Security Joes

Security Joes is a Tel Aviv–based incident response and threat research firm that combines managed detection and response (MDR) with crisis response, red team assessments, and an internal AI-assisted security research platform. Founded in 2020, the company operates a follow-the-sun global security operations center staffed with Israeli and international incident responders, threat analysts, and offensive security specialists. The firm's central positioning in the Israeli cybersecurity ecosystem provides access to deep expertise in both attacker behavior and defense-in-depth methodologies refined through real-world nation-state threat engagement.

The company's core product is a SecOps control plane that unifies incident lifecycle management, threat intelligence, and red team workflow orchestration. Clients use this platform to centralize visibility across SOC, MDR, IR, and red team activities. The platform integrates with existing SIEM and endpoint detection tools, reducing alert fatigue and automating triage. Security Joes has demonstrated capability in handling high-complexity incidents involving ransomware, supply-chain compromise, and advanced persistent threat (APT) groups. Their threat research division publishes original analysis on APT toolkits, attack techniques, and infrastructure—e.g., publicly documented research on Lazarus Group, DPRK operations, DigiCert breach cascades, and novel reverse-engineering tools (AskJoe 3.0). This publication strategy builds reputation and informs defense strategy for Fortune 500 and government customers.

The incident response market is expanding due to accelerating ransomware sophistication, critical infrastructure targeting, and regulatory scrutiny (HIPAA, NIS2, SEC rules on breach disclosure). Security Joes competes in the premium IR segment alongside CrowdStrike Services, Mandiant (Google), Secureworks, and Unit 42 (Palo Alto), but differentiates through Israeli talent density, follow-the-sun staffing (not time-shifted offshoring), rapid escalation culture, and direct access to nation-state threat research. The company has scaled from ~15 employees in 2021–2022 to 30+ by mid-2026, with visible hiring (recent leadership promotions in Head of Engineering, Head of Revenue Operations, and team expansion announcements). Founding team includes CEO Ido Naor and co-founder(s) with prior IR and threat research experience in Israeli military and intelligence contexts (implied by capability and hiring patterns).

From a commercial perspective, Security Joes targets mid-market to enterprise clients with complex security postures and high breach cost exposure—financial services, healthcare, critical infrastructure, and large SaaS firms. The company is likely at early Series A or late Seed stage (unfunded reports suggest seed-stage designation, but team growth, platform maturity, and customer volume imply capital raise has occurred or is underway). Revenue is recurring (IR engagements) plus platform SaaS licensing. Retention is typically strong in incident response (crisis-driven stickiness) but execution risk centers on scaling sales and operational excellence as incident volume and customer count grow.

Dual-use relevance is substantive. Incident response capabilities (forensics, attribution, containment, recovery) directly serve military cyber defense, national security incident response, and interagency coordination. Threat research on APT groups, nation-state tactics, and infrastructure is immediately applicable to cyber intelligence and operational planning. Red team capabilities (network assessment, exploitation, blue team feedback) are core to military readiness and critical infrastructure resilience testing. Israeli government and defense sector (IDF Cyber Unit, Shabak, Mossad sigint partners) are likely customers or stakeholder influence sources, creating both strategic advantage and dual-use surface. The company's operational model—real-time incident response with classified-adjacent handling—suggests credible government engagement. Export controls on cybersecurity services and talent (Israel's tech talent is internationally regulated) do not appear to constrain incident response delivery in allied NATO/Five Eyes contexts.