All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
ThreatSTOP sells DNS Defense and IP Defense, services that block traffic to malicious domains and addresses on firewalls, routers and DNS servers customers already run. Founded in 2009 for smaller organizations, it gained traction chiefly in higher education and healthcare, according to founder Tom Byrnes. ThreatSTOP names Geisinger, the University of Baltimore, Armor, TopCashBack and Phoenix Energy among its customers. SEC filings record a $4,750,000 equity raise from six investors in 2015. Its chief scientist is Paul Mockapetris, who proposed the Domain Name System in 1983. Some buyers can get the same class of control for free, such as federal civilian agencies through CISA's protective DNS service.
| Description | ThreatSTOP sells protective DNS and IP blocking that turns curated threat intelligence into block policy enforced on the firewalls, routers and DNS servers customers already run, plus a cloud DNS resolver. | [f1] |
|---|---|---|
| Founded | 2009 | [f2] |
| HQ | Carlsbad, United States | [f3] |
| Latest funding | $4.75M equity offering (first sale February 2015) | [f4] |
| Product | What it does |
|---|---|
| DNS Defense | Protective DNS that turns a customer's own DNS server, such as BIND, Windows DNS or Infoblox, into a checkpoint that blocks lookups of malicious domains. |
| DNS Defense Cloud | Cloud DNS resolver that checks and filters lookups for roaming users and remote sites, with nothing to install on premises. |
| IP Defense | Cloud service that pushes curated IP block and allow policy to existing firewalls, routers, switches, load balancers and intrusion prevention systems. |
| ThreatSTOP for AWS | Managed rules and DNS filtering for AWS WAF, Amazon Route 53 and AWS Network Firewall, deployed from AWS Marketplace. |
| ThreatSTOP OFAC and Sanctions | Blocks connections to and from sanctioned countries, embargoed regions and listed entities at the DNS and IP layers, using FiveBy sanctions intelligence. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
DNS Defense, DNS Defense Cloud and IP Defense block connections to malicious domains and IP addresses on customers' resolvers, firewalls and routers, and their reporting records what was blocked and where. Mapped to the Cyber Defense Matrix. [f5]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | ThreatSTOP names its buyer and problem plainly. It sells to organizations that want malicious connections stopped on gear they already run. Founder Tom Byrnes named education and healthcare as the strongest verticals in a 2021 interview. CISA runs its own protective DNS service, so a federal agency treats DNS-layer blocking as a real control. The pain figures on ThreatSTOP's pages are the company's own, and no reviewed source quantifies the problem independently, which keeps the pain vendor-asserted. [s1, s9, s28, s29] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | The documentation hub gives setup guides for a long list of named firewalls, routers and DNS servers. The product pages explain how curated intelligence becomes policy on each enforcement point. Granted patents cover the method of distributing network policy through DNS. Outside the company's pages, the reviewed sources document granted patents and Quad9 drawing on ThreatSTOP feeds in 2018. Neither evaluates the enforcement products, so the next rung's outside validation point is missing. [s2, s3, s4, s5, s17, s23, s26, s27] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | Protective DNS is an established control with a government precedent. CISA launched a protective DNS resolver for federal civilian agencies in 2022 under a congressional mandate for intrusion prevention. CISA offers it at no cost to those agencies. That regulatory signal dates from 2022. No reviewed source documents a buyer-side demand signal from the last year, such as RFP language, budget lines or analyst notes, so the score stays at the plausible-timing rung. [s29, s19, s18] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 4/5 | Independent records support more than one in-domain build. Wikipedia records that chief scientist Paul Mockapetris proposed the Domain Name System architecture in 1983. A ThreatSTOP patent granted in 2024 lists him among its inventors. Patent records list founder Tom Byrnes as inventor of the company's method for distributing network policy through DNS. ISMG's 2015 profile documents his earlier role as chief technology officer of the hosting company ADNC.com. Joel Esler's founding role at Cisco Talos appears only on the company's page, so it adds no independent weight. [s9, s23, s24, s25, s30] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 | ThreatSTOP names five customers on its case-study page, two with named staff