Flashpoint
Flashpoint is a New York City-based threat intelligence company, founded in 2010, that built its business on monitoring the deep and dark web — the forums, marketplaces, chat services and other illicit online communities where cybercriminals, fraudsters and extremists plan and trade. From origins in tracking terrorists' use of the internet, Flashpoint expanded that methodology into what it called Business Risk Intelligence: intelligence for cybersecurity, fraud, physical security, brand protection and geopolitical risk across an enterprise. Through venture funding, a unified platform called Ignite, and the 2022 acquisitions of Risk Based Security and Echosec, it has grown into one of the largest specialist threat-data providers, serving hundreds of commercial and government customers worldwide.
Founding in 2010
Flashpoint was formed in 2010 by chief executive and co-founder Josh Lefkowitz and his partner and co-founder Evan Kohlmann. Both founders had backgrounds as intelligence analysts focused on terrorist use of the internet. As Lefkowitz has explained, they watched the internet become a key node for terrorist recruitment, financing and propaganda, and recognised that their methodology for tracking and analysing that activity was more broadly applicable to a wider set of illicit actors in the underground of the internet — hackers and malware developers among them — and that this matched a need the private sector had. The company is headquartered in New York City; by 2016 it also had offices in Tysons Corner, Virginia, and Dublin, Ireland.
Unusually for a venture-backed technology company, Flashpoint did not begin raising venture capital until 2015, five years after founding. During that gap the founders enriched their products, built the company's reputation and networked in the commercial arena; Lefkowitz has said they had no sales team at first and received leads and referrals from customers, using long-standing relationships to prove viability and expand into the commercial market — one such relationship, with a former senior Cisco executive, led to an introduction at Cisco that later produced an investment.
Funding and Backers
Flashpoint's first major disclosed round came in July 2016, when it closed a 10 million dollar Series B funding round led by Greycroft Partners, with participation from new investors Jump Capital and Leaders Fund and existing investors TechOperators, K2 Intelligence, Bloomberg Beta and Cisco Investments; Greycroft partner Ellie Wheeler joined the board. The stated purpose was expansion into Business Risk Intelligence. Cisco Investments' later profile of the company described a team of analysts speaking more than fifteen languages at that stage — a figure that has since grown substantially — and presented Flashpoint's speciality as working exclusively in areas of the deep and dark web where illicit actors plot cyber-attacks and other illegal activities.
The Deep and Dark Web Method
Flashpoint's method combines automated collection with human intelligence. Its analysts operate in illicit online communities — deep and dark web forums, chat services, marketplaces, paste sites and social media — supported by analytical tools and data collections built over more than a decade, including, by the company's later account, more than ten years of archived underground communications and several petabytes of collected data. Lefkowitz has described the value proposition as improved visibility and context into the underground of the internet that traditional search engines cannot reach, delivered to business units across an organisation so they can mitigate risk: bolstering cybersecurity, confronting fraud, detecting insider threats, enhancing physical security, assessing merger and acquisition opportunities, and addressing vendor risk and supply-chain integrity.
That offering was productised early through an application programming interface. In September 2016 Flashpoint announced version 4 of its API, giving customers access to finished intelligence reports on cybercrime, emerging malware, fraud and physical security issues such as violent extremism; to aggregated collections of its analysts' deep and dark web conversations with attackers; to keyword monitoring and alerts; and to what it called Risk Intelligence Observables, a complement to traditional indicators of compromise intended to enrich investigations and highlight insider-threat and data-exfiltration activity.
Business Risk Intelligence
Flashpoint says it pioneered the Business Risk Intelligence category by expanding threat intelligence beyond traditional cyber indicators to encompass brand protection, physical security, fraud detection and geopolitical risk, all derived from monitoring illicit online communities. In practice its solutions span cyber threat intelligence, vulnerability intelligence, geopolitical risk, physical security, fraud and brand protection, delivered as finished intelligence reports, raw collections and platform search. The company states that its customers use that intelligence to safeguard critical assets, avoid financial loss and protect lives, and its later corporate materials cite more than 750 customers, more than 300 employees, and an intelligence team of more than 100 analyst experts fluent in more than 35 languages.
Acquiring Risk Based Security and VulnDB
On 12 January 2022 Flashpoint announced it had acquired Risk Based Security, a Richmond, Virginia-based company specialising in vulnerability and data breach intelligence and vendor risk ratings, for an undisclosed sum. Risk Based Security's products included its risk-based, asset-centric security platform, YourCISO, and above all VulnDB, its vulnerability intelligence database and third-party library monitoring service. Flashpoint noted that Risk Based Security had identified and classified more than 90,000 vulnerabilities not available in the common vulnerabilities and exposures registry; VulnDB later described coverage of more than 300,000 known vulnerabilities in end-user software and third-party libraries and dependencies, including more than 96,000 vulnerabilities missed by the CVE and national vulnerability databases.
