent product validation. NIST lists an active FIPS 140-3 Level 3 certificate for the Thales Luna K7 Cryptographic Module, and Biometric Update reports that Luna 8 is undergoing FIPS 140-3 Level 3 and Common Criteria assessment. Thales markets its HSMs for FIPS, Common Criteria and PCI DSS requirements.

The hosted services document their own attestations. Thales’s Data Protection on Demand documentation states ISO 27001:2022 certification and a SOC 2 certification, with the ISO scope extended to IdCloud and CDSPaaS.

Imperva’s record includes a disclosed breach and a disclosed flaw, both in products that customers route web traffic through. Krebs on Security reported in August 2019 that an Imperva breach exposed email addresses, scrambled passwords, API keys and SSL certificates for a subset of Cloud WAF users. Krebs quoted Rich Mogull, a founder of cloud security firm DisruptOps, saying that an attacker holding those API keys and certificates could undermine the security of traffic to and from a customer’s websites. NVD also records CVE-2023-50969, which let a crafted POST request bypass rules in the Imperva SecureSphere WAF 14.7.0.40.

Platform Strategy & Ecosystem Positioning Thales pitches the line as one data-centric portfolio across applications, data and identities…

Thales pitches the line as one data-centric portfolio across applications, data and identities. Its Imperva completion announcement groups CipherTrust, Imperva Data Security Fabric and the Luna and payShield HSMs as data security, alongside application security and identity products.

The portfolio grew through repeated acquisitions. Imperva was Thales’s ninth acquisition in digital security over nine years and its second largest after Gemalto, and Thales bought Vormetric in 2016. Thales also works with platforms and other vendors directly, launching Imperva for Google Cloud and offering an enterprise secrets management solution powered by Akeyless.

Team & Execution Capability Named executives lead the line’s product groups…

Named executives lead the line’s product groups. Sebastien Cano is Senior Vice President of the cyber security products business, Todd Moore leads data security products, Andy Zollo leads application and data security, and Tim Chang is general manager of Imperva Application Security.

The cyber line is a unit inside a much larger group. Thales generated 22.22 billion euros in 2025 revenue, 72 percent from military activities, and reports cyber sales inside a Cyber & Digital segment. Thales’s cyber site cites more than 6,000 cybersecurity experts without breaking the figure down by line.

Sources

Company Detail Sources (6)
Id Source Tier Accessed
f1 Thales: About Thales cyber security products official 2026-09-23
f2 Wikipedia: Thales Group research 2026-09-23
f3 Les Petites Affiches: THALES, modification de l'adresse du siège social (legal notice, 2023-09-04) regulatory 2026-09-24
f4 Imperva press release: Thales to acquire Imperva from Thoma Bravo press 2026-06-21
f5 Thales: CipherTrust Data Security Platform product page official 2026-09-23
f6 AI Defense Matrix Catalog mapping other 2026-09-23
Profile Analysis Sources (23)
Id Source Tier Accessed
s1 Thales: About Thales cyber security products official 2026-09-23
s3 Thales: CipherTrust Data Security Platform product page official 2026-09-23
s4 Thales: Hardware security modules product page official 2026-09-23
s5 Thales newsroom: AI Security Fabric launch announcement official 2026-09-23
s6 Thales: AI Security Fabric product page official 2026-09-23
s7 Thales: Identity and access management product page official 2026-09-23
s8 Thales newsroom: Imperva acquisition completion announcement official 2026-09-23
s9 Imperva: Data Security Fabric product page official 2026-09-23
s12 SecurityWeek: Thales acquiring Imperva from Thoma Bravo press 2026-09-23
s13 SEC EDGAR: Imperva EX-99.1 on its agreement to be acquired by Thoma Bravo regulatory 2026-09-23
s14 KuppingerCole: Leadership Compass on Data Security Platforms research 2026-09-23
s15 NVD: CVE-2023-50969 record research 2026-09-23
s16 Wikipedia: Thales Group research 2026-09-23
s17 NIST CMVP: certificate 4684, Thales Luna K7 Cryptographic Module regulatory 2026-09-23
s18 Thales newsroom: Imperva for Google Cloud announcement official 2026-09-23
s19 SecurityBrief UK: Thales unveils AI Security Fabric for runtime threats press 2026-09-23
s20 Krebs on Security: Imperva breach disclosure press 2026-09-23
s21 Thales Docs: Data Protection on Demand platform FAQ official 2026-09-23
s22 AeroTime: Thales first-half 2026 results press 2026-09-23
s26 Thales: Sabre customer testimonial page official 2026-09-23
s27 Thales newsroom: Luna 8 hardware security module launch official 2026-09-23
s28 CRN Asia: Thales unveils Luna 8 press 2026-09-23
s29 Biometric Update: Thales launches Luna 8 press 2026-09-23
Deep-Dive Sources (23)
Id Source Tier Accessed
s1 Thales: About Thales cyber security products official 2026-09-23
s3 Thales: CipherTrust Data Security Platform product page official 2026-09-23
s4 Thales: Hardware security modules product page official 2026-09-23
s5 Thales newsroom: AI Security Fabric launch announcement official 2026-09-23
s6 Thales: AI Security Fabric product page official 2026-09-23
s7 Thales: Identity and access management product page official 2026-09-23
s8 Thales newsroom: Imperva acquisition completion announcement official 2026-09-23
s9 Imperva: Data Security Fabric product page official 2026-09-23
s12 SecurityWeek: Thales acquiring Imperva from Thoma Bravo press 2026-09-23
s13 SEC EDGAR: Imperva EX-99.1 on its agreement to be acquired by Thoma Bravo regulatory 2026-09-23
s14 KuppingerCole: Leadership Compass on Data Security Platforms research 2026-09-23
s15 NVD: CVE-2023-50969 record research 2026-09-23
s16 Wikipedia: Thales Group research 2026-09-23
s17 NIST CMVP: certificate 4684, Thales Luna K7 Cryptographic Module regulatory 2026-09-23
s18 Thales newsroom: Imperva for Google Cloud announcement official 2026-09-23
s19 SecurityBrief UK: Thales unveils AI Security Fabric for runtime threats press 2026-09-23
s20 Krebs on Security: Imperva breach disclosure press 2026-09-23
s21 Thales Docs: Data Protection on Demand platform FAQ official 2026-09-23
s22 AeroTime: Thales first-half 2026 results press 2026-09-23
s26 Thales: Sabre customer testimonial page official 2026-09-23
s27 Thales newsroom: Luna 8 hardware security module launch official 2026-09-23
s28 CRN Asia: Thales unveils Luna 8 press 2026-09-23
s29 Biometric Update: Thales launches Luna 8 press 2026-09-23

Disclaimer

This content is provided "as is" with no warranties.

This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.

The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.

Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.

The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.

To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.

Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.

Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.