quoting results, and sells through AWS Marketplace and through MSP and OEM partner programs. Two independent 2018 records, an Internet Society post and a Quad9 press release, list ThreatSTOP among the threat intelligence partners feeding Quad9's public resolver. The customer stories are ThreatSTOP's own publication, and no reviewed source reports its revenue or customer count, so scale is not independently established. [s10, s6, s12, s13, s26, s27] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | SEC filings record one equity offering, $4,750,000 sold to six investors with a first sale in February 2015. Byrnes told Safety Detectives that a Department of Homeland Security grant funded the company's start. ThreatSTOP has kept shipping since, releasing DNS Defense Cloud in May 2022 and posting detection updates in February 2026. No revenue, margin or growth figure appears in the reviewed sources, so the raise looks proportionate while efficiency itself stays unconfirmed. [s21, s22, s28, s19, s18] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | Protective DNS is a recognizable category, and CISA uses the term for its own federal service. The outside records in the review place ThreatSTOP as a threat intelligence supplier to Quad9's resolver, while ThreatSTOP's own pages sell protective DNS and IP blocking. No analyst or buyer source in the review places ThreatSTOP's products in the protective DNS category, so placement still depends on the company's explanation. [s29, s26, s27, s3] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Some buyers can already get this class of control from a public service. CISA filters DNS for federal civilian agencies at no cost, and Quad9 runs a public resolver that draws on many threat feeds. ThreatSTOP's friction against absorption is its long list of documented device integrations, the categories its research team maintains, and its patents on distributing policy through DNS. None of that is a structural moat that a platform vendor's bundling could not eventually match. [s29, s26, s17, s18, s23] |
ThreatSTOP sells to organizations that want malicious connections stopped on network gear they already own. On its homepage, ThreatSTOP tells buyers to deploy ThreatSTOP to their existing firewalls and name servers, with continuous updates to keep pace with new attacks. DNS Defense blocks lookups of malicious domains on the customer's own DNS server, and IP Defense pushes block policy to firewalls, routers and switches.
On its about page, ThreatSTOP says Tom Byrnes founded the company in 2009 to give smaller companies the protection Fortune 1000 companies have. In a 2021 Safety Detectives interview, Byrnes said the company found most traction in third-level education and healthcare.
Protective DNS also has a government version. CISA launched a Protective DNS Resolver service in 2022 that blocks, redirects or sinkholes queries matching threat indicators. CISA offers it at no cost to participating federal civilian agencies and pilot organizations, so those buyers can get DNS-layer blocking without a purchase. [s1, s3, s5, s9, s28, s29]
ThreatSTOP's products share one engine that collects threat data, sorts it into categories and pushes policy to enforcement points. On its platform page, ThreatSTOP says the engine pulls threat data from hundreds of sources. Customers build policy by threat category and add their own allow and block lists. DNS Defense applies that policy on resolvers such as BIND, Windows DNS and Infoblox. DNS Defense Cloud filters lookups at a ThreatSTOP cloud resolver for roaming users and remote sites. IP Defense updates firewalls, routers, switches, load balancers and intrusion prevention systems.
The documentation hub lists the integrations device by device. It covers firewalls such as Check Point, Cisco ASA, Fortigate, Juniper SRX and Palo Alto Networks. It also covers resolvers such as Infoblox NIOS, Windows DNS Server and PowerDNS, and Azure deployments. ThreatSTOP for AWS publishes managed rules into AWS WAF, filters Amazon Route 53 resolution and protects AWS Network Firewall. A sanctions product blocks connections to and from sanctioned countries and listed entities using FiveBy sanctions intelligence.
The research team publishes its detection changes. A February 2026 post by Joel Esler describes detection logic built on SSL and TLS certificate hashes, which links malicious infrastructure even when domains and addresses change. [s2, s3, s4, s5, s6, s7, s17, s18]
ThreatSTOP positions its products around the network equipment customers already own. Byrnes told Safety Detectives that the big difference from other vendors is that customers install no software on the device. Its product pages repeat the point, stressing the customer's existing resolvers and firewalls.