Lefkowitz said the acquisition would let clients rapidly detect critical vulnerabilities before they were widely known and then automate how they prioritised and remediated them — a step, he said, toward Flashpoint's vision of being the single vendor enterprises could rely on to mitigate all types of security risk. Flashpoint subsequently built a ransomware prediction model on VulnDB data, assigning each vulnerability a ransomware likelihood rating derived from factors including exploit availability, attack type, impact and disclosure patterns, to help under-resourced vulnerability management teams decide what to patch first.
Acquiring Echosec and Open-Source Intelligence
Flashpoint's second acquisition of 2022, announced in August, was Echosec Systems, a provider of open-source intelligence and publicly available information for national security, public safety and enterprise customers, which had raised 11.5 million dollars in venture capital before the deal. Flashpoint said integrating Echosec's worldwide social media collections, interface and expertise would expand its open-source capabilities for on-the-ground situational awareness, executive protection, geopolitical risk assessments, counterterrorism, identifying and responding to misinformation and disinformation, and crisis response. Its president, Donald Saelinger, argued that intelligence practitioners require a converged solution combining insights from both open and closed sources. The two 2022 deals thus bracketed Flashpoint's range: Risk Based Security deepened its technical vulnerability data, while Echosec widened its open-source, real-world awareness.
Flashpoint Ignite
In April 2023 Flashpoint unveiled Ignite, a unified intelligence platform intended to accelerate threat detection and cross-functional risk mitigation. Ignite brought the company's collections — deep and dark web material, open-source and surface web data, threat actor groups, vulnerabilities, breaches and geospatial intelligence — into one workspace for cyber threat intelligence, vulnerability management, national security and physical security teams. Its features include universal search across text, video and images, with optical character recognition; rule-based alerting; news-style finished intelligence reports; personalised dashboards; and in-platform requests for information, completed by Flashpoint's intelligence team. The company said searches return results in less than a second, and that Ignite integrates with external tooling and other Flashpoint solutions including Managed Attribution and Automate; future development was tied to an expanded partnership with Google Cloud on artificial intelligence, including generative AI for customers, and an AI-powered conversational search interface, Flashpoint Copilot, followed. Patrick Gardner, its chief product and engineering officer, described Ignite as built for practitioners and as a unifier — a bridge between teams that lets an organisation understand its full risk profile.
Customers and Sectors
Flashpoint's customers sit in both the commercial and public sectors: financial services and technology companies, Fortune 500 enterprises, governments and law enforcement. Contemporary reporting on its funding noted use across the enterprise, and its platform marketing cites twenty of the twenty largest North American financial service institutions among its users. Different teams inside the same customer use the same underlying collections for different missions — security operations tracking malware and exploits, fraud teams tracking financial crime and account takeovers, brand teams tracking counterfeit goods and executive threats, and physical security teams tracking geopolitical events affecting operations — which is precisely the cross-functional pattern Ignite was built to serve.
Analysts, Languages and Tradecraft
A recurring theme in Flashpoint's presentation is that its data is enriched by human insight rather than offered raw. Its intelligence team — more than 100 analysts speaking more than 35 languages in its recent materials — supplies the requests-for-information service inside Ignite, writes finished intelligence reports and conducts the human intelligence work in closed communities that automated scraping cannot replicate. That emphasis descends directly from the founders' backgrounds: Lefkowitz and Kohlmann began as analysts of terrorist internet use, and the company's expansion — into fraud in the mid-2010s, vulnerability intelligence by acquisition, insider threat and physical security intelligence — has consistently layered new subject matter onto the same analyst-led collection model.
Position in Threat Intelligence
Flashpoint's arc since 2010 mirrors the maturation of threat intelligence itself: from a niche craft practised by a handful of specialists watching extremist forums, to a platform business selling data, vulnerability intelligence and open-source awareness into every security function of large organisations. Its self-founded bootstrapped first five years, its 2016 Series B, its twin 2022 acquisitions and its 2023 platform unification mark the steps of that journey. Headquartered in New York and describing itself as the leader in threat data and intelligence, Flashpoint now competes on breadth — cyber, vulnerability, fraud, brand, physical and geopolitical risk in a single platform — while its founding claim remains its differentiator: that the most valuable warnings are found where illicit actors talk among themselves, in the deep and dark web, by analysts who know how to listen.
