Code Blue

**Product and the concrete problem it solves.** Code Blue addresses a failure mode that sits outside the detection problem: organizations may have security telemetry and incident-response vendors, yet still lose control when a breach, ransomware event, operational outage, or third-party compromise forces many decision-makers to act at once. The company argues that cyber crises are business, legal, regulatory, communications, and continuity events rather than CISO-only incidents. Its product is Blue Castle, an AI-driven cyber crisis command platform, alongside Code Blue's human-led incident response and resilience services. The platform is designed to replace fragmented email threads, chat rooms, spreadsheets, conference calls, static playbooks, and disconnected notebooks with a shared operational environment. It lets a crisis management team prioritize decisions, assign ownership, track actions and timelines, coordinate technical and non-technical workstreams, and give senior leadership a current view of business impact and recovery status. The problem is especially acute for hospitals, energy operators, manufacturers, financial institutions, and government-linked organizations where a technical disruption can quickly become a safety, public-trust, or essential-services incident.

**Core technology and how it actually works.** Blue Castle is not presented as an autonomous malware detector or a replacement for EDR, SIEM, or forensic tooling. Its technical proposition is a structured decision and workflow layer grounded in Code Blue's accumulated crisis methodology. The company describes AI agents trained on crisis expertise that support fast, structured decision-making at scale, while the product pages describe a live operational picture, prioritized dilemmas, decision records, escalation paths, secure collaboration, and a full incident timeline. The architecture is organized into role-specific but connected war rooms: Crisis Management Team for executive command, Incident Response for containment and remediation, Public Relations for internal and external messaging, Business Continuity Planning for critical services and dependencies, Legal for regulatory exposure, and Negotiations for stakeholder or ransom discussions. Its R.E.D., or Resilience Every Day, workflow adds a readiness-assessment layer with more than 200 expert-designed questions. Tabletop exercise findings can update an organizational playbook; continuous threat-intelligence monitoring can raise an alert level; and a response room can then activate the prepared workflows. Public materials do not disclose model architecture, training datasets, hosting design, or independent performance testing, so the defensible technical claim is workflow intelligence and operational context, not frontier-model novelty.

**Market, customers, and go-to-market.** Code Blue sells into organizations whose cyber exposure has consequences beyond data loss and whose executives need a repeatable command process. The official site names healthcare, financial services, manufacturing and industrial organizations, energy, enterprises, and SMBs as target segments, while the company describes work with clients in Israel, Germany, Italy, Canada, and other jurisdictions. The go-to-market motion has two linked parts. Blue Castle can enter as a readiness and crisis-management software platform, with assessments, tabletop exercises, playbook preparation, and ongoing monitoring creating a recurring operational relationship. Code Blue's DFIR, strategic consulting, crisis-management-team, and tailored resilience services provide an implementation wedge and can supply the expert context that makes a software deployment useful during a real incident. The 2023 Dussmann announcement established a German joint venture for cyber-crisis and disaster-management services, extending distribution into a large facilities, technical-services, and food-services group. The 2026 CyberTech Tel Aviv catalog positions the company for global markets and describes an end-to-end approach combining technical mitigation, regulatory strategy, legal coordination, and crisis communications. Named customer identities, annual recurring revenue, contract values, and platform seat counts are not publicly disclosed.

**Traction, funding, and third-party validation.** Code Blue has more operating evidence than a typical pre-product startup, but less financing and product telemetry than an investor-grade software company would normally disclose. The company was represented in the official CyberTech Tel Aviv 2024 catalog as a cyber-crisis preparedness and management provider with a track record of managing hundreds of cyber crises. Its current website claims more than 1,500 hours per month of real-world crisis response across sectors including critical infrastructure, and lists case studies covering technology, aviation, and healthcare; these are company claims and should not be treated as independently audited outcomes. The German Dussmann partnership is a concrete third-party commercial validation of the service model: the partners announced a Code Blue by Dussmann joint venture in 2023, with coverage spanning cyber-risk management, incident response, network restoration, IT/OT, privacy, negotiations, and business continuity. Blue Castle was publicly launched as an AI-driven system for real-time cyber-crisis management in 2025, and the current product site remains active with demo and emergency-contact pathways. No publicly disclosed seed, venture, grant, revenue, valuation, or profitability data was located in the reviewed sources. This makes the company a credible operating ecosystem entry, but a financially opaque one.