Some buyers can get the same class of protection from public resolvers. CISA's Protective DNS Resolver serves federal civilian agencies at no cost. Quad9, a public resolver that IBM, Packet Clearing House and the Global Cyber Alliance launched, draws on many threat feeds. A 2018 Internet Society post lists ThreatSTOP among Quad9's 12 publicly listed threat intelligence partners, and Quad9's own release lists it among 19 feed partners.
In 2018, ThreatSTOP supplied intelligence to Quad9's public resolver. ThreatSTOP's partner page still lists Quad9 among the vendors and providers it works with. [s1, s3, s12, s26, s27, s28, s29]
ThreatSTOP names its customers on its case-study page, where the company says every story comes from a real customer. Geisinger, the University of Baltimore, Armor, Phoenix Energy and TopCashBack each appear with a story. Two carry named staff quotes. Rich Quinlan of Geisinger said ThreatSTOP caught the most threats. Mike Connors of the University of Baltimore credited it with a 90% cut in malware help-desk tickets.
The company sells directly, through partners and through AWS Marketplace. It publishes prices, from $1.50 per user per month for DNS Defense to $499 per month for IP Defense covering up to 200 users. An MSP program lets service providers resell protective DNS under their own brand, and an OEM program targets DDI, networking and carrier vendors. Through Community Edition, ThreatSTOP gives individuals and small teams protective DNS for free.
Two 2018 records list ThreatSTOP as a Quad9 threat intelligence partner, and no reviewed source reports ThreatSTOP's revenue or customer count. [s6, s8, s10, s12, s13, s14, s26, s27]
Founder and chief executive Tom Byrnes invented the DNS-based policy method. Patent records list him as inventor of a reissued ThreatSTOP patent on propagating network policy, granted in July 2024 and listed as active. ISMG's 2015 profile lists his earlier roles, including the US Army Signal Corps, Radware and chief technology officer of the hosting company ADNC.com.
ThreatSTOP's leaders include the designer of DNS and veterans of threat research. Wikipedia records that Paul Mockapetris proposed the Domain Name System architecture in 1983 and is chief scientist at ThreatSTOP. A ThreatSTOP patent granted in 2024 lists him among its inventors. On its about page, ThreatSTOP names Joel Esler, a founding member of Cisco Talos, as vice president for security, intelligence and research since 2023. Tom Bennett appears as a director on the 2015 Form D, and the company says he also sits on the Dragos board. [s9, s21, s23, s24, s25, s30]
ThreatSTOP's public trust material includes legal documents. ThreatSTOP, Inc. is the contracting party in its end user service agreement, and its privacy policy requires customers to submit firewall logs, which the company uses to measure performance and improve its services. No SOC 2 report, ISO certificate or trust portal appears on the probed surfaces.
ThreatSTOP pitches its sanctions product to compliance teams. The company says the product records what was blocked and when, in reports customers can hand to auditors. SEC filings record ThreatSTOP, Inc. as a Delaware corporation based in Carlsbad, California. [s7, s15, s16, s20, s21, s22]
| Company | Relationship | Note |
|---|---|---|
| CISA Protective DNS | adjacent | CISA runs a protective DNS resolver for federal civilian agencies at no cost, which is the same class of DNS-layer blocking ThreatSTOP sells. |
| Quad9 | adjacent | Quad9 runs a public DNS resolver that listed ThreatSTOP among its threat intelligence partners in 2018. ThreatSTOP's partner page still lists Quad9. |
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
press the advantage
Organizations that send DNS lookups to DNS Defense Cloud, ThreatSTOP's cloud lookup service, rely on ThreatSTOP to check each one before they connect to a site. ThreatSTOP's research team publishes its detection changes, such as one that links malicious servers through their encryption certificates when their domains change. ThreatSTOP received two US patents in 2024, one covering how it ranks network addresses and distributes them through DNS. It also requires customers to submit firewall logs, which it uses to improve its service. A departing customer keeps its firewalls and DNS servers but must replace ThreatSTOP's threat data and move its own allow and block lists.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 2/3 | Customers pay for intelligence that ThreatSTOP's people curate into policy as well as for the software that delivers it. On its platform page, ThreatSTOP says people and machines sort and enrich threat data into categories. The research team's posts describe detection changes the team made. Code and expertise blend, while the customer's team still sets policy and owns the outcome. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Leaving costs integration work. Customers build policies by threat category with their own allow and block lists and wire ThreatSTOP into resolvers and firewalls through documented integrations. Replacing it means repointing those devices at another intelligence source or resolver and moving the lists, and the cited record does not size that migration. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | No attestation appears on the probed surfaces, and the reviewed sources document no certification, authorization or retained liability a buyer would have to re-satisfy to replace ThreatSTOP. The sanctions product gives customers reports for their own audits, and nothing in the record ties that obligation to ThreatSTOP specifically. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 2/3 | ThreatSTOP describes people and machines sorting threat data into categories and pushing one policy to the DNS servers, firewalls and routers customers run. Its patent ranks addresses by a weighted count of how often they appear across sources, and it added detection logic using SSL and TLS certificate hashes. Those are filtering, correlation and policy distribution with moderate algorithmic depth, not work shown to need years of specialized expertise to reproduce. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | ThreatSTOP names Geisinger Health System on its customer-stories page, where a proof of concept found a clinical ultrasound machine beaconing to a command-and-control server, and Tom Byrnes told BankInfoSecurity its customers include financial services companies, hospitals and third-level education. Both are vendor accounts. ThreatSTOP also prices for SMBs and the mid-market, but establishing regulated-enterprise buyers suffices for this rung. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 3/3 | DNS Defense Cloud is a resolver customers point their DNS at, so lookups routed through it resolve only after ThreatSTOP checks them. Applications on those networks depend on that resolution to connect. DNS Defense and IP Defense push block policy that customers' own resolvers and firewalls enforce on live traffic. The dependence claim covers only the lookups and traffic routed through those components. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 | ThreatSTOP holds a reissued patent on its DNS-based policy method granted in 2024 and listed as active. A second 2024 patent lists Paul Mockapetris among its inventors. Its privacy policy requires customers to submit firewall logs, which the company uses to improve its services, so ThreatSTOP accumulates customer logs to improve its own services. No reviewed source supports a claim that a rival could not recreate either asset, so the score stays at the middle rung. |
ThreatSTOP aims at smaller organizations. On its about page, ThreatSTOP says Tom Byrnes founded the company to bring Fortune 1000 protection to smaller companies. The company publishes solution pages for healthcare, education, MSPs, enterprises and small businesses. Byrnes told Safety Detectives in 2021 that third-level education and healthcare produced the most traction.
The named customers follow that pattern. They include Geisinger, a health system, the University of Baltimore, the hosting provider Armor, the cashback site TopCashBack and Phoenix Energy, a single-location business. ThreatSTOP offers free protective DNS through Community Edition to individuals and small teams, and an MSP program serves providers that protect many clients from one console.
Some of those buyers can get DNS-layer blocking for free. CISA offers its Protective DNS Resolver at no cost to participating federal civilian agencies and pilot organizations, so for those buyers a government service covers the same class of control.
ThreatSTOP's core capability is turning many threat feeds into enforceable policy. The platform pulls data from hundreds of sources, and people and machines sort it into threat categories. Customers choose categories and add their own allow and block lists. ThreatSTOP then pushes the resulting policy to resolvers, firewalls, routers and cloud services, which block matching connections.
The company names AI as part of its curation. On its homepage, ThreatSTOP says machines and human analysts curate threat data into enforcement policy, and argues that defenders need AI against attackers who have it. The research posts describe concrete detection work, such as linking malicious infrastructure through certificate hashes and hash-based analysis of phishing login images. No reviewed source evaluates how well those detections perform, so every reviewed account of their effect comes from the company itself.