**Founders and team background.** Refael Franco is the central team signal and the reason Code Blue has unusual credibility in a market where generic incident-response software is easy to describe but difficult to operationalize. The company's leadership page identifies Franco as founder and CEO, with more than 25 years in operations, security, cyber, and technology. It says he served as deputy head of Israel's National Cyber Directorate, led its defense arm and cyber-regulation division, held executive positions in Israel's General Security Service, and received the Israel Security Award with the national cyber system. The Dussmann announcement provides the more specific historical framing that he helped found the Israel National Cyber Directorate and led Israeli cyber-defense and special operations before building a multidisciplinary preparedness and intervention model at Code Blue. The Blue Castle team page identifies Rachel Stern as director of product and a business-continuity specialist, Itai Tomer as chief product officer, and Eitan Platok as chief technology officer. LinkedIn lists the company at 51-200 employees, though the public profile also exposes roughly 40 employee profiles, so the exact headcount is not independently reconciled. The combination of national cyber command experience and product leadership is strong; the key question is how deeply that expertise has been codified into repeatable software rather than remaining expert services.

**Competitive dynamics.** Code Blue competes across three overlapping budgets. First are cyber-crisis and incident-response specialists such as Mandiant and CrowdStrike Services, which bring deep technical investigation, containment, and recovery capacity but are not primarily neutral command systems for executive, legal, communications, and continuity coordination. Second are operational-resilience and business-continuity platforms such as Fusion Risk Management and Noggin, which provide continuity planning, exercises, and critical-event workflows but do not appear to be built around Israeli national cyber-crisis operations or a dedicated cyber war-room model. Third are broad enterprise-workflow incumbents such as ServiceNow and Everbridge, which can absorb incident-management and executive-notification use cases through installed platforms, integrations, and procurement relationships. Cytactic is the closest Israeli conceptual peer, with cyber-crisis management and intelligence positioning that overlaps Code Blue's readiness and response thesis. Code Blue's potential edge is not a novel detection algorithm; it is the combination of field-derived playbooks, multidisciplinary crisis coordination, a dedicated decision environment, and a founder who has operated national-level cyber response. Its vulnerability is equally clear: the value can be difficult to quantify before an incident, and large incumbents can reproduce workflow features.

**Defense, security, and resilience dual-use relevance.** Code Blue qualifies as dual-use because the core capability is designed for continuity and command under hostile disruption, and the company has documented proximity to national cyber defense and critical infrastructure. The transfer path is direct in four ways. (1) Government agencies, defense suppliers, utilities, transport operators, hospitals, and emergency organizations all need a common operating picture when technical incidents cross into operational or public-safety consequences. (2) The platform's separation into crisis command, incident response, continuity, legal, communications, and negotiation rooms maps onto the multi-stakeholder structure of national and defense cyber incidents, where authority and escalation are as important as indicators of compromise. (3) The company's stated experience includes IT/OT, critical assets, network restoration, and cyber crises affecting essential services, which is more relevant to resilience than a generic enterprise-security adjacency. (4) Franco's former role in Israel's National Cyber Directorate and his reported leadership during national cyber operations are credible routes into government and regulated infrastructure ecosystems. The calibration matters: there is no public evidence of a defense contract, military deployment, classified accreditation, or operational use by an armed force. The record supports resilience and national-security relevance, not a claim that Blue Castle is fielded defense technology.

**Growth stage, trajectory, and key diligence risks.** Code Blue is classified as early because the company is young, privately held, and still presenting a founder-led platform-plus-services model even though it reports an international footprint and a substantial LinkedIn employee range. The legal entity was incorporated in Tel Aviv in January 2022, while LinkedIn lists 2021 as the company founding year; this is a normal distinction between operating launch and incorporation rather than a reason to discard either date. Its trajectory is to turn crisis-response expertise into an always-on resilience system: readiness assessment and tabletop exercises create structured organizational memory, threat intelligence can trigger prepared escalation, and the War Room can preserve a documented chain of decisions through recovery and lessons learned. Key diligence questions are: (1) how many paying Blue Castle deployments exist separately from consulting engagements; (2) whether the stated 1,500 monthly response hours are Code Blue-operated cases or broader ecosystem activity; (3) what AI models, data-governance controls, and tenant isolation protect sensitive incident information; (4) whether customers can operate the platform without Code Blue personnel during a prolonged crisis; (5) what measurable reduction in recovery time, decision latency, regulatory exposure, or downtime is demonstrated; (6) how the company competes against bundled ServiceNow, EDR-service, and continuity platforms; and (7) whether government, defense-industrial, healthcare, and energy customers require certifications or sovereign hosting that are not publicly documented. The opportunity is strategically strong, but commercial scale and software defensibility remain to be proven.