ThreatSTOP sells through several routes at once. Buyers can start a free trial from the pricing page, subscribe to the AWS products in AWS Marketplace, or buy through channel, OEMand MSP partners. On its partner page, ThreatSTOP says the OEM program is designed to integrate into DDI, networking and carrier vendor offerings, including white-label integration.
ThreatSTOP has also supplied intelligence to others. Quad9 listed ThreatSTOP among its threat intelligence partners in 2018, according to both an Internet Society post and Quad9's own release. ThreatSTOP's partner page still lists Quad9 alongside A10 Networks, CrowdStrike and Palo Alto Networks.
ThreatSTOP publishes its prices. DNS Defense lists at $1.50 per user per month, and DNS Defense Cloud starts as low as $1 per month. IP Defense costs $499 per month for up to 200 users. FirstSTOP, which the company positions for incident response, costs $400 per month. On its pricing page, ThreatSTOP states that every plan starts with a free trial and that annual subscriptions cost less.
Through Community Edition, ThreatSTOP gives individuals and small teams protective DNS at no cost, and the company says it uses the same intelligence as the paid plans. The free tier and low per-user prices fit the small-organization buyer the company describes.
ThreatSTOP delivers a cloud service that keeps customer equipment updated. IP Defense pushes policy to firewalls, routers and switches automatically, and DNS Defense updates the customer's DNS servers. DNS Defense Cloud runs the filtering in ThreatSTOP's own cloud resolver. The documentation hub gives setup guides per device, with web automation and command-line options for many firewalls.
A research team changes the protections customers receive, and ThreatSTOP describes those changes on its blog. In its February 2026 update, ThreatSTOP says the team held December changes until after the holidays to avoid disrupting customer networks, then released them. The same post describes a new Bambenek premium feed bundle.
ThreatSTOP's public trust material includes legal documents. ThreatSTOP, Inc. is the contracting party in its end user service agreement, and an addendum covers customers' use of indicators from the Department of Homeland Security's Automated Indicator Sharing program through the service. The privacy policy requires customers to submit firewall logs for performance measurement and service improvement.
No SOC 2 report, ISO certificate or trust portal appears on the probed surfaces. SEC filings record ThreatSTOP, Inc. as a Delaware corporation with its business address in Carlsbad, California.
ThreatSTOP works through other vendors' equipment. Its documentation covers firewalls such as Check Point, Cisco ASA, Fortigate, Juniper SRX and Palo Alto Networks. It also covers resolvers such as Infoblox NIOS, Windows DNS Server and PowerDNS, and Azure deployments. It also documents a REST API, STIX/TAXII and SIEM integration.
ThreatSTOP also draws intelligence from partners. FiveBy supplies the intelligence behind the sanctions product, and ThreatSTOP's partner page includes partners such as A10 Networks, CrowdStrike, Farsight Security and Bambenek Labs. ThreatSTOP added a Bambenek premium feed bundle in its January 2026 update.
Founder and chief executive Tom Byrnes is the named inventor on ThreatSTOP's patents. ISMG's 2015 profile lists his earlier roles at Radware and as chief technology officer of ADNC.com. Paul Mockapetris, who proposed the Domain Name System architecture in 1983 according to Wikipedia, is chief scientist and a co-inventor on a 2024 ThreatSTOP patent.
On its about page, ThreatSTOP names Joel Esler, a founding member of Cisco Talos, as vice president for security, intelligence and research. The company credits Francis Turner with developing the current DNS Defense product. Tom Bennett appears as a director on the 2015 Form D, and the company says he also sits on the Dragos board.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | ThreatSTOP: homepage | official | 2026-10-16 |
| f2 | ThreatSTOP: about page | official | 2026-10-16 |
| f3 | SEC EDGAR: ThreatSTOP, Inc. company filings | regulatory | 2026-10-16 |
| f4 | SEC EDGAR: ThreatSTOP, Inc. Form D/A | regulatory | 2026-10-16 |
| f5 | https://www.threatstop.com/threatstop-platform | official | 2026-10-16 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.